No Prosecution For Hacker Behind 2020 Breach Of 633K AZ Voters

After a hacker exfiltrated the data of 633,000 Maricopa County, Arizona, voter records in 2020, zero prosecutors at any level of government would prosecute despite urging from the FBI.

Documents released Thursday morning by the White House Government Transparency Task Force detail the massive data breach, an investigation by the FBI, a suspect who admitted to the crime, and a years-long attempt by the FBI to get someone to prosecute, only to close the case due to a lack of prosecutor interest.

“The suspect, perhaps to the chagrin of his attorney, admitted to all of the conduct involved, including that he noticed the vulnerability for quite some time. He considered himself a hobbyist hacker, that in the fall and spring he began looking for ways to exploit the site,” an administration official said on a Wednesday call with reporters. “He ultimately believes that over the course of a period of time, he extracted 1 million to 2 million voter registration records, and then he stored them in four gigabytes on his hard drive.”

About 930 records of the 633,000 included sensitive, non-public voter information such as domestic violence victimization. Although no ballots were accessed or changed and no registrations were changed, an administration official says the data breach displays a major vulnerability in the voting system and 2020 election that Democrats and the corporate press have persistently maintained was the most secure in history.

The first denial to prosecute the crime came from the U.S. Attorney for the District of Arizona on June 12, 2021, about six months into the Biden administration. The Arizona attorney general, Maricopa County district attorney, and the Pinal County district attorney all also declined to prosecute the hacker. According to the FBI summary, the suspect said he did not share the data and “said he was 100% accountable for his actions and was deeply regretful. [Name redacted] apologized and commented that he has to deal with the consequences of his actions.”

According to the official, others ignored evidence of the data breach, including former Cybersecurity and Infrastructure Security Agency (CISA) Director Chris Krebs, who was briefed on the issue with a document that places the breach in the “highest concern” where it was “repeatedly mentioned,” but Krebs never spoke about it.

The hacker used a script to extract data through the webpage a voter would use to fill out his own data, finding zero security on the front end, enabling him to access the location where the data was stored. The hacker apparently acted alone, and the FBI expended resources looking into bank records and communications to see if he was working with any domestic or foreign actors, and determined that he was not.

By 2023, after numerous failed attempts by the FBI to find someone to prosecute the hacker, the case was closed. According to the administration official, the White House has requested information about the prosecutors who declined to pursue the case.