Investigative Analysis: Pennsylvania Election, 2024, Part 2

Part 2: Election Day

Part 1: The Setup

Part 2: Election Day

Voting works differently in Pennsylvania than in the rest of the country.

The 2020 U.S. Presidential Election was the first federal election in which all registered Pennsylvania voters were eligible to apply for a mail-in ballot. This was due to a 2019 state law, and no one disputes that the COVID-19 pandemic was a major factor in the volume of mail-in ballots cast that year. 2,704,147 mail ballots were recorded in Pennsylvania’s 2020 presidential election, roughly 39 percent of the total ballots cast statewide. (Source: MIT Election Data + Science Lab)

Four years ago, all eyes were on Pennsylvania as their new process to manage mail-in votes led to days of slow and steady ballot-counting, with mail-in ballots finally tipping the scale towards Candidate Biden on November 7, 2020. (Source: CNN)

While Pennsylvania has attempted election law reform and process refinements over the last four years, lack of political consensus on what changes were needed resulted in incomplete and disjointed changes – including options for voters casting a ballot before Election Day. (Source: Votebeat)

There is no in-person “Early Voting” in Pennsylvania. Instead, all registered voters can cast a mail-in ballot either by mail, or through “on-demand mail-in voting” – both of which use hand-marked paper ballots that are processed and counted manually. Hand-marked, hand-counted ballots are objectively more difficult to manipulate than changing one line of code in “vote-counting computers” to alter results.

What does that mean in practice?

1. The opportunity to manipulate Mail-In and “Early Voting” in Pennsylvania was limited.

2. If a malicious actor sought to manipulate Pennsylvania’s vote count, the only opportunity to do so would be a few hours on Election Day.

3. ”Disruptions” across Pennsylvania on Election Day - such as reported bomb threats and equipment malfunctions - may be a symptom of a larger planned and coordinated opportunity for malicious actors to gain physical access to voting machines in Pennsylvania precincts.

---

Bomb Threats

On Election Day 2024, numerous bomb threats appearing to originate from Russian email domains targeted polling places and ballot-counting locations in multiple states. (Source: FBI) While many states were targeted, the volume of bomb threats targeting Pennsylvania specifically was significant, with at least 32 counties affected (Source: USAToday Network). Early analysis of Pennsylvania headlines by researchers working with ETA indicated that at least 11 bomb threats had been reported in Philadelphia alone, though reports of additional threats have surfaced in the intervening months.

These bomb threats targeted “mostly Democratic counties”. (Source: NBC News) Dozens of threats “briefly affected voting as sites were evacuated, and some poll hours were extended by courts as a result.” (Source: NPR)

In Chester County, officials evacuated a building, directing voters to cast their ballots in nearby polling places. Clearfield County secured judicial permission to extend the time for ballot drop-offs after a threat closed its administrative building, and Perry County officials obtained a court order to postpone ballot canvassing while police scanned their elections headquarters. However, in Bucks and York counties, election work continued regardless of threats. (Source: USAToday Network)

The 32 Pennsylvania counties affected on November 5, per USAToday Network reporting, is as follows:

• Adams

• Bedford

• Berks

• Blair

• Bradford

• Bucks

• Cameron

• Carbon

• Centre

• Chester

• Clearfield

• Columbia

• Cumberland

• Elk

• Franklin

• Jefferson

• Juniata

• Luzerne

• McKean

• Mercer

• Mifflin

• Northampton

• Perry

• Philadelphia

• Schuylkill

• Snyder

• Somerset

• Tioga

• Union

• Westmoreland

• Wyoming

• York

---

Voting System Errors and Malfunctions

In addition to disruptions caused by bomb threats, Pennsylvania reported a high volume of voting system malfunctions on Election Day, with machine error reports from at least 30% of their counties. Many of these error reports concern ballot scanner/vote tabulator machines failing to scan ballots.

Our investigation has confirmed that, in Pennsylvania, many of the 2024 election day malfunctions align with expected errors that national security agencies, such as America’s Cyber Defense Agency (CISA), have identified in compromised machines.

When a voter submits their completed ballot, digital images of the ballot are created and stored on memory cards collected from machines after the election and used to tabulate official results. Some machines have embedded or externally connected modems to transmit unofficial results rapidly on election night.

According to independent academic studies, software running on a single voting machine can manipulate votes with little risk of detection. Anyone with physical access to a voting machine or a memory card that will later be inserted into a machine, can install software in less than one minute. The software can then modify all the records, audit logs, and counters of each voting machine, so that even forensic examination of these records will find nothing amiss. In practice, poll workers and others often have unsupervised access to the machines.

Many of the error reports in Pennsylvania stem from a specific brand of voting machines, and several counties in PA that use this brand also use a precinct-based optical scanner, which is installed with either an analog or a cellular modem. Within the 2024 Pennsylvania malfunction reports, this scanner is listed multiple times as the cause of error. One working theory is that this modem is the connection being used to gain access to the machines remotely. The optical scanner does not need to be connected to the internet for this to happen.

A full PDF of all post-election error reports can be found here.

---

County-Specific Issues

2024 election results in Fayette County show that Candidate Harris received 39% fewer votes than the county’s registered Democratic voter base and 5.8% fewer votes than her closest down-ballot party candidate. In comparison, Candidate Trump won Fayette County with a tally of 43,633 votes, and the County only reports 41,149 registered Republicans.

Per Pennsylvania Department of State regulations, recounts may be initiated when it “appears” to a Board of Elections “that there is a discrepancy in the returns of any election district.” When Judge of Elections, Vincent Manetta, requested a hand recount in the Washington Township precinct (Fayette County) on November 5th, the effort was halted by an emergency court petition sought by Fayette County. The court’s formal, same-day order on November 5, 2024, stated that the Sheriff of Fayette County would physically escort anyone attempting to hand count the ballots off the premises.

In Cambria County, voters encountered an issue on Election Day, when their paper ballots could not be scanned, as reported by PennLive Patriot News at 9:46 am, Nov. 5, 2024.

The county’s official statement was that the error was caused by misprinted ballots, provided by a vendor named William Penn Printing, a company that does not currently maintain a web presence. Cambria County officials stated the paper ballots were “missing" the Time in Security (TIS) block that corresponds to the ballot’s ovals that the scanner "reads" to determine voter candidate selection.

According to this screenshot of footage from local news station, WTAJ, an error displays on a Cambria County voting machine (East Taylor Township No.1) on November 5th, 2024, at 9:22AM. The error code reads, “The code you entered is incorrect. Note: You can make only three attempts to enter the code and then the machine will power down. Press "Retry" to return to the code entry screen. Please contact your election administrator if you believe you entered the correct code."

However, our analysis indicates that this is not the error that would be displayed on this brand of voting machines if the TIS marks were not printed on Cambria’s ballots, as claimed by the county. According to the Operator Guide supplied by Cambria County’s election machine vendor, the error code expected when a machine attempts to read a ballot without TIS marks would be: “Ballot Couldn’t Be Read; Please remove your ballot and reinsert the opposite end first. The front-left timing track is not detected (page 175-176).

New ballots with the correct TIS stamp were immediately ordered and printed by William Penn Printing, and these were delivered to each precinct between 12:00 and 3:00 pm on November 5th. According to Election Day reporting, “the county acquired roughly 35,000 new ballots” from the printer on November 5th.

Voters who had completed the faulty ballots were given a few options:

• They could put their completed ballots in a secure bin where it would be hand counted later

• They could use the ExpressVote machines, which don't use a paper ballot, but instead, selections are made on a touchscreen computer where they are counted electronically (these machines remained operable throughout the election)

• They could leave and return later. Some voters reported that they were asked to provide their ballots to poll workers who would take ballots to another location where they could be scanned.

In a photograph accompanying the PennLive article, purportedly taken the morning of November 5 in a Cambria County polling center, timing marks can easily be seen on the ballots. However, local news reporting from the area on November 5 states that “corrected” ballots with Time in Security markings did not arrive at polling places until after noon.

When County Solicitor Ron Repak, Jr. was interviewed by a local news station around noon on November 5th, he stated that the faulty ballots that had already been completed would be counted by hand. However, around 1:00 am on November 6, Cambria County election officials petitioned the court for permission to employ an alternate strategy, claiming that they’d been unable to complete even one precinct by hand count. Instead of completing a hand recount of all the needed ballots, Cambria County officials requested and obtained the court’s permission to address the issue by marking voters’ choices on newly printed ballots that included the TIS marks.

Election officials stated that 65,000 ballots were completed on ballots without timing marks, and poll workers and volunteers manually duplicated these misprinted ballots, completing a brand new ballot on each voter’s behalf.

To repeat, instead of recounting the ballots by hand, which they claimed was too onerous, they read each ballot, manually duplicated each ballot by filling in ovals with pen and paper, and scanned each ballot. A three-step task, subject to multiple points of failure, as opposed to reading a ballot and recording its votes.

The evolution of this process raises some troubling questions about the integrity of this election:

• Official election results from Cambria County state that there were 55,497 votes for the office of President placed on November 5th, in-person voting, which would include duplicated ballots, ExpressVote machines that some precincts offered as a backup to the failed paper ballots, and the newly printed ballots that each precinct in the county had received by 3:00 pm). However, according to information provided by County Solicitor, Ron Repak, Jr. to WJACTV , “they expected about 35,000 ballots originally that would have to hand count (sic) or duplicated, but it turned out to be about 65,000 ballots”, roughly 30,000 more than were ordered as replacements and about 10,000 more than votes recorded on Election Day. This would suggest that every single ballot on Election Day was filled out on a faulty ballot, which fact negates, as corrected ballots were distributed at each precinct after 3 pm, and it would indicate that someone filled out 10,000 extra ballots. Why were 10,000 extra ballots completed on November 6th?

• Election workers in precincts throughout Cambria were instructed to store unscanned ballots in lockboxes in which they would otherwise be stored after scanning. However, after the lockboxes were full, the Board of Electors authorized sheriffs’ deputies to collect the ballots and deliver them to the county elections office. Per reporting by Capital-Star, “a house democrat staffer speaking on background said there are concerns remaining about the chain of custody during that process.” If the faulty, unscanned ballots were supposed to be stored for safekeeping in the same lockboxes that were intended to hold those same ballots (had they been successfully scanned), why did the lockboxes get too full? Were the blank, unscanned ballots also stored in the lockboxes, and if so, why?

These allegations regarding ballot duplication, ballot chain of custody, and ballot counting, collectively, are notable security risks. Final results tally in Cambria found that there were almost 3000 more votes for the Republican presidential candidate, Donald Trump, than there were registered Republican voters in the county.

The Cambria County Election Director, Mary Anne Dillon, retired on the day the county’s votes were certified, almost two weeks after Election Day, just as county officials and the Department of State were about to begin an investigation.

On December 26, 2024, State Rep. Frank Burns filed a Right-to-Know request with the Cambria County Commissioner to shed light on the Nov. 5 events. Burns requested “the number of voting machines used in Cambria County in the Nov. 5, 2024, election” and “the number of blank ballots that were ordered from William Penn Printing Co. on Election Day of Nov. 5, 2024, and the number that were then successfully distributed to polling places on Election Day of Nov. 5, 2024.”

The Commissioner denied this request on February 6, 2025, stating “they don’t have to comply with anything posed as a question in the legislator’s Right-to-Know Law request.”

Why was every scanner unable to scan ballots? Why were some voters not told to put their ballots in the emergency bin, but instead to give them to workers? Why were 65,000 ballots duplicated and tabulated by machines instead of counted by hand? Why were 10,000 “extra” ballots duplicated, and where did those votes go? Why don’t the report of new ballots ordered line up with reports of ballots duplicated? Why have the Right to Know requests been denied?

It is unknown whether the events that transpired in Cambria County on Election Day represent mistakes or misconduct. Regardless, the ETA believes that they require an immediate audit and – importantly – investigation to prevent these issues from arising again in future.

Armstrong County also had a "ballot printing" issue similar to Cambria, requiring them to reprint the ballots to update their layout so the voting machines could read them.

Centre County elections officials documented a “software issue” on Election Night, forcing them to rescan about 13,000 mail-in ballots.

The Bedford County Elections Office reported an Election Day issue with voting machines in five county precincts. Local officials initially had trouble opening the voting tabulators with their security keys and requested support teams to the affected precincts. Voters were still able to cast their ballots without disruption by placing them in secure storage bins on the tabulators, as per protocol for situations like this. The Elections Office states that this issue was ”not software-related” and was not linked to any voting issues in other Pennsylvania counties.

---

When viewed in aggregate, the volume and intensity of disruptions experienced in Pennsylvania on Election Day is noteworthy. Bomb threat and machine failures affected election workers, volunteers, officials, and voters. It is unknown the extent to which these disruptions could have impacted the ballot chain of custody, or resulted in “vote-counting computers” being left unattended.

The window of opportunity for malicious actors to manipulate Pennsylvania’s election results was limited – just a few hours on Election Day – and this may, in part, explain the concentrated blitzkrieg of disruptions and chaos. And election results that just don’t make sense.

Check out Part 3: The Fallout.

---

Disclaimer: Election Truth Alliance (ETA) is a non-profit, nonpartisan, volunteer-led organization dedicated to free and fair elections. Our present focus is on the 2024 Presidential Election in which we took a keen interest after election and cybersecurity experts announced the appearance of numerous irregularities in the election results. For this endeavor, ETA brought together a broad range of experts, which span across multiple disciplines, including, but not limited to, data analysis, political science, cybersecurity, auditing, computer engineering and bioengineering. Opinion and analysis is based on current data available.

ETA employed a data-driven analysis of the Cast Vote Records (CVR), corresponding voter data, ballot images and other accessible information; such analysis was performed at each stage of the voting process, from early in-person voting, mail in ballots to day of in-person voting.

All posts are subject to update as new or corrected information is brought to our attention, or if there is other information to share with readers.