WASHINGTON — Days after the 2020 presidential election, before all votes were counted and Joseph R. Biden was declared the winner, cyber experts and analysts piled into suites at the Trump Hotel in Washington and other hotel rooms in the area.
The plan was urgent: Crowdsource evidence of electoral fraud to secure a Trump victory with the assistance of his legal team and White House staff.
Weeks later, former Trump national security adviser Michael Flynn urged leaders of the effort to move to a more remote location, an isolated South Carolina plantation owned by conservative attorney L. Lin Wood. There, they planned weeks of lawsuits, attempts to access voting machines and ways to convince lawmakers to reject key state election results, driven by a frantic mission whose goal was to keep then-President Donald Trump in office after an election he lost.
Since the violent attempt on Jan. 6, 2021, to stop certification of the 2020 election results, much of the scrutiny has been trained on what Trump knew, as well as the involvement of those closest to him, including his chief of staff, Mark Meadows. But it was dozens of true believers gathered in hotels in Washington and at the South Carolina plantation who collected the information upon which the Trump campaign based its unsubstantiated claims that the election was stolen, information also used to enlist state and federal lawmakers to assist in a bid to overturn the election results.
The House Jan. 6 select committee is making its case in hearings this month of a coordinated, multistep effort with Trump at the center to subvert the will of voters and keep himself in power — even though he had been repeatedly told there was no credible evidence of fraud that could overturn the election. Much of the proof offered in crafting the "Big Lie" came from a motley crew of both big players and people unfamiliar to the public, who left their daily lives, families and jobs for weeks to travel to Washington or submit affidavits to support the Trump campaign's widely debunked claims of fraud.
Using public records, months of interviews with people behind the scenes and hundreds of never-before-seen documents, The Times assembled accounts of how the group came together and what it did in the frenetic weeks between election day in 2020 and Jan. 6, 2021, to help Trump and his circle push the false theory that the election was stolen.
Several of those involved told The Times they spoke to the committee at length as part of its 10-month investigation, or turned over troves of documents and communications. Others said they haven't been contacted by the committee.
Some of the key players in the group were already working together in New York City before the election to crack the laptop of Hunter Biden, son of the Democratic nominee, said former Overstock.com Chief Executive Patrick Byrne, who was a major funder of the effort. Byrne has increasingly spoken publicly about political conspiracy theories in recent years, particularly after leaving Overstock.com in 2019 over the disclosure that he was in an intimate relationship with Russian agent Maria Butina, who was convicted in the U.S. in connection with Russia's interference in the 2016 election.
Also a part of the effort were Trump's former attorney Sidney Powell and personal lawyer Rudolph W. Giuliani, along with his client, Michael Trimarco, a New York businessman who has previously worked with finance and technology companies and got involved with the group when Giuliani asked him to look at documents on the laptop.
The group set up shop in hotels around Washington to be ready for the election results, staffing multiple bases with a small army of cybersecurity experts, quantitative analysts, lawyers and former members of law enforcement, convinced that fraud took place and determined to prove it. Some said they believed Trump's months of claims that he could only lose if the election was stolen, others cared less about politics and were already convinced that fraud tainted all American elections.
"Among the people who believe there were a lot of irregularities and saw the pattern in the irregularities, they were all there," Byrne told The Times of the effort. "Everyone was there trying to do the same thing, to crack it [and] to find the evidence that could be exposed."
The Bad News Bears
Byrne said he rented a block of rooms at the Trump International Hotel in Washington for a team he called the "Bad News Bears," where they worked to collect affidavits, look for anomalies in election results and process findings for Powell and Giuliani's lawsuits. The initial members of Byrne's team were Conan Hayes, a former surfer and a co-founder of Costa Mesa-based clothing brand RVCA; former Army Capt. Seth Keshel and cybersecurity consultant Todd Sanders, Byrne said. Retired Army Col. Phil Waldron also came with them, but he quickly moved to work closely with the president's lawyers, Byrne said. Waldron became Giuliani's main presenter to state and federal lawmakers.
"I brought them up thinking that they were going to become key in helping unscramble [fraud], which they were," Byrne said.
In an interview with The Times, Trimarco said the group he led — which included attorneys, people who had previously worked in elections and others with ties to former White House chief strategist Stephen K. Bannon — got rooms across the river at the Westin Arlington Gateway hotel.
"There was a ton of information coming in from all over literally the world that needed to be vetted through very quickly and then, you know, interpreted to see if it was real or not, and then gotten up through the chain of command, which was to Rudy [Giuliani] so that if [it], I guess, passed muster there, then it would go to the president," Trimarco said.
Byrne's cyber team made its case to Powell and Giuliani on Nov. 9 in the Trump campaign offices as staff members were packing up their desks, theorizing that if bad actors had committed fraud in just six counties in swing states, it would have been enough to tip the 2020 election. They met for 45 minutes with Powell, who was so excited that she rushed Byrne and his team in to meet with Giuliani for 30 minutes, Byrne wrote in his book, "The Deep Rig." Giuliani was less convinced, and asked for a memo outlining their theory, Byrne wrote.
Powell and Giuliani did not respond to interview requests from The Times.
A few days later, Powell and others staying at the Westin Arlington Gateway gathered to hear Russell Ramsland, the head of Dallas-based Allied Security Operations Group, and Waldron detail their own theories on how the system was hacked and what they would need to address it, Trimarco said.
Ramsland declined to speak to The Times and Waldron, who previously worked for Ramsland's security firm, did not respond to requests for comment.
Ramsland and Waldron laid out the same theory as Byrne's team but in more depth, Trimarco said, asserting that finding fraud in election machines in six key counties could turn an election.
"They propose a plan that would essentially involve the private contractors — I guess namely themselves — going to get access to these voting machines to go find these security breaches or flaws and be able to audit the results," Trimarco said.
Since 2018, Ramsland, who ran an unsuccessful congressional bid in 2016 to unseat fellow Republican Pete Sessions in Dallas, had promoted a theory of foreign interference in voting machines to a succession of powerful Republicans, including several members of Congress. His conjecture was presented to but not substantiated by the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency in the months before the 2020 election, the Washington Post reported.
Byrne said he first met Waldron and some other cyber experts who would later join them in Washington in the summer of 2020.
Trimarco said when he brought Giuliani the plan by Ramsland and Waldron the day after meeting with them to get permission from the president to allow private contractors to seize voting machines and data, the president's lawyer dismissed it outright. Giuliani told Trimarco that their focus would instead be on convincing state legislators that the wording of the Constitution gives them power to overturn, alter or "decertify" a state's presidential election results — even if it changes whom voters selected. That reading of the Constitution is widely dismissed by constitutional experts, who say that elected state officials cannot change electoral college electors once they've been chosen by voters.
Though Giuliani rejected the idea, the concept of seizing voting machines would reemerge in mid-December when Trump was asked to sign an executive order authorizing the federal government to take control of state election systems.
Code names and pseudonyms
Emails and documents from those involved in the effort that were reviewed by The Times show several people used encrypted ProtonMail accounts or other email addresses connected to a private server. Some used code names in emails and identified themselves only by pseudonyms or initials.
"I'm loading a larger version of the Enola Gay," Powell wrote in a Nov. 12 email to Wood — who brought an election lawsuit in Georgia arguing proper procedures weren't followed in the election — in a nod to the American aircraft that dropped the atomic bomb on Hiroshima in World War II. It is unclear what Powell was referring to in her email.
Giuliani convinced Trump in a Nov. 12 Oval Office meeting to promote the theory that ballot counting machines owned by Dominion Voting Systems changed the results of the election and to allow Giuliani to guide efforts to contest it, the New York Times reported.
That same day, the U.S. Cybersecurity and Infrastructure Security Agency issued a statement with other federal election agencies confirming that there was "no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised," and that the 2020 presidential election was the most secure in American history.
Some members of the Trump campaign had already decided many of the fraud claims were baseless or didn't show enough fraud to change the result. The following day, Trump 2020 reelection campaign advisor Jason Miller emailed Meadows an internal memo prepared by the Trump campaign rebutting various allegations against Dominion Voting Systems.
"Will defer to you on whether or not to share full report with POTUS. POTUS is clearly hyped up on them," Miller said in a follow-up text obtained by CNN. It's unclear whether Meadows shared the report with Trump.
Giuliani knew the courts weren't going to wade into deciding an election, Trimarco said. Instead, he said, Giuliani believed the path to success was convincing lawmakers to reject state results. If they were going to persuade state lawmakers and members of Congress, they needed evidence "indicative of fraud," even if it wasn't conclusive, Trimarco said.
A group of people prepared to find that evidence was already in place. Prominent far-right conservatives put out social media pleas for voters to send them evidence of fraud. And a deluge of personal anecdotes about the election process poured in.
Byrne told The Times that Flynn was pleased with the operation he and Trimarco created to collect information, but said there needed to be better coordination with Powell and Giuliani. Flynn suggested moving the operation's headquarters "to a location far away from D.C., far away from any city, in fact," Byrne wrote in his book.
Flynn did not respond to interview requests from The Times.
Soon after, Powell and some of her attorneys staying at the Westin left, along with some of the cybersecurity experts.
"They left the Westin in the middle of the night," Trimarco told far-right commentator Ann Vandersteel recently in an online interview. "They pulled all of our stuff out of there because they thought that the Westin was compromised."
The plantation
Powell, Flynn and a few lawyers and cyber experts made a new headquarters at Tomotley, Wood's 1,000-acre plantation located just over an hour from Savannah, Ga., and Charleston, S.C.
Wood said in an interview with The Times that he and Flynn met through Twitter direct messages, but that he barely knew Powell when she asked if her team could come work at the plantation.
Powell and two attorneys arrived either Nov. 12 or Nov. 13, Wood said, and announced that Flynn would be joining them. Soon cybersecurity expert Doug Logan and former senior official for the National Security Agency Jim Penrose followed, along with Hayes and Keshel from Byrne's Bad News Bears team.
When Flynn arrived with Byrne the evening of Nov. 15, the group had a planning meeting.
"That was really where they planned what locations they were going to go to, who's going to offer up info," Joshua Merritt, a former employee of Ramsland's security firm, told The Times. "The Tomotley meeting was sort of that operational order where everyone sat down and planned it and figured out how they were going to go through everything."
Merritt said his research into foreign interference is the source of some of the claims that Powell, in particular, pushed in public, though he said the campaign mischaracterized it. An affidavit from Merritt explaining why he thought foreign interference in the election was possible was cited in the four lawsuits Powell filed challenging election results and alleging fraud in Arizona, Georgia, Michigan and Wisconsin.
Byrne said Logan, Penrose and the other cyber experts who stayed at the South Carolina plantation set up in a space above a garage on the property while Powell's lawyers worked from the main house about 50 yards away.
"That's so all this information could flow in from around the country and there would be people sort of just walking across the lawn and presenting it to these lawyers," Byrne said.
Flynn ran the Tomotley operation, multiple people told The Times, staying through Thanksgiving. Pictures posted on social media show him carving a turkey at Tomotley the day after being pardoned by Trump.
Though Ramsland and Waldron didn't receive the authority to seize election machines they asked Giuliani to obtain from Trump, the push to persuade elections and county officials across the country to grant private contractors permission to review ballot information and machines began. In a Nov. 17 email to the Tomotley team, Waldron listed the election equipment lawyers needed to ask for access to when they sought injunctions. The email does not say what the injunctions were for.
By the time Powell and Giuliani held their Nov. 19 news conference at the Republican National Committee headquarters in Washington alleging they had overwhelming proof of fraud, including interference from foreign countries, the Trump campaign had handed over information-gathering for its legal challenges to outside parties, Miller told the Jan. 6 committee, according to a deposition transcript.
"Keep in mind, my team — when I say 'my team,' meaning the remnants of the campaign team that were still around — were relying on evidence that had been pulled by outside people. So it's not as though the inside campaign team was out doing the original research. They were just verifying the results," Miller said.
Internal emails reviewed by The Times that were sent between members of the various teams attempting to gather evidence show tips flowed in from across the county, as did requests for help checking machines for fraud. Others offered to produce affidavits, and Byrne said he paid for their travel and hotel stays.
Trimarco said his team filtered through the onslaught of information, vetting it and forwarding it to Giuliani, and eventually to White House trade advisor Peter Navarro. A 26-year-old White House staffer named Garrett Ziegler acted as a conduit.
At the time, Navarro was compiling a three-volume report on election fraud for state and federal lawmakers, Trimarco said. The Justice Department has charged Navarro with contempt of Congress for refusing to speak to the Jan. 6 committee. He claimed Trump had asserted executive privilege.
At Tomotley, Logan and Penrose also worked to triage the flood of tips coming in and tried to get access to voting machines in Georgia, according to emails reviewed by The Times and interviews with several people involved.
Byrne's team also processed fraud tips in Washington, where Byrne said he was occasionally asked to speak by phone with county officials or prosecutors to explain his theory about voting machine fraud. When Giuliani, Powell or their lawyers determined a county official was willing to let them examine election machines, Byrne's team would fly there in an attempt to access the machines or data.
"We were getting calls and information from Rudy and Rudy's people and Sidney that there were different government officials calling in and saying that they had smelled skunk and they thought something was up — and they would be willing to cooperate in an investigation, in a limited investigation," Byrne told The Times.
Several times, Byrne said, his team showed up to access machines in Georgia and no one seemed to know they were coming, or the permission to access machines in other states promised by the lawyers working for Powell or Giuliani never came through.
'It looked like a really easy win'
Since the 2020 election, news has emerged of local and county officials offering or providing third parties access to voting machines in Colorado, Michigan, Nevada, Ohio and Pennsylvania. Most states have strict laws dictating who can access voting machines and election data and why, in order to ensure the machines are not tampered with. State and federal officials in at least four states are investigating whether local officials violated those laws and provided unauthorized access.
Trump's attorneys keyed in on rural Antrim County, Mich., in its cross-country search.
On election night, the reliably red county had gone for Biden by about 3,200 votes. But the county clerk soon discovered she hadn't properly updated the machines before the election, causing an error that had cast some Trump votes for Biden. When the update was made, Trump won with 62% of the vote. County officials verified the total and certified the results. But Trump supporters still claimed the situation was evidence of fraud.
"It looked like a really easy win," said Merritt, the former employee of Ramsland's security firm. "You see a 6,000-vote shift that didn't make sense, so everyone's thought is, it's an easy win."
On Nov. 27, Byrne's Bad News Bears, along with Katherine Friess, a lawyer working with Giuliani, hopped on a private plane hired by Byrne and headed to Michigan. They did so at the request of a local businessman who was challenging the results of an ordinance to allow a pot shop to open in an Antrim County town, which passed by a single vote. Friess did not return requests for comment.
The team wasn't initially able to persuade county officials to give them access to the machines, but found a sympathetic woman at a precinct office, Byrne said.
"They went on their own to a different place and just talked to a precinct captain. And then that precinct captain gave them access to what she had," Byrne said.
Byrne said the woman, whom he didn't identify, let them photograph the paper records of data from election machines, which the cyber experts claimed showed evidence of fraud. A judge viewed the images as justification to issue a court order to have forensic images taken of Antrim County's election equipment on Dec. 6.
The team then took those electronic images and data to Washington and "cracked it" in a Trump hotel suite, Byrne said.
Trimarco said his team at the Westin wrapped up its work on Dec. 7 or Dec. 8. COVID-19 had swept through what was left of the staff at Trump campaign headquarters, and that office also closed, Trimarco said.
"By that point in time, at least from my perspective being on the Rudy team, the wheels were in motion to do the process on Jan. 6," he said, referencing the plan to have politicians challenge state results.
The resulting Antrim forensic report signed by Ramsland alleged a broad conspiracy to rig the election and claimed that Dominion Voting Systems' machines were "intentionally and purposefully designed" to mark ballots as faulty so election administrators could change the results.
A person who discussed a draft of the report by phone with Friess and those who worked on it told The Times that the Dec. 13 report that was made public included politicized language that made broad statements blaming Dominion for fraud that was not in that earlier draft.
Election experts pointed out glaring errors and omissions in the report, but the Trump team's theory that fraud occurred took root.
Former Attorney General William Barr told the Jan. 6 committee that Trump gave him a copy of the "very amateurish" report in the Oval Office on Dec. 14, with the president calling it "absolute proof" that "means that I'm going to have a second term."
Giuliani, Powell and Flynn shared the Antrim report widely on social media. A Senate report on the pressure Trump put on the Justice Department during that time shows Trump's assistant Molly Michael emailed a copy to Deputy Atty. Gen. Jeffrey Rosen with the subject line: "From POTUS."
The report was cited in the executive order that Flynn, Powell and Byrne asked Trump to sign Dec. 18, which would have allowed the Department of Homeland Security to seize state election machines and voting data.
And it again appeared in the first volume of Navarro's report, titled "Immaculate Deception," which relied on information the teams in Washington had gathered. The report claimed that elections in six states that were won by Biden were touched by fraud.
Reporters quickly pointed out that many of the claims in Navarro's report had been dismissed by judges or fact-checked and rejected by experts. But Trimarco said the point wasn't to convince judges: It was to persuade state and federal lawmakers that enough questions existed to warrant examining election results.
"If these election irregularities are not fully investigated prior to Inauguration Day and thereby effectively allowed to stand, this nation runs the very real risk of never being able to have a fair presidential election again," the report stated.
Trimarco said his team was looking for information that indicated an audit of particular state or county results was necessary, evidence that "would lead you to believe that, while not conclusive, [is] indicative that there may be some underlying problems in the election votes, the tally of the votes, the computers — anything that would mean that there should be a bottom-up audit on the vote starting from the registrations all the way through the casting of the vote, and then the counting of the votes and the tabulation."
In the final days before members of Congress met to certify the election results on Jan. 6, 2021, Ramsland's Antrim report and Navarro's reports were presented to state lawmakers as reasons to doubt or challenge election results.
The reports were also presented to Republican members of Congress and Vice President Mike Pence as justification for rejecting electoral college votes from several states Biden won.
Dozens of representatives and some senators who saw the information the ragtag team had collected were planning to challenge the electors in those states when Congress met to certify the election.
