FBI files: 633k Maricopa voter records scraped before 2020; four prosecutors declined charges

Newly released FBI records show an intruder exploited a Maricopa County website in the weeks before the 2020 presidential election and extracted approximately 633,000 voter-registration records. Despite an admission from the identified suspect and a federal search warrant, federal, state, and county prosecutors declined to bring charges, and the FBI closed the case in May 2023, according to the documents.

The disclosures, part of the White House's election-integrity release, include the FBI's opening and closing documents, an interview report, and an Aug. 4 letter from FBI Director Kash Patel. Patel wrote that the FBI confirmed records "were illegally extracted" and that agents "identified a suspect who admitted the crime," according to the letter described in the release.

The legal consequence is blunt. Four prosecuting offices passed on the case after the bureau developed the facts. Rep. Abe Hamadeh questioned those declinations in an interview on John Solomon Reports, asking which attorneys at the U.S. Attorney's Office, the Arizona Attorney General's Office, and county offices "declined charges... when the FBI referred it and had this case pretty much handed on a platter."

According to an FBI opening document cited in the release, the Maricopa County Recorder's Office notified the bureau on Nov. 2, 2020, through the Arizona Counter Terrorism Information Center about an attempt to scrape voter-registration data. Investigators determined an intruder had been pulling data since Oct. 21 by placing voter identification numbers directly into the website's URL, bypassing normal authentication, then automating the process with a PowerShell script. The FBI documented approximately 633,000 exfiltrated records, about 930 of which involved domestic-violence victims, judges, and law-enforcement officers. The data included names, voter ID numbers, and party affiliations; it did not include Social Security numbers.

Maricopa County detected a traffic spike on Nov. 2 and configured its Cloudflare firewall to impose rate limits. The FBI traced the activity to a Fountain Hills residence. An interview report reflects the suspect said he noticed his own voter ID in a county URL around September 2020, tested other seven-digit numbers, and then scripted the process. He estimated he pulled 1 to 2 million records, though investigators documented about 633,000. He said he stored the information on hard drives and Google Cloud before deleting it.

Agents executed a federal search warrant on Nov. 5, 2020. A subsequent analysis of seized devices and financial, social-media, and email records confirmed the suspect developed and operated the script and later deleted the scraped data, according to the FBI's May 2023 closure memorandum. Investigators reported they did not find indications of domestic or foreign influence over his actions.

Despite the admission and technical attribution, the U.S. Attorney's Office for the District of Arizona declined prosecution. The Maricopa County Attorney's Office also declined and advised that the Arizona Attorney General's Office had already declined the matter. The FBI then presented the case to the Pinal County Attorney's Office, which also declined, according to the closure memo. Just the News, citing the FBI records, reported the federal declination occurred on July 12, 2021.

The disclosures also diverge from Maricopa County's public description in 2021. As Arizona Daily Independent previously reported in May 2021, county officials said no confidential voter files had been accessed, though publicly accessible information may have been viewed or copied. The FBI documents now indicate roughly 930 sensitive records included domestic-violence victims, judges, and law-enforcement officers, a meaningful gap between public messaging and investigative findings.

From a rule-of-law perspective, the authority was clear: federal, state, and local prosecutors all had charging discretion. The chosen remedy was technical mitigation and, ultimately, closure without charges. The outcome is no judicial record, no sanctions, and no formal deterrent. The cost is borne in public confidence and in the exposure of protected individuals, even if Social Security numbers and ballots were not implicated.

Hamadeh called the breach "a direct attack on democracy" and said Arizonans are seeking accountability. He has promoted the SAVE America Act, which would require proof of U.S. citizenship to register for federal elections and identification when casting a federal ballot, and urged the Senate to advance it in July. Whatever one thinks of that policy debate, the record here shows soft enforcement after a confirmed intrusion.

The FBI records concern voter-registration data, not ballots, and Just the News reported there is no evidence votes were changed. But the confirmed exposure of protected classes is not theoretical harm. The remaining unanswered questions are prosecutorial: who declined, on what grounds, and why the public had to wait years to see the case file that now frames those decisions.

See an error? Email corrections@saguarosignal.com. We append material corrections to the article.