DUAL LISTENING PORTS - EMS server configured to allow remote access & there was high usage of DNS on a non standard port (why would EMS in a controlled environment be using DNS so extensively?)
MARICOPA “AUDITORS” LIED: They reported NO internet history ... however that was in the “visible” or “allocated” space ... in the hidden / unallocated drive space there was significant internet history suggesting that the data had been deleted (FRAUD!)