I’m working on a few other things but wanted to capture a few details about the January 6 investigation.

John Pierce succeeds in hiring a new client from the COVID ward

Last week, I described how Ryan Marshall, an associate of John Pierce — the trial lawyer attempting to represent 17 January 6 defendants — claimed Pierce couldn’t be at a hearing for someone who would be his 18th because, “Mr. Pierce is in the hospital, we believe, with COVID-19, on a ventilator, non-responsive.”

After another hearing in which that associate, Marshall, showed up with few explanations, DOJ sent out notices to most of the defendants purportedly represented by Pierce, explaining the many conflicting explanations for Pierce’s absence offered in the last week.

The U.S. Attorney’s Office has had no contact with Mr. Pierce—by phone, e-mail, or otherwise—since Monday, August 23, 2021, when he appeared for a hearing before the Honorable Paul L. Friedman in United States v. Jeremiah Caplinger, No. 21-cr-342 (PLF). Since that time, the U.S. Attorney’s Office has heard conflicting information about Mr. Pierce’s health and whereabouts. The morning of Tuesday, August 24, Mr. Pierce was scheduled to appear before Judge Friedman for a status hearing in United States v. Nathaniel DeGrave, No. 21-cr-90. Mr. Pierce was not present at the hearing. Instead, Ryan Marshall—an associate from Mr. Pierce’s law firm who is not a licensed attorney—appeared in Mr. Pierce’s place and represented to the court that Mr. Pierce’s absence was due to a conflict. A few hours later, Mr. Marshall attended a reverse-proffer session with a different defendant represented by Mr. Pierce, telling the Assistant U.S. Attorney that he had just gotten word that Mr. Pierce had been in an accident and was on his way to the hospital. Mr. Marshall then proceeded with the reverse-proffer session in Mr. Pierce’s absence.

The next morning, August 25, Mr. Marshall again appeared in Mr. Pierce’s place at a hearing before the Honorable Amit P. Mehta in United States v. Shane Jenkins, No. 21-cr-245. At that hearing, Mr. Marshall represented to the court that Mr. Pierce was hospitalized with COVID19, on a ventilator, and non-responsive. After that information was reported publicly, a different individual reached out to an NPR correspondent and wrote that Mr. Pierce did not, in fact, have COVID, but instead “was hospitalized on Monday due to symptoms that he believed might be related to Covid-19”; “appears to have been suffering from dehydration and exhaustion”; and “remains under the care of his doctors[.]”3 On Thursday, August 26, Mr. Marshall again appeared before Judge Mehta in Mr. Pierce’s stead, this time in United States v. Peter Schwartz, No. 21-cr178. Before that hearing, Mr. Marshall told the Assistant U.S. Attorney that he had not had any direct contact with Mr. Pierce, but that one of Mr. Pierce’s friends had told him that Mr. Pierce was sick with COVID-19 and another had said he was not. During the hearing, Mr. Marshall requested, and was granted, a sealed bench conference at which to discuss Mr. Pierce’s condition. Later that evening, the same NPR correspondent reported that “[o]ne source close to attorney John Pierce tells me that [Mr.] Pierce is currently hospitalized, and has been diagnosed with COVID19, but firmly denied that he was ever placed on a ventilator.”4 Adding to the confusion, Mr. Pierce, who generally posts multiple messages to Twitter on a daily basis, has not tweeted since August 20.5 And there are reports that “multiple phone numbers for Pierce’s law firm, Pierce Bainbridge P.C., have been disconnected.” [my emphasis]

DOJ then declared all those cases to be “effectively at a standstill” and invited the respective judges to “take any steps [they] believe[] necessary to ensure that the defendant’s rights are adequately protected while Mr. Pierce remains hospitalized.”

Just as all these letters started to go out, the Notice of Attorney Appearance that Marshall had claimed had been filed on August 24, only dated August 30 and auto-signed by Pierce (who may or may not be on a ventilator), appeared in the docket for Shane Jenkins, the defendant at whose hearing Marshall first reported that Pierce was on a ventilator. Shortly thereafter a notice letter covering Jenkins went to Judge Amit Mehta, who had already received at least one for other Pierce defendants. It noted,

At an August 25, 2021, hearing before the Honorable Amit P. Mehta in United States v. Shane Jenkins, No. 21-cr-245 (APM), Ryan Marshall, an associate at Mr. Pierce’s firm, stated that Mr. Pierce now also represents Jenkins. A notice of appearance, purportedly signed by Mr. Pierce, was filed this morning (DE 22).

And with that filing, a man who may be incapacitated acquired an 18th defendant to represent.

WaPo has a good story on Pierce’s other shenanigans, including telling other defense attorneys that this is all a false flag operation and leaving one co-counsel unpaid.

“This whole thing was absolutely a false-flag FBI and intelligence community and military special operations set-up,” he wrote in a late July email to a group of lawyers coordinating defense efforts. The message was shared with The Washington Post. “I don’t [think] a single defendant should take any plea that involves one additional day in jail. At least that’s my mind-set.”

Another attorney replied, “John, can you explain more about how this false flag set-up worked? I’m unclear about the details of what you’re saying.” Pierce did not elaborate.

In another email chain discussing Capitol Police interviews, Pierce wrote, “THIS WHOLE THING WAS AN LEO/IC SET-UP,” referring to law enforcement officers and the intelligence community, “AND WE NEED TO WORK TOGETHER TO PROVE IT.”

[snip]

James Kelly, listed as co-counsel with Pierce in a Jan. 6 case, said Monday that he cut ties with the firm in June because he wasn’t paid, is withdrawing from the case and declined further public comment.

The December 17 cooperation update in the Oath Keepers investigation

Meanwhile, things seem to be progressing in the Oath Keepers case. As a reminder, there are four known cooperators in the case: Jon Schaffer, Mark Grods, Graydon Young, and Caleb Berry. In each, Judge Amit Mehta set a two month deadline for the first status report.

In the Schaffer case, the status report submitted on or before June 16 was quickly sealed; indeed, everything since his plea remains sealed.

In both the Graydon Young and Mark Grods case, however, the status report recently got filed.

In the case of Young, the notice similarly reported on ongoing cooperation, asked that Young’s release conditions be relaxed (to match those of other cooperators, though it doesn’t say this), and asked for December 17 to be the next status report in Graydon Young’s case.

The parties report that Defendant Graydon Young continues to cooperate with the government. We request the opportunity to file a further status report by December 17, 2021.

Defendant Young requests that the Court modify his release conditions, stepping him down from home incarceration to an appearance bond on personal recognizance, with the following conditions: not obtain a passport, surrender any passport, not possess any firearms or destructive weapons, not have any contact with co-defendants or associates or affiliates of the Oath Keepers, stay out of Washington, D.C., and notify Pretrial of any travel outside the Middle District of Florida. The government does not oppose this request.

In the Grods case, DOJ asked for the next status report to be due on the same day, December 17.

The parties report that Defendant Mark Grods continues to cooperate with the government. We request the opportunity to file a further status report by December 17, 2021

Berry pled guilty more recently, so his first status report isn’t due until September 21, two months after his plea.

None of this is all that surprising, but the fact that DOJ harmonized the next report date for Young and Grods, who would otherwise be a week apart, suggests DOJ thinks of that as a milestone in the Oath Keeper case. It may be tied to the first trial date for the conspirators, currently set for January 31, 2022. Or it may reflect some understanding of what the prosecutors think they have before them.

If it’s the latter, it says they’ve got four more months of investigation to complete before they’ll finish.

Update, September 18: The two sides have submitted a status report in the Caleb Berry case, and there, too, they’re asking for a December 17 report date.

“Zachary Studabaker’s” best-in-riot passwords

In a bid to delay trial for Zachary Alam, the guy who punched through the Speaker’s Lobby door with his bare fist, prosecutor Candice Wong gave an updated status on discovery for him (see this post on discovery provided to those who helped Alam break through the Speaker’s Lobby doors; Wong has sent Alam one, two, three, four, five, six). As part of that paragraph, Wong disclosed that the government is still trying to crack the passwords on multiple devices belonging to Alam.

The government has provided defense counsel with significant case-specific discovery, as outlined in seven discovery notices filed with the Court between March 26, 2021, and July 14, 2021. See ECF Nos. 10, 14, 17, 20-22, 24. The materials provided include videos encompassing surveillance footage from the U.S. Capitol Police, body-worn-camera footage from the Metropolitan Police Department, open-source videos posted on news and social media platforms, and videos obtained through legal process or voluntary productions in other Capitol investigations that depict the defendant. Case-specific discovery provided to the defendant also includes reports of interviews with civilian and law enforcement witnesses, grand jury materials, search warrant returns, subpoena returns, and jail calls. As the defendant was inside the Capitol for over half an hour, covered four floors, and had multiple interactions while he was there, the government continues to identify and produce additional case-specific materials. Also forthcoming are extractions of the multiple digital devices recovered from the defendant upon his arrest, for which law enforcement is still attempting to decrypt the defendant’s password protections.

The fifth discovery letter, above, describes four devices obtained via a warrant.

It’s not surprising that Alam would have pretty solid passwords. A detention motion in the case described that Alam used aliases…

Moreover, the defendant is known to have used aliases. Lawfully obtained records show that the defendant has provided multiple false names to service providers, including at least one false name – “Zachary Studabaker” – for services since the events of January 6, 2021.

Stolen license plates…

In addition, according to the government’s information, the defendant was at the time of his arrest driving a vehicle that he had purchased around September 2020 but never registered, and for which the defendant had used multiple license plates, including in recent months. These include a Washington, D.C. license plate, found inside the defendant’s vehicle in Pennsylvania, which was reported stolen in 2018 by an individual who indicated that the front license plate was taken off his vehicle while parked in Northwest D.C. D.C. traffic cameras captured a black Chevy truck matching the description of the defendant’s vehicle bearing this license plate as recently as January 4, 2021. Moreover, when agents located the defendant at the motel in Pennsylvania, they observed the defendant’s black Chevy truck parked outside and noted that it bore Pennsylvania license plates for a Mazda vehicle.

False identification…

Upon arrest, moreover, the defendant had multiple identification cards in his wallet, including a D.C. driver’s license and a D.C. identification card for one male, a Permanent Resident card for a second male, and University student identification card for a female.

Burner phones…

Among the items agents seized from the defendant’s motel room nightstand, moreover, were two mobile phones – a Verizon flip phone as well as an iPhone.

[snip]

For “Sun 1/10/21,” the defendant had written “activate burner,” indicating that four days after the events at the U.S. Capitol, he began using a “burner” phone. That “burner” appears to refer to the Verizon flip phone that agents recovered, as executing agents photographed a receipt dated January 10, 2021, for a “Verizon” phone paid for with $65.13 in cash at a Walmart in Pennsylvania.

Cryptocurrency…

The defendant’s other notes from January 10 referred to his intent to “buy crypto[currency]” and “consolidate crypto,”

[snip]

Meanwhile, on “Wed 1/13,” the notes indicate that the defendant planned to “buy CRV on Binance,” an online exchange for trading cryptocurrencies.

[snip]

He also wrote on another page, “Research security (location intelligence)” and “Research how to launder BTC [bitcoin]” right above notes that likewise appear to concern January 6: “Wanted a civilized discussion w/ our representatives but the door wouldn’t open” and “Call out Pence – should have been over.”

And (a poorly implemented) VPN…

Indeed, in a jail call he made on February 21, 2021, the defendant told an individual that he believed he had been tracked down by law enforcement through GPS on his phone and complained that he had downloaded “VPN on my phone” and “got IP Vanish” but that it was “a bullshit service”; “I tried to make that thing run all the time, and it just shut off like randomly sometimes… They can’t f–ing have the VPN running 24 hours? Basically the same thing as not having it… That’s how they figured out my general location.”

But that’s the thing: Alam was using a great deal of operational security. But when it came down to it, he used a free VPN and had his burner phone sitting on a nightstand right next to his smart phone. He was attempting to use operational security, but he was botching it at every opportunity.

And yet the FBI has not yet cracked passwords on multiple — at least two — of the four devices they seized from him, after arresting him seven months ago. FBI has had limited difficulties getting into January 6 defendants’ phones (the most notable of which was solved when they forced Guy Reffitt to use his face to open his Surface Pro), and there are suspects — including two charged suspects and one who fled bail — who have spent longer periods than Alam as fugitives. But this detail seems to suggest that Alam has the best passwords among the 600 January 6 defendants.