The presentation mentioned the tracks are easy to cover in syslogs but you can catch them in real time traffic captures. Hopefully dhs did. You can also determine by hand counting to see if the tabulation matches the real vote.
They also showed by just changing the order of the query in the and clause, the tabulation would give different results where one gave all the missing down votes to the dim.