Sometime in September 2020, a self-described "hacker or tinkerer" in Fountain Hills, Arizona discovered that the Maricopa County Recorder's website had zero security on its front-end voter registration system. So he wrote a PowerShell script and, between October 21 and November 2, 2020 — the thirteen days before the presidential election — scraped 633,000 voter registration files off the site.
He confessed to all of it. The FBI seized eight hard drives, three computers, and a bag of USB sticks from his home. Still, four separate prosecutors looked at the case and decided it wasn't worth their time.
That's the story buried in newly declassified FBI documents released this week. The U.S. Attorney's Office for the District of Arizona formally declined prosecution on July 12, 2021. The Arizona Attorney General's Office passed. The Maricopa County Attorney's Office passed. The Pinal County Attorney's Office passed.
The suspect told FBI agents he believed he had actually extracted between 1 million and 2 million voter registration records over the course of the operation. Among the 633,000 confirmed files, 930 contained sensitive, non-public information — records belonging to domestic violence victims, judges, and law enforcement officers whose addresses are supposed to be shielded from public access.
An administration official familiar with the declassified files told The Federalist that "the suspect, perhaps to the chagrin of his attorney, admitted to all of the conduct involved, including that he noticed the vulnerability for quite some time." The suspect reportedly "said he was 100% accountable for his actions and was deeply regretful." He told agents he "realized the gravity of the situation and became scared," which is apparently why he wiped his hard drives and deleted his Google Cloud copies before investigators came knocking.
The official added that "the data breach displays a major vulnerability in the voting system and 2020 election." No evidence emerged that any votes were changed or that registrations were altered, and the FBI verified through bank records and communications that the suspect acted alone. But the vulnerability itself — a county voter registration system with no front-end security in the weeks before a presidential election — is the kind of thing that should have triggered alarm bells from Arizona to Washington.
Instead, it triggered nothing. Remember, this was the same period when former CISA Director Chris Krebs was declaring 2020 "the most secure election in American history." Maricopa County's voter registration website was sitting there with no security while a hobbyist with a PowerShell script helped himself to hundreds of thousands of files, and the official line was that everything was locked down tight.
The declassified documents don't answer the most important question: why did four prosecutors independently decide that a confessed hacker who stole 633,000 voter files and destroyed evidence wasn't worth charging? The Biden DOJ's U.S. Attorney in Phoenix was first to decline, and the three state and local offices followed. Whether that was coordination or just a shared lack of interest in election security cases during an era when questioning election integrity could end your career — the documents don't say.
What they do say is that the breach happened, the confession happened, the evidence destruction happened, and nothing happened after that. A vulnerability in the Maricopa County system exposed over 600,000 voters, including some of the most vulnerable people in the system, and the entire apparatus of federal, state, and local prosecution looked at a gift-wrapped case and walked away.
