(CNN) Three weeks into the Arizona Senate's unorthodox audit of the 2020 presidential election results, one potential winner seems to be emerging, regardless of any count: Cyber Ninjas, the Florida-based consulting firm being paid to lead the analysis of the votes in populous Maricopa County.
Private fundraisers have boasted that they're funneling hundreds of thousands of dollars to the effort led by the security consulting firm, a company not previously known for election auditing. But there's little or no scrutiny on where that money is going or how it's being used.
A CNN review of state records shows no contractual provisions or safeguards controlling how much money Cyber Ninjas can accept from private contributors, how it can be spent, or even whether it needs to account to the Senate for those funds.
In fact, the Senate's spokesman for the audit acknowledged that the Senate isn't exercising any oversight or control over Cyber Ninjas' use of the private funds, which are expected to support the majority of the auditing efforts. The way the funding for the work is structured appears to skirt state transparency laws, CNN's review found.
Meanwhile, with few restrictions on the scope of its work, Cyber Ninjas, which presents itself as primarily focused on application security, has dived into baseless conspiracy theories, such as looking for bamboo traces in ballots to determine whether ballot boxes were stuffed with fraudulent votes from an unknown Asian country.
Along the way, it has made fundamental blunders in the way election audits are traditionally conducted, such as initially providing workers with blue-ink pens that can alter how tabulators read ballots; security lapses that allowed people access to what should have been secure areas before the audit began; allowing a former lawmaker who appeared on the ballot to be involved in verifying them; and planning door-to-door canvassing of voters before the Department of Justice warned such a move could violate federal laws against voter intimidation. Senate President Karen Fann, a Republican, told the DOJ that the Senate would "indefinitely defer" the planned canvass.
The GOP-controlled Arizona Senate allocated $150,000 to the audit, one third paid up front. But that money was expected to cover just a fraction of the work. Now, as state officials project that the audit will continue into the summer, with just 500,000 of the 2.1 million ballots hand-counted to date, the costs keep climbing.
To fuel that effort, Ken Bennett, the Senate's audit liaison, Fann and others have welcomed private donations. And Trump supporters and conspiracy theorists have jumped in, publicly stumping for funds and claiming to have funneled more than $1.6 million to the audit, while offering scant information about where that money is flowing.
Having the audit funded by "undisclosed private money, especially from people who back conspiracy theories about the conduct of the 2020 election, is extremely worrisome," said Rick Hasen, author of "Election Meltdown: Dirty Tricks, Distrust and the Threat to American Democracy." "It suggests those people are funding this because they want to see a particular result."
Two prior publicly-funded audits of Maricopa County ballots and election machinery used in the November election found no evidence of widespread fraud or voting irregularities. President Joe Biden won Arizona by 10,457 votes, his narrowest margin of the states he won.
Even as Fann and other audit leaders say they're focused on improving future elections, former President Donald Trump and his allies -- including some Arizona legislators -- are treating the audit here as, in effect, the first domino in amplifying claims of electoral fraud in states such as Pennsylvania, Michigan and Wisconsin, among others.
On a local TV program May 5, Fann said first that the audit is "not about overturning the election;" then, a minute later, added, "I think we're going to find some irregularities, that it's going to say... 'yeah, there's this many dead people that may have voted, or this many people that voted that don't live here anymore.' We're going to find those. We know those exist."
Arizona law covering state bodies that receive public and private funding requires the recipient to report the sources of the private donations and any strings attached; to deposit private funds in a separate account with the State Treasurer; and to account for every expenditure with the state's Department of Administration.
In this case, however, the Senate is arguing that the audit isn't subject to these provisions -- because the donations are being channeled straight to Cyber Ninjas. The Senate's attorney, Greg Jernigan, told CNN in an email that the state's funding law doesn't apply because the Senate, itself, is not accepting the private funds.
Bennett, the state spokesman for the audit and a GOP politician who served as Arizona's secretary of state from 2009 to 2015, said that the release of the total cost "is really not the Senate's responsibility." He said it's up to Cyber Ninjas whether to disclose how much in funds it's receiving and from where. So far, Cyber Ninjas has not done so, nor responded to CNN requests for that information. Bennett did say, "we're working on it."
"They are receiving money from opaque sources, and they are not disclosing that money," David Becker, a former voting-rights attorney at the U.S. Department of Justice and executive director of the nonpartisan Center for Election Innovation & Research, said of the Senate. "They can say it isn't coming to the Arizona Senate, but they're facilitating it; this would never have happened but for the Arizona Senate." Becker said it should be concerning that the Senate "handed ballots over to an inexperienced out-of-state firm and then said, 'fundraise off this, get as much money as you can.'"
The people ostensibly fundraising for the audit and/or saying they've made contributions include, at a minimum:
The state Senate could have put up more of its own funds or perhaps paid entirely for the audit. As first reported by the Arizona Mirror, thanks to spending far less during the pandemic, the Senate entered May with $8.1 million in unspent funds for the fiscal year that ends June 30.
In an interview Wednesday, Bennett said the Senate's purpose in relying on private funding for the audit is "to save taxpayer money, not hide where the funding came from, but you and others may assume different."
Bennett said that the sources of the funding don't affect the work of the audit.
By taking itself out of the process of accepting the funds, the Senate has bypassed the transparency requirement in the state's public finance law, ARS Sec. 35-149, which requires it publicly identify the sources of money being used on government-sponsored projects.
"Obviously, the spirit of the statute is being violated," said Jim Barton, general counsel for the Arizona Democratic Party. "The statute is about transparency and making sure that just what is happening right now doesn't happen... when the money isn't actually received by the government entity, but everyone knows, wink, wink, nudge, nudge, we're going to give it to Cyber Ninjas to get the work done."
Even before the audit began, critics questioned the choice of Cyber Ninjas, whose CEO, Doug Logan, repeatedly tweeted in support of the Stop the Steal movement and claimed the election had been rigged against Trump. Arizona Democrats sued over whether voter information, machines and ballots were being adequately protected; the news media sued to gain access to the audit, after initially being blocked from observing; Cyber Ninjas fought in court unsuccessfully to keep its audit processes secret.
While Fann said the audit will improve future elections, the GOP-controlled Arizona legislature hasn't waited for its outcome to move forward on bills making it harder to vote, including one signed into law by Gov. Doug Ducey May 11 that purged infrequent voters from permanent early voting lists.
Becker, the voting-rights attorney, called the audit corrosive. "It's fueling the false beliefs of those who don't believe the election was secure, and fueling the idea that elections are never truly over."
On Thursday, Cyber Ninjas paused its review of ballots until May 24, temporarily removing them from the Coliseum at the state fairgrounds to make way for 16 high school graduations, a yearly event at the Coliseum that the Senate somehow overlooked. Bennett said the ballots would be kept under 24-hour guard at the Wesley Bolin Building at the south end of the fairground's premises.
Bennett said that guards would be posted to keep people visiting the fair's Crazy Times Carnival, being held between the Coliseum and the Bolin Building, from accessing the area where the ballots were to be housed. They're needed since the outside section of the building is being used for the carnival's public toilets.