COGOP Unified Forensic Briefing

Current and former party officers coordinated to remove the sitting chairwoman through the party secretary. This examination cross-referenced 2,355 emails, administrative audit logs, court filings, and public records. Eight procedural violations were identified. The deleted communications, recovered from Google Vault, are cited below with Gmail message IDs and timestamps.

The email record documents coordination between a former chairman who holds no current party office, the current Secretary, the former Secretary, and the outgoing Vice-Chair regarding the removal of the current chairwoman. Their roles are documented in their own emails.

Evan Morris (Vice-Chair, Garfield County GOP) — Andrews’ personal assistant and email editor. Maintains the Red Book on Andrews’ behalf, paid at “the TCFG rate” from Andrews’ private professional rate structure. Edited the “AIRING DIRTY LAUNDRY” drafts. Same county as Andrews.

Julie & Chuck Bonniwell — RRC content and media. Julie is a 3x Emmy journalist (KMGH-TV, KDVR Fox-31). Chuck is a former trial attorney and publisher. Co-hosts of the “Chuck and Julie Show” podcast. Provide the professional media production for RRC’s newsletter operation.

Cody LeBlanc, Bridget Hulcom, Jeremy Goodall — meeting operations team for the February 21 session.

Ferguson served as Secretary under Williams. When Williams’ administration ended, Andrews was elected to the same role Ferguson vacated. Andrews now coordinates with both Williams (former Chair) and Ferguson (former Secretary) to remove Horn (current Chair). Two of the three executive officers serving under Horn — Andrews (elected March 2025) and Holtorf (elected July 2025 to fill a vacancy) — are documented in contact with the previous administration regarding the removal effort.

On March 29, 2025, the Colorado Republican Party held its leadership election. Brita Horn was elected Chair. Russ Andrews was elected Secretary. Darrel Phelan was elected Vice-Chair. Dave Williams’ chairmanship ended. Phelan resigned in June 2025 after approximately 2.5 months. Richard Holtorf was elected to fill the vacancy in July 2025.

Between March 4 and April 1, the following events were recorded in the Google Workspace administrative audit logs.

In March 2025, the outgoing administration systematically deleted 200 GB of Colorado GOP workspace data — emails, documents, calendars — across 19 accounts. Access was delayed 20 days, exceeding Google's recovery window. The 60-Day Report documented this in full and is public record.

Nineteen user accounts deleted: personal accounts (Shana, jon, eric, darcy, liz, Patrick, anna, hope, greg, Tom) and organizational infrastructure (electionsecurity@cologop.org, Volunteer@cologop.org, mail@colo-gop.org). Deleted by three actors across two domains: dave@cologop.org (12 accounts on the original domain), dave@colo-gop.org (3 accounts after the domain transition), and info@colo-gop.org (2 accounts, including Williams’ own). When it was done, one account remained active out of eighteen: info@colo-gop.org.

The deletions occurred across four dates: three accounts on March 4, two on March 26, seven on March 30, then four more overnight into March 31 on the new colo-gop.org domain. The last deletion was April 1.

The deletion rate for Williams-related emails was significantly higher than the overall mailbox rate.

The emails documenting the coordination — the Official Call, the strategy correspondence, the "Dirty Laundry" email — were all removed. The emails remained in Google Vault under litigation hold. Each is cited by Gmail ID in Act III.

On March 30, midway through the mass deletions, the workspace underwent a domain transition. The organization's primary domain shifted from cologop.org to colo-gop.org. All email accounts, settings, and administrative controls migrated to the new domain name.

The administrative actions were: admin role removed from info@cologop.org at 19:06 UTC. Primary admin transferred to dave@colo-gop.org at 19:55 UTC. Admin role assigned to info@colo-gop.org at 21:58 UTC. Primary admin transferred to info@colo-gop.org at 22:28 UTC. A six-hour gap separated the last action on the old domain from the first action on the new one. Then info@colo-gop.org deleted dave@colo-gop.org.

Before the mass deletions, on March 9–10, four OAuth clients — third-party applications granted access to Gmail data — were authorized for "Data Migration (New)" — Google's built-in tool for copying email data between systems. The authorization happened over an eight-hour window. Nineteen migration operations were recorded: 4 setup, 4 start, 3 report downloads. All authorized by dave@cologop.org.

Three of the four clients were granted full Gmail access: modify, insert, readonly, labels, compose. As of May 28, 2025, all four OAuth clients remained active with domain-wide delegation and Gmail scopes intact.

Google allows 20 days to restore deleted user accounts. After that, the accounts and their data are permanently gone.

The last account deletion occurred on April 1, 2025. Google's 20-day recovery window would expire on April 21. New leadership received workspace access on April 20 — day 20. One day before the window closed.

By the time the examination began: “Recently deleted users: No users match your current selection.” Recovery count: zero. One active user out of 18 licensed accounts. 5.6% utilization. The deleted accounts included electionsecurity@cologop.org, Volunteer@cologop.org, and mail@colo-gop.org.

This document exists because of a security review — a routine examination of the party’s Google Workspace infrastructure during the leadership transition.

The emails were deleted from Andrews' inbox. They remained in Google Vault, where litigation holds had been activated during the security review. Each email cited in this briefing is reproduced with its original headers, timestamps, recipients, Gmail message ID, and content.

This is what the new leadership inherited: a workspace with 200 GB of deleted data across 19 accounts, a primary domain that had been transferred, OAuth (third-party access) tokens still connected, and a 20-day recovery window that was one day from expiring when access was granted. The 60-Day Report (public record) documented the deletions. The coordination that followed — documented in the next section — used the party’s own email accounts.

Between February 7 and February 16, 2026, six documented events occurred involving overlapping participants. The evidence for each is drawn from emails, audit logs, and public records — much of it deleted from party accounts but preserved through forensic extraction.

On February 21, 2026, members of the Colorado Republican State Central Committee held a special meeting to vote on three measures against Chairwoman Brita Horn: suspending her spending authority, ceasing party litigation, and a motion of no confidence calling for her resignation. All three passed with 90–94% support from those voting.

246 members were credentialed for a two-hour meeting. The organizing team tested the Zoom infrastructure daily for two weeks. A petition was circulated statewide. A YouTube live stream was set up independently from official party channels. The resulting no-confidence vote has no provision in the bylaws. The spending vote invoked authority that belongs to a different body. Removal was not attempted — it requires 302 votes and only 246 were present.

One member stated on the record:

The meeting was called by Secretary Russ Andrews under Article VII, Section D(3) of the COGOP bylaws, which allows a special meeting upon written request of one-quarter of voting members. Andrews also chaired the meeting. It was held over Zoom — not on the official COGOP Zoom account, but on infrastructure provided by an entity called CB Strategic Consulting. The meeting was live-streamed on YouTube (2:09:29 runtime).

Andrews appointed every operational role for the meeting.

RUSS ANDREWS — Secretary / Acting Chairman
├—— CODY LEBLANC — Teller Committee Chair
│   ├—— Controlled all polls (launch, timing, close)
│   ├—— Controlled all muting/unmuting
│   ├—— Operated YouTube live stream (CB Strategic)
│   └—— 2 weeks daily testing (3-6 sessions/day)
├—— BRIDGET HULCOM — Credentials Committee Chair
│   ├—— Controlled who was credentialed
│   ├—— Managed waiting room admissions
│   └—— Phone: 970-371-7598 (shared publicly)
├—— JEREMY GOODALL — Parliamentarian / Temporary Chair
│   ├—— Ruled on procedural questions
│   ├—— Took over chair during Andrews' speech
│   └—— Corrected procedural errors (motions out of order, debate time)
└—— ANNA FERGUSON — Recording / Chat Management
    ├—— Managed Zoom chat
    ├—— Recorded meeting (NOT taking formal minutes)
    └—— Operator of Restore REAL Colorado

During his six-minute speech, Andrews handed the gavel to Goodall as Chairman Pro Tem. When Andrews finished and asked for the gavel back, Goodall declined, stating it was “more appropriate for me to conduct business from this point on.” Goodall chaired for approximately 23 minutes before eventually returning control to Andrews for the final credentials vote and adjournment. All four operational roles were held by people Andrews appointed.

Five people ran the meeting. All were appointed by Andrews.

The February 21 meeting followed a sequence where each step depended on the one before it. Some of these steps used legitimate bylaws mechanisms. Others are disputed. And some of the legitimate steps were carried out by a single person who held conflicting roles.

Step 1: The Petition

What the bylaws say: One-quarter of voting members (126 of 502) can petition for a special meeting. The petition must use “a form to be developed and authorized by the Secretary.” The Secretary “shall have authority to verify any signature or other indication of assent.” (Art. VII, §D(3))

What happened: Raymond Garcia circulated the petition and collected signatures. Andrews, as Secretary, verified the signatures and confirmed the petition met the threshold.

Step 2: The Challenge

What the bylaws say: “Any such meeting request may be challenged by any voting member and such challenge shall be heard and determined as provided by Article XV.” Critically: “If the meeting request has been challenged before the Executive Committee, the period for issuing the call shall be extended while the challenge is pending (including any subsequent appeal from the Executive Committee).” (Art. VII, §D(3))

What happened: Horn’s Executive Committee declared the petition “irregular” — a challenge under the bylaws. Under the provision above, this should have extended the deadline for calling the meeting while the challenge was resolved.

Step 3: The Meeting Call

What the bylaws say: If unchallenged, “the meeting shall be called by the Chairman within ten days.” If the Chairman fails to call it, “any voting member may issue the call.” The Secretary can call meetings only “in the event when both Chairman and Vice-Chairman are absent or unable to act.” (Art. VII, §D(2)–(3))

What happened: Andrews issued the meeting call before the EC’s challenge was resolved. The petitioners’ position is that Horn failed to call the meeting within the required time, forfeiting her authority. Horn’s position is that the EC challenge extended the deadline, so she had not yet “failed” to act.

Step 4: Who Chaired

What the bylaws say: The Chairman shall “Issue the call and preside at all meetings of the CRC and the Executive Committee.” (Art. V, §B.1.b)

What happened: Horn was not present. Andrews chaired the meeting. He appointed all committee positions (LeBlanc, Hulcom, Goodall, Ferguson), controlled the agenda, and temporarily handed the gavel to Goodall during his own roughly six-minute speech. When Andrews finished and asked for the gavel back, Goodall declined, stating it was “more appropriate” for him to continue chairing. Goodall chaired for approximately 23 minutes — through the amendment debate and vote — before eventually returning control to Andrews for the final credentials vote and adjournment.

At this point, one person — Andrews — had verified the petition, called the meeting, chaired the meeting, appointed all the supporting roles, and was about to deliver the speech making the case against the Chair.

Step 5: The Votes

Every vote taken at this meeting depends on the meeting having been properly called. If the meeting call is disputed, the authority of the votes is disputed.

The meeting was hosted on a Zoom account belonging to CB Strategic Consulting and live-streamed on their YouTube channel. No public record of this entity exists.

Dave Williams was not part of the operations team. He did not chair the meeting, run the polls, or manage credentials. But he was on the call — and Andrews recognized him by name from the chair.

Williams spoke three times during the meeting, all on the budget suspension item. He did not speak on the no-confidence vote, the cease-legal-action vote (which involved parties connected to the organizing effort — Ferguson was a co-plaintiff in the El Paso County case, Klenda a defendant), or the bylaws amendment. All three statements concerned practical fiscal questions about keeping the caucus and assembly running.

He proposed practical amendments, was gracious when asked to modify them, calmed confusion, and kept things moving. Other members deferred to him — Holtorf referenced “extraordinary circumstances as Mr. Williams mentioned”; Cherry Porter said “Dave just said what I was going to say.”

Meanwhile, his coordination with Andrews before the meeting — 14 emails, 86% (12 of 14) subsequently deleted — and his direction to Ferguson to include the removal question on the petition form are documented in the prior acts.

The Federal Employment Question

Public reporting and Williams’ own social media confirm the picture. On February 28, 2025, the Colorado Springs Gazette reported that “Republican sources told Colorado Politics that Williams has landed a job with the Trump administration but couldn’t provide specifics.” Williams’ Facebook profile now provides those specifics: he lists his current position as Senior Advisor, International Trade Administration (ITA), Department of Commerce, effective July 1, 2025. His bio reads: “Senior Advisor to the ITA at Trump #47.” This is a political appointee role. The ITA is headquartered at 1401 Constitution Ave NW, Washington, DC.

Williams’ Facebook still lists his location as “Colorado Springs, CO” — it does not confirm a move. However, Senior Advisor roles at federal agencies typically require physical presence in Washington. Inference He likely maintains a Colorado Springs address while working in DC. His voter registration remains active at the same Colorado Springs address the Red Book lists.

Williams is a federal political appointee who took a position in Washington, DC, while continuing to coordinate state party removal operations via email (documented: proxy responses on behalf of Andrews, petition forms to county chairs, all from repdavewilliams@gmail.com).

After the meeting formally ended, the YouTube stream kept running. Participants discussed their strategy for the next meeting openly, not realizing they were still being broadcast.

What they discussed: attend Horn’s March 2 SCC meeting, then hold their own meeting on March 3 and vote on the same three agenda items again.

CB Strategic Consulting already has a live stream scheduled for March 3.

The Removal Math

Removal requires 302 yes votes (3/5 of all 502 members). 246 were credentialed. Removal was not attempted. See Act V: The Math for the full accounting of what this meeting cost and what it produced.