Arizona Attorney General's Office 2020 Election Investigation

In a departure from the ACV's focus on Arizona county-level governance, this page highlights state-level observations of the Arizona Attorney General's Office 2020 Election Investigation (AZ AG's report). The AZ AG's report investigated criminal allegations originating from the Arizona Senate on September 24, 2021. The allegations were reported to the Arizona Attorney General (AZ AG), who is responsible for investigating criminal allegations related to Election Fraud committed within the State of Arizona.

Separate from the collection of data being collected from the AZ AG's report to identify potential governance gaps, some of the inspector's observations are worthy of being highlighted on this page. Key points may be lost during the comparison of county behaviors to the US GAO's Green Book, which was being used as a standard for good governance in the absence of any known standard being applied by Maricopa County.

Finally, some of the inspector's investigative practices appear shallow, considering this was referred to the Arizona Attorney General's Office as a criminal investigation. Generally speaking, the Inspector relied heavily on interviews to reach report findings. None of the findings resulted in criminal charges. For example, five procedure violations in Allegation #2 were confirmed. These procedure violations were no by themselves acts of fraud committed by Maricopa County workers. However, these procedure violations were lapses in security measures intended to protect against fraud. Thus, Maricopa County workers did not commit acts of fraud, they knowingly or unknowingly, facilitated acts of fraud by not protecting early ballot security. The AZ AG's inspector could not determine the willingness of MC workers to participate in fraud without intrusive investigation to find objective evidence.

In a sad perspective, the AZ AG's shallow investigation seems in some ways to reflect poor governance at the state level whereas this assessment is concerned about poor governance at the county level. At its worst, the shallow investigation would appear to show collusion in the cover up of fraud perpetrated by others.

Arizona Attorney General's Office Posting of the Investigation

Did the AZ AG's Office intentionally make it difficult for the public to read the report?

The Arizona Attorney General's Office 2020 General Election Investigation is a publicly available document, at the following:

• https://www.azag.gov/sites/default/files/2025-06/2020_General_Election_Investigation_Summary.pdf

The document was posted rotated 90 degrees. Extra effort is needed by the public to rotate the document into the proper orientation before it can be read.

The AZ AG's Office posted a poor image of the document. As an image, report content cannot be copied. Efforts to use an Optical Character Recognition (OCR) to convert to a text file were unsuccessful. Behind the text, the image background is dark and hazy, which inhibits the OCR identification of text characters.

The poor quality of posting was either intentional or sloppiness considering the purpose of the posting was to communicate the results of the AZ AG's investigation.

Origins of the Criminal Investigation

Report Origin

• Karen Fann - President of the State of Arizona Senate submitted the allegations to the AZ AG's Office.
• Mark Brnovich - State of Arizona Attorney General received the allegations.
• Keith Thomas #395 - Assistant Chief Special Agent Criminal Division / Special Investigations Sections conducted the investigation.

Allegation #1 - Signature Verification

Interviews

• Nabor, Celia - Assistant Director of Early Voting
• Valenzuela, Ray - Assistant Elections Director
• [Withheld] - Personnel from Runbeck Elections Services Inc.,
• [Withheld] - Level 1 Signature Verifiers (assumed to be among the 33 permanent MC employees, not 40 temporary workers)

Objective Evidence

• Signature Verification training materials provided by the Arizona Secretary of State
• Signature Verification training materials from Maricopa County Elections Department
• Signature Verification training videos by the Maricopa County Elections Department
• Election data provided by the Maricopa County Elections Department

Inspector's Notes

• Additional details are available from Special Investigation Section #SIS-2021-0482.
• All Mail-In and Drop Box ballots are sent to Runbeck Elections Services Inc where the ballots are scanned into batches. These images are then sent to the Maricopa County Elections Department where Signature Verification Process begins.
• Early ballots are sent to Signature Verifiers in batches of 250.
• Level I Signature verifiers will flag an early ballot that does not have a signature OR the signature cannot be verified.
• Flagged early ballots are "cured" by Level II Signature Verifiers. Flagged early ballots may be resubmitted for tabulation after the Level II Signature Verifier determines the early ballot is valid via the curing process.
• 1,910,317 early ballots were submitted to MC
• 17,126 early ballots were sent to Level II Signature Verifiers for curing.
  • 15,084 ballots without signatures were cured (verified valid)
  • 1,455 early ballots without signatures were rejected (not valid)
  • 587 early ballots were rejected for "bad signatures" (not valid)
• 73 Level I Signature Verifiers were involved in the 2020 General Election
  • 29 fulltime MC employees received signature verification training
  • 4 parttime MC employees received signature verification training
  • 40 temporary employees performed Level I Signature Verification without training
• Level I Signature Verifiers are expected to complete an early ballot verification at a rate of one ballot per 7.2 second (250 ballots per 30 minutes)

Inspector's Findings

• The AZ AG's inspector found "no Improper Procedures" were discovered.
  • However, no procedures were referenced in the report, which would have served as objective evidence for the finding. The inspector relied on interviews.

Hypothetical Questions for the Inspector

1. Did the Signature Verification training verify the competency of the Verifiers? If not, the training was for show, not impact.
2. If training did verify the competency of the trainee's Signature Verification, did the verify assure competency at a rate of 7.2 early ballots per second?
3. For a criminal investigation, how were untrained Signature Verifiers to ensure compliance with A.R.S. 16-550-01 if they were untrained? This appears to be more than a procedure violation as presented in the Inspector's findings.
4. If training was important for 33 MC employees, then why didn't the 40 temporary workers receive the same training prior to performing Level I signature verifications.
5. Did 587 "bad signatures" flagged seem unreasonably small considering the 1,910,317 early ballots submitted?
6. Given the subjectivity of signature verifications, did 587 "bad signatures" seem unreasonably small when compared to 16,539 ballots flagged for having no signature? Having no signature is an easy decision; it's binary, there is a mark in the signature box or no mark. An actual signature is more complicated. Therefore, there should have been far more early ballots flagged for "bad signatures" than "no signatures."

Allegation #2 - Drop Box Collection

Interviews

• Eckstein, Tim - Maricopa County Legal Council
• Honey, Heather - from Verify Vote, which was the source of the original allegation
• Novak, Ed - Maricopa County Legal Council
• Puli, Andrew - from Verify Vote, which was the source of the original allegation
• Wick, Jason - United States Postal Service Inspector

Objective Evidence Reviewed

• Arizona Secretary of State Drop Box procedures
• Maricopa County Drop Box procedures
• Early Voting Ballot Transport Statements (EVBTS)

Inspector's Notes

• Numerous EVBTS were missing data and/or signatures (see report for details).
• MC staff stopped counting ballots on October 21, 2020 because "the number of received ballots became too large to utilize the ballot counter."
  • The inspector notes state, "the decision was made to weigh trays."
  • They began weighing boxes of ballots to estimate the number of ballots received.
  • They began transmitting estimated early ballots by email instead of using the EVBTS forms.
• Ultimately, five procedure violations were confirmed by the AZ AG's inspector, which were associated with the following deviations:
  • Drop Box collection teams of two were procedurally required to have one team member from each political party (Democrat and Republican). However, 15 of the collection team members did not identify as Democrat or Republican.
  • The signatures from both of the collection team members were required on the EVBTS forms by procedure. However, one or both signatures were sometimes missing.
  • Departure times were not always filled in on the EVBTS forms, contrary to procedure requirements.
  • Signatures were for receipt inspections were not always on the EVBTS forms, contrary to procedure requirements.
  • Ballots were not aways counted, contrary to procedure requirements.

Inspector Findings

• The AZ AG's inspector confirmed five procedures had been violations.
  • No report information was available to identify who was responsible for these procedure violations.
  • No report information was available to identify any corrective actions implemented to prevent a recurrence of these procedure violations.

Hypothetical Questions for the Inspector

1. Why weren't the 56,226 undeliverable early ballots investigated for fraud; the number was far to high to be rationalized as citizen errors during the voter registration process?
2. Why weren't any clarifying questions asked about the security or chain of custody measures to assure all the undeliverable early ballots matched the number of early ballots destroyed.
3. Were any extra security measures applied to early ballots beyond what is routinely applied to all undeliverable first-class mail?
4. Were the voter registration forms reviewed to determine if there were any patterns in the data to suggest fraud, such as some voter registrants accounting for unusually high occurrences of fictious addresses?

Allegation #3 - Election Management System

Interviews

• Bilotta, Gary, Director of Geographical Information Systems
• Cotton, Ben - CyFir Owner
• Gates, Bill - Maricopa County Board of Supervisors
• Jarret, Scott - Director of Elections for Ballot Tabulation
• Logan, Doug - Cyber Ninjas Owner
• Ramirez, Brian - Election Information Technology staff member
• Richer, Steven - Maricopa County Recorder
• Young, Nate - Director of Information Technology

Objective Evidence

• Maricopa County Elections Published Records
• Requested forensic pre-view of Maricopa County Election System

Allegation #3, Sub-allegation #1 - EMS Data Purged

Investigation Notes

• Per Director of Information Technology stated EMS data purge was required for logic and accuracy tests.
• Per Elections Department policy backups were createed between 10/20/2020 and 11/16/2020.

Investigation Findings

• Undetermined - Agents are pending a date to review achieved data to ensure all election files are present.
  • According to Elections Department personnel backups were available, but the investigator did not review as part of a criminal investigation.

Allegation #3, Sub-allegation #2 - Election Files Deleted

Data Notes

• Data files are shared/transferred over the local network to the EMS server.
• Data files are removed from the tabulation stations when data space (memory) on the computer begins to get full.
• Since these files are not associated to the tabulation files stored on the EMS server, they are not backed-up or archived.

Findings

• Undetermined - Agents are pending a date to review achieved data to ensure all election files are present.
  • According to Elections Department personnel backups were available, but the investigator did not review as part of a criminal investigation.

Allegation #3, Sub-allegation #3 - Corrupt Ballot Images

Inspector's Notes

• Maricopa County Elections Officials randomly selected images from the date periods that Ben Cotton from CyFir claimed were corrupted and the were able to open all images.

Inspector's Finding

• Undetermined. Agents are pending a date to review archived data to ensure all election files are present.
  • This allegation was for corrupted ballot images, not missing data files and not inability to open files, as MC Election officials claimed they were able to achieve.

Hypothetical Questions for the Inspector

• If Maricopa County Election staff was under criminal investigation, why would you allow them to perform random samples for use as factual evidence?
• Why were no images reviewed to support or refute the allegation of corrupted ballot images?

Allegation #3, Sub-allegation #4 - Missing Ballot Images

Investigator's Notes

• Cloned copies of hard drives were provided to Cyber Ninjas and they were able to locate the files they claimed were missing.

Investigator's Findings

• Undetermined. Agents are pending a date to review archived data to ensure all election files are present.
  • This allegation was for missing ballot images, not missing data files.
  • This allegation was initiated by CyFIR and delivery of files to Cyber Ninjas was credited as action taken towards resolution of the allegation.

Hypothetical Questions for the Inspector

• Why were no images reviewed to support or refute the allegation of corrupted ballot images?

Allegation #3, Sub-allegation #5 - Failure to Follow Basic Cyber Security Practices

Investigator's Notes

• The EMS server along [with the] other election equipment is configured in an air gapped standalone system (no outside connectivity outside of the controlled access room).
• Maricopa personnel assert that Cybersecurity and Infrastructure Security guidelines do not apply to this air gapped standalone computer configuration.
• The EMS server along with the other election equipment resides inside a controlled access room under 24-hour video monitoring.
• Further security requirements include a two-person rule to enter the room.

Investigators Findings

• Unfounded Allegation. Cyber Ninjas presented its opinions on these areas. There has been no indication of malicious or criminal acts performed by Maricopa County Elections Officials. Cyber Ninjas suggest a better practice base on their beliefs; however, Maricopa County Elections was within compliance of state and federal law as it pertains to these areas.
  • MC Election officials' assertion of appropriate behaviors seems weak for the malicious or criminal behaviors under investigation.

Hypothetical Questions for the Inspector

• How the EMS computer system considered a standalone air gapped system if it is connected to the local area network (See Allegation #3, Sub Allegation #2)?
• Were video surveillance records of the EMS server and ancillary equipment for the period under investigation reveiwed? If not, were you relying on the assertion of the Election officials under investigation as objective evidence for no malicious or criminal acts performed?
• How was the two-rule stated?
• Were there any access logs, recording when each individual entered and exited the access point for the EMS server?
• Does the two-person control measures for EMS access seem disproportionately weak when compared to drop box pick up, which was investigated as Allegation #2. For drop box collection, two people from two different political parties (Democrat and Republican) are required to document the collection times in accordance with a procedure with perhaps a few hundred ballots at risk of corruption. For EMS access, any two people may enter the EMS server area without any controlling procedure or enter/exit logs with 1,910,317 ballots at risk.
• Does the two-person rule require both people to have equivalent knowledge and experience? It would be difficult for a person with minimal Information Technology experience to detect an experience fraudster's malicious activities.
• Given that federal and state laws are generally written at policy level, not for implementation level, how is assertions of compliance to laws applicable to measures to securely tabulate ballots, regardless of what's specified in law.
• Prior to this event, had MC Officials ever detected a violation of the two-person rule? If not, were security measures and video surveillance adequate to deviation from the two-person rule?
• Prio to this event, had MC Officials ever disciplined an individual for a violation of the two-person rule. If disciplinary actions were never taken for two-person rule violations, it's not really a rule.
• In the absence of any disciplinary actions, how was the rule communicated to the staff and did it include consequences for violations?

Allegation #3, Sub-allegation #6 - Subpoenaed Equipment Not Yet Provided

Inspector's Notes

• All data and equipment were provided as part of "the settlement agreement."

Inspector's Findings

• Unfounded Allegation. According to the statements made by Mr. Bill Gates and a letter dated September 17, 2021 by State Senate President Karen Fann to Attorney General Marck Brnovich, all materials were provided to the State Senate by Maricopa County.

Allegation #3, Sub-allegation #7 - Anonymous Logins

Inspector's Notes

• There were five Type 3 logins (Logon Type 3, also known as a Network Logon, occurs when a user or device connects to a computer over the network rather than through the console or a remote desktop session).
• The five Type 3 logins occurred between 11/18/2020 and 3/5/2021 and were identified by PacketWatch.
• Apparently, the Cyber Ninjas allegations were for a timeframe noted for the five Type 3 logins.
• No "script-based activities were performed during these anonymous logins as per the PacketWatch report.

Inspector's Findings

• Undetermined. The allegations by Cyber Ninjas appear to have different activity dates as to that which was reviewed by PacketWatch. Agents have a pending request to review anonymous logins with Election Officials.

Hypothetical Questions for the Inspector

• Why was PacketWatch presented as investigative data when its time frame was different than the Cyber Ninjas allegation?

Allegation #3, Sub-allegation #8 - Dual Boot System Discovered

Inspector's Notes

• There was a second hard drive on one computer; the drive was not powered on or used at any time while in Maricopa County's possession.
• This drive did not play a role in any Maricopa County election as it was not plugged into the computer, and therefore not operational.
• County Elections stated they did not retain copies of photos for this portion of the SLI report but stated they are available by request from SLI.
• County Elections was unsure if it was the same computer identified by Cyber Ninjas.

Inspector's Findings

• Undetermined. County Elections makes statement about SLI Compliance finding related to dual boot systems; however, within the SLI report, there is no mention of this finding. Furthermore, County Elections stated they did not retain copies of photos for this portion of the SLI report but stated they are available by request from SLI. County Elections was unsure if it was the same computer identified by Cyber Ninjas. Based upon the two date available from Cyber Ninjas and SLI, and the different naming conventions, it is unclear if it is the same computer.
  • For what it's worth, no follow up action is stated. There is no evidence to suggest follow-up was taken to any of the other undetermined findings.

Hypothetical Questions for the Inspector

• Why did you assert in the data that only one computer was effected, but then later acknowledge that two computers may have been effected?
• Why would you rely on County Elections personnel to say the second bootable drive was not connected or powered on when they are the ones under investigation?

Allegation #3, Sub-allegation #9 - Operating System Logs Not Preserved

Inspector's Notes

• Election Officials explain "the EMS server could be remotely accessed via the local area network within the air gap system."
• The EMS server was often accessed from the EMS Admin Station located within the BTC.
• Three EMS server access events were identified, with justification provided by the Election Department.
• On April 12, 2021, the Election Department identifies Brian Ramirez, a County Elections Staff Member, as having access. The county asserts that the second individual with Brian Ramirez is a coworker, but was not identified.

Inspector's Findings

• Agents have a pending request to review log entries with Election Officials. This review will allow for a better understanding of the logs, and help further identify why there are discrepancies between the logs identified by Cyber Ninjas and the logs notated by PacketWatch and County Elections. Additionally, further questions will be asked regarding what actions were taking place on 2/11/21.

Hypothetical Questions for the Inspector

• Why was one county worker identified by name as accessing EMS on 4/12/21, but the other coworker's name was omitted from the report?
• What was of special interest during the 2/11/21 access?

Allegation #3, Sub-allegation #10 - Internet Connections to the EMS

Inspector's Notes

• Election Officials explained REWEB and REGIS systems were web servers that host "record.maricopa.gov" and the internet connectivity is legitimate.
• The REWEB and REGIS systems do not connect to the EMS.
• Walkdowns confirm the existence of an air gap system.

Inspector's Findings

• Unfounded Allegation. Upon review of this section and applicable data known thus far, there is no further analysis that can likely be done as it relates to internet connectivity. Of the devices reviewed by Cyber Ninjas, they articulate a need to review the "routers" in order to determine if internet connectivity did in fact occur. Additionally, with the lack of log files, they cannot review information related to potential internet connections.

Allegation #4 - Maricopa County Board of Supervisors - Data not provided for audit

Inspector's Notes

All of the following bullets are quotes from the AZ AG's inspector's report:

• On Novemeber 23rd 2021, Mr. Bill Gates of the Maricopa County Board of Supervisors responded to questions sent by Agent Geisler. Mr. Gates did not grant agents an interview and would only answer questions pre-submitted in writing.
• Mr. Gates indicated all data was provided to the State Senat Attorney Kory Langhofer and Senate Liaison Ken Bennett, and not to the "Auditors."
• He confirmed the board received Legislative Subpoenas issue on January 12th and July 26th.
• Following a settlement agreement and Judge Thomason's decision on February 25th 2021, State Senate President Fann confirmed the Board Fully complied.
• After signing the settlement agreement, President Fann sent a letter to Attorney General Brnovich on September 17th 2021 stating: "Accordingly, the settlement agreement places the County in with applicable state law, including the subpoena, and additional action by your office is not warranted."
• Mr. Gates stated that all data was provided as requested by the subpoena and that election archived data was not subpoenaed and not provided and were part of the settlement agreement.
• Mr. Gates stated he is not aware of what was provided to Cyber Ninjas by the Senate and that question should be directed to Senate President Fann.

Inspectors Findings

Unfounded Allegation. According to statements made by Mr. Bill Gates and a letter dated September 17th 2021 by State Senate President Karen Fann to Attorney General Mark Brnovich, all materials were provided to the State Senate by Maricopa County. Mr Gates confirmed that materials not listed in the subpoena or settlement agreement were not released to the Senate.

Allegation #5 - Pima County Election Department - Voter spike prior to election

Inspector's Notes

• According to US Census Bureau, the population for Pima County on April 1, 2020 was 1,043,433
  • 772,140 were of legal voting age, which is 74%

• According to the voter statistics from the Arizona Secretary of State official 2020 Canvas for Pima County:
  • The General Election Data (November 3, 2020) - [Votes cast]
    • 638,355 Total Eligible Voters
    • 526, 319 Total Ballots Cast
    • 112,036 No Vote Cast
    • 82.% Voter Turnout
  • The Primary Election Data (August 4, 2020) - [Eligible voters by Party]
    • 584,070 Total Eligible Voters
    • 171,331 Republican
    • 230,325 Democratic
    • 4,243 Libertarian
    • 178,171 Other
• Pima County Recorder Ann Rodriguez sent a letter to the Pima County Board of Supervisors on November 18, 2020, with the following election data:
  • 489,623 registered voters are on the Permanent Early Voting List, which is 76.7%.
  • Ballot return rate was 87.5%, the highest rate for any prior election.
  • 526,319 votes were cast, which was 87.36%. Again, this was the highest rate in any prior general election.
• The AZ AG's inspector notes that Ann Rodriguez also reported an increase in drop-off ballots vs. walk-in voters, which was supported by statistics but not carried forward into the AZ AG's report.

Inspectors Findings

Unfounded Allegation. Between August 4, 2020 to November 3, 2020, the total of registered voters in Pima County increased by 54,285 voters. This 8.5% increase in voter registration validates the continuousness of the 2020 General Election. This review did not uncover any potential election fraud associated with the allegation. It should be also noted that Pima County Attorney's Office investigated 151 incidents reported by the Pima County Recorder's Office of potential voter fraud. These investigations determined that most were voter confusion about the electoral process to mail-in and provisional ballots. These additional ballots were not counted in the final tally of votes.

Allegation #6 - Unknown published flyer allegations

This allegation consisted of eight sub-allegations, and all were determined to be unfounded.

Allegation #7 - Email sent to State Representative Mark Finchen

Meeting held by Pima County Democrats (Voter Fraud Planning meeting) 35,000 votes were embedded into Pima County election system.

This allegation originated form emails sent to Arizona State Representative Mark Finchem on November 10 & 12 2020 from brianwatson70002@gmail.com.

Inspector's Notes

There were no observations that were relevant to poor governance

Inspector's Findings

This was an unfounded allegation.