December 1, 2021 / by emptywheel

 

How Google’s GeoFence Captured “Lions Not Sheep” Lisa Homer

Over the course of the January 6 investigation, I have repeatedly looked at the role several geofences — warrants collecting the identifiers of those who accessed cell sites in the vicinity of a crime — have played in the investigation. The FBI has relied on such geofence data from at least AT&T and Verizon (a recent arrest affidavit revealed that there were “significantly fewer devices in the T-Mobile data” from that day “than the company would expect”), as well as Google. There’s reason to believe the FBI obtained similar data from Facebook, perhaps identifying all those who livestreamed from inside the Capitol, but the scope of the collection time and place of that data remains obscure.

I’d like to revisit that discussion as part of a review of the arrest affidavit for Lisa Anne Homer/Boisselle. She was charged on November 15 with just trespassing, and arrested Monday, two weeks during which she may have been under close surveillance.

A word about her trespassing charges. In the initial days after the riot, FBI was arresting the people who most visibly mugged in videos, whether or not they had engaged in violence. In the days after the riot, FBI Director Christopher Wray explained that they were using arrests to understand the extremist networks they had missed before the attack.

The more arrests we make, the more from those cases we learn about who else their contacts are, what their tactics are, what their strategies are, et cetera. And that makes us smarter, better able to get in front of the threat going forward.

In many cases, those initial trespassing charges would lead to far more serious charges.

The number of trespassing arrests has significantly tailed off since then (and if DOJ believes these misdemeanors have a one-year statute of limitation, it will stop altogether next month). Indeed, for many of the more recent trespassing arrests, the FBI seems to have a specific purpose in arresting the people. Very often, the arrest affidavits focus on photos or videos the defendant obviously took during the insurrection. In some cases, the FBI seems to be looking for footage that might show what more serious participants did that wasn’t fully captured by CCTV. That’s definitely true of the events leading up to Ashli Babbitt’s shooting, and seems to be true for Kelly Meggs’ hunt for the Speaker after he broke into the Capitol.

In other cases, DOJ is arresting friends or accomplices of existing defendants on trespassing charges. That may be an attempt to be thorough, or it may be an effort to collect evidence about a primary target that accompanied the person to insurrection.

In some cases, such as with InfoWars personality Owen Shroyer, the government seems to have arrested people because they are key witnesses in the larger plot and DOJ can easily sustain a trespassing prosecution against them.

There are probably a slew of reasons why the FBI prioritized arresting Homer (who in June, legally changed her last name back to her maiden name, Boisselle, after a divorce). She did, in fact, film key scenes at the riot and she was wearing a GoPro under her chin.

She must also be someone of interest from a networking standpoint. For example, she lives or lived in AZ (indeed, the sole AUSA on her case right now, a detailee on Jan 6 cases who first filed notices of appearance on September 30, is located there), whence the siblings Konold traveled to insurrection; like Felicia Konold, Homer was standing next to Billy Chrestman as he riled up the crowd.

But the FBI suggests there may be a far more significant reasons for their interest later in her arrest affidavit. More than with virtually any of the Proud Boy or even Oath Keeper defendants, the FBI focuses on Homer’s attendance (and photography at) the November 2020 Proud Boys protest in DC.

The events of the November and December events in DC are undoubtedly central to the government’s investigation of the planning and networking that made January 6 happen. The government must be focused closely on it. They’ve just been very coy about sharing details of the key players at those earlier events., which seems a deliberate effort to shield what they know of those lead-up events from defendants (who, after all, are not charged for crimes committed in November and December). Nevertheless, in this case, FBI makes the November 2020 Proud Boy event central to the story they tell about Homer.

Indeed, the big reveal at the end of her arrest affidavit is a photo, which the FBI says was taken at the November 2020 Proud Boy event, that Homer posted on Instagram just weeks before she was charged. Her caption for the photo suggests that some guy — whose identity the FBI obscures but who surely can ID himself in the picture — “took my hand that night” is proof for her that “miracles can happen.”

It appears to be a love story wrapped inside an insurrection — a compelling story indeed.

But it starts (or at least, the FBI claims it started) with the Google GeoFence.

To be clear: The FBI likes to “parallel construct” investigative stories. To hide a sensitive investigative source (something like sensitive investigative methods, classified intelligence, or a cooperating witness), the FBI will often tell a story that suggests their investigation that ended with a big reveal — a love story wrapped inside an insurrection, perhaps — started with something totally innocuous, like a Google GeoFence that collected on everyone who trespassed on January 6.

And that’s how, the FBI suggests, this story started, with Homer tripping the Google GeoFence by entering the Capitol on January 6.

Again, there’s no reason to believe this is what really happened, but the FBI suggests they found Homer’s ID in the Google GeoFence, that led to “additional investigation,” that provided her phone and email information, which led to discovery of her travel records (which might have led to discovery of her trip to the November 2020 event), which made it very easy for the FBI to know where in all the video of from January 6 to find the photos that proved the figure whose face was hidden by a gaiter and glasses while inside the Capitol was the same person who showed her face freely outside of it.

One reason I’m amused by this story is that, for whatever reason, the FBI Agent failed to obscure what most affidavits including Google GeoFence Reports hide, which is that the GeoFence includes in the report the information that FBI claimed required “additional information:” Homer’s email, her Google ID, her SMS recovery number, her recovery email, her account creation date, as well as the map itself showing the points both in and outside the Capitol itself where she tripped the GeoFence. Normally, the FBI can obtain all this information with a subscriber request (or an NSL, in the case of national security cases), so it’s not treated as very sensitive and would require just one additional step to get in any case. But if the government has obtained a GeoFence including everyone recognizable to Google who trespassed that day, along with selectors that would form part of the subscriber information for other social media providers, such as the Instagram account that forms a key part of the rest of Homer’s affidavit, then it is really powerful data.

To date, we don’t know how much of this GeoFence data Google collected and included in individualized reports in response to a request in the immediate aftermath of January 6, how much these reports reflect reports done in response to individualized requests after the fact, based on preserved data, or whether it’s a mix (such as that Google provided the initial identifiers to the FBI, which the FBI then used to cross-reference with other investigative materials, leading them to prioritize certain requests for more detailed reports). The FBI could obtain this information via a warrant for the GeoFence or via individualized warrants served months later (and Google surely has carefully preserved all investigative information tied to the event).

But this report provides a clue: it says that Homer last logged into Google on January 19, 2021.

It would take unbelievable amounts of discipline for someone to go ten months without logging into Google one way or another, the kind of discipline not exhibited by a person who doesn’t delete user location and who also posts incriminating photos to Instagram from a year earlier. So this report was presumably finalized much closer to January 19, not long after she had logged into Google, than November.

Maybe that Google GeoFence really is where this apparent love story started.

Copyright © 2021 emptywheel. All rights reserved.
Originally Posted @ https://www.emptywheel.net/2021/12/01/how-googles-geofence-captured-lions-not-sheep-lisa-homer/