A hacker ran a script against Maricopa County's voter registration website, extracted 633,000 voter files in the days before the 2020 election, and then sat down with FBI agents and told them everything. He said he was "100% accountable for his actions and was deeply regretful." He admitted he'd noticed the vulnerability for "quite some time" before exploiting it.
Four separate prosecutors looked at the confession, the evidence, and the 633,000 stolen records — and all four declined to press charges.
Here's what the hacker got away with. He used a script to exploit zero front-end security on the county recorder's voter registration page and pulled what he claimed were between 1 and 2 million voter registration records over time. The FBI confirmed at least 633,000 extracted files. Of those, 930 contained sensitive, nonpublic information — records belonging to domestic violence victims, judges, and law enforcement officers. The kind of data that gets people hurt.
When investigators started closing in, the suspect wiped his hard drives and deleted his Google Cloud copies. Destroyed evidence, on top of the original theft. The FBI still built the case. They got the confession. They walked it to prosecutors.
The U.S. Attorney's Office for the District of Arizona formally declined prosecution on June 12, 2021 — six months into the Biden administration. The Arizona Attorney General's Office passed. The Maricopa County Attorney's Office passed. The Pinal County Attorney's Office passed. Four chances. Four walks.
"The FBI expended significant resources to solve the case and even got the suspect to confess," he said. "But the Biden DOJ via the U.S. attorney in Phoenix and three state and local prosecutors all declined to prosecute. No accountability," said John Solomon, head of the White House Government Transparency Task Force.
Jeff Clark, former Assistant Attorney General for the Civil Division, was blunter. "Standing alone, the Maricopa County, Arizona hack was one of the largest compromises in U.S. history of confidential voter data," Clark said. "Yet the culprit was allowed to get off scot-free."
The FBI found no evidence that any votes were changed or that any voter registrations were altered. The hacker apparently acted alone — no foreign actors, no coordinated domestic operation. So certain corners of the internet will argue this was a nothingburger. A guy poked around a website, grabbed some files, and nobody got hurt.
Which is an interesting standard to apply to the theft of 633,000 records — 930 of them belonging to people whose physical safety depends on that data staying private — followed by deliberate destruction of evidence and a full confession to federal agents. If someone broke into a bank vault, photocopied 633,000 account records, shredded the copies when the cops showed up, and then confessed, we wouldn't call that a victimless clerical error.
Remember the backdrop. This was 2020 Arizona — the election that former CISA Director Chris Krebs called the "most secure in American history." The election that then-Arizona Secretary of State Katie Hobbs described as "easily the smoothest" and "most secure election in recent history." The FBI closed the case in 2023, having failed to find a single prosecutor willing to act.
The vulnerability existed on a public-facing county website with, per the FBI's own documents, zero front-end security. The hacker used a script. Not a nation-state cyberweapon. Not a sophisticated zero-day exploit. A script, pointed at a webpage that was essentially an unlocked filing cabinet containing the personal information of hundreds of thousands of voters.