Government Moves to Dismiss Its First January 6 Case: Christopher Kelly

/17 Comments/in /by

In a first among the January 6 cases, the government has moved to dismiss the trespassing and obstruction charges against Christopher Kelly, a New Yorker whose arrest documents quoted Facebook postings saying that he was going to the riot with a former NYPD cop believed to be his brother and some Proud Boys.

The Kelly Facebook Account also shows that on January 4, 2021 another Facebook user (User 2) asked KELLY, “How are things there?? Gonna be crazy on the 6th eh?” KELLY responded, “Yea Im leaving tomorrow in the afternoon to gey there early.” He added, “Yea driving its only 250miles.” User 2 stated, “Enjoy the occasion, hope it all goes to plan. Stay safe, Antifa will be out in force.” KELLY responded with, “No worries, I’ll be with ex NYPD and some proud boys. This will be the most historic event of my life (emphasis added).”

And unless there was a horrible mistake, his Facebook posts also show that he entered the Capitol and was enthusiastic about the results.

At 2:22 pm EST Chris Kelly posted the photograph in Figure One. A chat participant asked, “You’re there, @Chris Kelly? What’s really going on?” At 2:25pm EST, KELLY responded, “MAGA is here full on. Capitol building is breached.” At 2:30pm EST KELLY added, “Tear gas, police, stopped the hearing, they are all headed to the basement,” and, “Fuck these snakes. Out of OUR HOUSE!” (emphasis added).”

One possibility is that he didn’t enter the Capitol, his brother did, and that because Kelly sent the picture the government believed he had been inside.

I had pointed to his case back in April as one where the defendant, by proximity to the Proud Boys but not one of them, might have enough to offer to get a cooperation agreement.

As of less than a month ago, his excellent attorney, Edward McMahon, was still discussing a plea, not outright dismissal.

Since that time, counsel have engaged in substantial plea discussions that would, if successful, render moot the current hearings. Both parties agree that a continuance of the preliminary hearing and status conference date is warranted to allow for the continuation of plea discussions with an eye towards a resolution of this case.

But instead, his case will be dismissed and his record will remain clear.

There are a couple of things — aside from any cooperation he already provided — that might explain the dismissal.

First, as noted, the former NYPD he was traveling with was his brother, and no one resembling his brother has shown up in arrest records. If his brother had ties to the Proud Boys, then it might be more important to pursue him than Kelly. So maybe that’s what’s happening in lieu or prosecuting Kelly.

A far more interesting possibility would involve the established informant who first provided the tip turning Kelly in.

On or about January 9, 2021, CS-1 identified a Facebook account as being utilized by “Chris Kelly.” CS-1 provided to the FBI screenshots containing content posted to and sent and received by this account. The materials provided by CS-1 included a screenshot of the account’s profile picture.

1 Since in or about 2019, CS-1 has provided information to FBI in exchange for monetary compensation. CS-1 has no criminal record and the information provided by CS-1 has been proven to be reliable in the past.

There were maybe five established informants involved in the original tips out of all the January 6 defendants (and the case of one of the others, Timothy Hale-Cusanelli, also has problems). But informants in the vicinity of the Proud Boys pose particular problems, because there are reports that a whole slew of them were feeding tips to the FBI before January 6. And if one of them had his own involvement in January 6, but decided to narc out Kelly for cash or to divert attention from himself, that would make a case against Kelly unsustainable.

Another possibility, again, is that he didn’t enter the building. The pictures he posted of himself show him well outside the boundary of the restricted zone.

Whatever it was, the government wants to dismiss the case without prejudice.

The defendant was arrested on a Complaint in this matter on January 20, 2021, and he had his initial appearance before this Court on February 9, 2021. The matter has been continued several times and the next date is June 2, 2021 for preliminary hearing and status conference. The government and defense counsel have discussed the merits of the case, and upon reflection of the facts currently known to the government, the government believes that dismissal without prejudice at this time serves the interests of justice. The defendant consents to this motion to dismiss the Complaint without prejudice.

By dismissing the case “without prejudice,” the government could bring it back if circumstances change. But for now, Kelly becomes the first charged January 6 defendant to walk.

Update: Josh Gerstein gets confirmation that DOJ dismissed this because they have no evidence that Kelly entered the Capitol.

However, subsequent inquiries indicated that Kelly never actually entered the Capitol, according to a law enforcement official.

Prosecutors maintain that breaching the police lines outside the building is illegal, but few if any people have been charged in federal court solely for that.

“Since he was not inside, in the interest of consistency in the investigation, the charges were dropped,” the official said.

 

OpSec Confusion on the Oath Keeper Conspiracy

/36 Comments/in , /by

I write a lot about the comms the Oath Keepers used to plan insurrection. There was the post about how they figured out, too late, not to plan an insurrection on Facebook; of the five counts of obstruction on the Oath Keeper indictment released Sunday, two pertain to Facebook. Then there was the post where I cataloged how many social media platforms were described in the last iteration of the indictment against them.

  • A leadership list on Signal they appear to have obtained from either Watkins and/or Kelly Meggs
  • Open channels on Zello, possibly separate ones for each large event
  • Telephony chats and texts, including during January 6
  • MeWe accounts
  • Way too much blabbing on Facebook, followed by a foolish belief they could delete such content
  • Parler for further blabbing
  • Stripe for payment processing (possibly for dues)
  • GoToMeeting for operational planning

The remaining three obstruction charges pertain to this social media activity, one — for Joshua James — specifically describing his attempt to delete and burn the “[S]ignal comms about the op.”

Add hand-written ProtonMail attachments to the toolchest

It turns out I should have included ProtonMail in that list, because both the addresses to which Laura Steele sent her vetting application to join the Oath Keepers on January 3 were ProtonMail addresses, but the government only laid that out in their unsuccessful bid to keep her detained, in an attempt to use its encryption to ascribe to her that operational security.

On the evening of January 3, 2021, Defendant Steele emailed a membership application and vetting form to the Oath Keepers of Florida.4 She copied Defendant Young on the email, and wrote: “My brother, Graydon Young told me to submit my application this route to expedite the process.” Under the section for “CPT Skill Sets (Community Preparedness Team) Experience or Interests,” she checked “Security.” Under “Skillsets,” she wrote: “I have 13 years of experience in Law Enforcement in North Carolina. I served as a K-9 Officer and a SWAT team member. I currently work Private Armed Security for [company name redacted]. I am licensed PPS through the North Carolina Private Protective Services.”

Within 10 minutes, Defendant Steele sent another email, this one directly to Defendant Kelly Meggs’s email account at Proton Mail, again copying Defendant Young. She again attached her application and vetting form, and wrote: “My brother, Graydon Young told me to send the application to you so I can be verified for the Events this coming Tuesday and Wednesday.”

The following day (January 4), Defendant Steele sent the same materials to yet another Oath Keepers email address at Proton Mail. On her email, she copied co-defendants Kelly Meggs and Graydon Young.

4 The email recipient was actually a Florida Oath Keepers account at “protonmail.com.” Proton Mail is housed overseas (in Switzerland) and offers end-to-end encryption. “Even the company hosting your emails has no way of reading them, so you can rest assured that they can’t be read by third parties either.” Mindaugas Jancis, ProtonMail review: have we found the most secure email provider in 2021?, CyberNews, Mar. 4, 2021, at https://cybernews.com/secure-email-providers/protonmail-review.

But Proton is not going to help if one side of a communication is on Gmail or some other email service on which FBI can serve a subpoena. Which may explain how the government obtained this email from the newly indicted Joseph Hackett in the latest superseding.

41. On December 19, 2020, HACKETT sent an email to YOUNG with a subject line “test.” The body of the email stated: “I believe we only need to do this when important info is at hand like locations, identities, Ops planning.” The email had a photo attached; the photo showed cursive handwriting on a lined notepad that stated: “Secure Comms Test. Good talk tonight guys! Rally Point in Northern Port Charlotte at Grays if transportation is possible. All proton mails. 7 May consider [a rally point] that won’t burn anyone. Comms – work in progress. Messages in cursive to eliminate digital reads. Plans for recruitment and meetings.”

7 Based on the investigation, “proton mails” appears to refer to the company “ProtonMail,” which offers encrypted email services.

I’ve not seen anything that suggests the government has obtained Proton Mails from the Oath Keepers conducted entirely on the platform; that may have to wait until someone involved decides to cooperate. But I’m not sure how writing the most sensitive messages on what sounds like dead tree paper before sending it adds to the security.

DOJ’s selective understanding of encryption

One of the more aggravating pieces of confusion in the new indictment, however, comes not from the alleged conspirators but from the government.

The last item in a list of Manner and Means employed in the conspiracy is the use of “secure and encrypted communications.”

Using secure and encrypted communications applications like Signal3 and Zello4 to develop plans and later communicate during the January 6 operation.

The first overt act describes Stewart Rhodes laying out what I am calling the “Antifa foil” on a GoToMeeting meeting.

At a GoToMeeting5 held on November 9, 2020, PERSON ONE told those attending the meeting, “We’re going to defend the president, the duly elected president, and we call on him to do what needs to be done to save our country. Because if you don’t guys, you’re going to be in a bloody, bloody civil war, and a bloody – you can call it an insurrection or you can call it a war or fight.”

As a result, the following footnotes appear on the bottom of the same page.

3 Signal is an encrypted messaging service.

4 Zello is an application that emulates push-to-talk walkie-talkies over cellular telephone networks. Zello can be used on electronic communication devices, like cellular telephones and two-way radios.

5 GoToMeeting is an online meeting site that allows users to host conference calls and video conferences via the Internet in real time.

Start with Zello: It can be secure. But it wasn’t, as used by the Oath Keepers, the day of the insurrection, because it was an open channel. Indeed, the reason we know about it is because journalist Micah Loewinger was following along in real time. Plus, anything saved onto a phone will be accessible once the phone is compromised, just like Signal will. (From the discovery letters shared with the Oath Keepers — the most recent of which is over a month old — the government appears to have initially relied on WNYC’s published versions of the Zello chats. But this superseding indictment includes time stamps from Watkins’ Zello exchanges, which suggests they’ve obtained a more reliable copy since then.

Signal, DOJ says, is encrypted. I have no problem with that. But they started compromising the Signal chats as soon as they exploited Jessica Watkins’ phone. And the latest indictment seems to rely on the exploitation from another of the more involved participants — it’s where the new details on the Quick Reaction Force come from (here’s my rough capture of the communications we’ve seen referenced to date).

What I find annoying is that, after treating Signal and Zello as super spooky applications, DOJ then treats GoToMeeting like a normal tool, just “an online meeting site that allows users to host conference calls and video conferences via the Internet in real time.”

But it is also end-to-end encrypted and has a number of other security features that are necessary for its use by mainstream businesses and health care providers. That said, it is centralized and probably responds eagerly to legal process, which is the distinction DOJ really intends by this. That is, it’s not encryption that makes the use of these apps a useful marker of a conspiracy, it’s decentralized security, security that the Oath Keepers didn’t use with Zello the day of the insurrection. Plus, for a conspiracy indictment, as opposed to other criminal charges, the use of G2M suggests a bureaucratization that should be more useful to prove the case.

In any case, with this fourth indictment, DOJ added content from G2M that was probably meant to be secure: Stewart Rhodes’ “Antifa foil” comments. An initial production of G2M had been provided to defendants by April 9, with a second attempt on April 23. So it may be that it has taken some time to reconstruct whatever full production they might receive from the various Oath Keeper accounts.

The money is the metadata

That said, it is amusing seeing the conspirators try to add a layer of security to the already secure ProtonMail while they’re laying a trail of travel plans that knots them all up into a network. Here are just some of the fleshed out details from the indictment:

79. On January 4, 2021, HARRELSON and DOLAN departed Florida together in a vehicle rented by DOLAN and traveled to the Washington, D.C., metropolitan area.

[snip]

82. On January 4, 2021, PERSON TEN checked into the Hilton Garden Inn in Vienna, Virginia. The room was reserved and paid for using a credit card in PERSON ONE’s name.

[snip]

85. On January 5, 2021, PERSON ONE and MINUTA separately traveled to the Washington, D.C., metropolitan area and checked into the Hilton Garden Inn in Vienna, Virginia.

[snip]

90. KELLY MEGGS paid for two rooms, each for two people, at the Comfort Inn Ballston from January 5-6, 2021. The rooms were reserved under the name of PERSON THREE.

90. KELLY MEGGS paid for two rooms, each for two people, at the Comfort Inn Ballston from January 5-6, 2021. The rooms were reserved under the name of PERSON THREE.

91. KELLY MEGGS also booked two rooms at the Hilton Garden Inn in Washington, D.C., from January 5-7, 2021. KELLY MEGGS paid for both of the rooms, using two different credit cards.

[snip]

93. HACKETT paid for a room at the Hilton Garden Inn in Washington, D.C., from January 5-7, 2021. The room was booked in the name of PERSON SIXTEEN.

[snip]

95. MINUTA, using his personal email address and his personal home address, reserved three rooms at the Mayflower Hotel in Washington, D.C., under the names of MINUTA, JAMES, and PERSON TWENTY. A debit card associated with PERSON FIFTEEN was used to pay for the room reserved under MINUTA’s name. A credit card associated with JAMES was used to pay for the room reserved under JAMES’s name.

Kelly Meggs, by paying for what appears to be the QRF room and another for Person 3 to tend the weapons, would tie the Floridians staying in the DC Hilton Garden with a group coming from at least three states at the Ballston Comfort Inn (and that’s before you consider the surveillance footage that shows others dropping off weapons). Minuta, by reserving three rooms at the Mayflower, would tie Joshua James, Person Twenty, and Person Fifteen to the group, including Minuta, staying at the Vienna Hilton Garden, which includes Rhodes and Person Ten. And there’s at least one known payment — from some unidentified person to James’ wife — that doesn’t show up here.

Post 9/11, it’s hard to hide hotel travel, especially retroactively, after engaging in a terrorist attack, but it doesn’t help that the Oath Keepers didn’t compartment their network at all. So all the encrypted messaging and meeting apps in the world could not hide that this was a network that spanned (thus far, but I’m holding out hope they’ll roll out the first Mississippi defendants any day!) at least seven states.

Update: I’ve taken out a reference to the Ohioans walking Isaacs back to a hotel in DC. They did separate early but it was not to take him back. Thanks to Benny Bryant for the correction.

Crystalizing Conspiracies: Fourth Superseding, James Breheny, Puma’s GoPro, [Redacted], and the Willard Hotel

/69 Comments/in , /by

Since I’ve acquired new readers with my January 6 coverage and since the financial stress of COVID is abating for many, it seems like a good time to remind people this is not a hobby: it is my day job, and I’d be grateful if you support my work.

In this post, I used the imminent guilty plea of Paul Allard Hodgkins to illustrate that we really don’t know what evidence of conspiracy prosecutors are looking at, which means that we can’t really say whether the January 6 investigation will ultimately hold those who incited the violence accountable. I explained how a PhD in Comp Lit might be useful training to see the gaps in prosecution filings that show what secrets they’re holding in abeyance. And, as I further explained, if those most responsible for January 6 are going to be held accountable, it will likely be (at least in part) via conspiracies with the Oath Keepers and Proud Boys, including the multiple ties Roger Stone has with both militias.

This post is meant to be read in tandem with that one.

This one will look at four developments in the case against the Oath Keepers in the last week or so.

The superseding indictment turns the screws

Most spectacularly, the government rolled out a fourth superseding Oath Keeper indictment yesterday. The ostensible purpose of it was to add four new defendants: Joseph Hackett, Jason Dolan, and William Isaacs, all from Florida, along with a fourth, accused of just three crimes, whose name is redacted.

The indictment broadens the kinds of communications used to communicate during the conspiracy, including Signal along with Zello, as well as orders to write key details in cursive, then send them via Proton Mail.

It adds a comment Stewart Rhodes made on November 9 laying out what I’ll call the “Antifa foil” — an affirmative plan, laid out months before the insurrection, to use the “threat” of Antifa as the excuse to come armed and a means to foment violence.

At a GoToMeeting5 held on November 9, 2020, PERSON ONE told those attending the meeting, “We’re going to defend the president, the duly elected president, and we call on him to do what needs to be done to save our country. Because if you don’t guys, you’re going to be in a bloody, bloody civil war, and a bloody – you can call it an insurrection or you can call it a war or fight.” PERSON ONE called upon his followers to go to Washington, D.C., to let the President know “that the people are behind him.” PERSON ONE told his followers they needed to be prepared to fight Antifa, which he characterized as a group of individuals with whom “if the fight comes, let the fight come. Let Antifa – if they go kinetic on us, then we’ll go kinetic back on them. I’m willing to sacrifice myself for that. Let the fight start there. That will give President Trump what he needs, frankly. If things go kinetic, good. If they throw bombs at us and shoot us, great, because that brings the president his reason and rationale for dropping the Insurrection Act.” PERSON ONE continued, “I do want some Oath Keepers to stay on the outside, and to stay fully armed and prepared to go in armed, if they have to . . . . So our posture’s gonna be that we’re posted outside of DC, um, awaiting the President’s orders. . . . We hope he will give us the orders. We want him to declare an insurrection, and to call us up as the militia.” WATKINS, KELLY MEGGS, HARRELSON, HACKETT, PERSON THREE, PERSON TEN, and others known and unknown attended this GoToMeeting. After PERSON ONE finished speaking, WATKINS and KELLY MEGGS asked questions and made comments about what types of weapons were legal in the District of Columbia.

The indictment provides more evidence of a plan to have Oath Keepers from North Carolina stationed as a Quick Reaction Force to pick up weapons from one of two locations in DC and deliver them to others already there (a recent filing arguing Thomas Caldwell needs to keep informing pretrial services of his movements included surveillance video from the Ballston Comfort Inn of the conspirators carrying around presumed guns draped in sheets).

On the evening of January 2, 2021, at about 5:43 p.m., KELLY MEGGS posted a map of Washington, D.C., in the Leadership Signal Chat, along with the message, “1 if by land[,] North side of Lincoln Memorial[,] 2 if by sea[,] Corner of west basin and Ohio is a water transport landing !!” KELLY MEGGS continued, “QRF rally points[.] Water of the bridges get closed.”

[snip]

On January 4, 2021, CALDWELL emailed PERSON THREE several maps along with the message, “These maps walk you from the hotel into D.C. and east toward the target area on multiple roads running west to east including M street and P street, two of my favorites . . . .”

[snip]

On January 4, 2021, WATKINS wrote in the Florida Signal Chat, “Where can we drop off weapons to the QRF team? I’d like to have the weapons secured prior to the Op tomorrow.”

On the morning of January 5, 2021, HARRELSON asked in the Florida Signal Chat for the location of the “QRF hotel,” and KELLY MEGGS responded by asking for a direct message.

It provides more details about what the Oath Keepers did in the Capitol (including descriptions of how the kitted out veterans folded — retreated — as soon as they were hit with some tear gas).

When officers responded by deploying a chemical spray, the mob—including CROWL, WATKINS, SANDRA PARKER, YOUNG, and ISAACS—retreated.

[snip]

JAMES briefly breached the Rotunda but was expelled by at least one officer who aimed chemical spray directly at JAMES, and multiple officers who pushed him out from behind.

Importantly, the superseding indictment adds civil disorder charges against six of the Oath Keepers for interactions they had with cops inside the Capitol. It adds an assault charge against Joshua James for his physical interaction with cops. It adds obstruction charges against Kelly Meggs, Kenneth Harrelson, and James for deleting comms. Some of these charges were expected; it’s just that adding four new defendants was a convenient time to add them.

As these defendants are sitting here, though, their legal jeopardy is getting worse. Which is likely part of the point. They might stave off any further charges if they decide to cooperate with prosecutors.

When the government first charged this conspiracy, they were way over their skis, with detention requests and claims of danger that they did not yet have (or were not yet willing to show) evidence to support. That’s no longer true, and I wouldn’t be surprised if the government tries to detain a few more of these defendants when they are arraigned on the new charges this week.

James Breheny’s inter-militia network

One of the interesting details of this indictment is the exclusion of Oath Keeper James Breheny from it. Unlike the Proud Boys, all the Oath Keepers have been charged on one conspiracy indictment. The sole exception is Jon Schaffer, who from very early on was cultivated to flip, which he did on April 16. Remarkably, it’s not clear that Schaffer’s cooperation shows up in the new superseding indictment.

Now Breheny joins Schaffer in being charged (at least for now) on his own, which means, as of now, he’s only on the hook for his own crimes, not those of 16 co-conspirators. Breheny is an Oath Keeper from New Jersey who self-surrendered (suggesting ongoing discussions involving a lawyer) on May 20.

Breheny’s charging documents are interesting on several points. First, the affidavit excerpts a post Stewart Rhodes published on December 14, calling on Trump to invoke the Insurrection Act, including this paragraph:

You must act NOW as a wartime President, pursuant to your oath to defend the Constitution, which is very similar to the oath all of us veterans swore. We are already in a fight. It’s better to wage it with you as Commander-in-Chief than to have you comply with a fraudulent election, leave office, and leave the White House in the hands of illegitimate usurpers and Chinese puppets. Please don’t do it. Do NOT concede, and do NOT wait until January 20, 2021. Strike now.

This Rhodes post doesn’t appear in the Oath Keeper conspiracies, though it is a continuation of the November 9 comment from Rhodes also calling for insurrection, and it provides context for a comment he made on January 6 about what he expected Trump to do.

Then, Breheny’s complaint describes him inviting Rhodes to “a leadership meeting of ‘multiple patriot groups'” in Quarryville, PA on January 3, 2021. His invite directed Rhodes not to bring a phone and explained,

This will be the day we get our comms on point with multiple other patriot groups, share rally points etc. This one is important and I believe this is our last chance to organize before the show. This meeting will be for leaders only.

Breheny’s complaint also explains that Rhodes only added Breheny to the leadership list for the Oath Keepers on January 6. In explaining that detail, a footnote explains,

numerous individuals affiliated with the Oath Keepers who have been alleged to have participated in the riots participated in this chat and have been indicted in US v. Caldwell et al, 21-cr-28-APM.

It’s a neat way of saying that Breheny conspired with those charged in the main Oath Keepers conspiracy and they conspired with him, without charging him in that conspiracy.

The rest of the complaint explains how Breheny lied to the FBI about what he did on January 6, but after the government got a warrant for his phone, they obtained pictures and texts showing he had done far more on January 6 than he admitted to cops, including fighting his way in the East Doors that all the other Oath Keepers entered.

The government has been selective about whom they’re charging with obstruction for lying and deleting evidence, but their case that Breheny deliberately attempted to obstruct the investigation is quite strong.

Anthony Puma’s GoPro is arrested

On May 27, a guy from Michigan named Anthony Puma was arrested, more than four months after the FBI interviewed him on January 14 and after, on January 17, he shared the SD card from the GoPro he wore on January 6.

On April 23, the government obtained Puma’s Facebook account, which provided video and text evidence that, in his January 14 interview, Puma dramatically downplayed his knowledge of events on January 6. Most notably, they found texts he posted on January 5, knowing that, and precisely when, “we are storming” the Capitol the next day.

Tomorrow is the big day. Rig for Red. War is coming

We are here. What time do we storm the House of Representatives?

Hopefully, we are storming the House of Representatives tomorrow at 100 pm.

There’s no hint in his charging documents that Puma has association with the Oath Keepers. Assuming he does not, it seems likely he was arrested, as I believe a number of other recent defendants were, so he can be forced to authenticate the important video evidence he shot on the day of the insurrection.

As a Comp Lit PhD who had to read a fuck-ton of postmodern theory, my favorite picture from his GoPro shows him filming himself shooting a video on his phone as he approached the Capitol.

But there are two other clips that I suspect are more important — one, showing what I believe to be a second stack of likely Oath Keepers preparing to breach the Capitol.

And another, showing presumed Oath Keepers on their golf cart race from the Willard Hotel to reinforce the Capitol, calling out, “We are inside, they need help, we’ve breached the Capitol.”

So whether or not Puma has a tie to the Oath Keepers, he now has reason to cooperate with prosecutors on making this video available for any trial.

[Redacted]

As noted, there were four people added to the Oath Keepers conspiracy indictment, but the name of one remains redacted.

It can’t be Roger Stone, as a lot of people are wishing, because Stone’s not an Oath Keeper.

But whoever [redacted] is, he almost certainly traveled with Roberto Minuta and Joshua James from the Willard Hotel where they were “guarding” Roger Stone and others to the Capitol.

I say that because of four paragraphs from the third superseding indictment describing the golf cart race to the Capitol, three are redacted in the fourth.

That doesn’t necessarily mean that [redacted] has had a child with Roger Stone or anything as exciting as that. It does mean that someone who was a likely witness to what happened on the Willard Hotel side of phone calls between Person Ten (who was the ground commander for the Oath Keepers that day) and James has been added to the conspiracy.

[redacted] appears to have entered the Capitol with Minuta and James, as what had been ¶104 describing their entrance “together with others known and unknown” in the third superseding is redacted as ¶154 in the fourth.

But the potentially more interesting actions of [redacted] appear in ¶¶76 and 77, which explain pre-insurrection communications and planning, as well as ¶99, which must explain what [redacted] did the morning of the insurrection, probably with James and Minuta. And ¶102 likely describes what the three of them were doing at the Willard Hotel while everyone else started breaching the Capitol.

As I said in this post, it takes more than four months to charge a complex conspiracy. But these four developments together add a December call for insurrection (in tandem with events that day in DC), places the Oath Keepers — including Stewart Rhodes — in a January 3 meeting coordinating with other militias, and it seemingly adds a third witness to what went on in the Willard Hotel the morning of the insurrection.

Latex Gloves Hiding Evidence of Conspiracies: On the Unknown Adequacy of the January 6 Investigation

/27 Comments/in , /by

Since I’ve acquired new readers with my January 6 coverage and since the financial stress of COVID is abating for many, it seems like a good time to remind people this is not a hobby: it is my day job, and I’d be grateful if you support my work.

Update, 6/2: As this post lays out, Hodgkins’ plea was indeed just a garden variety plea. During the hearing he explained the latex gloves. He carries a First Aid kit around all the time and saw Joshua Black’s plastic bullet wound (though he didn’t know Black and didn’t name him in the hearing) and put gloves on in preparation to provide medical assistance. After Black declined his help, he took the latex gloves off.

On Wednesday, June 2, insurrectionist Paul Allard Hodgkins will plead guilty, becoming just the second of around 450 defendants to publicly plead guilty (particularly given the number of people involved, there may be — and I suspect there are — secret cooperation pleas we don’t know about).

NOTICE OF HEARING as to PAUL ALLARD HODGKINS: A Plea Agreement Hearing is set for 6/2/2021, at 11:00 AM, by video, before Judge Randolph D. Moss. The parties shall use the same link for connecting to the hearing.(kt)

This could be the first of what will be a sea of plea deals, people accepting some lesser prison time while avoiding trial by pleading out. But there’s one detail that suggests it could be more, that suggests Hodgkins might have knowledge that would be sufficiently valuable that the government would give him a cooperation deal, rather than just a plea to limit his prison time.

Hodgkins is one of the people who made it to the Senate floor and started rifling through papers there, which by itself has been a locus of recent investigative interest. But he is an utterly generic rioter, wearing a Trump shirt and carrying a Trump flag. According to an uncontested claim in his arrest affidavit, he told the FBI he traveled to the insurrection from Florida alone, by bus. Because the only challenge he made to his release conditions — to his curfew — was oral, and because the prosecutor in his case hasn’t publicly filed any notice of discovery (which would disclose other kinds of evidence against him), there’s nothing more in his docket to explain who he is or what else he did that day, if anything.

But one thing sticks out about him: before he started rifling through papers in the Senate, he put on latex gloves.

It’s not surprising he had gloves. During the pandemic, after all, latex gloves have been readily available, and I’ve wandered around with gloves in my jacket pocket for weeks. But he did show the operational security to put them on, when all around him people were just digging in either bare-handed or wearing the winter or work gloves they had on because it was a pretty cold day.

There’s just one other instance I know of where someone at the insurrection showed that kind of operational security (though there is one person identified by online researchers by the blue latex gloves he wore while playing a clear organizational role outside the Capitol). When one of the guys that Riley June Williams was with started to steal Nancy Pelosi’s laptop, Williams admonished him, “dude, put on gloves” and threw black gloves (which may or may not be latex) onto the table for him to use.

There’s no reason to believe there’s a tie (as it happens, Williams had a status hearing last week where her conditions were loosened so she can look for work). There is a cybersecurity prosecutor, Mona Sedky, who is common to both cases, which sometimes indicates a tie, but she is also on cases against defendants who have no imaginable tie to Williams. But Hodgkins exhibited the kind of operational security that, otherwise, only other people who seemed to be operating from some kind of plan exhibited.

My point is not that there’s a tie, but that we don’t know whether there’s something more interesting about Hodgkins, and we might not even learn whether there is on Wednesday, in significant part because if there is one, prosecutors may not want to share that information publicly.

And I think, particularly in the wake of Republicans’ successful filibuster of a January 6 Commission and discussions of whether there will be any real accountability, that’s a useful illustration about the limits of our ability to measure the efficacy of the investigation right now. Paul Hodgkins could be (and probably is) just some Trump supporter who hopped on a bus, or his latex gloves could be the fingerprint of a connection to more organized forces.

With that said, I’d like to talk about what we can say about the investigation so far, and where it might go.

Last week, when I read this problematic and in several areas factually erroneous attempt to describe the attack in military terms, I realized that readers new to my work may not understand what I do.

I cover a range of things, but when I cover a legal case, I cover the legal case as a means to understand what prosecutors are seeing. That’s different than describing the alleged crime itself; particularly given the flood of defendants, I’m not, for example, reading through scraped social media accounts from before the attack to understand what was planned in the semi-open in advance. But reading the filings closely is one way to understand where the criminal investigation might go and the chances it will be successfully prosecuted and if so how broadly the prosecution will reach.

I’m not a lawyer, though I’ve got a pretty decent understanding of the law, especially the national security crimes I’ve covered for 17 years. But my background in corporate documentation consulting and comparative literature (plus the fact that I don’t have an editor demanding a certain genre of writing) means I approach legal cases differently than most other journalists. For the purposes of this post, for example, my academic expertise in narrative theory makes me attuned to how prosecutors are withholding information and focalizing their approach to preserve investigative equities (or, at times, hide real flaws in their cases). Prosecutors are just a special kind of story-teller, and like novelists and directors they package up their stories for specific effects, though criminal law, the genre dictated by court filings, and prohibitions on making accusations outside of criminal charges impose constraints on how they tell their stories.

One of the tools prosecutors use, both in a legal sense and a story-telling one, is conspiracy. The problematic military analysis, linked above, totally misunderstood that part of my work (as have certain Russian denialists looking for a way to attack that doesn’t involve grappling with evidence): when I map out the conspiracies we’re seeing in January 6, I’m not talking about the overarching conspiracy that made it successful, how the entire event was planned. Rather, I’m observing where prosecutors have chosen to use that tool — by charging four separate conspiracies against Proud Boys that prosecutors are sloppily treating as one, and charging (as of yesterday) sixteen members of the Oath Keepers in a single conspiracy — and where they haven’t, yet — for a set of guys who played key roles in breaching the East door and the Senate chamber who armed themselves and traveled together. As that set of guys shows, prosecutors aren’t limited to using conspiracy with organized militias, and I expect we’ll begin to see some other conspiracies charged against other networks of insurrectionists. It’s virtually certain, for example, that we’ll see some conspiracies charged against activists who first organized together in local Trump protests; I expect we’ll see conspiracies charged against other pre-existing networks (like America First or QAnon or even anti-vaxers who used those pre-existing networks to pre-plan their role in the insurrection).

Conspiracies are useful tools for prosecutors for several purposes. For example, a conspiracy charge can change what you need to prove: that the conspiracy was entered into and steps taken, some criminal, to achieve the conspiracy, rather than the underlying crime. It can used to coerce cooperation from co-conspirators and enter evidence at trial in easier fashion. And it’s the best way to hold organizers accountable for the crimes they recruit others to commit.

If Trump, or even his flunkies, are going to be held accountable for January 6, it will almost certainly be through conspiracy charges built up backwards from the activities at the Capitol. I am agnostic on whether they will be, but it’s not as far a reach as some might think. This handy guide to conspiracy law that Elizabeth de la Vega laid out during the Mueller investigation provides a sense of why that is.

Conspiracy Law – Eight Things You Need to Know.

One: Co-conspirators don’t have to explicitly agree to conspire & there doesn’t need to be a written agreement; in fact, they almost never explicitly agree to conspire & it would be nuts to have a written agreement!

Two: Conspiracies can have more than one object- i.e. conspiracy to defraud U.S. and to obstruct justice. The object is the goal. Members could have completely different reasons (motives) for wanting to achieve that goal.

Three: All co-conspirators have to agree on at least one object of the conspiracy.

Four: Co-conspirators can use multiple means to carry out the conspiracy, i.e., releasing stolen emails, collaborating on fraudulent social media ops, laundering campaign contributions.

Five: Co-conspirators don’t have to know precisely what the others are doing, and, in large conspiracies, they rarely do.

Six: Once someone is found to have knowingly joined a conspiracy, he/she is responsible for all acts of other co-conspirators.

Seven: Statements of any co-conspirator made to further the conspiracy may be introduced into evidence against any other co-conspirator.

Eight: Overt Acts taken in furtherance of a conspiracy need not be illegal. A POTUS’ public statement that “Russia is a hoax,” e.g., might not be illegal (or even make any sense), but it could be an overt act in furtherance of a conspiracy to obstruct justice.

We know that Trump and his flunkies shared the goal of the conspiracies that have already been charged: to prevent the certification of the vote. Trump (and some of his flunkies) played a key role in one of the manner and means charged in most of the conspiracies: To use social media to recruit as many people as possible to get to DC. Arguably, Mike Flynn played another role, in setting the expectation of insurrection.

What’s currently missing is proof (in court filings, as opposed to the public record) that people conspiring directly with Trump were also conspiring directly with those who stormed the Capitol. But we know the White House had contact with some of the conspirators. We know that organizers like Ali Alexander and Alex Jones likewise had ties to both conspirators and Trump’s flunkies (an Alex Jones producer has already been arrested). We know that Flynn had other ties to QAnon (which is why I’ll be interested if the government ever claims QAnon had some more focused direction with respect to January 6). Most of all, Roger Stone has abundant ties with people already charged in the militia conspiracies, and was at the same location as some of the Oath Keepers before they raced to the Capitol in golf carts to join the mob. If Trump or his flunkies are held accountable, I suspect it will go through conspiracies hatched in Florida, and the overlap right now between the Oath Keeper and Proud Boys conspiracies are in Floridians Kelly Meggs and Joe Biggs. But if they are held accountable, it will take time. It’s hard to remember given the daily flow of new defendants, but complex conspiracies don’t get charged in four months, and it will take some interim arrests and a number of cooperating witnesses to get to the top levels of the January 6 conspirators, if it ever happens.

This post, which is meant to be read in tandem with this one, assesses developments in the last week or so in the Oath Keepers conspiracy case.

Republicans Filibuster Keeping the Capitol Safe

/91 Comments/in /by

Republicans just filibustered the bill to create a bipartisan commission to investigate January 6, 54-35. It was the first bill killed by filibuster in this Congress.

I never held out much hope that the commission would work with our partisanship anyway. But this vote has now made it clear that Republicans put party above country.

In [Legal] Defense of the Nazi

/6 Comments/in , /by

The biggest known investigative fuck-up in the January 6 investigation thus far was when the FBI raided the home of Marilyn and Paul Hueper believing that Marilyn was a woman that the FBI suspects, based off surveillance video, may have been part of stealing Nancy Pelosi’s laptop. The Hueper’s claims about their actions on January 6 don’t seem to be entirely forthright, but Marilyn has made a solid case that the FBI mistook her for the woman in question.

I think the FBI did have probable cause for that search, but I also think the FBI did not use available tools — most notably the Google and GeoFence warrants they’ve used in many other cases — that should have been able to exclude Marilyn as the suspect.

I think it likely that DOJ has made an error, of another sort, with Nazi sympathizer Timothy Hale-Cusanelli, detaining him for four months based off a mistaken belief he played a more important role in January 6 violence than he did.

Hale-Cusanelli was arrested on January 15, three days after a co-worker of his, who was already an NCIS informant, alerted the FBI that Hale-Cusanelli took part in the riots and had, in the past, espoused fairly extreme white supremacist views. On January 14, the informant recorded Hale-Cusanelli describing giving hand signals to the mob and taking a flag that Hale-Cusanelli described as a “murder weapon” to destroy.

Hale-Cusanelli’s arrest warrant, which charged him with the misdemeanor trespassing charges everyone gets charged with along with a civil disorder charge, included no video from the day of the attack. When the government indicted him, they added obstruction charges and abetting.

When the FBI arrested Hale-Cusanelli, he admitted in an interview that he gave hand and voice signals — which could be no more than waving people forward — to encourage others to “advance” past cops. But the government’s primary basis to keep him jailed, when they first succeeded in doing so back in January, seems to have been that, once you cut him off from the military network he worked in as a Navy contractor, he was bound to turn to war.

Releasing Defendant from custody will only reinforce his belief that his cause is just. Given his impending debarment from Naval Weapons Station Earle, and his potential Administrative Separation from the U.S. Army Reserve, Defendant’s release will likely leave him with nowhere to go and nothing to do except pursue his fantasy of participating in a civil war. If nothing else, the events of January 6, 2021, have exposed the size and determination of right-wing fringe groups in the United States, and their willingness to place themselves and others in danger to further their political ideology. Releasing Defendant to rejoin their fold and plan their next attack poses a potentially catastrophic risk of danger to the community.

When they made a more substantive (and successful) argument he should remain detained, they focused on two things: his choice of a third party guardian was also an extremist who had helped him try to game reporting from the Navy on his extremism, and his extremism itself, including that he groomed to look like Hitler.

They also argued that Hale-Cusanelli poses a threat to the informant who IDed him.

Hale-Cusanelli is appealing his detention. But both he and his attorney, Jonathan Zucker, are getting fed up. Last week, Zucker submitted a motion asking to be replaced, but also claiming that he has received nothing in discovery about what Hale-Cusanelli did at the Capitol.

The parties were last before the court on May 12, 2021. At that time the defense expressed concern to the court regarding the paucity of discovery in this case. To date the prosecution has disclosed the defendant’s custodial interview, a surreptitiously recorded conversation between the defendant and a cooperating witness who was wearing a recording device provided by law enforcement, two portions of text messages between the defendant and two other civilians. The prosecution has provided nothing else, particularly no evidence regarding what defendant did on January 6 either outside or inside the Capitol. Nor any other evidence regarding the defendant’s activity in relation to the charged offenses. 1

1 Defendant advises that other defendants have disclosed to him that other defendants indicated they received discovery of recordings from inside the Capitol where defendant has been seen peacefully walking in the hallways.

Yesterday, the government responded. AUSA Kathryn Fifield claimed that most of what Zucker had said was not accurate.

The bulk of Defendant’s representations to the Court regarding discovery—both in terms of what they have received and government’s response to their requests—are not accurate. To date, the government has provided the most substantial portions of the government’s evidence. That includes the CHS recordings in which Defendant makes substantial admissions regarding his criminal conduct on January 6, Defendant’s custodial interview in which Defendant makes substantial admissions regarding his criminal conduct on January 6, and a partial extraction of Defendant’s cellular phone. The partial extraction includes the extraction report and the native files, including chats, videos, and photos. Defense counsel has confirmed with the undersigned that they have access to these materials on USAfx. Further, the government separately provided Capitol CCTV video capturing Defendant inside the Capitol building on January 6 and reports of interviews conducted by NCIS. Defense counsel confirmed receipt of these materials with prior government counsel. Thus, Defendant is already in possession of the evidence most relevant to detention proceedings and to Defendant’s conduct on January 6, and has been in receipt of these materials since before the last status hearing on May 12, 2021.

She described how, because of the technical issues that occur every time the government shares large volume electronic files with defense attorneys, Zucker still doesn’t have the full content of Hale-Cusanelli’s phone.

But the accompanying discovery summary in fact seems to confirm what Zucker has said: he has received no or next to no surveillance video of his client in the Capitol, and what he has gotten appears to pertain primarily to a different person he represents (Zucker also represents Jerod Wade Hughes and Thomas Webster, and did represent Dominic Pezzola for a period).

Video recording of custodial interview of Defendant Hale-Cusanelli produced via USAfx on February 22, 2021.

Bulk report of interviews conducted by NCIS produced via email on March 7, 2021.

Report of interview conducted by NCIS of Sergeant John Getz produced via email on March 8, 2021.

Partial extraction of Apple iPhone – includes Cellebrite Extraction Report (PDF 1209 pages) and native files most relevant to Defendant’s detention proceedings and conduct on January 6, 2021. Produced via USAfx on March 11, 2021.

Capitol Surveillance CCTV produced via USAfx in connection with another defendant represented by defense counsel on March 31, 2021. Upon information and belief, you confirmed receipt of this video with prior government counsel. Reproduced in the USAfx folder for this case on May 25, 2021. The Government has designated these files Highly Sensitive under the Protective Order issued in this case.

CHS video and audio recordings produced via USAfx on May 7, 2021. The Government has designated these files Sensitive under the Protective Order issued in this case. Cellebrite Extraction Report (PDF 63073 pgs): iPhone 6s (A1633), MSISDN 7328105132, ISMI 310120163205040. Produced via USAfx on May 7, 2021.

Full extraction of Defendant’s Apple iPhone produced on encrypted zip drive on or about April 28, 2021, on Blu Ray discs on or about April 28, 2021, and on defense counsel’s hard drive on or about May 25, 2021.

One of the main images in an earlier detention memo from inside the Capitol is indexed to Pezzola, so that may be the discovery in question.

This guy has absolutely loathsome views. But they are views protected by the First Amendment — and also views shared by a goodly percentage of the other January 6 defendants, many of them out on personal recognizance. The others who, like Hale-Cusanelli, were of particular concern to the government because they held clearance on January 6 also engaged in physical assault — and Freddie Klein was released even after that. As I noted, the government spent two months confirming details of active duty Marine, Major Christopher Warnagiris’ far more important conduct from the day before arresting him, and then let him out on personal recognizance.

While the government has provided evidence that he did intend to obstruct the vote count, nothing in his conduct from the day substantiates the civil disorder challenge. Yesterday, Fifield asked for two more months to find that evidence.

This seems like a mistake that the government is simply doubling down on. But if you haven’t found more compelling evidence after four months, what are the chances you will?

RICO Comes to the January 6 Investigation — But Not the Way You Think

/25 Comments/in , /by

Longterm readers of this site know that bmaz always gets incensed when people discuss RICO, mostly because those discussions tend towards magical thinking that RICO can make complex legal questions magically result in jail time for bad guys.

That’s why I put RICO in the title.

But RICO really has come up in a January 6 case: pertaining to DOJ’s attempted seizure of the $90,000 John Sullivan made off selling his video of the insurrection. Much of that filing dismisses Sullivan’s attempt to keep the money because he needs it for living expenses. If he genuinely needed it to pay his lawyer, he might have an argument, but DOJ says he’s got other bank accounts with significant funds for that.

Here, the defendant has submitted no declaration, financial affidavit, or banking statements. He has not provided any information about his assets outside his bank account ending in 7715, the only account from which funds were seized. He has not provided information about his short- or long-term liabilities. He has not detailed his sources of income, despite being, to the government’s understanding, currently employed by his father. He has not described his ability to use other assets, liquid and non-liquid, to pay basic necessities, including the assistance of family members and friends. He has not provided information regarding what funds he has recently expended toward household expenses and what any additional funds are requested, nor detailed what the “household expenses” entail. Such specification is particularly essential where expenditures can dramatically vary, irrespective of necessity, based on a defendant’s typical lifestyle. Cf. United States v. Egan, 2010 WL 3000000, at *2 (S.D.N.Y. July 29, 2010) (“The Court does not take lightly a request to release funds allegedly stolen from former customers in order to finance luxuries” such as high-end vehicles or a multimillion-dollar home”).

A more fulsome showing is particularly warranted in light of the defendant’s Pretrial Services Report from the arresting jurisdiction, which was prepared from an interview conducted on January 15, 2021 and, according to D.C. Pretrial Services, submitted to this Court with the Rule 5 papers. That document reported significant funds in unspecified bank accounts of the defendant – funds that wholly predate, and lie entirely outside the scope of, the government’s seizure warrants. The government’s seizure warrants instead surgically targeted the defendant’s $90,875 in proceeds from sales of his video footage from the U.S. Capitol – all of which was deposited into his bank account subsequent to January 15. The Pretrial Services Report further noted multiple vehicles owned by the defendant. And it provided a specific estimate of the defendant’s monthly expenses to include rent, groceries, cell phone, auto insurance, and other incidentals – which, if extrapolated, should mean that the defendant retains substantial assets notwithstanding the government’s seizure of the $62,813.76 on April 29, 2021.

The government, moreover, is aware of at least one other bank account of the defendant with America First Credit Union in which he retained a positive balance as of March 19, 2021. Again, this account and the funds therein lie wholly outside the scope of the government’s seizure warrants.

But there’s a part of the filing that probably answers a question I asked: aside from the First Amendment concerns of seizing funds from making a video, I wondered why DOJ had invoked the obstruction charge against Sullivan to do so, rather than the civil disorder charge, as the basis for the seizure. There’s more evidence that Sullivan was trying to maximize chaos than obstruct the counting of the vote, so it seemed like civil disorder was the more appropriate felony.

It seems that invoking obstruction gave DOJ a way to seize the funds, and even then it had to go through RICO magic.

Here’s the language in question: I’ve highlighted the RICO reference in bright red letters for bmaz’s benefit.

Title 18, United States Code, Section 981(a)(1)(C) provides that “[a]ny property, real or personal, which constitutes or is derived from proceeds traceable to a violation of … any offense constituting ‘specified unlawful activity’ (as defined in section 1956(c)(7) of [Title 18 of the U.S. Code])” is “subject to forfeiture to the United States.” The provision thus subjects “proceeds” traceable to violations of specified unlawful activities (“SUAs”) to civil forfeiture. Meanwhile, criminal forfeiture is authorized when 18 U.S.C. § 981(a)(1)(C) is used in conjunction with 28 U.S.C. § 2461(c), which holds that “[i]f the defendant is convicted of the offense giving rise to the forfeiture, the court shall order the forfeiture of the property as part of the sentence in the criminal case.” In turn, 18 U.S.C. § 1956(c)(7) – which was cross-referenced in § 981(a)(1)(C) – incorporates as SUAs all predicate offenses under the Racketeer Influenced and Corrupt Organizations (“RICO”) statute – that is, “any act or activity constituting an offense listed in section 1961(1) of this title [Title 18] except an act which is indictable under subchapter II of chapter 53 of title 31.”

Finally, 18 U.S.C. § 1961(1) sets forth the RICO predicates and expressly includes, among those predicates, 18 U.S.C. § 1512. 3 Thus, “[b]y application of § 2461(c), forfeiture of property is mandated for a violation of 18 U.S.C. § 1512, since it is a racketeering activity identified in 18 U.S.C. § 1961(1), which is a specified unlawful activity under 18 U.S.C. § 1956(c)(7)(A).” United States v. Clark, 165 F. Supp. 3d 1215, 1218 (S.D. Fla. 2016) (emphasis added).

The forfeiture law, 18 USC §981, allows for forfeiture when a person profits off any of a bunch of crimes. Terrorism is in there, for example, but Sullivan is not charged with a crime of terrorism (they might get there with Sullivan if he were charged with breaking a window that surely cost more than $1,000 to fix, but they haven’t charged him for that, even though his own video suggests he did break a window and all those windows are ridiculously expensive). Instead, DOJ is using 18 USC §1956, money laundering, to get to forfeiture. Sullivan is not alleged to have laundered money. But that law includes RICO’s predicates among the unlawful activities for which one might launder money. And obstruction, 18 USC §1512, is a specific unlawful activity that may be part of RICO.

That is, they found a crime that Sullivan allegedly committed — obstruction — nested three layers deep in other statutes.

DOJ admits that obstruction hasn’t led to forfeiture all that often — but they’ve found nine cases, none in DC, where it has.

3 There is a limited number of forfeiture allegations paired with § 1512 as the SUA. Section 1512 prohibits (a) killing or assaulting someone with intent to prevent their participation in an official proceeding, (b) intimidating someone to influence their testimony in such a proceeding, (c) corrupting records or obstructing, impeding, or influencing such a proceeding, and (d) harassing or delaying someone’s participation in such a proceeding – crimes that do not often generate profits. Nonetheless, the government has identified at least nine indictments where a § 1512 count was a basis for the forfeiture allegation. See United States v. Clark, 4:13-cr-10034 (S.D. Fla.); United States v. Eury, 1:20CR38-1 (M.D.N.C.); United States v. Ford and Prinster, 3:14-cr45 (D. Or.); United States v. Shabazz, 2:14-cr-20339 (E.D. Mich.); United States v. Cochran, 4:14- cr-22-01-HLM (N.D. Ga.); United States v. Adkins and Meredith, 1:13cr17-1 (N.D. W. Va.); United States v. Faulkner, 3:09-CR-249-D (N.D. Tex.); United States v. Hollnagel, 10 CR 195 (N.D. Ill.); United States v. Bonaventura, 4:02-cr-40026 (D. Mass.). Congress likewise included some of § 1512’s surrounding obstruction-related statutes as SUAs, and forfeiture allegations have also referenced these sister statutes. E.g., United States v. Fisch, 2013 WL 5774876 (S.D. Tex. 2013) (§ 1503 as SUA); United States v. Lustyik, 2015 WL 1401674 (D. Utah 2015) (same).

Of course, those obstruction charges were probably garden variety obstruction (say, threatening trial witnesses for pay), not the already novel application of obstruction that other defendants are challenging.

bmaz may swoop in here and accuse DOJ of using RICO for magical thinking. At the very least, this all seems very precarious, as a matter of law.

I’m all in favor of preventing someone from profiting off insurrection. But this seems like a novel application of law on top of a novel application of law.

Sullivan has a hearing today before Judge Emmet Sullivan, so we may get a sense of whether the judge thinks this invocation of RICO is just magical thinking.

DOJ Moves to Label John Sullivan a Professional Provocateur

/23 Comments/in /by

Yesterday, the government released a superseding indictment for John Earle Sullivan, the guy who filmed video of the insurrection and then sold it to CNN and other media outlets. In addition to adding two crimes for his possession of a knife he boasted of having in his own video but then allegedly lied to the FBI about, the government moved to seize almost $90,000 in forfeiture. The move is an aggressive step that may be justifiable for Sullivan, but has implications for the five or so other propagandists arrested as part of the riot.

Sullivan was first charged, with civil disorder and trespassing, on January 13, after several FBI interviews. His arrest affidavit described how, repeatedly during the video he filmed of the riot, he made comments egging on the rioters. At the moment he caught Ashli Babbitt’s shooting on film, he had pushed himself to the front of that mob by calling out that he had a knife.

When the government first indicted Sullivan on February 3, the added obstruction and abetting charges to the civil disorder and trespass charges. That happened at virtually the same time the government moved to revoke his bail, based off several violations of the limits imposed on his use of social media. Sullivan responded by arguing that all that media contact was his job; his lawyer even provided evidence of the funds CNN have paid him to obtain his video of the insurrection. In response, Sullivan remained on bail with more explicit limits to his Internet access.

The one public discovery notice provided to Sullivan so far includes:

  • Earlier publications showing his efforts as a provocateur, including “Let’s start a riot” and “How to Take Down a Monument”
  • His criminal arrest record that includes association with past outbreaks of violence at protests
  • An interview he did on Infowars after the riot
  • Subpoenas to CenturyLink and Beehive Broadband, suggesting they were tracking traffic on Sullivan’s website

Then things went quiet in his case until, on May 7, his lawyer filed a motion to get funds in a Utah bank released he said had been seized without warning. It argued that Sullivan is entitled to a hearing at which he can contest that he committed a crime and the funds being seized came from the crime.

Accordingly, the federal courts have held that when the government restrains a criminal defendant’s assets before trial on the assertion that they may be subject to forfeiture, due process requires that the defendant be afforded a post-deprivation, pretrial hearing to challenge the restraint. If certain minimal conditions are satisfied, “[t]he wholesale use of…forfeiture proceedings [should cause] grave concern when the Government has clearly focused its law enforcement energies and resources upon a person and attempts to restrain his property….” United States v. $39,000 in Canadian Currency.” 801 F.2d 1210, 1219 n.7 (10th Cir. 1986).

The United States Supreme Court has made clear that pretrial seizure, pursuant to 21 U.S.C. Sec. 853 (f) requires two probable cause findings: (1) that the defendant committed an offense permitting forfeiture and (2) that the property at issue has the requisite connection to that crime.” Kaley v. United States, 134 S. Ct 1090,1095 (2014).

At the outset, defendant notes that he needs the funds in the seized bank account in order to pay his rent and household necessities. Additionally, the proceeds of the seized bank account are not the product of criminal activity alleged in the indictment.

Thus the new indictment, I guess.

The indictment ties the forfeiture not to Sullivan’s civil disorder charge, which would seem to make sense given Sullivan’s past history of profiting off inciting violence at peaceful protests, but instead to Sullivan’s obstruction charge. That seems to argue that Sullivan’s filming of the insurrection, in which he cajoled police to step down (including from the confrontation before Babbitt was shot) and cheered on the seizure of the Capitol, was part of the successful obstruction of the vote count.

Given Sullivan’s past incitement (which, ironically, was well-documented by leftist activists months before Trump supporters and Sullivan’s own brother tried to base an Antifa false flag claim on Sullivan’s presence), this may be a reasonable argument for Sullivan.

But there are at least five other right wing propagandists who were present at the insurrection for whom that might be a really troubling precedent (an InfoWars video editor Sam Montoya also witnessed and magnified Babbitt’s death).

Again, this may all be merited. And perhaps DOJ is tying Sullivan’s new charges for his knife to the seizure. But it seems an important development to track.

Update: Sullivan’s motion for a hearing on the seizures alluded to more discovery. This letter may describe that discovery. It describes a slew of subpoenas, including Square, JP Morgan, Venmo, Discover, Amazon, and others. In other words, the letter reflects a concerted effort to figure out how Sullivan’s finances work.

But the more interesting detail is item 21, reflecting the HIGHLY SENSITIVE estimate from the Architect of the Capitol estimating the cost of replacing a window. Sullivan’s own video strongly implies he broke that window. But he hasn’t been charged with it yet. That’s important, because he could be — and if he is, it could trigger terrorism enhancements.

It was harsh of the government to seize Sullivan’s funds. But what might come next will be far more harsh.

Update: Justin Rohrlich found and shared the seizure warrants. The logic behind this seizure is as follows:

¶31: The affidavit lays out evidence of Sullivan admitting he’s not a journalist, including hims saying on January 5 that he made that claim up “on the fly.”

¶32: A description of how after the riot, Sullivan changed his webpage description to incorporate a claim to be a journalist.

¶34: Citations to the hearing on his release violations in which he presented the contracts he got for the video.

¶35: A brag, right after he left the Capitol, saying, “Everybody’s gonna want this. Nobody has it. I’m selling it, I could make millions of dollars. … I brought my megaphone to instigate shit.”

¶36: A summary of the deposits paid for use of the video.

Y’all Qaeda Northwest: Ethan Nordean Provides Yet More Proof of the Proud Boys’ Sophistication and Resilience

/30 Comments/in , /by

The government and Ethan Nordean are having a dispute that is, at least procedurally, about whether by giving Nordean the Telegram text messages he demanded in prioritized fashion, the government committed a Brady violation. Nordean started this dispute on April 29 with a filing admitting that the texts he received before his detention hearing were the ones he asked for specifically but still complaining that he didn’t get all his texts at once.

Today, the government produced for the first time additional Telegram messages extracted from Nordean’s phone. The government provided no explanation as to why they were produced after the hearing on its third detention motion and not beforehand.1 Like the Telegram chats it used to support detention, today’s production was drawn from the same device (Nordean’s phone), the same app (Telegram), and only postdate by some days the chats the government used to detain Nordean. In reviewing the following chats, the Court may recall that because the Telegram messages are encrypted and, according to the government, “designed to evade law enforcement,” the government would have the Court believe the app users are speaking candidly in Telegram.

On March 25, Nordean requested that the government produce, at least by March 30, Telegram chats on Nordean’s phone sent and received between 1/4/21 and 1/8/21. Nordean did not say that no other chats should be produced, nor did he waive any right to Brady material of which the government was aware. On March 9, Nordean served a discovery letter on the government seeking all of the defendant’s statements and requesting that Brady material be produced according to the schedule in Rule 5.1.

The government response doesn’t point out that they gave Nordean precisely what Nordean asked for. It does describe how they provided Nordean’s Telegram chats in three waves, with the entire content of his phone provided by April 30.

On April 29, 2021, the government produced to defendant Nordean eleven (11) strings of text messages, totaling over 5,000 pages, that contained the terms “Ministry of Self-Defense” or “MOSD,” and that were recovered from defendant Nordean’s phone.

Thereafter, on April 30, 2021, a full copy of an extraction from defendant Nordean’s phone was produced to Nordean’s counsel. That production included approximately 1,172 Telegram message strings (totaling over 1.3 million messages). The extracted text of the Telegram messages in Nordean’s phone runs over 204,000 pages when printed in .pdf format, which does not include any of the images, audio, or video files that are associated with the message strings. In addition to the Telegram messages, the phone contains hundreds of other communications using other platforms, including other encrypted platforms such as Signal and WhatsApp. The government’s review of these message strings, hundreds of which contained communications between December 2020 and January 2021, is ongoing, and all of this information is in defendant Nordean’s possession.

Nordean’s reply doubles down on the accusations of misconduct, now claiming the government intentionally withheld substantiation of Nordean’s claim to have disavowed rallies.

Nordean had presented an audio recording of himself in a conversation with members of his group in which he rejected political rallying. The recording shows him annoyed with how often he had to “repeat himself” on the point. The clip was recorded in February, shortly before his arrest. It is not “self-serving,” as he was communicating with his in-group and through the medium that the government alleges was used “to evade detection.”1 The Court found that the clip “does suggest that, at some point, [Nordean] agreed that the Proud Boys should stop rallying.” Hr’g Trans., 4/19/21, p. 55:21. However, the Court also found that “without any further context there’s no indication that that was some kind of permanent decision.” Id., p. 55:22.

At the time of the hearing, there was “further context.” The government knew it and did not inform the defense or the Court. Shortly after that hearing, on April 29, the government produced late January chats in which Nordean repeatedly discussed “bans on rallies”; in which Nordean said, “fuck politics, build communities and local economy” (Cf. the Court: “politics has not [passed]”); where Nordean endorses the doubly capital notion “THE PROUD BOYS ARE NOT MARCHING ON CAPITAL BUILDINGS”; and in which Nordean reacts dismissively, in real time, to the conspiracy charge supposedly predicating his detention. On its own, the government’s late production of these chats is unequivocally a violation of the Due Process Protections Act and Local Criminal Rule 5.1. It is also a violation of Rule 3.8(e) of the D.C. Rules of Professional Conduct for prosecutors.2

2 “The prosecutor in a criminal case shall not . . . Intentionally fail to disclose to the defense, upon request and at a time when use by the defense is reasonably feasible, any evidence or information that the prosecutor knows or reasonably should know tends to negate the guilt of the accused or mitigate the offense.” Rule 3.8(e) of the D.C. Rules of Professional Conduct.

In his reply Nordean asks a fair question — why the government didn’t just keep screen-capping texts that were a “two-second scroll” down Nordean’s phone from the chats the government had turned over in response to Nordean’s specific request. It seems the government has a reasonable answer: because it was responding to a specific request, though they have yet to say that specifically.

Nevertheless, neither side is treating this as a dispute over misconduct. The government notes that his original motion asks for no relief.

Defendant Nordean’s notice alleging a violation of those provisions (ECF 79) seeks no relief, and no relief or further action by the Court is necessary or appropriate.

Nordean’s reply asks for no relief either. It instead says that he is “developing evidence,” but once again asks for no relief.

The government concludes its response by saying Nordean’s “notice seeks no relief because defendant is entitled to no relief.” ECF No. 84, p. 12. The government is mistaken. The notice sought no relief because Nordean is developing further evidence of the government’s misconduct in filing a series of misleading claims in this matter and in withholding evidence so that it cannot be timely used.

And Nordean goes from that comment — stating that it is incorrect that he asks for no relief by once again asking for no relief — to instead make an argument about bail. (This series of exchanges is actually about preparing a record for Nordean’s detention challenge at the DC Circuit.)

Nordean points to this declaration from Daniel Aurellano stating that Ethan Nordean is no longer the President of Proud Boys Seattle Chapter, because he, Aurellano, was elected to replace him.

Nordean is also developing evidence showing that the premises for revoking his release order are factually mistaken. For example, although Nordean’s leadership role in the Proud Boys was cited to detain him, he is no longer a leader, in any sense of the word, in that organization, nor does he have any decision-making authority, as sworn statements indicate and will further indicate.

Aurellano says he was elected to replace Nordean “in February 2021,” but doesn’t say when that happened. Nor does Aurellano say when, in February 2021, the Proud Boys Northwest chose to dissociate from the national Proud Boys. He does, however, say Nordean stopped participating in Proud Boys Internet communications after his arrest in February 2021. Which suggests Aurellano got elected to replace Nordean at a meeting that Nordean called for while still the head of the chapter, on January 20, and at which Nordean planned to discuss “bugout bags” and “bulk armor deals” because they were “on the brink of absolute war.”

Nordean makes much of the fact that subsequent to this January 20 statement, and so also subsequent to Joe Biggs’ arrest on January 20, he made a series of comments forswearing rallies.

But that means one of the last things Nordean did while still in charge was call for and prepare for war — not to mention to call for bugout bags for which the old passport of one’s ex-wife, such as the one the government alleges (though the allegation is contested) was out on Nordean’s bedroom dresser when the FBI came to search his house — would be acutely valuable. And then everyone started getting arrested and the Proud Boys took steps to cover their tracks.

Amid this whole bail dispute pretending to be a misconduct dispute, however, Nordean has helped to lay out both that this is a remarkably organized militia, and it is adopting a tactic other terrorist groups have in the past: to splinter and rebrand as a way to attempt to evade prosecution, as if the Proud Boys Northwest had adopted the name Y’All Qaeda Northwest like African branches of the Islamic State did.

Thus far, filings in the Proud Boys Leadership conspiracy case have shown that:

  • The Proud Boys started preparing a compartmented cell structure in anticipation of the January 6 insurrection on December 29
  • Enrique Tarrio anticipated he would be arrested when he came to DC on January 4 and so provided for a succession plan
  • Charles Donohoe allegedly attempted to destroy evidence of past planning in the wake of Tarrio’s arrest, specifically in an attempt to avoid gang charges (whether he succeeded or not remains contested)
  • In the aftermath of January 6, the Proud Boys (and Nordean specifically) took steps to prepare for war
  • In Seattle, the Proud Boys responded to Nordean’s arrest by ensuring the continuity of the organization

Again, none of this is exculpatory for Nordean. It shows the Proud Boys operating like sophisticated terrorist groups have operated in the past, in an attempt to retain viability while under government scrutiny.

And along the way, Nordean and the government have been drawing an utterly convincing argument — with two attempts to access passports and an explicit call for bugout bags — that he would flee the country the first chance he got.

January 6: A Change of Pace

/21 Comments/in , /by

Although GWU’s tracker, which is still the best way to keep track of all the January 6 defendants (though this visual story from WaPo using their data is nifty) added four new January 6 defendants yesterday, the pace of new defendants has slowed considerably. While there are still some detention fights, several of those disputes (Proud Boys Ethan Nordean and Joe Biggs, and disorganized conspirators Nate DeGrave and Ronnie Sandlin, as well as Neo-Nazi sympathizer Timothy Hale-Cusanelli — have moved to the DC Circuit.

We’re likely to have more bail revocation fights. The other day, for example, Landon Copeland — who made news for his meltdown during a magistrate judge’s hearing last week — was arrested for some still unidentified bail violation. The government has also moved to revoke Patrick Montgomery’s bail because he — a professional hunting guide — shot a mountain lion that he — a felon — cannot legally possess.

But there are a couple of developments this week that point to what’s going on with this investigation.

Delayed phone exploitation

In a hearing in the case against mother and son defendants Deborah and Salvador Sandoval, Deborah’s attorneys were anxious to move to trial based off an apparent misunderstanding that the evidence on her sole computer device, her smart phone, would show she barely entered the Capitol. Meanwhile, the government revealed that because Salvador chose not to share passwords to his multiple devices, those are taking a lot longer to exploit. As I’ve already noted, Ethan Nordean is the only Proud Boys leadership co-conspirator whose phone DOJ was able to exploit without cracking the password first (the FBI got the password from Nordean’s wife). Exploiting all these phones is going to take a lot of time.

In another case, there appear to be privileged communications on Eric Torrens’ phone, which will delay the exploitation of that for up to four weeks as a filter team reviews the content.

In other words, even before you consider any delay created by FBI’s need to respond to Signal’s Moxie Marlinspike’s exposure of vulnerabilities in Cellebrite’s code, it will take some time to process the vast volume of evidence the government has obtained since January 6.

The network analysis

The arrest of Brittiany Dillon gives a sense of another cause of delay.

Bryan Betancur was one of the first wave of January 6 defendants to be arrested, on January 17, after his parole officer alerted the FBI that he had lied about handing out Bibles to get permission to travel from Baltimore to DC that day. The government got a warrant for his phone on January 20. Once they got into his phone, they discovered text messages between Betancur and Dillon in which Dillon described falling in the door of the Capitol during the riot. The government found video of her — falling down as she entered — on surveillance videos by January 23. The government obtained phone and Google warrants to confirm that Dillon had been inside the Capitol the day of the riot. For some reason, the FBI only got around to interviewing Dillon’s father, ostensibly about Betancur, on April 21; the agent got Dillon’s father to confirm Dillon’s ID while they were talking.

This is similar to what happened with Patrick Montgomery, who like Betancur was arrested on January 17. Only after FBI exploited his phone and found some key pictures did they arrest a buddy he was with that day, Brady Knowlton, while pursuing two others.

These arrests of friends of early arrestees may reflect an FBI agent trying to get arrest numbers, but in a number of cases, they seem to reflect larger investigative strategies based on things investigators have found in the profiles of the original defendant. By my count there are about 18 cases of network arrests aside from the militia conspiracies, and about half of those look like they may be more interesting than friends getting scooped up together. I would expect to see more of this going forward.

Delayed arrests

The two month delay between the time DOJ identified active duty Marine, Major Christopher Warnagiris, as the person who played a key role in keeping the East door of the Capitol open after it was first breached on January 6 and when they arrested him on Wednesday is far more interesting.

As the arrest affidavit explains, FBI isolated Warnagiris as a suspect based on his conduct as shown in video, and then published a Be On the Lookout picture to figure out who he was. On March 16, a former co-worker IDed him, and on March 17, the FBI interviewed one of his current co-workers, who positively IDed Warnagiris.

And that’s it–that’s where the narrative in the affidavit, which was signed on Wednesday, ends. They get a BOLO-based tip on March 16, and get military witnesses to confirm his ID on March 17. And that’s all they’re telling us about who he is and what other evidence they have against him.

I’m sure that’s not all that has transpired since FBI discovered an active duty Major played a key role in keeping the East Capitol breach open.

All the while, someone who by dint of being an active duty service member has clearance, has (as far as we know) been going into Quantico every day for the almost two months since they IDed him. That’s … an interesting investigative decision.

Compare that narrative to the one told in the arrest affidavit of Timothy Hale-Cusanelli, the Army reservist and Nazi-sympathizer who worked as a contractor at Naval Weapons Station Earle in New Jersey. On January 12, an informant told the FBI that Hale-Cusanelli was at the riot, on January 14, the informant recorded a conversation in which Hale-Cusanelli admitted to pushing and shoving along with the rest of the mob. Hale-Cusanelli has been jailed since the very next day, January 15 (he is appealing his detention to the DC Circuit). Hale-Cusanelli has not been charged with assault and he is not known to have played such a key role in compromising the Capitol from a second side.

Now, for many defendants, I can see taking your time after the initial rush of arrests. After all, if they were going to delete their Facebook, that would have happened (and did happen, with a goodly number of defendants) by January 9. But Warnagiris seems like a more urgent risk.

And, remarkably, DOJ apparently did not ask for any special conditions on Warnagiris. He has no location monitoring, no restrictions on possessing a gun, no specificity to his travel around DC (most defendants have stay-away orders, but for people like Warnagiris who are local to DC, they’re sometimes restricted to their District). They did not ask him to surrender his passport. Now, perhaps something is also going on with him in the military. But the whole thing — on top of the inevitable shock of having an active duty officer arrested — raises more questions than other cases.

All of which is to say that, with a defendant who genuinely poses unique security risks, the government is now taking their time to flesh out their investigation.

I’ve said from the start that this investigation has been lightning quick. That’s still, absolutely, true. But there’s going to be a lot more happening behind closed doors in the weeks ahead.