DENVER – Former Mesa County Elections Manager Sandra Brown, who was fired for her involvement in the breach of the county’s elections system last year, was arrested this week on two felony counts, and her arrest affidavit contains new details about the conspiracy theorists involved in making hard drive images of the elections machines.
The Grand Junction Daily Sentinel first reported Brown’s arrest and the new details contained in the affidavit and arrest warrant on Tuesday. Denver7 obtained the affidavit and warrant on Wednesday morning.
Brown was fired in November and blocked from participating in Mesa County elections because of her involvement in the May 2021 breach of the elections system, which prosecutors allege was coordinated by Mesa County Clerk and Recorder Tina Peters as part of her quest, along with other conspiracy theorists, to show there were irregularities and fraud in the 2020 election – which she still has never proven.
Court records show Brown was arrested Monday and had an advisement hearing on Tuesday afternoon. Her arrest warrant carries charges of conspiracy to commit criminal impersonation – gain a benefit (class 6 felony) and attempt to influence a public servant (class 4 felony).
Records show Brown is set to be formally charged on July 28 in Mesa County District Court. She had a $15,000 personal recognizance bond set in the case.
Affidavit details more complete timeline of breach
The arrest affidavit was compiled and written by 21st Judicial District Attorney’s Office Investigator James Cannon, who has more than 18 years of law enforcement experienced and thousands of hours of training regarding election crimes and cell phone and computer investigations.
The affidavit further details the exact timeline in which Peters, Brown, and Deputy Clerk and Recorder Belinda Knisley, who was also indicted in relation to the breach, facilitated the copying of the hard drive images, and includes information about others who were involved from other states whose identities were not publicly released previously.
Some of the new details come from a proffer session Knisley had with investigators in June, according to the warrant.
The Colorado Secretary of State’s Office first started telling counties in April 2021 when their “trusted builds” of their elections systems – upgrades to the elections software – would take place, and telling them about the rules about who was allowed to participate — which in Mesa County was only required personnel from Dominion Voting Systems, which were the systems the county was using, personnel from the Secretary of State’s Office, and necessary county employees.
The trusted build was to be videotaped, and the room in which the systems were contained was typically kept under 24/7 video surveillance.
According to the affidavit, some of the planning of what would eventually become the security breach occurred at an April 23 meeting in Peters’ office, which someone at the meeting secretly recorded and provided the audio to investigators.
Those in attendance included Peters, Knisley, Brown, county elections director Brandi Bantz, and front office elections manager Stephanie Wenholz from Mesa County. Also in attendance, according to the affidavit, were Sherronna Bishop, who is Lauren Boebert’s former campaign manager, Douglas Frank, an Ohio-based conspiracy theorist who has falsely claimed an algorithm changes vote totals in the U.S. and whose claims have widely been debunked, and Maurice Emmer, a former Aspen mayoral candidate who has also espoused election conspiracy theories.
Peters asked Bantz and Wenholz to leave the room at some point in the meeting but did not ask Brown to do the same. But what was recorded during the meeting included Frank asserting the Dominion machines were “likely accessible remotely,” telling Peters she could not legally open the voting machines, and Bishop asking, “When they come, what’s the plan?” in regard to the upcoming trusted build a month later.
The affidavit says Peters asked Frank if he wanted to attend the trusted build, and Bishop claimed "they’re gonna wipe the machines.”
Frank responded: “I don’t think I’m your guy to do that audit, but I know the team and they’ll do it for you and they’ll come in with the best in the country,” according to the affidavit. It was after that statement that Peters asked Bantz and Wenholz to leave the room.
Over the next week, the Secretary of State’s voting systems manager, Jessi Romero, emailed county clerks about specifics on the trusted build and reminders about who would be allowed to participate and what else they should do in preparation.
That included backing up election projects, which does not involve making any hard drive images, according to the affidavit.
Prosecutors allege Gerald Wood’s identity was stolen
About two weeks later, on May 13, Knisley and Peters initiated the cover story to get an unauthorized person into the upcoming trusted build, according to the affidavit, using a Garfield County man named Gerald Wood as a foil. “Wood’s” involvement in the breach was previously documented in investigations by the Secretary of State’s Office and law enforcement, but he has since been cleared of wrongdoing, according to the affidavit.
Knisley told Mesa County HR they were hiring Wood as a temporary employee for the elections department and asked them to create a security badge and county email address for him. The next morning, Peters called Wood and they spoke for six minutes before Knisley later that day asked for Wood’s badge access to be the same as Brown’s, who was the back-office elections manager.
On May 17, Peters and Brown were seen on surveillance video footage inside the Tabulation Room looking at the surveillance cameras and taking pictures of them, according to the affidavit. It was around that time that the cameras were turned off. That same day, Wenholz, who was supposed to be involved in the May 25 trusted build, was told she would no longer be participating. She was also asked that day to complete a background check on Wood, though she said that his was the only check she was ever asked to do out of nearly 200 in which she never met the applicant in person or saw their HR paperwork.
“According to Wenholz, the manner in which she was requested to perform Wood’s background check was entirely different from all other checks she performed in her position,” the affidavit says.
Brown represented in an email to Romero and Knisley that Wood was an administrative assistant and would be participating in the trusted build, though that job was never posted until June 4.
On May 19, according to the affidavit, Knisley texted Wood to come to the DMV window and ask for her. At that meeting, Knisley took the security badge Wood had been issued, and Wood never did any work for the Elections Department. At one point, Wenholz had asked to meet Wood, but she told investigators she believes Brown and Peters said Wood’s employment was “not going to work out.” Neither she nor Bantz ever saw Wood in the Election Department.
Conan Hayes flown to Mesa County from Grand Junction
And on May 20, investigators found, Bishop’s credit card was used to buy hotel reservations for someone called “James Hayes” in Grand Junction from May 22-26.
But prosecutors say that was a fake name and that the man who actually came to Grand Junction and stayed in the room was a California man named Conan Hayes – a former professional surfer from Hawaii and successful businessman of companies like RVCA – who worked for former President Trump’s legal team that was protesting the 2020 election results. The New York Times first reported his involvement based off a conversation with Patrick Byrne, a former executive who has provided money to Peters’ legal defense fund.
According to the affidavit, investigators discovered Hayes was the person involved by following his cell phone and flight records from California to Mesa County on May 22.
The next day, Sunday, May 23, the key cards for Peters, Wood and Brown all accessed the elections building. That was the same day that someone illegally took the first elections system hard drive image, which Peters admitted was true.
That image was the one that ended up being leaked on far-right websites online and discussed by MyPillow conspiracy theorist Mike Lindell, which led to the initial breach investigation last year.
The trusted build occurred as scheduled on May 25 and 26, attended by Peters, two Dominion staffers, a Secretary of State’s Office employee, Brown, and the person claiming to be Gerald Wood.
But that evening, Peters’ and Brown’s key cards accessed the elections department again between 5:30 p.m. and 7 p.m. Investigators discovered that someone took the second illegal hard drive image of the voting machines around 5:43 p.m. that day.
Hayes had already left Mesa County by that point, according to phone data and flight records, the affidavit says.
But the next day, May 27, Mesa County Recording Manager Kelly Bryant shipped something from Tina Peters to Conan Hayes in California. She told investigators that Brown handed her an object wrapped in plastic and Peters told her to ship the object to an address in Aurora Hills, Calif., that Peters had been sent in a text message.
Further investigation by the FBI and Mesa County IT found someone used software to capture data and internet traffic from the Mesa County Computer Network and that Brown’s credentials were used during the process. County employees are not allowed to share passwords, skirt data protections, or violate licensing agreements.
Cannon, the DA’s Office investigator, wrote in the affidavit that investigators discovered in February 2022 that “the defendants used Wood’s identity for another person who was not Wood.”
“While Peters was using Wood’s identity, additional crimes were committed/completed,” the affidavit says.
It says Cannon found probable cause that Brown “assisted and conspired” with the overall scheme and crime of copying the hard drives, and that she misrepresented Hayes’ identity and role to copy the hard drives by using Wood’s identity.
“Brown’s actions, statements, and/or inactions were a (successful) attempt to influence the public servant’s decisions and actions before and during the Trusted Build through Sandra’s misrepresentation,” the affidavit says. “Wood is no longer a target of the investigation. The person who completed that computer service using Wood’s identity is still under investigation.”
Neither Hayes nor Bishop had been charged with any crimes as of publication of this story.
Belinda Knisley’s proffer session
Knisley was suspended last August and barred from being at work or performing work for Mesa County, and was later criminally charged with second-degree burglary and cybercrime after she was allegedly at a county building and using Peters’ computer two days after she was suspended.
She was then indicted, alongside Peters, in March on three counts of attempting to influence a public servant; one count of conspiracy to commit attempting to influence a public servant; violation of duty; and failing to comply with the secretary of state tied to the elections security breach.
Brown’s affidavit says that in June, Knisley agreed to a proffer session – essentially cooperating with an ongoing criminal investigation – and told investigators and Cannon that it was Peters who told her to lie to Mesa County HR about Wood, and that Peters was bringing in an outside consultant to perform the work she was saying Wood would do.
Knisley also told investigators that Peters told her “that they needed to protect the identity of the person who was actually coming in, instead of Gerald Wood, and this was the reason for turning off the cameras,” as the affidavit states. She said she later learned that person was Conan Hayes.
The Colorado Times Recorder reported Wednesday Peters said at a right-wing sheriffs conference in Las Vegas Tuesday that after making the first image, Hayes ate dinner with her, Bishop, and Rep. Lauren Boebert.
A spokesperson for Boebert's U.S. House office said in a statement Thursday that Boebert "is not aware of ever having met with the person who allegedly took images related to Tina Peters' indictment and never encouraged such images to be taken."
"Any claim to the contrary is false," the spokesperson added.
Knisley also told investigators that Brown would have known Wood was not a real Mesa County employee, and that she told Brown to tell the Secretary of State’s office that Wood would be participating despite his actual identity being someone else.
Brown also had to finish making the second hard drive image “because Conan had to leave,” the affidavit says, citing what Knisley said during the proffer session.
“Knisley conceded that the key card badge, ‘admin assist’, using Gerald Wood’s identity, and the cameras being turned off was all part of the plan, ‘that was [their] goal to hide it from SOS’ regarding who was actually in the room of the trusted build,” Cannon wrote in the affidavit.
Peters was again barred from overseeing Mesa County’s primary election in June, as she was the 2021 election, and she was handily defeated – by 14 percentage points by Pam Anderson – in the Colorado Secretary of State’s Office Republican primary. The day after the primary, when it was mostly obvious she had lost, she tweeted out another election conspiracy theory about the primary.
A report from the Mesa County District Attorney’s Office released in May found no evidence that there was outside interference in the 2020 or 2021 elections, as Peters and the others have claimed.
