Source: Politics<\/p>\n
Donald Trump\u2019s top pick to administer Arizona elections in 2024 is more than a garden-variety backer \u2014 he played a little-known but notable role in bolstering the former president\u2019s push to subvert the 2020 ballot.<\/p>\n
It was the waning weeks of the Trump presidency when Arizona state Rep. Mark Finchem made an unusual request of the federal agency that deals with cybersecurity threats. Finchem, a longstanding Trump ally now running for Arizona secretary of state, asked the Department of Homeland Security agency to conduct \u201ca full spectrum forensic examination\u201d of voting machines.<\/p>\n
Finchem\u2019s request was elevated to the acting director of DHS\u2019 Cybersecurity and Infrastructure Security Agency, Brandon Wales, at 7:59 a.m. on Christmas Eve 2020. And it got his attention. \u201cWe need to do a call on this today,\u201d Wales wrote to several people eight minutes later, including the agency\u2019s then-deputy chief external affairs officer.<\/p>\n
The emails to the DHS agency, known as CISA, are part of a tranche of new communications<\/a> that show Trump lawyer Rudy Giuliani and his allies\u2019 attempts to get the federal government to help them reverse election results went even broader than previously known. American Oversight, a watchdog group, obtained the emails through a Freedom of Information Act lawsuit and shared them with POLITICO.<\/p>\n Perhaps even more significantly, the emails underscore that Trump\u2019s stalwart allies in his baseless quest to contest his loss to Joe Biden are still core parts of his network heading into a possible 2024 White House bid. Finchem, in particular, worked overtime in the weeks after the 2020 election to try to reverse Biden\u2019s win in his swing state. And last September, Trump endorsed his bid to become Arizona\u2019s secretary of state<\/a>, in charge of its 2024 ballot.<\/p>\n During the last days of Trump\u2019s administration, Finchem was one of the leading proponents of \u201cauditing\u201d voting machines \u2014 and hosted an infamous hearing with Giuliani<\/a> in late November 2020 where then-President Trump called in to lie about his loss. Emails reviewed by POLITICO show Finchem asking for help from one of CISA\u2019s Hunt and Incident Response Teams, saying a subcontractor to one of the nation\u2019s largest defense contractors could help.<\/p>\n Finchem did not respond to requests for comment.<\/p>\n On Dec. 18, 2020, Trump met in the Oval Office with a group of supporters trying to change the election outcome \u2014 including Sidney Powell, Michael Flynn and Giuliani \u2014 who were pushing for extreme measures to advance their goal. Finchem\u2019s outreach to CISA appears to have begun around that same time.<\/p>\n During the Oval Office meeting, some attendees urged Trump to have the Defense Department seize voting machines so they could be audited. They even brought along a draft executive order to do just that. (Baseless allegations of voting machines being \u201cflipped\u201d were a foundation of pro-Trump conspiracy theories at the time.)<\/p>\n POLITICO reviewed a second, similar draft<\/a> executive order that would have had the Department of Homeland Security take on that project, rather than DOD. The same week, Giuliani called DHS\u2019 second-in-command to ask if his department could seize the voting machines, The New York Times reported<\/a>. That official, Ken Cuccinelli, told him that wouldn\u2019t be possible.<\/p>\n The newly released emails show that six days after the Oval Office meeting, top CISA officials viewed Finchem\u2019s request for help. Finchem sent CISA the request through a standard online form that anyone can use to report suspicious cyber activity to CISA, and the date of his initial outreach isn\u2019t clear from the documents.<\/p>\n CISA spokesperson Michael Feldman said the agency \u201cdoes not comment on specific correspondence with state or local officials.\u201d<\/p>\n \u201cWe work regularly with the election community, including officials in all 50 states, in support of their security and resilience efforts,\u201d the spokesperson continued. \u201cThis includes sharing timely and actionable information and intelligence, and providing cybersecurity services, technical assistance, and guidance. CISA services are provided at no cost, when requested by system owners or operators for the purposes of improving their security.\u201d<\/p>\n Finchem and the Arizona state legislature where he serves did not own or operate any of the state\u2019s voting systems.<\/p>\n On Dec. 28, 2020, four days after CISA\u2019s acting director requested the call on Finchem\u2019s voting machines request, the emails show another person \u2014 whose name is redacted \u2014 flagging that CISA had conducted fact-finding on the issue with the sitting Arizona secretary of state, Katie Hobbs, and the state elections director at the time.<\/p>\n A spokesperson for Hobbs\u2019 office declined to comment. Hobbs, a Democrat, is now running for Arizona\u2019s open gubernatorial seat.<\/p>\n In the request to CISA\u2019s tip line, Finchem specifically asked for help from one of the agency\u2019s Hunt and Incident Response Teams \u2014 a term of art not widely used outside the cybersecurity community. The team would help probe voting machines, Finchem hoped.<\/p>\n \u201cIf possible, we understand that Raytheon\u2019s subcontractor \u2018CyTech\u2019 has the technology (CyFIR) and the subject matter expertise that can do this expert level of analysis and investigation,\u201d Finchem continued. \u201cWe would request that they support this effort in a manner as expeditiously as possible.\u201d<\/p>\n CyTech has worked with the federal government since 2010, getting awarded contracts with the Defense Department and two other agencies, but a review of public records does not show the small company had any connection to Raytheon Technologies.<\/p>\n However, CyTech, CyFIR and their former owner, Ben Cotton, eventually played their own roles in the effort to undermine Biden\u2019s win in Arizona \u2014 focused on the decisive Maricopa County.<\/p>\n While Trump and his allies were unsuccessful in getting the federal government to audit the 2020 election, they successfully pushed the Arizona state Senate to conduct a review of the election in Maricopa, the state\u2019s largest county, which Biden narrowly carried by about 45,000 votes. It was the first time Maricopa had voted for a Democrat on the presidential level in decades.<\/p>\n That state Senate review was run by a company called \u201cCyber Ninjas\u201d that drew widespread consternation from bipartisan election experts, as well as the county\u2019s Republican-controlled elections office and board of supervisors. The \u201cCyber Ninjas\u201d review was ultimately dismissed as a sham effort run by amateurs<\/a> who spent most of their time chasing conspiracy theories.<\/p>\n CyFIR was a subcontractor for that review and was listed in Cyber Ninjas\u2019 statement of work<\/a>.<\/p>\n The election review lasted for much of 2021, during which Cotton copied data from the county and drove it to a lab in Montana, the Arizona Republic reported at the time<\/a>. Cotton also presented during the delivery<\/a> of the final report to the state Senate. That report was published in September 2021<\/a>.<\/p>\n Two years before the 2020 election, Cotton had spun off CyFIR from CyTech, for which it was initially developed as a tool that provides incident response, threat hunting, digital forensic investigation, insider threat analysis and malware detection.<\/p>\n Cotton continued to own both separate companies, but sold CyFIR to eSentire in 2021 and is working for the company as vice president for incident response, according to his LinkedIn profile. eSentire announced the acquisition<\/a> on June 17, as the Arizona audit was underway.<\/p>\n eSentire confirmed to POLITICO that the firm was aware of CyFIR\u2019s work on the Arizona audit when it bought the spun-off company. CyTech and Raytheon Technologies declined to comment. Cotton did not respond to multiple requests for comment.<\/p>\n Another cryptic email in the tranche obtained by American Oversight appears to show that \u2014 a few days before CISA\u2019s top brass scrambled to field Finchem\u2019s tip-line request \u2014 a different Trump ally reached out directly to DHS\u2019 top lawyer with a request for collaboration. <\/p>\n Chad Mizelle, DHS\u2019 acting general counsel, received an email at 9:48 p.m. on Dec. 21, 2020, from a sender whose email address is partially redacted.<\/p>\n \u201cHere is the image of the request memorandum,\u201d the sender wrote. \u201cI look forward to working with you.\u201d<\/p>\n It’s not clear what the “request” in question referred to. But American Oversight spokesperson Dera Silvestre said the group is confident, based on other open records requests it has made, that the partially redacted email belongs to Trump ally Phil Waldron.<\/p>\n Waldron is a retired Army colonel who has said he worked under Michael Flynn at the Defense Intelligence Agency, according to The New York Times<\/a>. A Giuliani ally has told the Jan. 6 select committee<\/a> that Waldron originated the idea of having the Defense Department seize the voting machines to halt Trump\u2019s loss. <\/p>\n Waldron also distributed a PowerPoint presentation after the election pushing Trump to declare a state of emergency. His outreach to Mizelle came as he worked feverishly to overturn the 2020 election results.<\/p>\n \u201cIt\u2019s concerning that someone like Phil Waldron had this degree of access to DHS officials even while he and other Trump allies were pursuing dangerous schemes to reverse the election,\u201d said Silvestre, the American Oversight spokesperson. \u201cIt\u2019s even more concerning that we\u2019re only now finding out about it, over a year later.\u201d<\/p>\n DHS did not provide any materials to American Oversight that indicated Mizelle replied to the message he received. Mizelle declined to comment on the communication, and Waldron did not respond to requests for comment.<\/p>\nAn odd request<\/h5>\n
A problematic suggestion<\/h5>\n
\u2018I look forward to working with you\u2019<\/h5>\n