Court records show Cyber Ninjas' CEO Doug Logan is 'Individual 25' in Georgia's Trump indictment

Cyber Ninjas CEO Doug Logan is one of 30 unnamed and unindicted co-conspirators accused by a Georgia grand jury of aiding former President Donald Trump in trying to overturn the 2020 election, an analysis of court records shows.

Conduct attributed to "Individual 25" in the sweeping criminal indictment of Trump and 18 of his closest allies matches Logan's testimony in another elections case about his activities Georgia down to the dates, times and locations.

In a 2022 deposition obtained by The Arizona Republic, Logan describes accessing Georgia election data on multiple occasions before getting special access to inspect equipment at a rural county elections office.

Logan, who is best known for leading the Arizona Senate's discredited "audit" of Maricopa County's 2020 election results, was not charged with a crime in Georgia. But his testimony and other records make clear he is "Individual 25" referenced in the indictment brought Monday by the Fulton County district attorney.

The indictment outlines an alleged conspiracy to keep Trump in office that played out in Arizona and Michigan the same way it did in Georgia.

Conspirators solicited and harassed high-ranking state officials, created fake documents to cast false elector votes, unlawfully breached election equipment, intimidated election workers and tried to convince U.S. Department of Justice officials to claim the election was corrupt, the 98-page indictment states.

Logan already was part of a team enlisted by Trump lawyers to access voting equipment and data in Michigan when he traveled to Georgia, according to his testimony in an election-related lawsuit separate from the indictment.

And the same lawyers, analysts and others he testified to working with in those states would become active participants in the Arizona "audit," text messages obtained by The Republic through a public records lawsuit show.

The Georgia grand jury indictment alleges Individual 25 "unlawfully accessed certain data copied from Dominion Voting Systems equipment at the Coffee County Board of Elections Registration Office" at least three times, on Jan. 9, 11 and 13, 2021.

It also alleges that on Jan. 18, 2021, former Coffee County Elections Director Misty Hampton gave Individual 25 and another unindicted co-conspirator listed as Individual 29 access to nonpublic areas of the elections office and to the voting equipment.

"This was an overt act in furtherance of the conspiracy," the indictment alleged.

Logan did not respond to a request for an interview Friday.

In a November deposition for the elections lawsuit, Logan confirmed accessing the Coffee County data on the same dates listed in the indictment: He created file folders and remotely downloaded information on the 9th; he deleted a broken file and uploaded a new version of it on the 11th.

He also acknowledged leaving his business card at the Coffee County elections office on Jan. 18, 2021. "It was probably me. I don't remember doing that, but it was probably me," he said in the deposition.

Logan testified that he initially accessed the Coffee County data remotely on Jan. 9, 2021, via a server maintained by a cybersecurity firm called SullivanStrickler, which Trump's attorneys had hired to analyze voting machines around the country.

The data was collected days earlier by Trump operatives invited to Coffee County by Republican elections officials who had raised concerns about the potential rigging of voting machines.

Logan said he and an analyst named Jeff Lenberg later drove to the elections office, where they met with Hampton and inspected the machines.

"And she was just looking for answers," Logan told lawyers. "I mean, I wouldn't say she wanted us to specifically look into. You know, she was looking for answers on things. And so we answered questions as best we could, and we said — you know, Jeff came up with a way to — to assess the system. He suggested that it should be done as a way to validate if what she said was real or not."

Video surveillance footage obtained by CNN in September showed Logan and Lenberg arriving at the election office on Jan. 18, 2021, the date in the Georgia indictment associated with Individual 25. They were welcomed by another Coffee County elections official who held the door open for them. CNN reported nobody else was given access to the office that day.

Logan: Plan was 'to not touch anything'

Logan in his deposition described what he did with the data. He denied touching any voting equipment, saying he and Lenberg agreed from the outset that was a "bad idea."

"We thought it was better to stick to the plan to not touch anything and just leave that to — to really what the experts are. Because I'm not a forensics person," he said. "If there — if we had captured anything at that time or touched anything at that time, it would be very difficult to defend any of that in court, because it's not my expertise, it's not my background, it's not my certifications."

Logan said most of his work with the Coffee County data occurred off-site, from information already copied onto the SullivanStrickler server. He said he didn't remember specifically what he did with the data but acknowledged analyzing event logs and using a "virtual machine" to duplicate the functions of a real machine.

Logan was deposed as part of a long-running case known as Curling v. Raffensperger that was brought by voting rights organizations concerned about vulnerabilities in Georgia's election system.

Plaintiffs in December sent a letter to the FBI and other federal authorities warning it had information Trump lawyers had breached election equipment in Coffee County.

The plaintiffs said emails, contracts and other documentation obtained through discovery showed Trump lawyer Sidney Powell hired technicians, including Logan, to "unlawfully access, copy, analyze and distribute copies of election software in the aftermath of the 2020 election."

Logan testified that he believed they had permission to access the data or he wouldn't have done it. Still, he was told to keep mum about his work in Coffee County, he said.

"I mean, it wasn't trying to be a secret, as in anything wrong was done there," he said. "But I was told that — to — that this — that they didn't want it talked about until whatever legal action they had was in place."

Georgia, Michigan data helped Logan with Arizona 'audit'

Logan in his deposition acknowledged the Dominion voting machine data he captured in Coffee County would help him with the Arizona "audit."

But he bristled when asked if he was "using the data that you captured from Coffee County to assist in your analysis of the system in Arizona?"

"That's not what I said," he replied, then added:

"I — I don't recall any of the specifics about — in here. But that's — would definitely be why I was concerned on, what was that, April 12, which the — the audit I believe started — we arrived on site around April 19, if I remember correctly. So I would have been very concerned with how to capture forensic images of ICP devices to capture and do analyses and plans."

ICP likely refers to Internet computer protocol, which is used to connect one data center to another.

Logan said the voting machines in Michigan, Georgia and Arizona were remarkably similar.

"They're substantially similar, the software across the board ... that means those things are virtually identical except for small differences," he said. "And this is — I can tell you that, you know, from observing and seeing the way the software works and different stuff, there's no visual discernible difference between them."

Georgia was just one stop in Logan's election-machine data discovery mission that would take him first to Michigan then to Georgia and back to Michigan and finally Arizona.

Court records and text messages detail how the same people in Coffee County were involved in data breaches in Michigan and the Arizona "audit," where election data was secretly transported to Montana. They all had ties to Logan.

His deposition and texts cement Logan's involvement in a coordinated plot with Trump allies to overturn election results in several swing states when the Arizona Senate tapped him to lead the recount of 2.1 million ballots cast in Maricopa County.

Others involved in data breaches tied to Cyber Ninjas recount

Logan testified that in December 2020 he was enlisted by a Trump lawyer in Michigan to analyze data from election machines in Antrim County. The same lawyer, Stefanie Lambert, hired him again in March to disassemble five voting machines from three more Michigan counties, he said.

A Michigan grand jury indicted Lambert, who was arraigned Aug. 3 on multiple charges including "undue possession" of a voting machine as part of a conspiracy to flip the state for Trump.

Former Michigan attorney general candidate Matt DePerno, who was endorsed by Trump, and ex-state Rep. Daire Rendon, both Republicans, also were charged. All pleaded not guilty and say the investigation is politically motivated.

Michigan authorities in 2022 named Logan as one of six other co-conspirators in the plot.

They said Logan and Arizona "audit" subcontractor Ben Cotton, the president of a Virginia-based cybersecurity firm called CyFIR, were involved in taking apart voting machines while holed up at a Detroit-area hotel room in April 2021 — the same month the ballot review started in Maricopa County.

Neither Logan nor Cotton was charged in the case.

Cotton is a Trump supporter who at the height of the ballot recount took copies of Maricopa County's election data and its server to a remote cabin in Montana that Cotton has described as both a laboratory and his home.

Cotton also worked for Lambert to analyze the Coffee County election data, according to his own deposition in the Curling case.

He told lawyers Lambert retained him to serve as an expert witness about Dominion voting machines and tasked him with analyzing the Coffee County data. Among Cotton's jobs: forensic imaging of hard drives.

Cotton also described meeting with Coffee County election director Misty Hampton. Not in Georgia, but at dinner in Detroit in April 2021. He said Lambert introduced them. He called it a "social setting."

Hampton, who is one of the 19 people indicted by the Georgia grand jury, was forced to resign from her job in February 2021. Cotton said he was aware that Hampton had hired Lambert to represent her. He said they didn't talk about voting data.

Hampton also shows up in text messages Logan exchanged with Trump allies during the Arizona "audit." One came from retired Army Col. Phil Waldron, who was part of Trump lawyer Rudy Giuliani's team and helped to get Logan hired by the Arizona Senate.

"?? Misty from coffee co is getting hammered like Tina in Mesa Co. Do you have a copy of the image? We need to get it to our lawyer — Bundren — ASAP for her defense," Waldron texted Logan on Sept. 22, 2021.

Waldron sent multiple texts within seconds of each other, but the rest are redacted. Logan's response is also missing.

"I told him I wasn't giving it to him," Logan said in his deposition, referring to a string of texts about Hampton that he has not turned over to The Republic. "And I told him, no, I'm not going to just give data to a random person because they asked me. That's not what you do with data."

Logan hiding texts with indicted Michigan lawyer

Logan has redacted and withheld thousands of text messages in defiance of multiple court orders and a $50,000-per-day contempt fine to turn over all "audit"-related communications as part of The Republic's 2021 lawsuit.

Those include more than 1,600 texts he exchanged with Lambert. Although Lambert had no official role in the audit and was not Logan's lawyer, he claims most of his messages with her are protected by attorney-client privilege because she hired him as an expert witness on the Georgia and Michigan cases.

Logan exchanged more texts with Lambert — about 2,400 — than with any other person he messaged during the audit. The two went back and forth almost daily, often dozens of times.

Unredacted texts show they discussed their Michigan election data, the Department of Justice investigation, "audit" fundraising and Dominion voting machines. Logan also bragged about his reach into the Arizona Senate, telling Lambert he could direct state lawmakers to do his bidding on claims of election fraud.

Text messages show Logan couldn't make sense of his own data and ultimately had no way to quantify results of the Arizona hand count. In a series of messages, Logan said "our numbers are screwy" and that he would be satisfied so long as the count was right "most of the time."

That meant the work of hundreds of volunteers, who spent two months sitting at counting tables inside Veterans Memorial Coliseum in Phoenix reviewing ballots and recording individual votes with tick marks onto more than 70,000 tally sheets, was worthless.

Logan's review was supposed to take a few weeks and cost taxpayers $150,000. It ultimately took more than five months and so far has cost Arizona taxpayers more than $5 million.

Former Senate President Karen Fann hired the Cyber Ninjas after privately communicating with Waldron. Although neither Logan nor his company had election auditing experience, Fann at the time said he was "well qualified" and "well experienced."

While Logan confirmed President Joe Biden's victory in Arizona, his report to the Senate focused on so-called anomalies that raised doubts about the process. It allowed Trump allies to insist the vote was compromised, instilling distrust in voting machines and encouraging partisan calls for paper ballot tabulations, hand recounts and "audits."

The Arizona Attorney General's Office announced in July that it had launched its own probe into a range of Republican-led efforts to overturn the 2020 election.

That includes two slates of fake electors who falsely certified the state's electoral votes should go to Trump and the Cyber Ninjas "audit," the only privately run recount of ballots in America.

Attorney General Kris Mayes, at an Aug. 16 news conference, asked for patience.

"I understand why folks want to know what is happening in our investigation. That's a natural desire, given what just happened in Georgia and Michigan," Mayes said. "But we are doing a thorough and professional investigation. And we're going to do it on our timetable as justice demands."

Arizona Republic reporter Stacey Barchenger contributed to this article.

Robert Anglen is an investigative reporter for The Republic. Reach him at robert.anglen@arizonarepublic.com or 602-444-8694. Follow him on X (the site formerly known as Twitter) @robertanglen.

This article originally appeared on Arizona Republic: Doug Logan is 'Individual 25' in Georgia's Trump case, records show