Was the Maricopa County Database ‘Wiped’ Before the Cyber Ninjas Audit?
After the results of the Maricopa County partisan election “audit” were released on Friday, false rumors of voter fraud in Arizona have been circulating. An article from One American News Network, which has been shared widely on social media, for example, claims that “Maricopa County Election Database Wiped One Day Before Audit.”
According to the article, Doug Logan, CEO of Cyber Ninjas, the firm hired to conduct the review—who has a history of promoting baseless voter fraud claims—and Ben Cotton, the founder of digital security firm CyFIR and a member of the Arizona audit team, claimed that “an administrator account deleted the entire Maricopa County general election results the day before the audit began.” More specifically, per the article, Cotton maintained that “the EMS server was connected to the internet February 1 and SQL logs indicated election records were wiped that day right before two audits were due to begin on February 2.” The article suggests that Logan “confirmed” this claim.
The assertion is false.
Maricopa County officials did not wipe out the election database the “day before two audits were due to begin on February 2,” and Maricopa County’s election management server (EMS) is not connected to the internet.
Maricopa County officials disputed the claim of deleted databases on Twitter on September 24, saying, “Nothing was purged. Cyber Ninjas don’t understand the business of elections. We can't keep everything on the EMS server because it has storage limits.”
The county further explained that “data archival procedures” are standard practice because “[T]he Election Management System (EMS) database does not store election information forever.” Servers, the county explained, have “space limitations,” so files are archived, but not deleted.
As Maricopa County officials noted, and as The Dispatch explained previously, this false allegation of deleting files is similar to a claim in May of this year that falsely alleged the voter database was deleted in Maricopa County. In response to this claim, Maricopa County Election Department officials explained: “On April 12, 2021, the Recorder Office’s IT Team shut down the server to be packed up and made ready for delivery to the Senate. At no point was any data deleted when shutting down the server and packing up the equipment.” As previously stated, the Senate liaison for the Maricopa County audit ended up walking back claims of a deleted server after the allegedly “deleted” databases were recovered: “I was able to recover the deleted databases through forensic data recovery processes. We are performing data continuity checks to ensure that the recovered databases are usable.”
The claim that the Maricopa County Election Management System is connected to the internet is also false. County officials explained: “Maricopa County uses an air-gapped system in its tabulation room, meaning the ballot counting equipment is never connected to the internet and is completely separated from the Maricopa County network. There are no routers connected to the tabulation system and there never have been.”
Furthermore, the county noted that in February 2021, there were two certified Voting System Testing Laboratories who tested the equipment and found “no evidence of Internet Connection.” (You can read the full reports from SLI Compliance and Pro V&V at their respective links.) The county continued: “These tests determined the tabulators were not transmitting information outside the closed air gapped system within the County tabulation center or while being delivered, returned, or used at a Vote Center.”
If you have a claim you would like to see us fact check, please send us an email at email@example.com. If you would like to suggest a correction to this piece or any other Dispatch article, please email firstname.lastname@example.org.