Federal agents identified and interviewed a man who admitted exploiting Maricopa County’s election website and obtaining hundreds of thousands of voter registration records, but federal and state prosecutors declined to pursue the case.
By yourNEWS Media Newsroom
A hacker exploited a security weakness in Maricopa County’s voter registration website shortly before the 2020 presidential election and obtained more than 633,000 voter files, including hundreds containing sensitive personal information, according to newly declassified FBI records.
The FBI traced the intrusion to a residence in Fountain Hills, Arizona, secured a search warrant and interviewed a man who admitted creating a computer script to extract the records. Despite that admission and the resources devoted to the investigation, the U.S. Attorney’s Office in Phoenix and three Arizona prosecutorial agencies declined to file charges, according to a Just the News report.
The White House Government Transparency Task Force released the records Thursday. The documents show the breach occurred from Oct. 21 through Nov. 2, 2020, ending one day before voters went to the polls in the presidential election.
The incident did not involve ballots, and the records contain no evidence that votes were altered. The intrusion did, however, expose voter registration information and became the most frequently flagged event in a cyberincident log maintained by U.S. intelligence agencies around Election Day.
FBI Director Kash Patel told the White House task force that the bureau devoted “significant resources” to the inquiry but was unable to persuade prosecutors to bring a case. According to Patel’s letter detailing the investigation, charging decisions were declined by the U.S. Attorney’s Office in Phoenix, the Arizona Attorney General’s Office, the Maricopa County Attorney’s Office and the Pinal County Attorney’s Office.
The federal prosecutor’s office formally declined the case on July 12, 2021, during the Biden administration, according to the FBI. The newly released records do not specify when the three state and county agencies made their decisions.
The bureau closed its investigation in 2023.
Maricopa County officials alerted authorities one day before the Nov. 3 election. The county recorder’s office submitted information through the Arizona Counterterrorism Information Center reporting “an attempt to scrape voter registration information,” according to the FBI’s case-opening document.
Investigators determined that an unidentified intruder had used a PowerShell script to exploit a weakness in the county recorder’s public website. The operation extracted more than 633,000 records over approximately two weeks.
Microsoft describes a PowerShell script as “a plain text file saved with a .ps1 extension that contains a sequence of commands (called cmdlets), variables, and logic to automate tasks.”
The compromised records included approximately 930 files containing “sensitive voter information like domestic violence victims, judges and law enforcement officers,” according to the FBI materials. The article’s summary separately identified 933 voters whose private information was exposed.
That assessment contradicted public statements made by Maricopa County election officials after the intrusion. County officials said at the time that the intruder had accessed the website used for voter registration but had not penetrated the server where the county’s full voter records were stored.
The county also said the only individual information obtained consisted of voter registration numbers. The FBI’s findings indicate that more than 900 records included protected information, such as whether a voter was a domestic violence victim.
The breach appeared repeatedly in the intelligence community’s 2020 cyberincident logs, which were also declassified with redactions. By 7:15 a.m. on Election Day, intelligence officials knew the intrusion had captured nonpublic information.
Although voter registration records do not contain cast ballots, U.S. intelligence agencies have warned that access to such databases could be used to interfere with citizens’ ability to vote in future elections. Documents released last month by President Donald Trump showed that China had obtained approximately 220 million voter files.
The FBI traced the Maricopa County intrusion to a Fountain Hills home and dispatched agents there several days after the election. Investigators interviewed the person associated with the internet activity and executed a search warrant at the residence.
According to the official FBI interview summary, known as an FD-302, the man described himself as a “hacker or tinkerer” and explained how he discovered and exploited the website’s vulnerability.
An FD-302 is the form FBI agents use to summarize interviews with suspects, witnesses and informants.
The man told agents he first noticed the weakness in September 2020 after entering his own voter information on the county website.
“He noticed his voter ID appeared in the URL” and then “tested the vulnerability by entering several seven-digit numbers into the URL path resulting in access to different voter registration information,” agents wrote.
After identifying the flaw, the man said he developed a PowerShell script capable of automatically retrieving additional records. He ran it from early October until about Nov. 2, when Maricopa County detected the activity and “fixed their firewall,” according to the interview record.
Although the FBI documented more than 633,000 extracted records, the suspect estimated that he may have obtained between 1 million and 2 million voter files.
Agents wrote that the man eventually “realized the gravity of the situation and became scared” because he knew “he would get a visit from [law enforcement].”
He considered alerting the media but instead kept the breach secret, wiped his hard drives and deleted files stored through Google Cloud, according to the FBI summary.
Agents searched the residence on the same day as the interview and reportedly seized eight hard drives, three computers and a bag containing USB storage devices.
The federal search became public in December 2020 through reporting by Forbes. The Arizona Daily Independent also reported that FBI agents had searched a home for evidence connected to a cyberattack against an organization that had not yet been publicly identified.
Forbes reported that a man living at the Fountain Hills address had been investigated by police in Wisconsin in 2011. At the time, he was employed as the information technology administrator for the city of Ashland and was questioned about spoofed emails distributed before a local election.
Despite the suspect’s statements and the evidence recovered during the search, prosecutors at the federal, state and county levels declined to authorize charges.
After receiving those decisions, the FBI investigative team requested permission to close the matter in May 2023, nearly three years after Maricopa County first detected the intrusions. The agents cited the prosecutorial declinations in the bureau’s case-closing memorandum.
The declassified records document a substantial breach of election-related data in one of the country’s largest counties immediately before the 2020 presidential election. They also show that the investigation ended without prosecution even after the FBI identified a suspect, obtained an admission and recovered electronic devices from his home.
Comments