You Can Now Read the GBI’s Coffee Co. Report in Full

On Jan. 7, 2021, the day after the attack on the United States Capitol in Washington, D.C., a Republican Party official named Cathy Latham and a bail bondsman named Scott Hall accompanied a computer forensics team into the elections office in Douglas, Georgia. Inside, they were welcomed by the local elections supervisor, Misty Hampton. 

The forensics team—a group of employees with an Atlanta-based firm called SullivanStrickler LLC—allegedly traveled to Douglas at the behest of Sidney Powell, a lawyer aligned with then-President Donald J. Trump. Over the course of the day, they handled, scanned, and copied the state’s most sensitive voting software and equipment. They did this, prosecutors in Fulton County will later allege, without lawful authority.

What occurred inside the elections office in the early days of 2021 might have gone unnoticed if not for a phone call Hall placed that spring to Marilyn Marks, the executive director of an election integrity group called Coalition for Good Governance. Hall called Marks to request information related to Curling v. Raffensperger, a long-running civil suit focused on election security that Coalition for Good Governance had been litigating since 2017. During the recorded call, Hall began to boast about the initial breach. “I'm the guy that chartered the jet to go down to Coffee County to have them inspect all of those computers,” he told Marks. “We scanned every freaking ballot,” Hall said.

In August of 2022, more than a year-and-a-half later, the Georgia Bureau of Investigation began investigating allegations of computer trespass and other crimes related to unauthorized access to voting equipment in Coffee County. The agency recently completed its 13-month investigation, culminating in a 392-page investigative report from which the account described above derives. The report relies, for the most part, on documents and depositions produced in the Curling litigation. In August, the agency turned the document and supporting files over to the Georgia Attorney General, Chris Carr, who will decide whether to pursue charges based on its findings.

The GBI also provided its report to the Fulton County district attorney’s office, which conducted a separate criminal probe related to the breach. When a Fulton County grand jury handed down a sprawling indictment against Trump and 18 others in August, the events in Coffee County figured prominently. Two individuals charged in the Fulton County case, Hall and Powell, recently pleaded guilty to criminal charges related to unauthorized access to voting systems.

Lawfare obtained a copy of the previously unreleased report. Today, for the first time, we are publishing the document in full. (Portions of the text have been redacted to protect individuals’ personal identifying information.)

Next week, I will follow up with more granular analysis of the report and what it tells us about the GBI’s underlying investigation. For now, what follows is a high-altitude summary of the report and its contents. 

The Report

During the Trump era, the American public has suffered no shortage of mammoth-sized reports that meditate on the various misdeeds carried out by the former President or his allies. Most recently, the Jan. 6 Committee released its sprawling account of the attack on the United State Capitol and the efforts to overturn the 2020 election that preceded it. Before that, the Mueller Report created a detailed factual record regarding Russian interference in the 2016 election and Trump’s efforts to obstruct the investigation of that interference.

Compared to those Herculean feats, the GBI report is comparatively modest in scope. The investigation commenced at the behest of the Secretary of State’s office, which requested assistance from the GBI in an Aug. 2, 2022, letter to Director Vic Reynolds. The letter articulates the GBI’s investigative mandate: To investigate “possible election- and cyber-related crimes in Coffee County, Georgia.” While little is known about the GBI’s internal strategy regarding the scope of its investigation, it appears that the agency narrowly interpreted its mandate. That is, the report appears to focus primarily on subjects who were physically present in the elections office during January 2021 rather than those who may have assisted in planning or orchestrating the breach from afar. (More on that next week.)

The form of the document is equally modest in its ambitions. It does not attempt to situate the events in Coffee County within a sprawling, truth-commission-like narrative—it is, after all, not the result of a criminal investigation, not a Congressional committee. Equally, the report does not attempt to analyze how its factual findings stack up against applicable criminal laws. Nor does it contain recommendations or declinations regarding the pursuit of criminal charges against the subjects of its investigation.

Instead, the document is crafted in the vein of a police report, albeit an especially lengthy one. It comprises a series of diary-like entries, referred to as “investigative acts,” in which special agents assigned to the case summarize relevant evidence gathered during the investigation, such as depositions, video surveillance, emails, and interviews. The investigative acts are not necessarily ordered chronologically, and the document is totally devoid of narrative elements that make for a good story—character, plot, setting, and the like.

All of which renders the report somewhat difficult to read. Below, I attempt to Frankenstein a narrative out of the evidence compiled in the GBI report. For a more exhaustive account of the breach and the events that preceded it, my previous piece on the subject, “What the Heck Happened in Coffee County?,” includes context and details that were omitted from both the report and the summary that follows.

The Narrative

In mid-November, 2020, as Trump and his allies sought to overturn the election he had lost to Joe Biden, a network of lawyers, advisers, and election deniers decamped to Tomotley Plantation, the sprawling South Carolina estate of the attorney L. Lin Wood. According to the GBI report, the group that assembled there included Sidney Powell, an attorney who had recently joined the then-President’s legal team and promised to “release the Kraken” of evidence demonstrating widespread election fraud. 

In addition to Wood and Powell, the individuals who gathered at Tomotley that winter included Mike Flynn, the former national security adviser who had twice pleaded guilty to lying to the FBI—and to whom Trump would grant a sweeping pardon in December 2020. They were joined by Doug Logan, the owner of a cybersecurity firm called Cyber Ninjas, and Jim Penrose, a former NSA official.

As described by the GBI report, Tomotley soon became “the central hub for the voter fraud information processing.” Shortly after her arrival at the plantation, Powell hired a forensics company called SullivanStrickler, which would be used “to capture forensic images from voting machines across the nation to support litigation,” the report alleges. To conduct the work, Powell signed an engagement letter with the firm. The agreement, dated on Dec. 6, 2020, initially anticipated forensic work in Michigan and Arizona. 

Later that month, the report suggests that a plan to access voting machines in Coffee County began to take shape. On Dec. 31, 2020, a Georgia attorney named Preston Haliburton emailed a purported “open records request” to Hampton, the then elections supervisor in Coffee County. According to the report, the request sought “original, paper absentee ballots” as well as “scanned /electronic copies” of ballots that were counted or discarded during the 2020 Presidential election. Hampton replied to Haliburton two hours later: “Y’all are welcome in our office anytime,” she wrote. “Coffee County is willing to work with anyone with accordance to the Georgia law.”

The next day, a Trump attorney named Katherine Friess messaged an employee of SullivanStrickler. “Hi! Just handed [sic] back in DC with the Mayor,” she wrote—an apparent reference to Rudy Giuliani, who Friess worked closely with at the time. Friess added: “Huge things starting to come together! Most immediately, we were granted access—by written invitation!—to the Coffee County Systens [sic]. Yay! Putting details together now with Phil, Preston, Jovan etc. Want to give you a heads up for your team. Will be either Sat or Sun this weekend. More soon ).” The GBI report identifies “Preston” as Preston Haliburton, the attorney who emailed Hampton the day prior. “Jovan,” meanwhile, is Jovan Pulitzer, an election denier and conservative social media influencer. “Phil” appears to be a reference to Phil Waldron, the retired Army colonel with ties to Allied Security Operations Group (ASOG) and Trump’s post-election efforts.

The GBI report contests the notion that Hampton’s letter authorized access to voting machines in Coffee County. It notes that there was no document “generated or agreed upon by Coffee County Officials granting outside access to their voting equipment.” And, according to testimony summarized in the report, the board of elections did not authorize the forensic work. One then-member of the board of elections, Eric Chaney, was present in the elections office on Jan. 7, 2021. But Chaney “would not have authority on his own to allow third party access to the office,” according to the report.

A few days after Friess sent a message about accessing Coffee County voting systems, a violent mob forcibly disrupted the counting of electoral votes at the Capitol on Jan. 6, 2020. That afternoon, sometime between 12:30 p.m. and 2:00 p.m., Giuliani exchanged several phone calls with Waldron, according to deposition testimony cited in the GBI report. Citing attorney-client privilege, Giuliani did not elaborate on the details of those calls. But the former Mayor of New York City alluded to one reason why Waldron called: “He was still trying to get access to machines, particularly in Georgia.”

Later that day, back in Coffee County, Hampton texted Eric Chaney. “Scott Hall is on the phone with Cathy [Latham] about wanting to come scan our ballots from the general election like we talked about the other day,” she wrote at 4:26 p.m. At the time, Latham served as the chairwoman of the Coffee County GOP. According to testimony in the report, Latham had become acquainted with Hall, an Atlanta-area bail bondsman, through “mutual political contacts.”

The next morning, Paul Maggio, the chief operations officer of SullivanStrickler, sent an email to Powell and others: “Per Jim Penrose’s request, we are on our way to Coffee County Georgia to collect what we can from the Election / Voting machines and systems,” he wrote, attaching an invoice for SullivanStrickler’s $26,000 retainer fee. The invoice billed Powell’s charity, Defending the Republic.

Meanwhile, Hall traveled to Coffee County from Atlanta on a chartered plane. He was joined by Alex Cruce, an engineer from Florida who believed that Trump was the rightful winner of the 2020 election. According to the report, Cruce told GBI investigators that he had tagged along with Hall to “observe and learn as much information as he could to assist him in his current investigation into the results of the 2020 Presidential Election.”

Shortly before noon on Jan. 7, Latham arrived at the elections office. A timeline of video surveillance detailed in the report states that she then waited outside for the SullivanStrickler team and Hall, escorting them into the building after they arrived. Once inside, she introduced Hall and the forensics team to Hampton, Chaney, and a former member of the elections board, Ed Voyles.

That afternoon, as SullivanStrickler employees created forensic copies of virtually every piece of Coffee County’s elections equipment, Maggio again emailed Powell. “Everything is going well here in Coffee County GA,” he said, before asking for confirmation of payment. Maggio and the forensics team departed shortly before 8 p.m. that evening, according to the report. The report states that Powell’s non-profit, Defending the Republic, paid for the work carried out by SullivanStrickler.

Later that month, video surveillance summarized by investigators shows that outsiders were again permitted access to election equipment. Shortly before 5 p.m. on Jan. 18, Hampton arrived at the elections office alongside Logan, the CEO of the Cyber Ninjas security firm, and Jeff Lenberg, a forensic consultant. At one point while Logan and Lenberg were in the building, Hampton texted Chaney: “The guys measuring my desk are still here,” she wrote. The report observes that Hampton used this “code phrase” to communicate with Chaney about Lenberg and Logan’s presence in the elections office.

Over the course of the month, Lenberg made additional visits to the elections office, where the footage shows that he spent time in the room that holds the election management system server. (Lenberg has said that neither he nor Logan touched any of the voting equipment; instead, they “directed” Hampton to conduct certain tests, according to deposition testimony referenced in the report.) 

A month later, on Feb. 25, Hampton resigned from her position as elections supervisor, purportedly to avoid termination for falsifying her time sheets. That evening, the report notes, a private jet owned by Mike Lindell—an election conspiracy theorist, Trump confidant, and founder of MyPillow—appeared on the tarmac at the Douglas municipal airport in Coffee County. An airport employee who pumped fuel for the plane advised the GBI that Lindell had visited Douglas that evening to attend an event at a local high school. (Last year, Lindell told the Washington Post that he was there to meet with entrepreneurs about “cooling towels” that they were pitching to MyPillow.)

In the months after the Coffee County breach, the GBI report alleges that multiple third parties accessed the copied data. Those who gained access included Penrose, the former NSA official who worked with Powell; Conan Hayes, the ex-pro surfer turned election denier; Todd Sanders, who is connected to Patrick Byrne’s America Project, a conservative non-profit that has funded efforts to audit and inspect ballots; and Stefanie Lambert, an attorney who was recently indicted in Michigan in connection to an allegedly illegal plot to gain access to voting equipment.

Read the report here, or below: