Maricopa County Forensic Audit: Findings, Funding, and Grand Jury Seizure

The Maricopa County forensic audit, the Arizona Senate’s privately funded 2021 review of the 2020 presidential election run by Florida cybersecurity firm Cyber Ninjas, confirmed that Joe Biden won the county. The hand count of roughly 2.1 million ballots actually widened Biden’s margin slightly over the official canvass, and Maricopa County later rebutted nearly every fraud-related claim the review produced.¹ Nearly five years later, the audit’s records are back in the news: the FBI seized them in March 2026 under a federal grand jury subpoena.²

What the Hand Count Found

Cyber Ninjas presented its report to the Arizona Senate in September 2021. Its hand recount of the 2,089,563 ballots cast in Maricopa County for president and U.S. Senate confirmed Biden’s win. Compared to the official canvass, the recount found 99 additional votes for Biden and 261 fewer votes for Trump.¹

Senate President Karen Fann acknowledged the vote totals matched the official results, but the report attached claims of tens of thousands of “potentially invalid” ballots based on voter address changes, alleged internet connectivity of equipment, and purportedly deleted files. Maricopa County officials called the report “littered with errors and faulty conclusions.”¹ Former Secretary of State Ken Bennett, who served as the Senate’s liaison to the review, acknowledged under questioning before Congress that the hand count showed Biden received more votes than Trump in the county.³

A separate equipment audit the county had commissioned months earlier, performed by U.S. Election Assistance Commission–certified labs Pro V&V and SLI Compliance, had already reached its own conclusions in late February 2021: no malicious software or hardware, no unauthorized software modifications, no internet connectivity, and no vote switching.⁴

How the Senate Review Was Run

The Senate took possession of the ballots after Maricopa County Superior Court Judge Timothy Thomason ruled on February 26, 2021, that subpoenas from Senate President Karen Fann and Judiciary Chairman Warren Petersen were valid. The judge held that the legislature’s constitutional authority to oversee elections and inform future legislation reached the paper ballots, tabulation equipment, and voter rolls the subpoenas demanded, and that the 24-month ballot-sealing statute did not shield the records from legislative process.⁵

The Senate then hired Cyber Ninjas without a formal bidding process, rejecting proposals from two other firms.⁶ CEO Doug Logan had no election auditing background. He had authored documents intended to help congressional members object to certifying the 2020 electoral vote on January 6, 2021, and appeared under the pseudonym “Anon” in The Deep Rig, a film alleging the election was rigged against Trump.⁷ Cyber Ninjas subcontracted vote counting to Wake TSI and voting system evaluations to CyFIR and Digital Discovery.

The physical recount began April 23, 2021, at Veterans Memorial Coliseum in Phoenix. Counters processed ballots on a rotating “spinning carousel” rather than the stacking method used in official Arizona hand recounts, in which multiple counters view each ballot at rest and agree on it before moving on.⁶ Auditors searched ballot paper for bamboo fibers, testing a conspiracy theory that counterfeit ballots had been shipped from Asia. They examined ballots under ultraviolet light and used a commercial address-verification service to flag voters who may have moved, a method Cyber Ninjas itself acknowledged was prone to error.⁸

Chain-of-custody questions dogged the review. Former Republican state representative Anthony Kern was observed counting ballots at the coliseum from an election in which his own name had appeared as a candidate; Senate liaison Ken Bennett said he had not realized Kern had applied as a counter in addition to volunteering as an observer.⁹ An Arizona Republic reporter who photographed Kern counting ballots had their press credentials revoked.¹⁰

During the review, the U.S. Department of Justice’s Civil Rights Division warned Senate President Fann that a planned door-to-door canvass of voters could violate federal voter-intimidation laws and that handing federal election ballots to a private firm could violate federal record-retention requirements.¹¹ Fann responded that the canvassing had been “indefinitely deferred” and that the Senate retained physical security of the ballots.

How Maricopa County Rebutted the Audit

On January 5, 2022, Maricopa County election officials released a 93-page report titled Correcting the Record, reviewing 75 specific claims made by Cyber Ninjas and its subcontractors. The county classified 38 as inaccurate, 25 as misleading, and 11 as false. Only one allegation, that roughly 50 ballots may have been accidentally double-counted, was found to be potentially valid.¹²

The headline number from the Cyber Ninjas report, 53,304 ballots flagged as “potentially invalid” over voter residency, collapsed on review. The county found that 53,267 of those flags came from errors in commercial database matching and loose “soft matches” on names and birth years. Only 37 potential instances of double-voting were referred to the Attorney General, about 0.069 percent of the flagged ballots.¹²

On the claim that election files had been “illegally deleted,” IT Director Nate Young said the county’s examination of cloned hard drives showed no evidence of permanent deletion; files were archived as state law required or had never been subpoenaed. The auditors’ assertion that workers had created 37,000 system events to overwrite data was countered with data showing only 385 events during the relevant window. The two web servers Cyber Ninjas cited as evidence of internet connectivity were, the county said, intentionally connected systems with no role in tabulation; the tabulation system itself was air-gapped.¹²

The county also noted that Cyber Ninjas used a “tally method” for its hand count rather than the stacking method mandated by Arizona law, and that 28.3 percent of batches showed different totals between the hand count and the Senate’s own machine count.¹³

Maricopa County Board of Supervisors Vice Chairman Bill Gates testified before the U.S. House Committee on Oversight and Reform on October 7, 2021, that the review’s purpose was “raising doubts” rather than verifying facts, calling the rise of privately funded, government-backed audits “the biggest threat to our democracy in my lifetime.”³ Doug Logan was invited to testify at the same hearing but notified the committee less than two days beforehand that he would not appear under oath.¹⁴

Who Paid for It

The Senate’s contract with Cyber Ninjas was worth only $150,000 in public money, an amount Fann acknowledged fell far short of the actual cost.¹⁵ The audit’s total operating cost reached roughly $8.8 million, with $5.2 million going to payroll and labor.¹⁶

By July 2021, Cyber Ninjas disclosed $5.7 million in private donations. The largest single donor was The America Project, a 501(c)(4) founded by former Overstock.com CEO Patrick Byrne and former Trump national security adviser Michael Flynn, which contributed $3.2 million.¹⁷ Byrne later said he personally supplied roughly $27 million of the $30 million The America Project raised overall.¹⁸ Other donors included America’s Future ($976,514), Voices and Votes ($605,000), Defending The Republic ($550,000), and Election Integrity Funds for the American Republic ($280,000). Voices and Votes was created by One America News Network host Christina Bobb. The Senate’s contract with Cyber Ninjas did not require disclosure of outside funding, and the firm initially refused to identify donors.¹⁵

The Collapse of Cyber Ninjas

A separate legal fight over public records drove Cyber Ninjas out of business. Watchdog group American Oversight sued the Arizona Senate and Cyber Ninjas in May 2021 for communications and financial records. An Arizona appeals court ruled in August 2021 that because the Senate had hired Cyber Ninjas to perform a legislative function, the firm’s records qualified as public records subject to disclosure, even though a private company held them.¹⁹

Logan refused to comply. A judge imposed a $50,000-per-day fine that reached more than $3 million by March 2022 and more than $4.3 million by May 2022.²⁰¹⁶ The Arizona Supreme Court declined to throw out the fine. Logan declared the company insolvent, saying he had “no money to cover the cost,” and Cyber Ninjas filed for bankruptcy. The firm owed subcontractors more than $1.9 million; EchoMail said it had never been paid.

American Oversight settled with the Senate and Cyber Ninjas in April 2023, producing the release of tens of thousands of pages of records. Text messages from the release showed Logan had planned to work on a similar review in Wisconsin, that he and Christina Bobb discussed audit strategies in other states, and that Bobb had advised Logan against testifying before the House Oversight Committee because he could be “accused of lying under oath.”²¹ The records also detailed involvement by Rudy Giuliani, Patrick Byrne, Phil Waldron, and Jovan Pulitzer in funding, coordination, or staffing.²²

The 2026 Federal Grand Jury Seizure

In March 2026, the FBI seized more than three dozen hard drives and servers containing audit data under a federal grand jury subpoena issued to Arizona Senate President Warren Petersen. Petersen confirmed he received and complied with the subpoena, saying publicly: “The FBI has the records.”²³

The subpoena, dated March 5, 2026, and facilitated by the FBI Phoenix Field Office’s fraud investigations unit, sought nearly all records from the audit: Cyber Ninjas’ forensic reports, original electronic media provided by Maricopa County, clones of election equipment software and data, chain-of-custody documentation, and communications between the Senate and county officials. The Senate turned over multiple six-terabyte hard drives, backup servers containing video footage, eight USB drives, and miscellaneous documents, much of it attributed to subcontractor CyFIR.²⁴

The investigation is part of a broader Trump administration effort to re-examine the 2020 election. Kurt Olsen, a former Trump campaign lawyer serving as the White House’s director of election security and integrity, has been granted access to classified CIA and NSA intelligence as part of a federal probe into whether Biden’s 2020 win resulted from “fraud or other electoral irregularities.”²⁵ Olsen represented Kari Lake in her 2022 gubernatorial election challenge and was sanctioned by the Arizona Supreme Court for making false claims in court in that case.²⁶

Arizona Attorney General Kris Mayes called the grand jury inquiry the “weaponization of federal law enforcement in service of crackpots and lies.”²³ Election integrity experts and former Arizona Attorney General Mark Brnovich had previously concluded the audit’s findings were “misleading or outright wrong” and “deeply flawed.” Maricopa County officials said they had not received a subpoena from the FBI as of March 2026.²⁷

Where Maricopa County Elections Stand Now

After three new Republican supervisors took office in 2024, the Maricopa County Board of Supervisors announced on January 6, 2025, that it would commission a fresh independent review of county election processes. Chairman Thomas Galvin drew an explicit line: “There will be no Cyber Ninjas here.”²⁸

The new review has two components: a technology review confirming that 2024 election equipment was not tampered with and cannot connect to the internet, and a broader review of physical security, chain of custody, candidate filing compliance, temporary worker hiring, vote center selection, and drop box usage. Unlike the 2021 effort, it will not reexamine past election results or handle cast ballots, and it is overseen by the Maricopa County Internal Audit Department to insulate it from the board and staff. On June 25, 2025, the board approved a $400,000 contract with accounting firm BerryDunn, running through June 30, 2026, and committed to releasing BerryDunn’s findings publicly “without edits, revisions or changes.”²⁹

Separately, new County Recorder Justin Heap, elected on a platform questioning previous county election administration, has been locked in a dispute with the Board of Supervisors over control of ballot drop boxes. Heap asserted in May 2026 that his office holds sole authority over drop box locations and threatened criminal prosecution of anyone operating drop boxes without his authorization. Attorney General Mayes sided with the board, saying a drop box is “simply a place to deposit a voted and sealed early ballot packet,” not an early voting location under the recorder’s jurisdiction.³⁰ The board has appealed a separate court ruling that granted Heap broader control over election functions, and the dispute remained unresolved heading into the county’s July 2026 primary.³¹

1
CNBC. Trump-Friendly Cyber Ninjas Audit of Arizona Votes Still Shows Biden Won
2
ProPublica. Maricopa County Arizona Election Records FBI
3
U.S. House Committee on Oversight and Reform. Oversight Committee Hearing Exposes How Arizona Election Audit Aimed To Undermine Confidence in Elections
4
Arizona Mirror. Audits Find No Problems With Maricopa County Election Machines
5
U.S. House Committee on Oversight and Reform. Document Submitted for the Record
6
States United Democracy Center. Report on the Cyber Ninjas Review
7
Arizona Mirror. Audit Leader Doug Logan Appears in Conspiracy Theorist Election Film
8
Brennan Center for Justice. The Partisan Arizona Election Audit Was Flawed From the Start
9
Arizona Mirror. Where Was Anthony Kern on Jan 6
10
Arizona Capitol Times. Reporter Forced From Senate Audit for Photographing Ex-Lawmaker
11
NPR. In Response to Justice Dept, Arizona Senate Says Plan to Canvass Voters Is on Hold
12
Arizona Mirror. Maricopa County Rebuts Audit Findings, Bogus Election Claims
13
Maricopa County Elections Department. Correcting the Record – January 2022 Report
14
NC Newsline. Cyber Ninjas CEO Refuses to Testify at Congressional Hearing on Arizona Audit
15
Tucson Sentinel. Arizona Audit Funding
16
Arizona Mirror. Audit Records Show Cyber Ninjas Went Deep Into Debt Despite Pro-Trump Donations
17
Cronkite News. Critics Say $5.7 Million in Private Funds for Ballot Audit Taints Results
18
Issue One. Patrick Byrne, Michael Flynn, and The America Project Tax Filing
19
Arizona Mirror. Appeals Court: Senate, Cyber Ninjas Must Produce Audit Records Immediately
20
FOX 10 Phoenix. Arizona Supreme Court Won’t Consider Cyber Ninjas Appeal of Daily $50K Fine
21
American Oversight. Texts Between Cyber Ninjas CEO Doug Logan and Christina Bobb Reveal Early Plans
22
American Oversight. American Oversight Lawsuit Comes to a Close
23
Arizona Capitol Times. Federal Probe Examines Debunked 2020 Arizona Election Audit
24
Arizona Mirror. DOJ Subpoena Reveals Federal Investigators Sought Virtually All Records From Arizona’s 2020 Audit
25
Politico. Kurt Olsen 2020 Election Intelligence
26
CNN. Kurt Olsen 2020 Election Fraud Trump
27
Votebeat. Maricopa County 2020 Election FBI Records Warren Petersen
28
Arizona Mirror. Maricopa County’s New Leaders Pledge Another Election Audit, But Not Like the Last One
29
Maricopa County. Independent Election Review
30
KJZZ. Mayes Sides With Maricopa County Supervisors in Drop Box Dispute With Recorder Heap
31
Votebeat. Maricopa County Board Supervisors Justin Heap Ballot Drop Boxes Primary Election