OCTOBER 2016

People traveling into Arizona may first look for the beautiful oddities in the land—giant saguaro fruit-bearing cacti with their twenty-five-foot spiky arms, coyotes walking ancient salt trails, and watermelon-colored sunsets bleeding along the flat expanse of the Sonora.

I am not one of those people. When I am not scoping out a city for a golf course to explore, I am generally viewing a city or state through the lens of its news coverage. I try to see every new place I travel to like an archeologist who has returned to our lost civilization after it has collapsed, to dust off artifacts and try and figure out how we lived. Just as I love to figure out what drives people's personalities, I love to figure out what drives us as a society. That year while I recognized we were on the brink of some kind of major shift, that passion to know how we got to this place as a nation became stronger. Simultaneously, like everyone else, I was feeling a bit of dread.

As my producer Andy and I drove into the eerie, grid-like Arizona metropolitan area demarcated with strip malls, I thought about how Maricopa County sheriff Joe Arpaio's tough war on crime and his anti-immigration projects had made headlines.

These included the world's only female chain gang where women linked by ankle weights limped along the side of the road, performing disconcerting tasks like burying unclaimed bodies, and Tent City, an outdoor jail just south of downtown Phoenix, which Arpaio himself once “jokingly” referred to as a concentration camp.1

Tent City held undocumented immigrants, the majority of whom had committed minor crimes like shoplifting, using drugs, or working illegally. The men were housed in green Korean War–era tents in temperatures that could spike to over 120 degrees, and wore black-and-white-striped uniforms with pink underwear and pink socks to humiliate them.2

Arpaio often expressed pride in Tent City, and publicly made fun of the men in press conferences.³ Arpaio fielded nearly a dozen lawsuits in connection to mistreatment of prisoners, which, in more than a handful of cases, led to death.⁴ It was the subject of numerous human rights violation charges by Amnesty International and other organizations. Still by the time I traveled through Arizona in October 2016, it was in its twenty-third year of operation.

Perhaps I reflected on Arpaio because his immigration policies were a harbinger of things to come. A Department of Justice (DOJ) investigation, which concluded in 2013, found that the Maricopa County Sheriff's Office had engaged in a “pattern of misconduct that violates the Constitution and federal law.”⁵ Some of the activities flagged by the DOJ included racial profiling of Latinos at traffic stops, use of excessive force, and retaliation against those who spoke up against the practices. Although the DOJ ordered the Maricopa County Sheriff's Office to stop the practices, they continued. Arpaio's last year as sheriff was 2016, but in 2017 he was convicted of criminal contempt of court for refusing to cease those activities, a crime that he was pardoned for a month later by President Trump.⁶ He would go on to announce that he was running for Senate.⁷

For years Arpaio had been operating outside the rules of the game, in the eyes of his critics stepping out of the boundaries of the Constitution. This was exactly the kind of thing that was contributing to the rift that was ultimately making us vulnerable to attack.

We pulled into the parking lot of Arizona's State House, where I would be conducting an interview with Secretary of State Michele Reagan about breaches in Arizona's voter databases. We got our gear and approached the building, a tall, silo-like concrete building on a compound with gravel planters in the parking lot, and a few scraggly-looking trees. The sun was bright. The heat was oppressive, and the air was thick with haze that wavered like grease over a griddle.

I was looking forward to the interview. Although I had only spoken with Reagan on the phone, she seemed deeply concerned about the breaches in the database in a way that transcended politics or party.

Reagan, like former Maricopa County sheriff Joe Arpaio, is a conservative Republican who was elected in the same conservative Republican state. She even shares some of the same kinds of controversial views. For example, she cosponsored state senate bill SB 1070, which was an immigration law that could be viewed as allowing racial profiling.8 She voted to have Arizona define marriage as a union exclusively between a man and a woman.⁹ I was pretty sure she understood that what we would be talking about transcended politics. Also, she seemed to be someone with integrity who always played within the rules.

THE MOON LANDING

The secretary of state's main office was on the seventh floor of a nine-story tower sandwiched between two floors of the governor's office, and the whole floor was under construction. The walls had been opened, and whole sections were cordoned off.

Reagan introduced herself and laughed as our crew started laying out our self-contained, pop-up moveable studio, pulling up lights and working around us. “We call it our moon landing,” one crew member told her.

As I got to know her, Reagan surprised me with her down-to-earth, self-described “happy-go-lucky” personality. I was relieved to notice that she wasn't tightly wound. She explained how most people who have reached a certain level of government are more scripted.

“My greatest strength is also my biggest liability, and that is that I am a completely regular person,” she later said. She explained how this personality disarms individuals. “I've had people actually show up to events I was going to be at with the intention of heckling me, and then they hear me and they say, ‘Wow, she's cool.’”¹⁰

Reagan's down-to-earth nature and political integrity were sustained throughout a year of utter political chaos. She did what she thought was right when she first learned that her office's computers had been hacked in late June 2016, prompting her to seek out the federal government's help.11

She also did what she believed was right a year later, in July 2017, when she refused a request by Trump's Commission on Electoral Integrity for the names, social security numbers, dates of birth, and maiden names of persons from Arizona's voter registration rolls.¹² The commission was created by the Trump administration to review supposed claims of voter fraud, after Trump alleged that millions of immigrants voted when they were not legally allowed to do so. These supposed immigrant voters cost Trump the popular vote, according to Trump. Reagan refused to hand over her state's voter info because she believed the request was illegal, would be ineffective, and because doing so could pose a legitimate cybersecurity threat. Reagan, like most secretaries of state, knew very little about cybersecurity prior to Arizona's voting systems being hacked. In just a year, she had become more of an expert.

THE VIRTUOSO

Reagan's story began in June 2016, when she got a call from the FBI alerting her that the username and password of one of her officials was on sale on the dark web.¹³ The dark web is the underbelly of the World Wide Web. You can't gain access to it without specialized software. There are covert sites within the dark web that can't be accessed through a search engine. Someone must provide you with the specific site address. There are a myriad of criminal activities that can be accessed through the dark web, ranging from “darknet markets” where you can buy anything from crystal meth to an AK-47 to an assassin to a human-trafficked woman.¹⁴ It isn't a place where a government agency would want its email to end up.

The hacker had obtained the information by phishing, sending a seemingly ordinary email to the official, which appeared to be from a constituent looking for help.¹⁵ The FBI further informed Reagan that they believed the hacker was from Russia, and was a virtuoso of sorts, having achieved a rating on their hacker scale of 8 out of 10. In other words, the hacker was very good. Eventually, the initial phishing expedition opened the door for a more serious breach. According to Reagan, she was told the voter database had been hacked too. She explained what her first reaction was when she learned that the Russians had hacked into the system.

Shock and dismay, obviously because this is the reality of a foreign entity, outside intruders if you will, coming into our state and wanting to mess with our election system, wanting to play around and make people feel unsafe.16

Arizona, like many of the other states whose databases were being hacked, didn't know exactly what to do. Reagan allowed the FBI and Department of Homeland Security (DHS) to step in. She called in Arizona's cyber troops, a cybersecurity team she later discovered they were lucky to have (not all states have them). The team took Arizona's voter registration off-line to be analyzed for what was supposed to be two days. Two days turned into five, and five into seven.

“We decided to keep it off-line for ten days,” Reagan said, “to allow multiple jurisdictions to go through and check it for us because we really wanted to make sure 1) was any information stolen; 2) was any information altered, because that would be just as bad if not worse; and 3) probably the very worst scenario would be if some virus was inserted into the system. So, we were looking for quite a few things before we put [the system] back up. The look on your face is exactly what I felt—it was horrible.”¹⁷

In the ensuing months, Reagan's office put into place eighteen precautionary measures that the DHS and the FBI laid out. She learned other nifty terms unique to cyber espionage, such as cyber hygiene (the steps organizations take to protect against cyberattacks), malware, and trolls.

These were things that people had never heard of before. Before this attack happened to us, I never heard of the dual-factor authentication; I'd never heard of SQL injections. Who would have heard of these things? I mean we're busy on the ground trying to register people to vote, trying to get them involved in ballot propositions or learning about different candidates; we're not worried about Russian hackers. Now that's something we need to be worried about, and that again is why I'm so focused on educating other people who, fortunately, haven't had this happen to them, that this is something they do need to also worry about.18

They found certain quick fixes: for example, avoid a SQL injection, which is the placement of malicious codes into SQL statements when a site asks a user for input (such as insert your name), via web page, and don't use an exclamation point or a colon when you are entering your name into an address bar—all of which introduce vulnerabilities.

Arizona hired three new IT staff members, which is basically all they could afford. Although Reagan declined to give a hard figure on how much improving cybersecurity could cost, she noted that it wasn't as much as in other states. She admitted, though, that even if her office received just an extra million in the following year's $10 million budget, it would help a lot.¹⁹

“That's real money,” she said, “and when you have an IT staff that's running all of that, over eighty thousand web pages for all of these different divisions, adding a couple of IT people is a big deal in a tiny government agency. I will say again, we don't have the resources of a Pentagon, and we shouldn't be expected to have the resources to fight these kinds of global terrorist threats via the internet. This is a new territory for us.”²⁰

Unlike some other states, Arizona was assured that the hackers hadn't reached its databases. After the investigation concluded, Arizona's voter registration database went back online. Reagan said that she was confident intrusions wouldn't compromise their election integrity.

Simultaneously, Reagan admitted that the state was reeling from the prospect of protecting the data of its nearly four million voters. Even with the federal government's help, probing continued in Arizona throughout the fall. In September 2016, Reagan learned that the state's systems had 192,000 “intrusions” or “unknown attempts” with 11,000 being deemed so suspicious they were immediately blocked. “That's just in one month,” she said, “and this just in a tiny state agency, so I guess what I'm saying is, we need to speak out about how big the scope of this is. We need to recognize that this is something we need to be vigilant about, very diligent about.”21 They continued to seek out help from the DHS and Arizona's DHS, and to partner with “anybody who has best practices,” while they waited for the following year's budget allocations.

When other secretaries of state contacted her, asking if they should trust the federal government, she understood their concerns. Reagan said that many states believed federal help came with strings attached.

The right of states to hold their own elections is baked into our Constitution, and that is something that states protect fiercely, and so states aren't going to want to give it up. I can understand why people aren't going to go running to the federal government saying, “Here's my database, please look it over for me.” I can understand that….

Now, going forward, I have the choice of just washing my hands of it and sticking my head in the sand and saying this isn't going to happen again, or saying what are the best practices that the federal government recommends, what are the best practices that my state Department of Homeland Security recommends, and implementing them.

Of course, I'm going to choose…those best practices and how I, as an elected official, how can I best protect my state voters. I think that's prudent. I think that crosses party lines. I urge other people to consider doing the same, just as I urge the federal government if states come to you for help, don't put strings on it, just let's all partner together to help each other.²²

Reagan reiterated that she understood that other states may not necessarily trust the federal government, but that this was a unique situation: “I liken it to when you're being invaded by Russia; you don't decide not to call in your National Guard. At some point you have to say, I need the army, and that's the reality we're living in right now.”²³

I spoke to Reagan again in January 2018 following the controversy when she refused to comply with certain clauses in a letter that Kris W. Kobach, vice chair of the Presidential Advisory Committee on Election Integrity, sent to her on June 28, 2017, and to all secretaries of state asking for information on their election processes, voter fraud, and election-related crimes that occurred in their states and information about their voters. The letter included these words:24

In addition, in order for the Commission to fully analyze vulnerabilities and issues related to voter registration and voting, I am requesting that you provide to the Commission the publicly-available voter roll data for [Arizona], including, if publicly available under the laws of your state, the full first and last names of all registrants, middle names or initials if available, addresses, dates of birth, political party (if recorded in your state), last four digits of social security number if available, voter history (elections voted in) from 2006 onward, active/inactive status, cancelled status, information regarding any felony convictions, information regarding voter registration in another state, information regarding military status, and overseas citizen information.²⁵

It was a lot of personal information to just hand over.

President Trump established the commission in May 2017 to investigate whether his claims that three to five million people committed voter fraud in the 2016 election were substantiated. Vice President Mike Pence chaired the commission.²⁶

Although several dozen secretaries of state (including Reagan) refused to comply with the ruling altogether, others submitted partial information.²⁷ The establishment of the commission also led to several lawsuits: for example, Maine's secretary of state Matthew Dunlap joined the commission and then later sued it to find out what it was doing.²⁸ In January 2018, the commission was terminated.²⁹

Many secretaries of state didn't mince words when refusing to send the information. For instance, Mississippi's representative Delbert Hosemann, a Republican, told the commission to “jump in the Gulf of Mexico.”³⁰ Reagan spoke about why she chose not to cooperate with the federal government's request when her agency's computers had been hacked.

While Reagan says she agreed with the commission's overall goal—finding out if there was fraud in the system—she didn't agree with the way the commission was going about it, namely, asking for identifying voter information wholesale. She distinguishes her reasoning from that of various Democratic secretaries of state who basically asserted, “We're not sending our information because this is an attempt to suppress voters.”31 Reagan describes the Republican state officials’ response this way: “Our philosophy, a number of your Republican ones, is, we're not sending the information, but it's rooted in conservative values and has nothing to do with us thinking they're trying to do something nefarious. It's just that what they're asking for isn't going to do any good.”

Instead Reagan, like Hosemann and a select group of fifteen Republican secretaries of state, sent a letter to the commission suggesting alternative ways to investigate alleged voter fraud. They never heard back. “I mean, this wasn't rooted in anti-Trump thought,” Reagan explained. “This was [us saying], ‘Hey, what you're asking for isn't going to work. Here's some things you could do.’”³²

Reagan based her decision on a few factors. Foremost among them was that her constituents voiced their objections. Her office received nearly a thousand emails from voters, some angry and others heartfelt, imploring her not to send their information. Many threatened to withdraw their voter registrations. Reagan said that she never had any intention of sending all the requested information, since it was illegal.

I tried explaining the facts to people. “Here's what we can send; here's what we can't send. Here's the process for public records requests that somebody has to do, according to a lawsuit that was just settled in our state between Project Vote and Arizona.”

Sometimes facts are boring. So, I started saying exactly what I really believed. Since when do conservative folks want their information sent to the federal government to be put in [a] database? I mean, isn't this something we're supposed to be completely against?

And how would you have felt if Barack Obama had asked for this information? And I started saying to people on the radio, “You would have lit your hair on fire.”³³

We spoke for a while about these strange times we're living in. We discussed Reagan's new website, See the Money, which actually has the capability to use artificial intelligence, and which tracks politicians’ budgets, spending, and donations in a transparent manner so that the public can see what they are doing.

I asked Reagan if she believed that this particular point in time had the potential to be a watershed moment in terms of the American elections and maintaining the credibility of the system. Reagan explained how this is a defining moment in history, but that some people are stuck in an old mind-set and don't see the way our systems are changing.

There are some people that are still looking at this as just Y2K. But Y2K was a one-time event. Y2K was a computer bug [that] programmers believed may have caused computer web systems to collapse on January 1, 2000, and beyond, causing systems ranging from banking to energy to collapse and causing massive chaos. Some believed it would cause an apocalyptic-type reaction in society, a sentiment echoed by Time magazine's January 18, 1999, cover story entitled “The End of the World.”

This is something we're going to be dealing with [for some time].

We're still going to be dealing with foreign hackers; we're still going to be dealing with cyber terrorism. It's still going to be there. Let's get in front of it.34

The Commission for Voter Integrity was a sign of our very strange times. Simultaneously, federal investigators who had looked into the wunderkind hack that had occurred in states, including Arizona, put up barriers. Reagan had cooperated fully with their investigation, but had been kept out of the loop. She didn't know what they were doing with her state's information, nor did she know if they had reached any kind of conclusion about what the hackers were doing with that information.

They had also given her conflicting accounts of what had actually happened. I learned in early October 2017, about sixteen months after the voter database in Arizona had been hacked, that federal officials were telling Arizona election officials that suspected criminals had actually been behind the breach, not the Russian government. They were also told, according to my sources close to the investigation, that the suspected criminal hackers had targeted the Phoenix Public Library.

Arizona election officials were frustrated by what they were hearing. They didn't believe federal officials were being transparent. So they considered responding publicly in a blog to what they had been told privately. The blog said, “The Secretary of State's office met with DHS officials earlier this week to discuss alleged intelligence reports that the Russian government attempted to ‘scan’ (i.e. search for weaknesses or access points) in the statewide voter registration system in 2016. (Note: this meeting was intended to discuss alleged new information and was completely unrelated to why the Secretary of State's office briefly shut down the statewide voter registration database in June 2016). Despite initial reports to the contrary, DHS could not confirm that any attempted Russian government attack occurred whatsoever to any election-related system in Arizona, much less the statewide voter registration database. Thus, while we will continue to forge a strong partnership with DHS on cybersecurity issues, we consider Arizona not to be one of the 21 states whose electoral systems were allegedly targeted by the Russian government in 2016.”35 In April 2018, a Trump administration official told Reuters that suspected criminals were behind the Arizona breach.³⁶ I wanted to know more, so I pressed Secretary of State Reagan about her reaction to this new information.³⁷

Pegues: Going back to the breach, what were the Russians trying to do in Arizona?

Reagan: Well, we've been…asked by a federal agency to not use the term “Russian,” but, instead, use the term “foreign,” because they can't confirm that it was Russia. It went through a server in Ukraine, but that doesn't mean that it emanated or started from that area. These folks, as you probably know, go through multiple servers to hide their true identity…. We got the word “Russian” from newspaper reports and from something that the FBI put out later [in 2016]. Later, in meetings with Homeland Security and with the FBI, again in 2017—and those were separate meetings—both of them said, “We'd appreciate you not saying ‘Russian.’” And I said, “Well, I only said it because it was reported, because it came from something you guys put out.” And they said, “Yes, there is no hard confirmation that we can give you that it was the Russians.” So, we started using the word “foreign.”

Pegues: Were you surprised by that?

Reagan: That was the part of the meeting that we were very surprised about. And, you know, we asked if they knew a little more of where it was coming from or what their [the hackers’] intentions were, [and] what were they trying to do. Were they trying to steal information? Were they trying to sell information? Were they trying to scramble or destroy information? Because if you really want to mess up an election, that would be the way to do it.

You know, people go to the polls, and all of a sudden you're not Jeff anymore; your name is John Smith, and you're registered at a different address. That's probably the biggest thing we were worried about. I didn't get any answer on what that was. I pitched an idea that that was what I thought was [happening], or could have been [happening]. I said, “Have you considered this?” They did not confirm or deny that they had considered it.

Pegues: You also asked federal officials if the scanning and probing of the voter database was connected to the Russian manipulation of Facebook and Twitter ads or posts tailored toward people in a specific age bracket, income level, or who worked for a specific company. It makes sense that the Russians might look into this constituency's tastes or world framework, and tailor ads to hook them on a certain candidate or beliefs.

Reagan: Yes. Right around the time [secretaries of state] were having these meetings with the FBI and with Homeland Security, and I asked them about reports that had come out where Facebook and Twitter came forward and said that there were Russian groups buying ads. Well, in the work that we've done at the secretary of state's office, and the work that various campaigns do, it's no secret that targeting messages [is] a lot more effective than just throwing an ad up on Facebook. I mean, it's targeted, that's the name of the game these days.

What's a better place to get a treasure trove of information about the way people lean and where they live? Does this particular city lean this way or that way? You go to the voter records. I did not get a confirmation or a denial on [my speculation]. That was just talking, and everyone just kind of looked at me.

Pegues: Well, that's another reason why you really have to keep this data safe and secure.

Reagan: Exactly. It was interesting that all of this was coming on the heels of a request, also from the federal government, to just send [information] over.

I thought about everything I had learned from Reagan. Before I'd interviewed her, I understood, theoretically, what affected states might be contending with. Reagan's interview was more impactful; it hit home. A state office under construction in the middle of the Arizona desert has its information sent over the dark web. When they were willing to cooperate, they were provided assistance that helped them come up with a reconnaissance strategy.

After speaking with Reagan, a second time, I had a fuller understanding of why all those states that had refused federal intervention prior to the election did so. Politicians skirting the rules could be negligent and could willfully or inadvertently disregard voters’ rights. State officials believed they had the right to be protective of their voters’ information. Simultaneously, it struck me that by this point in history there wasn't more trust between the states and the federal government. They couldn't seem to work effectively together.