Arizona’s largest county suffered a significant breach of its election data in the days before the 2020 presidential election when a self-described hacker foiled security and obtained 633,000 voter registration files but the Biden Justice Department and local prosecutors declined to bring charges even after the FBI got the suspect to confess, according to declassified documents made public Thursday by the White House.
The scraping of Maricopa County’s voter registration files was the most flagged security incident in a cyberintrusion log kept by U.S. spy agencies in the days around the Nov. 3, 2020 election, and it caused an extensive FBI investigation that led agents to a home in Fountain Hills, Ariz., the memos show.
The man the FBI confronted admitted he wrote a computer script to exploit the county voter systems security and scraped the files, which included 930 with “sensitive voter information like domestic violence victims, judges and law enforcement officers,” according to the FBI case files declassified and made public by President Donald Trump’s White House Government Transparency Task Force.
FBI Director Kash Patel sent a letter to that task force this week stating the bureau spent “significant resources” but could not get the U.S. Attorney’s Office in Phoenix, the Arizona Attorney General’s Office, the Maricopa County Arizona Attorney’s Office or the Pinal County, Arizona Attorney’s Office to bring charges despite an admission from the alleged hacker.
The U.S. Attorney’s Office declined to prosecute the alleged hacker on July 12, 2021, under the Biden Administration, according to the FBI. The newly released memos do not state when the other prosecutorial agencies made similar decisions not to bring charges, but the full case was officially closed in 2023.
Just one day before the Nov. 3 election, the Maricopa County Recorder’s Office submitted a tip through the Arizona Counterterrorism Intelligence Center that there had been “an attempt to scrape voter registration information,” according to one FBI summary.
According to that memo, an unidentified intruder gained access to voter registration data on the recorder’s website by using a “Powershell script” that exploited a weakness in security. More than 633,000 voter records were exfiltrated between Oct. 21, 2020, and Nov. 2, 2020, the memos state.
According to Microsoft, “a PowerShell script is a plain text file saved with a .ps1 extension that contains a sequence of commands (called cmdlets), variables, and logic to automate tasks.”
Voter registration files do not include ballots, and there’s no evidence votes were changed in the incident, But the U.S. intelligence community has been warning since 2020 that if bad actors gained access to such files they could hamper the ability of voters to cast ballots in the future. China has obtained about 220 million such files, documents released last month by President Donald Trump show.
The Maricopa County incident appeared frequently in the Intelligence Community’s cyber instruction logs in the days leading up to and on the day of the presidential election. Those logs were also made public, with redactions for sensitive information, by the White House. They show that by 7:15 AM on Election Day, the Intelligence Community knew that the Maricopa intrusion had scooped up non-public information.
At the time, Maricopa County election officials said that the suspect accessed the website where people could register to vote, but could not pierce the server where the county’s voter registration files are actually stored. The county also said that the only information obtained on individual voters were voter registration numbers, but this is contradicted by the FBI, which identified more than 900 voter records that contained private information, like domestic violence victim status.
The FBI traced the intrusion to a Fountain Hills, Ariz., home and agents were dispatched several days after the election to interview the subject and execute a search warrant on the premises.
The man was forthcoming, telling federal agents exactly how he discovered the vulnerability in the Maricopa County Recorder’s website and how he wrote a computer script to exploit it, according to an FD-302 memorializing the interview. An FD-302 is the official FBI form used by special agents to write down a summary of an interview with a witness, suspect, or informant.
The suspect, who described himself as a “hacker or tinkerer,” told the agents that he first discovered the vulnerabilities in Maricopa’s website about two months earlier, in September 2020. “He noticed his voter ID appeared in the URL” after entering his own voter information and “tested the vulnerability by entering several seven-digit numbers into the URL path resulting in access to different voter registration information,” the agents wrote.
The man said that after discovering the vulnerability, he developed a “PowerShell script” that he ran from the beginning of October until around November 2, 2020, the day before the election. At that point, Maricopa County had detected the intrusions and “fixed their firewall,” according to the FBI memo.
The man estimated he obtained between 1 million and 2 million voter files.
The FBI agents noted that the suspect eventually “realized the gravity of the situation and became scared,” knowing that “he would get a visit from [law enforcement].” Though he considered telling the media about his actions, he decided to keep his breach a secret and scrubbed his hard drives and deleted files from his Google Cloud, according to the FBI-302.
The same day of the interview, FBI agents executed a search warrant on the suspect’s home. The search was publicly reported by Forbes in December 2020. The Arizona Daily Independent also reported that a home was targeted by FBI agents seeking evidence of a cyberattack on a then-unnamed organization.
The agents reportedly seized eight hard drives, three computers, and a bag of USB sticks.
Forbes reported that a man who lived at the address was previously investigated by police in 2011 when he lived in Wisconsin. While working as the IT administrator for the City of Ashland, local police questioned him over a series of spoof emails sent out ahead of a local election.
After both federal and state prosecutorial agencies declined to bring charges using the FBI’s findings, the investigative team requested that the bureau close the case in May 2023, nearly three years after the intrusions were first detected, an additional FBI memo shows. The agents cited the declinations to justify closing the file.
Editor’s Note: John Solomon is on leave as Editor-in-Chief of Just the News while working as the chairman of the White House Government Transparency Task Force as an unpaid special government employee. Part of this story was written for the White House website, which allows any media outlets to publish the contents. Any additional reporting was conducted separately by Just the News staff.