GoToInsurrection and Other Astounding Oath Keeper Social Media Habits

/38 Comments/in , /by

DOJ has now charged the following Oath Keeper associates:

Between all the charges, prosecutors have laid out a breathtaking scope of social media use by the militia:

  • A leadership list on Signal they appear to have obtained from either Watkins and/or Kelly Meggs
  • Open channels on Zello, possibly separate ones for each large event
  • Telephony chats and texts, including during January 6
  • MeWe accounts
  • Way too much blabbing on Facebook, followed by a foolish belief they could delete such content
  • Parler for further blabbing
  • Stripe for payment processing (possibly for dues)
  • GoToMeeting for operational planning

Plus, most of the people arrested thus far had their cell phones on, pinging cell towers, while they were in the Capitol (thus far, two of the accused did not enter the Capitol).

It’s the GoToMeeting revelation, in Harrelson’s affidavit, that gets me:

Pursuant to legal process, the government obtained records from Go To Meeting showing that a user named “gator 6” was the organizer for a meeting titled “dc planning call” on January 3, 2021. The user “gator 6” accessed the meeting from a mobile device using the same IP address ending in 158 [as Harrelson used to access Apple servers], and the user listed themselves as living in Titusville, Florida. Between September 30, 2020, and January 3, 2021, the user with the same IP address ending in 158 attended or organized approximately 30 meetings on Go To Meeting affiliated with the Oath Keepers, using the names “gator 6,” “hotel 26,” or kenneth harrelson.”

GoToMeeting is basically spyware for your computer, because it has to access so many features of your computer to work. As a default it collects a great deal of data on participants, and can be set to collect more. It is end-to-end encrypted, but with legal process FBI might be able to get a great deal of information from GTM, if the Oath Keepers kept it.

Between these twelve people, then, DOJ has served legal process on enough databases to create a veritable dossier on the Oath Keepers. While some of these comms (such as the Zello comms) are ephemeral, Facebook and GoToMeeting and Stripe are data vacuums.

With a database like this, the government can be choosy about which Oath Keepers they arrest. Reportedly, DOJ says they may add 6 more people to their collection of Oath Keeper defendants.

Indeed, it’s not really clear why they’ve charged the last three — Minuta, James, and Harrelson — before charging the last several members of the Stack that entered the Capitol together.

Harrelson was not part of the Stack, but the affidavit justifying his arrest shows him — and another guy — in communication as the Stack came up the Capitol steps, with Harrelson interacting with Graydon Young inside the Capitol. But his organizing efforts in Florida would put him in close touch with the Meggses (Kelly leads the Florida chapter) and James (who lives in Alabama but seems to be tied to the Florida chapter), along with Young (who lives in Titusville).

These Florida Oath Keepers were providing “security” for Roger Stone well before the January insurrection, including an event in Florida. (MoJo had a summary of who provided security when yesterday.)

As for Minuta, in addition to serving as Stone’s security on January 5 and 6, he also was abusive to cops before entering the Capitol and on his way out, when he promised the Second Amendment option came next. Like Young, Minuta is also accused of deleting Facebook, probably just as unsuccessfully.

In James’ case, DOJ seems particularly interested in the communications he had with Minuta, called Person Five in the affidavit even though he was already arrested by the time it was approved.

While James stood with the other Oath Keepers, at least one of them (who will be referred to below as “Person Five”)2 aggressively berated and taunted U.S. Capitol police officers responsible for protecting the Capitol and the representatives inside.

[snip]

Records indicate that phone number XXX-XXX-4304 (associated with James) exchanged a number of phone calls throughout November and December 2020 with a person who will be referred to herein as Person Five.

On November 13 and 14, 2020, for example, phone number XXX-XXX-4304 (associated with James) exchanged approximately eight calls with the number associated with Person Five. Your affiant is aware that certain Oath Keepers attended rallies in Washington, D.C., held on November 14, 2020, at which some Oath Keepers, to include Person Five, operated as a personal security detail for one or more speakers at the events.

Later, on or around November 20 and December 11, 2020, records indicate that phone number XXX-XXX-4304 (associated with James) exchanged two phone calls with Person Five. Your affiant is aware that certain Oath Keepers attended rallies in Washington, D.C., held on December 12, 2020, to protest the results of the 2020 election—at which some Oath Keepers, to include Person Five, operated as a personal security detail for speakers at the events.

Finally, records indicate that, on or around January 5, 2021, phone number XXXXXX-4304 (associated with James) exchanged six calls with the number associated with Person Five. That day, James, Person Five, and other individuals wearing apparel with the Oath Keepers name and/or insignia provided security to a speaker at the “Stop the Steal” events planned for that day.

Note that Minuta was hanging out with Proud Boy Dominic Pezzola in that December MAGA event.

James’ affidavit ends with this group photo, identifying Connie Meggs, two still uncharged Stack participants, four uncharged people who tracked with James and Minuta during the insurrection, Kelly Meggs, and another Stack member.

Both the Minuta and James affidavits focus on Oath Keeper head Stewart Rhodes, described as Person One, as does this detailed filing opposing bail for Caldwell.

James stayed in touch with others during the time of active investigation:

Since January 6, 2021, phone number XXX-XXX-4304 (known to be associated with James) has exchanged multiple phone calls and text messages with the number associated with Person Five. The number associated with James has also placed at least one call as recently as February 2021, to a phone number known to be associated with Kelly Meggs, the now-arrested self-described Florida Oath Keeper leader.

Thus far, DOJ isn’t explaining why Minuta, James, and Harrelson were arrested in the weeks after FBI started exploiting the Signal chats that organized Oath Keeper efforts on January 6 and, particular, Kelly Meggs’ communications.

But because the Oath Keepers were such promiscuous users of all kinds of social media tools, the FBI has a remarkable collection of data about the group’s activities since last fall. And they’ve picked these guys to arrest.

Update: In his detention hearing today, the FBI focused on James’ providing security for Stone.

The FBI agent who testified at Thursday’s hearing said several firearms were found during a search warrant executed at James’ home. All of the firearms were legal, and none were confiscated. They included a shotgun, a hunting rifle, a few “AR-15 style rifles,” and two pistols, the agent said.

James was paid $1,500 for security at two events, including a “Stop the Steal” rally on January 6, according from testimony from his wife, Audrey James. Stone and other pro-Trump figures held several events in Washington in addition to the official rally that Trump spoke at shortly before the attack.

Audrey James said she was sent “around $1,500 total” directly from the Oath Keepers over a mobile app. She stated the funds were paid out over a couple of months to assist her and her children during Joshua James’ absence to Texas and Washington, DC, while he was providing security. She said she didn’t know where the money originated from.

This story, by itself, presents real problems with the story Stone told. He raised funds for “security” in advance of the insurrection, but then said he couldn’t find paid security so relied on volunteers.

Arrest First, Learn about Right Wing Terrorism Later

/46 Comments/in , /by

In his Senate testimony the other day, FBI Director Chris Wray was not particularly cognizant of the granular details of the investigation into January 6. But he said something else, repeatedly, that bears consideration.

In response to a Dick Durbin question about whether he agrees that the Capitol attack involved white supremacists and other violent extremists, Wray responded by explaining that as the FBI arrests more and more people, it is developing a better understanding of the motivations behind those involved in the attack.

We’re seeing quite a number, as we’re building out the cases on the individuals we’ve arrested for the violence, quite a number of what we would call militia violent extremists, so we have a number who self-identify with, you know, the Proud Boys or the Oath Keepers, things like that. We also have a couple of instances where we’ve already identified individuals involved in the criminal behavior who we would put in the racially motivated extremists who advocate for what you would call sort of white supremacy. Some of those individuals, as well — one of the things that is happening is part of this is that as we build out the cases on the individuals when we arrest them for the violence we’re getting a richer and richer understanding of different people’s motivations.

Then, in response to a Chuck Grassley question about how the FBI will learn more about alleged left wing extremists (which Wray answered for anarchists), Wray said that by arresting these people, the FBI is learning about their tactics and tradecraft.

I think as with any domestic terrorism threat or, frankly, any counterterrorism threat more broadly, we’re also looking to develop more and better sources so we get more visibility and insight into the plans and intentions, tactic, tactics, procedures of any group of violent extremists. Another is to get better at how to navigate around some of the operational trade craft that they use. So, the more times, the more arrests we see and this is relevant both for the anarchist violent extremists and the racially motivated violent extremists, for example, the more arrests you see, that’s obviously good news that we’re arresting people that need to be arrested. There’s a whole ‘nother part of that is really important. The more arrests we make, the more from those cases we learn about who else their contacts are, what their tactics are, what their strategies are, et cetera. And that makes us smarter, better able to get in front of the threat going forward.

Finally, when Amy Klobuchar asked if the attack was planned and coordinated, Wray first responded that there were aspects that had been planned. Then, in response to a specific question about the Proud Boys’ coordination, Wray explained that the FBI is escalating charges after initial arrests based on what they learn subsequent to the initial arrest.

There have been a growing number of charges as we continue to build out the investigation, either individuals who are now starting to get arrested involving charges that involve more things like planning and coordination or in some instances individuals who were charged with more simple offenses, but now we’re superseding as we build out more of an understanding of what people were involved in. And there were clearly some individuals involved, which I would consider the most dangerous, the most serious cases among the group, who did have plans and intentions and some level of coordination.

None of this is surprising. It has been apparent from the court filings in the investigation.

But the significance of it is worth considering. The FBI blew it in advance of the attack for reasons that have yet to be confirmed but at least seem to arise from an unwillingness to see right wing terrorism being planned in plain sight. But, as I’ve repeatedly said, the nature of the attack is such that every single person who entered the Capitol and many of those who remained outside, physically fighting cops, committed a crime. And so, based on those trespass crimes, the FBI is arresting a lot of people. Because that’s the way the investigation has rolled out — and because, for every single trespass defendant, the record of what they said about their actions in advance make the difference between getting charged for obstructing the vote count or not — it means the FBI arrests people before they’ve done a lot of investigation they otherwise might do before an arrest. For better and worse, that means that the FBI is arresting people and then conducting intrusive collection on them, starting with their cell phone, even for people who seem to be just trespass defendants. That further means that the FBI will get access to communications that will support conspiracy charges when they otherwise would have a difficult time making such charges without a domestic terrorism statute.

There are real problems with this approach — Oath Keeper affiliate Jon Ryan Schaffer moved to dismiss the charges against him because DOJ has left him in an Indiana jail for 48 days without obtaining an indictment. For existing networks that aren’t recognizably a militia, I’m fairly certain the FBI is not seeing associations until after initial detention bids have been lost. Prosecutors have had to backtrack on claims with some notable defendants (such as Ethan Nordean, who got sent released to home confinement as a result).

But it means the FBI will obtain a far more detailed understanding of some of these people than they otherwise would have been able to get. And as it does so, it is seeing the networks of conspiracy that they otherwise might not have.

FBI Seems Confident in the Granularity of Their Capitol Cell Tower Dumps

/119 Comments/in , /by

In the grand scheme of schemes leading up to the January 6 insurrection, Larry Stackhouse appears to play a minuscule role. Like over a hundred other people, according to his arrest warrant, he walked inside the Capitol and now, weeks after his colleagues reported him to the FBI, he is getting charged with misdemeanor trespassing as a result.

I’m interested in him, though, because of the evidence against him. First, there are the co-workers who, because of their obvious exhaustion with Stackhouse’s vocal support for Donald Trump, might be easy to discredit:

On approximately February 5 and 11, 2021, a witness (“W 1”) was interviewed by law enforcement. WI reported to law enforcement that it was “common knowledge” among those who worked with Larry Stackhouse (“STACKHOUSE”), that STACKHOUSE had entered the Capitol on January 6, 2021. WI stated that STACKHOUSE had called out of work on January 5 and 6, 2021 and that STACKHOUSE had previously been reprimanded at work for displaying political signs and attires in support of former President Trump, which violated their employer’s policies. WI initially stated that STACKHOUSE had been identified by his employer as being associated with “hate groups” from his social media, but later clarified that the employer had no information that STACKHOUSE supported hate groups. Rather, STACKHOUSE was a strong supporter of President Trump who had expressed that support at work in a manner inconsistent with the employer’s policies.

Unlike most referring friends, families, and disgruntled colleagues that serve as witnesses for these affidavits, W1 doesn’t claim to have seen Stackhouse post anything to social media from his trip.

The affidavit does cite social media from Stackhouse. But it’s a picture posted to Telegram from outside the Capitol, which is not a crime.

The affidavit cites “videos and images” from inside the Capitol showing Stackhouse, but the only one included is not all that clear.

The only other piece of evidence substantiating the affidavit — the one I’m interested in — is the claim that Stackhouse’s phone was picked up on an AT&T cell site consistent with being inside the Capitol.

According to records obtained through a search warrant which was served on AT&T on January 6, 2021, in and around the time of the incident, the device associated with cellular telephone number ***-***-6199 was identified as having utilized a cell site consistent with providing service to a geographic area that includes the interior of the U.S. Capitol building.

Given the date, this must be a cell tower dump — the FBI didn’t have their first tip on Stackhouse until a month later (which would also mean the FBI obtained that dump on the day of the attack). And while the FBI uses careful language that a cell tower dump only shows what the service area includes, using it as the third data point to substantiate an otherwise thin arrest warrant suggests they’re pretty confident that it includes only the Capitol (because, again, standing outside is not a crime).

Likewise, the FBI used cell site data (this time, from Verizon) to substantiate an otherwise thin part of the affidavit against someone who does matter to grander schemes: Roberto Minuta, the Oath Keeper who went from providing “security” for Roger Stone to storming the Capitol.

Minuta is charged with three crimes: Obstruction of the vote count (easily substantiated with parts of the larger Oath Keeper conspiracy) obstruction of the investigation for deleting his Facebook account on January 13, and the trespass crime everyone gets charged with.

There are unsurprisingly, given the focused attention to the Oath Keepers’ movements that day, more pictures of Minuta inside or existing the Capitol than of Stackhouse, tied together by the goggles Minuta wore and, in several frames, his Oath Keeper badge.

At least in what the FBI chose to reveal in this affidavit (other filings suggest they have far more collected on him and a range of his associates), the other piece of evidence included proving that Minuta entered the Capitol — rather than yelled at cops outside — is his use of a Verizon cell site consistent with being inside the Capitol.

Eventually, Minuta unlawfully breached the Capitol building itself. According to records obtained through a search warrant, which was served on Verizon, the cellphone associated with XXX-XXX-4147 was identified as having used a cell site consistent with providing service to a geographic area that includes the interior of the United States Capitol building on January 6, 2021, the day of the attack on the Capitol.

Unlike with Stackhouse, the government needs to ensure Minuta’s prosecution is water-tight, as he is a key link between the raid itself and Trump flunkies like Roger Stone, and he and several of the Oath Keeper defendants have already shown a desire to undermine the entire premise of the investigation.

As I have noted elsewhere, the granularity of the cell tower data is a critical factor in assessing the privacy impact of its use in the investigation (reiterating that reported broader cell tower dumps taken in an effort to identify the elusive pipe bomber do pose more concern). And these claims will undoubtedly be tested.

Still, the FBI seems to have confidence that these cell sites were not just serving traffic “consistent with” being inside the Capitol, but probably even “exclusive to” being inside.

Update: In an arrest affidavit for Jared Adams, arrested for trespass crimes, the FBI conveniently included a map of how the Google GeoFence works, as well as a description of how they moved from Instagram to Adams’ Google account.


First they used his Instagram to get his Gmail account.

Instagram records confirmed that the Instagram account jokerschild1994 is associated with ADAMS, with an e-mail address of [email protected], and T-Mobile phone number ***-***-5569. Records provided by Facebook (username jared.adams.35325) include the same e-mail address and phone number. Records lawfully provided by Google reveal that the mobile device associated with [email protected] belonged to a Google account registered in the name of Jared Hunter ADAMS. The Google account also lists a recovery SMS phone number that matches ***-***5569, the same number as identified above. Information from law enforcement databases indicates that ADAMS lives in Plain City, Ohio. The FBI reviewed ADAMS’ application for an Ohio driver’s license, which contains the same phone number (***-***-5569)). In addition, three managers of apartment complexes where ADAMS either lived or applied for an apartment between 2017 and July 2019 also confirmed his phone number.

Then they used the Google account to geolocate Adams within the specific space of the Capitol (using, as earlier affidavits relying on Google GeoFence have, GPS, WiFi, and Bluetooth).

According to records lawfully obtained from Google, a mobile device associated with [email protected] was present at the U.S. Capitol on January 6, 2021. Google estimates device location using sources including GPS data and information about nearby Wi-Fi access points and Bluetooth beacons. This location data varies in its accuracy, depending on the source(s) of the data. As a result, Google assigns a “maps display radius” for each location data point. Thus, where Google estimates that its location data is accurate to within 10 meters, Google assigns a “maps display radius” of 10 meters to the location data point. Finally, Google reports that its “maps display radius” reflects the actual location of the covered device approximately 68% of the time. In this case, Google location data shows that a device associated with [email protected] was within the U.S. Capitol from approximately 2:53 p.m. until approximately 4:40 p.m. for a total approximate time inside the U.S. Capitol of one hour and 47 minutes. Google records show that the “maps display radius” for this location data was less than 100 feet, which encompasses an area that is partially within the U.S. Capitol Building.

As illustrated in the map below, the listed locations encompass areas that are partially within the U.S. Capitol Building during 2:53 p.m. until 4:40 p.m. Specifically, Google location data shows that a device associated with [email protected] was within the U.S. Capitol at the times and locations shown in the map below (at the locations reflected by each darker blue circle), with the “maps display radius” reflected in the map below (as reflected in a lighter blue ring around each darker blue circle). In addition, as illustrated in the map below, the listed locations were entirely within areas of the U.S. Capitol Grounds which were restricted on January 6, 2021.

This reflects the same 68% confidence as an earlier use of the Geofence.

The FBI then used the GeoFence information to pull security footage showing him in the place where Google said he was. They then got his former roommate to ID him from a photo.

 

FBI Had an Open Investigation into a QAnon Cultist Predicting World War 3 before January 6

/47 Comments/in , /by

As I noted in this post, partly due to the way Krysten Sinema restated Assistant FBI Director Jill Sanborn’s response, the woman in charge of FBI’s counterterrorism efforts mistakenly claimed that the Bureau cannot monitor public social media communications. The reality — as confirmed by NBC — is that they can’t persistently target a person’s communications, but they can monitor open source postings.

In a statement to NBC News, the FBI acknowledged that it can and does look at public social media information. An FBI official said Sanborn understood Sinema’s question to be referring to “whether the FBI persistently and passively examines internet traffic and social media conversations, to include direct messages between two users.” In fact, her question referred to comments made on public-facing social media services.

“The FBI may observe and collect information from open sources as long as the FBI activities are done for a valid law enforcement or national security purpose and in a manner that does not unduly infringe upon the speaker or author’s ability to deliver his or her message,” an FBI official said. “The authorized purpose must specifically be tied to federal criminal or national security purposes, usually to further an FBI assessment or … investigation.”

Given that the FBI can monitor open source communications, it makes this earlier exchange, between Sanborn and Maggie Hassan, more significant. Senator Hassan asked Sanborn how many of the people already arrested in the January 6 insurrection had been under investigation before it.

Maggie Hassan: Of the individuals charged to day in relation to the attacks of January 6, how many were already under investigation by the Bureau.

Jill Sanborn: Ma’am, I’d have to get you the specific number, but I can only recall, from my memory, one, of the individuals that was under investigation prior.

While Sanborn was speaking from memory and promised to get an exact number, Sanborn could only remember one open investigation among the people arrested so far.

FBI appears to have done an assessment on at least three people arrested so far (assuming that the MPD arrest of Enrique Tarrio for targeting a Black Church in December is not the one Sanborn was thinking of).

For example, in December, an associate of Kevin Strong contacted the FBI to alert them that the FAA employee had started stock-piling goods, warned someone else that World War 3 was going to start on January 6, and was pushing Parler as a legitimate source of information. That led the FBI to open an investigation on Strong on December 30.

On December 30, 2020, the FBI initiated an investigation of STRONG based on reporting from Witness #1 (“W-1”). W-1 is familiar with STRONG and his previous residence. W-1 told the FBI that STRONG had been showing signs of behavioral changes over the last few months including stock-piling items and telling others to get ready for Marshal Law, rioting, and protesting. Specifically, W-1 was aware that STRONG had sent messages to another individual claiming World War 3 is going to occur on January 6, 2021, and that the military was coming in and getting involved. W-1 was aware that STRONG hung a flag with the logo “WW1WGA” on his house. W-1 told the FBI that he/she looked it up on the Internet and found that that “WWG1WGA” was a QAnon slogan standing for “Where We Go One, We Go All.” STRONG was known to declare that he had “Q clearance” and believed he was part of a “movement” that was greater than himself. He had recently purchased a new truck and believed that QAnon would cover the debt. STRONG had also been promoting the “Parler” application as a place to get information.

STRONG is currently employed by the Federal Aviation Administration (FAA) in San Bernardino, California. On January 7, 2021, an employee in the Internal Investigations Branch of the FAA contacted the FBI and reported STRONG was observed at the United States Capitol building during the unlawful entry that took place on January 6, 2021. According to the FAA employee, STRONG was seen on a news broadcast.1 The employee provided a screengrab from the news broadcast to law enforcement.

Strong was charged with the two misdemeanor trespassing crimes virtually everyone who entered the Capitol was charged with but not, as those who posted conspiracies about the election in advance of January 6 generally were, with obstruction of the vote count.

Even though they had an investigation into Strong, it still took a tip from the FAA to alert the FBI that Strong had entered the Capitol on January 6, to which he readily confessed when he was interviewed on January 16.

Then there’s Bryan Betancur. While out on probation after serving time for burglary, Betancur was explicitly talking about following the lead of James Field, the Neo-Nazi who murdered Heather Heyer.

BETANCUR is a self-professed white supremacist who has made statements to law enforcement officers that he is a member of several white supremacy organizations. BETANCUR has voiced homicidal ideations, made comments about conducting a school shooting, and has researched mass shootings. BETANCUR voiced support for James Fields, the individual convicted for killing an individual with his car during protests in Charlottesville, Virginia. BETANCUR has stated he wanted to run people over with a vehicle and kill people in a church. BETANCUR subsequently stated that he had changed his mind about hurting people.

After being released following a conviction for fourth degree burglary, BETANCUR continued to engage racially motivated violent extremist groups on the internet. BETANCUR also made increased verbalizations about his desire to be a “lone wolf killer.” BETANCUR has repeatedly violated the terms of his parole and probation.

Betancur’s arrest affidavit describes a Task Force officer interviewing Betancur repeatedly during what it calls an investigation of him.

A FBI Task Force Officer who has interviewed BETANCUR multiple times throughout the FBI’s investigation of BETANCUR also believes the individual on the left side of the image to be BETANCUR.

Betancur lied to his probation officer — claiming he was going to hand out Bibles in DC — to get permission to go to DC that day. And he showed up wearing a Proud Boys shirt and flashing white supremacist symbols and (in another picture) waving a Confederate flag.

In spite of the fact that this guy was aspiring to replicate Field’s attack and the apparent fact he was under investigation, the FBI affidavit suggests they needed a cooperating witness to ID Betancourt’s social media accounts.

Your affiant has also reviewed screenshots of accounts believed to belong to BETANCUR, provided by a cooperating witness (hereafter “CW1”). CW1 submitted an image to the tip-line established in the aftermath of the events of January 6, 2021. CW1 provided comments with this image stating that the individual in the screenshot had participated in the events at the U.S. Capitol on January 6, 2021 and posted numerous images using social media accounts with the names Bryan Clooney and Maximo Clooney. In the image CW1 submitted to the tip-line, a social media user with the user name “bryan_patriot_1776” appears to stand on scaffolding erected on the western side of the U.S. Capitol Building holding the corner of a confederate battle flag.

Like Strong, Betancur was charged with just misdemeanor trespassing charges, though he’s back in trouble in Maryland for violating probation.

A third defendant the FBI investigated before the insurrection is perhaps the most damning for what it says about the social media activity the FBI will notice.

The FBI is coy about two details in the arrest affidavit for Rasha Abual-Ragheb: One is when the Newark Office obtained Abual-Ragheb’s Facebook data, before or after January 6.

In addition, FBI Newark Division (FBI Newark) recently obtained, through legal process, records associated with the Facebook account with the display name Rasha Abu. The Facebook records link the Rasha Abu account to the same phone number that Rasha Abual-Ragheb provided the interviewing agents in November of 2020. FBI Newark also recently obtained, through legal process, records associated with the phone number provided by Rasha Abual-Ragheb, which confirmed Rasha Abual-Ragheb was in fact the subscriber.

And given that so many people have written affidavits in this investigation, it’s unclear whether the two people identified as “Confidential Human Sources” reporting back to the Philadelphia FBI Office in Abual-Ragheb’s arrest warrant are, as the name would normally suggest, FBI informants, or whether they’re just concerned citizens calling in tips as happened with the vast majority of tips on January 6 defendants.

On January 7, 2021, CHS 1 reported to the FBI Philadelphia Division (FBI Philadelphia) that he/she observed Rasha Abual-Ragheb’s Facebook page (display name Rasha Abu) showing Rasha Abual-Ragheb at the protest in Washington, DC on January 6, 2021 (attachment 1). A post made by Rasha Abual-Ragheb on the Facebook page revealed she checked into the Kimpton George Hotel (attachment 2). In another Facebook post (attachment 3), Rasha Abual-Ragheb posted the following: “Just left Dc… I got tear gas, paper spray!!! But I was part of the history. We the people won’t take it anymore. Antifa were between us, i and other MAGA people told Dc police, get that Antifa they didn’t do anything. He had black metal chair… The police would order to use full force on us from the beginning when we start marching to the capital, the use teargas and pepper spray and rubber bullet, they shot the woman that was standing peacefully without a a weapon, they hit women’s kids. They hit people with the pat metal one.”

On January 6, 2021, Confidential Human Source #2 (CHS 2) advised the FBI Philadelphia that on the night of January 6, 2021, CHS 2 encountered a woman on the sidewalk of the Kimpton George Hotel in Washington D.C. dressed in distinct clothing and making a scene (attachment 4, which was photo taken by CHS). The woman on the sidewalk identified herself as “Rasha,” admitted to being in the U.S. Capitol, and showed CHS 2 a picture of herself in the building (attachment 5). CHS 2 further reported Rasha Abual-Ragheb said she was in the U.S. Capitol and saw a woman get shot.

Still, what is clear is that, back in November, the FBI responded to Abual-Ragheb making inflammatory comments and repeating Donald Trump’s “Stand By” comment on social media by conducting — at a minimum — an Assessment against her, including an FBI interview.

In November 2020, a Facebook account with display name Rasha Abu participated in Facebook and Telegram group chats involving the New Jersey chapter of the American Patriot 3%. In the Facebook chat, user Rasha Abu advised the revolution will start not by standing by but by standing up. In addition, she advised civil war is coming and they need to show support, and rise up and fight for our Constitution. Open Source research identified an individual named Rasha Abual-Ragheb, residing at a specific address in New Jersey, as the possible user of the Facebook account. As part of the FBI’s assessment of Rasha Abual-Ragheb, she was interviewed. During the interview, she advised she was a Trump supporter, attended Trump rallies, and was blocked from making posts on Facebook and Twitter for pro-Trump postings. Additionally, Rasha AbualRagheb advised she was born in Lebanon and fled to Jordan when she was a child due to the civil war there. She further advised that she has lived in the United States for 21 years and she provided the interviewing agents with her telephone number.

Like Strong and Betancur, Abual-Ragheb was charged with just the two misdemeanor charges.

While her attorney, Elia Amato, could provide no clarity on whether the investigation into Abual-Ragheb continued from November through January 6 — possibly up to and including arranging for informants to track her movements on the day of the attack — Amato did emphasize that, “What ever prior investigative concerns law enforcement may have had appear to have been quashed.”

Still, it’s clear that, almost alone among 300 people charged so far, the FBI had noticed Abual-Ragheb’s public comments on social media and taken further investigative steps.

Jill Sanborn excused FBI’s failure to see the insurrection in advance based off obfuscation about the Bureau’s ability to observe and react to comments in public. But the Bureau did identify a potential threat and conduct an assessment in Abual-Ragheb’s case.

That also means they did that — almost uniquely — with an immigrant who has a Middle Eastern name, while ignoring others, many with criminal records, who made far more substantive or inflammatory comments.

The FBI didn’t respond to Proud Boy Enrique Tarrio’s plans for January 6 in plain sight, even though he had committed a racially motivated attack the last time he had been in DC.

They didn’t see and respond to Facebook posts from Three Percenter Michael Lopatic, the former Marine who spent the months after the election naming his hunting kill after Joe Biden, Kamala Harris, Chuck Schumer, Nancy Pelosi, Jerry Nadler, and Adam Schiff, posted a “Call to Arms,” in advance of January 6, and is accused of assaulting at least two cops at the insurrection.

They did see the woman on Three Percenter sites with an Arab name.

Meanwhile, by dint of opening an investigation into Kevin Strong, the FBI had evidence that delusional QAnon followers believed there would be Martial law and World War 3 on January 6, a description of January 6 as “war” in the FBI’s hands a week before the January 5 Norfolk report.

But that didn’t raise a wider alarm, either.

Now that the FBI has conceded that it had the authority to look at any of the social media discussions that led others to anticipate that January 6 would be something different, it has more some explaining to do — not least why one of the only January 6 participants it discovered in advance was virtually the only one with an Arab name.

FBI and DHS Aren’t Using the Free Expertise on Right Wing Terrorism While Looking to Pay for It

/58 Comments/in , , /by

There was a remarkable moment in the Homeland Security/Rules hearing on January 6 the other day. Krysten Sinema asked whether FBI knew of the conversations on social media where people were openly planning for insurrection. FBI’s Assistant Director for Counterterrorism, Jill Sanborn, explained they did not know of them because the Bureau couldn’t collect on the social media of Americans without a predicated investigation.

Krysten Sinema: Was the FBI aware of these specific conversations on social media?

Jill Sanborn: To my knowledge, no ma’am, and I’ll just sort of articulate why that is. So under our authorities, because, being mindful of the First Amendment and our dual-hatted mission to uphold the Constitution, we cannot collect First Amendment protected activities without, sort of the next step, which is the intent, and so we’d have to have an already-predicated investigation that allowed us access to those comms and/or a lead or a tip or a report from a community citizen or a fellow law enforcement partner for us to gather that information.

Sinema: So the FBI does not monitor publicly-available social media conversations?

Sanborn: Correct, ma’am, it’s not within our authorities.

For what it’s worth, Sanborn’s first comment was about collecting on social media. Sinema then treated that as a limitation on monitoring it (and Sanborn didn’t correct her). Still, Sanborn explained away FBI’s failure to see the insurrection many of the rest of us were seeing develop in real time by saying that discovering it would have required tracking Americans’ protected speech.

A more revealing moment came elsewhere, when Sanborn revealed that just one person who has been arrested in the wake of the attack had already been under investigation. That means, in spite of the Proud Boys’ threat, with Roger Stone, against Amy Berman Jackson two years ago, the FBI didn’t have an enterprise investigation into them (or the Oath Keepers or a range of other extremist organizations involved in the attack). So, because the FBI was not investigating the Proud Boys, the Proud Boys were able to plan an insurrection in plain sight.

That has changed, of course.

Later in the hearing, Mark Warner — citing all the FBI’s warnings in recent years about what a lethal threat white supremacist terrorism is — asked both Sanborn and the woman currently running DHS’ Office of Intelligence and Analysis, Melissa Smislova, what they’re doing to improve things and whether they’re using any of the open source experts out there.

Sanborn talked about working with “partners” (which I took to mean social media companies) and Fusion centers. Smislova revealed that DHS is looking to contract with experts on the topic, rather than read what those experts produce on a regular basis.

Mark Warner: I appreciate Ms. Sanborn’s appropriate response that they not arbitrarily collect off of American citizens if there’s not some nexus, but I do think it’s important, I think others have mentioned this that Domestic Violent Extremists didn’t start with January 6. They didn’t start with Donald Trump. They’re not going to end with January 6. They’re not going to end with Donald Trump. In my state we saw, a few year’s back, the Unite the Right rally at Charlottesville where many of these same groups and affiliations came together in another violent effort where one protestor was killed, we unfortunately lost a couple members of our State Police. Director Wray has repeatedly said in testimony before the Intelligence Committee, the Worldwide Threat Assessment, that Domestic Violent Extremists are a major national security threat to this country. I personally believe that that message was downplayed during the previous Administration because they didn’t want to hear it. I want to start with Ms. Smislova and Assistant Director Sanborn — Director Sanborn it’s great to see you again — is that, recognizing the constraints that are placed upon you in terms of collections, and also acknowledging that this threat has been around for some time. The FBI in particular has acknowledged that it is an extraordinary major severe threat, what have you both been able to do in engaging in open source intelligence and independent research communities to better identify these DVEs. I know in the run-up to the January 6 insurrection there was research done by Harvard’s John Donovan and Elon University’s Megan Squire as well as other researchers that pointed to the fact that these DVEs and affiliated groups, oftentimes groups that are working in conjunction with groups in Europe, were planning this effort. So how are you both, DHS and FBI, utilizing these independent researchers, these open source activities, and making sure we’ve got a better handle on it, recognizing your appropriate constraints on what you can do directly?

Melissa Smislova: Yes, Senator, thank you for the question. We just last week met as, as inside I&A, to discuss contracting with some of those experts outside. We are aware that we need to invest more in our understanding of Domestic Terror, we understand as well that it will require a different approach than a traditional Intelligence Community approach, we must use different sources to understand this threat, we are looking to get outside experts, invest more in-house, we are secondly looking at how to better understand the social media world, so we can better focus on where we might find specific and insightful information about what the adversary is thinking about. We are additionally looking to partner more with our state and local colleagues who we know have a different perspective on this threat and have more information, in some cases, than we do, and we are also, again, partnering more across the department and with our federal partners, increasing our relationships with FBI.

Warner: Ms. Sanborn?

Jill Sanborn: Thank you Senator, nice to see you again as well. I’d sort of say what we’re trying to do, and I’ll put it in three buckets, really, for you. Increasing our private sector is 100%, I have a section just inside my division that does nothing but partner engagement. We have found that the better we educate them on the threat we’re facing and painting a picture for them of what those threats we are, they’re better able to pay attention and collect and refer information to us and that is helpful and that’s when we talk about the fact that 50% of our tips and leads to our cases, or predication for our cases come from that relationship and that education. We’re also, same as my colleague said, using the state and local partners, so we leverage the Fusion centers a lot and their ability and their expertise — and the Orange County Fusion Center is a great example of leading, sort of, the analytics of social media and leveraging their expertise to predicate cases and they were actually behind the predication of the case, The Base, that we disrupted. And then last, I’d say, challenging ourselves for better collection inside, right, trying to point our sources and our collection to be in the right places to collect the intelligence that we need and that is what led to the Norfolk SIR, that is us pointing our collection in a space that gathered that information.

Warner: I have to tell you, respectfully, I’m pretty disappointed with both of your answers. This is not a new threat, we’ve seen since 2016 election how foreign adversaries manipulate social media, hear repeatedly from DHS and FBI that we’re going to get better at collecting. We saw the Unite the Right rally in Charlottesville. We heard people say we’re gonna get better at collecting information and better partnering, neither one of your referenced — there’s literally a host of experts at academia, at organizations like Graphika, and others that are monitoring the DVEs and their activities, oftentimes in their connections to anti-government groups in Europe, again, oftentimes amplified by nations like Russia, and I guess we’re always going to get ready and we’re somehow surprised when we see the kind of chaos that took place on January 6th.

Mark Warner proceeded to chew out both FBI and DHS’s witnesses given that, even after he raised open source expertise available, neither mentioned relying on it.

I hope Warner is paying attention to Huffington Post’s recent reporting. On February 26, relying on the work of some anti-fascist researchers, HuffPo identified Danny Rodriguez as the likely culprit behind the tasing of DC cop Michael Fanone, which led him to suffer a mild heart attack. HuffPo also reported that the FBI had gotten tips IDing Rodriguez in January, but had done nothing to call those who submitted the tips until HuffPo called the Bureau for comment.

The man in the red “MAKE AMERICA GREAT AGAIN” hat seemed to think he was untouchable. He joined the mob as they yelled “HEAVE! HO!” and tried to force their way through a police line into the Capitol building. Once inside, he used a pole to ram against a window, trying to shatter it and bring more people into the Capitol. In the most disturbing footage of all, he was caught on camera appearing to shock D.C. Metropolitan Police Officer Mike Fanone with a stun gun. As rioters push Fanone down the stairs and away from other cops, video shows the man in the red cap pressing a small black device against the officer’s neck. Fanone instantly drops to the ground, swallowed by the mob.

[snip]

His assailant in the red MAGA hat, who has been at large since the insurrection, is 38-year-old Daniel Joseph Rodriguez from Fontana, California, HuffPost can confirm.

Rodriguez, who goes by “Danny” and “DJ,” is well known among Trump supporters in the Los Angeles area as a superfan of the former president. Multiple news outlets have featured him in their coverage of the local pro-Trump movement in recent years, in articles that included his name and photo. He regularly attended the weekly Trump rallies in Beverly Hills last year. He was recognizable there by his dark-rimmed glasses and the many distinctive pins on his hat, which has a big GOP elephant symbol on the brim.

[snip]

Two separate anti-fascist activists ― as well as a third witness who supported Trump and called himself a former friend of Rodriguez ― reviewed footage of the man at the Capitol and told HuffPost they recognized Rodriguez from the California rallies.

The FBI received tips about Rodriguez last month, including one from a man he assaulted on video at a Los Angeles-area rally. But it wasn’t until hours after a HuffPost inquiry to the bureau for this story that the tipster heard from an FBI special agent with questions specifically about a man named “Danny Rodriguez.”

Then, yesterday, HuffPo revealed another case where a researcher sent in a tip only to have no visible response from the FBI. Shortly after January 20, SeditionHunter “Amy” identified Robert Scott Palmer as the guy in an American flag jacket who sprayed a fire extinguisher at cops.

With bright red and white stripes across his body and stars down his sleeves, the man in the American flag jacket and “FLORIDA FOR TRUMP” hat wielded a fire extinguisher while charging the U.S. Capitol on the afternoon of Jan. 6. He shoved his way through the crowd of rioters to the police line, then sprayed officers at close range before chucking the emptied canister at them. By nightfall he himself had been lightly harmed, apparently by a police crowd control munition. He held up his shirt to show off his bruised gut during an interview with a female journalist filming him live as cops pushed the mob back from Capitol grounds. Then he looked straight into her livestreaming device and identified himself as Robert Palmer from Clearwater, Florida.

[snip]

Palmer is now publicly on the FBI’s radar, though not by name. Three photos of him are featured on the bureau’s Capitol violence page, where he’s listed only as “#246 – AFO [Assault on Federal Officer].” But the images didn’t appear there until nearly a month after Amy had already tipped off the FBI about his identity.

#FloridaFlagJacket was used as a hashtag on Twitter less than a week after the Capitol attack, when Trump was still in office. Amy sent in a tip naming Palmer not long after President Joe Biden was inaugurated. His photos were finally added to the FBI database in late February.

It’s not just online researchers whose tips the FBI isn’t moving on quickly. On January 11, someone who knew Peter Schwartz as a felon who had gotten released from prison due to COVID, alerted the FBI that Schwartz had skipped out on his halfway house to attend the rally (the tipster was friends with Schwartz but Schwartz owed him money). The FBI subsequently identified Schwartz as the person who maced some cops.

On January 11, 2021, the FBI National Threat Operations Center (NTOC) received a tip from an individual (hereinafter W-1) who is personally acquainted with SCHWARTZ. In the tip, W-1 reported that “Pete SCHWARTZ” was involved in the Capitol riots. W-1 stated SCHWARTZ is a felon and was released from prison due to COVID-19. W-1 also stated that SCHWARTZ is employed as a traveling welder. According to W-1, SCHWARTZ was supposed to be at a rehabilitation facility in Owensboro, Kentucky on January 6, 2021. However, W-1 saw a picture of SCHWARTZ on the Capitol Building steps that appeared to have been taken on January 6, 2021. As part of the tip, W-1 also provided the Facebook URL for what he claimed was SCHWARTZ’s Facebook page. W-1 did not provide any other photographs, however. Due to the volume of tips provided to the FBI since January 6, 2021 – which stands at over 150,000 as of January 26, 2021 – the FBI was not able to immediately contact W-1 regarding the information that W-1 provided and did not immediately link SCHWARTZ to the individual who repeatedly maced officers at the Capitol.

Schwartz wasn’t arrested until February 4.

Still, that’s less time than these other tips.

The FBI, perhaps justifiably given the flood of data they’re dealing with, seems to value tips from suspects’ direct associates rather than online tipsters. The vast majority of tips they have acted on do come from people who know a suspect directly, often their family or friends or high school classmates.

But many of these researchers have been doing what FBI claims it cannot do (or could not before an insurrection gave them the predicated investigation permitting them to do so): connect the dots from public social media.

Instead, DHS is looking to pay people for the assistance people are trying to give the FBI for free.

Unpacking a January 6 Phone Warrant

/24 Comments/in , /by

Given the focus on legal authorities used in the January 6 investigation, I wanted to look at a search warrant affidavit for the phone of Karl Dresch, a Yooper arrested on January 19 for trespassing and obstructing the vote certification. FBI obtained it Wednesday and executed it yesterday.

The investigation into Dresch arose, as most of the January 6 investigations have, when some informed the FBI — in his case, on January 7 — that Dresch had posted about busting into the Capitol on Facebook. The FBI obtained a warrant for Dresch’s Facebook content, and then, on January 19, arrested him on trespass and obstruction charges. On January 22, in part because of his Facebook posts promising “we will be back” and in part because he had a 2013 arrest and felony conviction for a high speed chase to avoid arrest in Wisconsin, he was ordered detained pending trial. Shortly thereafter, the Houghton County Sheriff, Brian McLean, who knows both Karl and his father (who helped bust the Oklahoma City bombing terrorists), told a reporter Karl should have gotten released on bail.

His father, Stephen Dresch, who died in 2006, provided the FBI information a year prior that led agents to a stash of explosives one of the Oklahoma City bombers had hidden away at his since-vacated Kansas home.

[snip]

Despite the polar opposite outcomes, Houghton County Sheriff Brian J. McLean, who knows the Dresch family, called Stephen Dresch’s son “a chip off the old block.”

[snip]

Stephen Dresch, whom McLean described as a “brilliant, sharp guy,” and his son were “very vocal” about their beliefs, the sheriff of 24 years said. Karl Dresch “likes to give his opinion, whether other people want to hear it or not,” he said.

Houghton County deputies have dealt with Karl Dresch on “minor nuisance calls,” but never anything serious, and he wouldn’t be on a “list of people we’re concerned about,” McLean said.

[snip]

Sheriff McLean disagrees with the risk assessment. He said Karl Dresch doesn’t pose a significant risk to the public and “absolutely” should have received bond.

Since then there’s little else that has happened in this case. On February 3 he was indicted — again for the obstruction and trespassing charges, but still not an illegal possession charge tied to having two guns as a felon. On February 19, a CJA attorney filed an appearance for him. But there’s not even (in the docket) notice of his arraignment.

Now, over forty days after seizing the phone that the FBI believes he had with him on January 6, they have taken steps to access it, stating that they believe they will find evidence relating to his existing charges (trespassing and obstruction) along with unlawful possession.

Search warrant boilerplate for January 6 is slightly more comprehensive than for arrest warrants. In this case, it includes details of people calling out for Nancy Pelosi and other Members of Congress, a description of the note that Jacob Chansley left for Mike Pence in the Senate Chamber: “Justice is Coming.” It describes Eric Munchel and others wandering around with zip ties. That is, it culls the evidence from various insurrectionists that hints towards a more malign plot against Congress, without stating that explicitly. It is the story that DOJ may believe they will one day tell.

In this case, too, it includes details on the exact location and the size of the Capitol, including the Visitor’s Center.

U.S. Capitol Police (USCP), the FBI, and assisting law enforcement agencies are investigating a riot and related offenses that occurred at the United States Capitol Building, located at 1 First Street, NW, Washington, D.C., 20510 at latitude 38.88997 and longitude -77.00906 on January 6, 2021.

At the U.S. Capitol, the building itself has 540 rooms covering 175,170 square feet of ground, roughly four acres. The building is 751 feet long (roughly 228 meters) from north to south and 350 feet wide (106 meters) at its widest point. The U.S. Capitol Visitor Center is 580,000 square feet and is located underground on the east side of the Capitol.

I note the inclusion of these details because these measurements would be really useful in an affidavit that relied on details — such as the ones in Jeremy Groseclose’s arrest affidavit — that talk about the granularity of the location data the FBI is obtaining. In Groseclose’s case, a Google warrant IDed his presence in the Crypt to within 34 meters at 68% confidence. Given the size of the Capitol, then, a Google result like that would fairly clearly show the target in the Capitol, and (given a room the size of the Visitor’s Center) in the room in question.

The Visitor’s Center is one of two places inside the Capitol (the other is the Crypt) where Dresch took pictures and videos he later posted to Facebook, including this one, which court documents describe Facebook data doesn’t include the time for, but which he posted later that night.

So that may be one thing the FBI hopes to find by accessing this phone: More details about the photos Dresch took while in the Capitol. For example, there may be something on the video he took that implicates either him or others, and so want better evidence for trial.

But that’s one of the interesting absences in this affidavit. The warrant notes that Dresch used Verizon, but it doesn’t mention anything about his Verizon call records or — more especially — his location data. Presumably they have that, but have chosen not to include it.

It’s possible (indeed, the government has asserted they think they’ll find) more on the guns he has, in particular any evidence he brought them to DC either on January 6 or some follow-up trip, the one suggested by a second hotel receipt (note, in the existing affidavits, the FBI doesn’t say whom Dresch told, “we have your back give the word and we will be back even stronger,” after January 6, but Facebook surely has that).  If the FBI had reason to believe they could place someone at the Capitol with a gun, that would be an important investigative addition.

There are also his interlocutors, especially the guy, USER 2, with whom he was sharing information about what was going on in the Capitol during the event. The FBI undoubtedly knows who that is, but it’s possible FBI has reason to believe there may be more (such as deleted content) on the phone itself.

Finally, one reason the government is always going to want to exploit a phone is to obtain encrypted communications (like Signal) that wouldn’t be accessible from a provider.

None of this is at all momentous: Just an affidavit to search the phone of one presumably very minor guy, and one that can’t be all that operationally interesting (or else they would have sealed it, as virtually all search warrants currently are). Just one case among 300. At least on its face, just an effort to add another charge or learn more about other insurrectionists.

Timeline

December 16, 2020: Dresch posting about January 6: “1/6/2021=7/4/1771”

January 3: Dresch posts that he’s headed to DC: “NO EXCUSES! NO RETREAT! NO SURRENDER! TAKE THE STREETS! TAKE BACK OUR COUNTRY! 1/6/2021=7/4/1776”

January 7: Tip that Dresch posted on Facebook about entering the Capitol.

January 12: Warrant for Facebook account.

January 13: FBI obtains Facebook content. Among other things it shows the following posts from January 6 and 7:

  • January 6, 2:26: Picture 3 taken with a Moto e6 in the Crypt, which is under the Rotunda
  • 2:43: USER 2 messages Dresch that, Patriots are in the Capitol building now”
  • 2:44: Dresch responds to USER 2: I am, with picture of Capitol Visitor’s Center
  • 2:48: USER 2 messages Dresch that, “Word is police are getting ready to use teach gas.
  • 2:48: Dresch responds, “Been using it. Mask up.”
  • 3:13: Dresch posts, “Who’s house? OUR HOUSE!”
  • 3:14: Dresch posts Picture 3 with caption, “We are in”
  • 4:46: Dresch responds to comments saying “It was peaceful … still got a lil gas tho … mask on for safety
  • 5:17, 5:18: Dresch sends USER 3 two pictures with the caption, “That’s right outside the house of representative … we got in! Took a lil gas … wtf I love masks now!” Had the cops booking it”
  • 6:09: Dresch responds to comments saying, “we broke no glass no shoving I seen”
  • 8:32: Dresch posts crowd at Washington Monument, “Total Victory!”
  • 8:44: Dresch posts “I’m excited”
  • January 7, 12:11 AM: Dresch posts image from Visitor’s Center stating that “antifa did not take the capitol. that was Patriots. … those traitors Know who’s really in charge”
  • 8:32PM: Dresch posts to another post, “Mike Pence gave our country to the communist hordes, traitor scum like the rest of them, we have your back give the word and we will be back even stronger”

January 15: FBI obtains arrest warrant for Dresch

January 19: FBI surveils Dresch’s residence and then arrests him outside it, searches his home, finding:

  • A Motorola that may be a Moto e6
  • A bag that Dresch had with him in one of the photos he posted to Facebook, including:
    • A receipt from a hotel in Washington DC (no date described)
    • Eight boxes of ammunition
    • A CB radio
    • A Whistler laser/radar detector
    • A DC Metro Pass
    • A hotel receipt for a hotel in Chantilly, VA for arrival on January 5 and departure on January 7
  • A Russian SKS-type rifle with a bayonet
  • A shotgun

January 22: Because of prior felony involving evading arrest, Dresch detained pending trial

March 3: Warrant obtained

March 4: Warrant executed

Insurrection Inciters Ted Cruz and Josh Hawley Only Want the Violent January 6 Criminals Prosecuted

/38 Comments/in , /by

I just waded through the 159 pages of culture war questions — God, guns, and racism — that GOP Senators posed to Merrick Garland to justify their votes opposing the widely-respected moderate to be Attorney General. Along with a seemingly broad certainty among the Republican Senators that John Durham will finally find something 21 months into his investigation and a committed belief in outright lies told about Mike Flynn’s prosecution, two of the Republicans — coup-sympathizers Ted Cruz and Josh Hawley — made it clear they think the only crime from January 6 that should be prosecuted is assault.

Cruz did so as part of a series of questions designed to both-sides domestic terrorism. While he may intend this question and a counterpart about all protests in Summer 2020 (whether conducted by leftists or not) to set up an attack on a DOJ appointee, Cruz created a false binary regarding crimes related to January 6, where people either simply “attended the Trump rally” or they “participate[d] in any act of violence.”

66. Do you believe that an individual who attended the Trump rally on January 6, 2021 did not participate in any act of violence should be prohibited in holding a political position in the Department of Justice in a future administration, even if he or she did not personally engage in any unlawful conduct?

RESPONSE: Americans have a constitutional right to engage in lawful, peaceful protest. If confirmed, I would assess any candidate’s fitness for a role in the Department on an individual basis and with the goal of hiring individuals who are capable of carrying out the Department’s important mission with integrity.

This ignores the people who committed a crime by peacefully entering the Capitol, as well as people who didn’t enter the building but in some other way participated in efforts to prevent the certification of the vote.

Cruz also challenged the description of January 6 in terms of domestic terrorism.

69. At your hearing, you stated that your definition of “domestic terrorism” is “about the same” as the statutory definition.

a. What is the statutory definition of “domestic terrorism”?

RESPONSE: The term “domestic terrorism” is statutorily defined in 18 U.S.C. § 2331.

b. What is your definition of “domestic terrorism”?

c. What is the difference between your definition and the statutory definition?

d. What relevance will your personal definition of “domestic terrorism” have to your duties, if confirmed, as Attorney General?

RESPONSE: At the hearing, I described domestic terrorism as using violence or threats of violence in an attempt to disrupt democratic processes, noting that this definition is close to the statutory definition of the term in the criminal code codified at 18 U.S.C. § 2331. If confirmed, all of my actions as Attorney General would be guided by the law as written.

Ultimately, Cruz seems to be objecting to treating the interruption of the certification of the vote as a particularly “heinous” crime, as Garland had labeled it during his confirmation hearing.

Meanwhile, Josh Hawley asked Garland how he intends to protect the First Amendment rights of Americans to “criticize their government and pursue political change” while investigating an insurrection that Hawley calls “rioting.”

5. If you are confirmed as Attorney General, as you conduct your investigation of the rioting that took place at the Capitol grounds on January 6, 2021, what specific steps do you intend to take to ensure that Americans’ First Amendment rights to criticize their government and pursue political change are not infringed?

RESPONSE: Americans have a fundamental right to engage in lawful, peaceful protest. If confirmed, I will vigorously defend this right. Acts of violence and other criminal acts are not protected under the Constitution.

As Cruz did, Hawley’s question treats the January 6 investigation as a binary, either violence or protected under the First Amendment.

This framework, in both cases, ignores that even those who didn’t enter the Capitol, along with people who entered as part of a larger violent effort, are being charged both for obstructing the vote certification (the treatment of which as terrorism offended Cruz) and for conspiracy in the larger goal of obstructing the certification.

Mind you, both of these men should be safe. They have the right to raise questions about the vote, and the effect of the insurrection was to interrupt whatever they were doing, even if it was, itself, delaying the certification. So their peaceful contributions to the events of January 6 should be fine.

Unless, of course, it can be shown that their efforts were coordinated with the larger effort, were an effort to buy time until the rioters could more effectively end the process of democracy that day.

In any case, both are very clearly working the soon-to-be ref here, hoping to limit the scope of the investigation to those who committed assault. As Hawley did the other day with his alarmed questions about normal legal process, we should expect Hawley to attempt to delegitimize any scrutiny into his far right allies from that day.

Chain of Command: The AWOL Descriptions of the Commander in Chief’s Role in the National Guard Non-Response on January 6

/94 Comments/in , , /by

The only formal explanation Trump has offered to describe his role in deploying the National Guard in response to the attack on the Capitol on January 6 came in his impeachment defense. As part of that defense, Bruce Castor pointed to things he claimed happened before Trump’s speech ended. In Castor’s inaccurate portrayal of the timeline, he suggested that the first action Acting Secretary of Defense Christopher Miller took was when, at 1:05 (which Castor said was 11:05), Miller “received open source reports of demonstrator movements to the U.S. Capitol.” He continued to claim that,

At 1:09 PM, US Capitol Police Chief’s Steven Sund called the House and Senate Sergeants at Arms, telling them he wanted an emergency declared and he wanted the National Guard called. The point: given the timeline of events, the criminals at the Capitol were not there to even hear the President’s words. They were more than a mile away engaged in a preplanned assault on this very building.

Admittedly, this was probably no more than an incompetent parroting of the existing timeline released by DOD. It’s possible that Trump’s lawyers didn’t ask him what happened inside the White House that day, because if they did, it would not help their case.

Still: Trump’s own defense claimed that the first that Acting Secretary Miller did in the matter was at 1[1]:05 on January 6.

That’s mighty interesting because there have been two claims that Trump proactively offered up National Guard troops for January 6 in the days beforehand. The first came in a Vanity Fair piece written by a journalist that Trump’s DOD flunkies permitted to embed with them (he requested to do so before the insurrection, but didn’t start his embed until January 12, meaning the claims reported in this article were retrospective). That piece claimed that, the night before the attack, Trump told DOD they would need 10,000 people.

The president, Miller recalled, asked how many troops the Pentagon planned to turn out the following day. “We’re like, ‘We’re going to provide any National Guard support that the District requests,’” Miller responded. “And [Trump] goes, ‘You’re going to need 10,000 people.’ No, I’m not talking bullshit. He said that. And we’re like, ‘Maybe. But you know, someone’s going to have to ask for it.’” At that point Miller remembered the president telling him, “‘You do what you need to do. You do what you need to do.’ He said, ‘You’re going to need 10,000.’ That’s what he said. Swear to God.”

[snip]

“We had talked to [the president] in person the day before, on the phone the day before, and two days before that. We were given clear instructions. We had all our authorizations. We didn’t need to talk to the president. I was talking to [Trump’s chief of staff, Mark] Meadows, nonstop that day.”

[snip]

What did Miller think of the criticism that the Pentagon had dragged its feet in sending in the cavalry? He bristled. “Oh, that is complete horseshit. I gotta tell you, I cannot wait to go to the Hill and have those conversations with senators and representatives.”

[snip]

Miller and Patel both insisted, in separate conversations, that they neither tried nor needed to contact the president on January 6; they had already gotten approval to deploy forces. However, another senior defense official remembered things quite differently, “They couldn’t get through. They tried to call him”—meaning the president.

So according to Acting Secretary of Defense Christopher Miller, Trump had given him “clear instructions” to “do what you need to do,” and had warned him to have thousands of Guardsmen available. Miller said he was speaking non-stop to Mark Meadows, though an anonymous source stated that they tried but failed to get the President on the line.

Long after impeachment and even after his CPAC speech, Trump went to Fox to make the same claim that appeared in Vanity Fair.

Former President Trump told Fox News late Sunday that he expressed concern over the crowd size near the Capitol days before last month’s deadly riots and personally requested 10,000 National Guard troops be deployed in response.

Trump told “The Next Revolution With Steve Hilton” that his team alerted the Department of Defense days before the rally that crowds might be larger than anticipated and 10,000 national guardsmen should be ready to deploy. He said that — from what he understands — the warning was passed along to leaders at the Capitol, including House Speaker Nancy Pelosi — and he heard that the request was rejected because these leaders did not like the optics of 10,000 troops at the Capitol.

“So, you know, that was a big mistake,” he said.

Fox and other Trump mouthpieces have suggested that Nancy Pelosi rejected the Guard. That’s false. According to then Capitol Police Chief Steve Sund, House Sergeant at Arms Paul Irving did.

On Monday, January 4, I approached the two Sergeants at Arms to request the assistance of the National Guard, as I had no authority to do so without an Emergency Declaration by the Capitol Police Board (CPB). My regular interactions with the CPB, outside of our monthly meetings regarding law enforcement matters, were conducted with the House and Senate Sergeant at Arms, the two members of the CPB who have law enforcement experience. I first spoke with the House Sergeant at Arms to request the National Guard. Mr. Irving stated that he was concerned about the “optics” of having National Guard present and didn’t feel that the intelligence supported it. He referred me to the Senate Sergeant at Arms (who is currently the Chair of the CPB) to get his thoughts on the request. I then spoke to Mr. Stenger and again requested the National Guard. Instead of approving the use of the National Guard, however, Mr. Stenger suggested I ask them how quickly we could get support if needed and to “lean forward” in case we had to request assistance on January 6.

Notably, Sund’s request and Irving’s response occurred before the conversation between Miller and Trump purportedly took place the night before the attack (which was far too late to deploy 10,000 people in any case). Moreover, Pelosi, Zoe Lofgren, and Mark Warner, among others, raised concerns about staffing for the day, so it’s not like Democrats weren’t raising the alarm.

Still, over a month after making no such claim as part of his Impeachment defense, Trump and his flunkies want to claim that Trump was proactive about deploying 10,000 people to defend the Capitol against his most ardent supporters.

That’s interesting background to the testimony offered by Robert Salesses, the “Senior Official Performing the Duties of the Assistant Secretary for Homeland Defense and Global Security,” in a joint Rules/Homeland Committee hearing on January 6 yesterday. As several people noted during the hearing, for some reason DOD sent Salesses, who wasn’t involved in the key events on January 6, rather than people like General Walter Piatt or General [Mike’s brother] Charles Flynn — who were on a call with MPD Chief Robert Contee and Sund on January 6 and who have made disputed claims about what occurred, including that Piatt recommended against sending the Guard because of optics. Effectively, Salesses was repeating what others told him, offering no better (indeed, more dated) information than Vanity Fair was able to offer. Salesses apparently called General Piatt the day before and dutifully repeated Piatt’s claim that he did not use the word, “optics,” which DC National Guard Commander General William Walker had just testified did occur.

General Piatt told me yesterday, Senator, that he did not use the word, “optics.”

Salesses then gave more excuses, explaining,

Senator, in fairness to the committee, General Piatt is not a decision-maker. The only decision-makers on the Sixth of January were the Secretary of Defense and the Secretary of the Army Ryan McCarthy. It was a chain of command from the Secretary of Defense to Secretary McCarthy to General Walker. That was the chain of command.

General Walker, the Commander of the DC National Guard, responded by reiterating the response he had gotten from Piatt (and the brother of the guy who had incited many of the insurrectionists) implicitly correcting Salesses about chain of command. The Commander in Chief, of course, is in that chain of command.

Yes, Senator. So the chain of command is the President, the Secretary of Defense, the Secretary of the Army, [points to self] William Walker Commanding General District of Columbia National Guard.

After General Walker described more of the restrictions placed on him ahead of time, including the preapproval before moving a traffic control point from one block to another (which restriction, Walker said, he had never experienced in 19 years) and the issuance of riot gear, Salesses made more excuses (repeating his silence about the role of the President’s role in the chain of command). Remarkably, he described how Ryan McCarthy dithered from 3:04 until 4:10 because shots had been fired at the Capitol.

Salesses: Sir, Secretary Miller wanted to make the decisions on how the National Guard was going to be employed on that day. As you recall, Senator, the spring events, there was a number of things that happened during those events, that Secretary Miller as the Acting Secretary –

Rob Portman: Clearly he wanted to. The question is why? And how unusual. Don’t you think that’s unusual based on your experience at DOD?

Salesses: Senator, there was a lot of things that happened in the spring that the Department was criticized for — Sir, if I could. Civil Disturbance Operations? That authority rests with the Secretary of Defense. So if somebody’s gonna make a decision about employing military members against US citizens in a Civil Disturbance Operation —

Salesses: At 3:04, Secretary Miller made the decision to mobilize the entire National Guard. That meant that he was calling in all the National Guard members that were assigned to the DC National Guard. At 3:40–at 3:04 that decision was made. Between that period of time — between 3:04 and 4:10, basically, Secretary McCarthy had asked for — he wanted to understand, because of the dynamics on the Capitol lawn, with the explosives, obviously shots had been fired, he wanted to understand the employment of how the National Guard was going to be sent to the Capitol: what their missions were going to be, were they going to be clearing buildings, be doing perimeter security, how would they be equipped, he wanted to understand how they were going to be armed because, obviously, shots had been fired. He was asking a lot of questions to understand exactly how they were going to be employed here at the Capitol, and how many National Guard members needed to be deployed to the Capitol.

When asked whether restrictions placed on Walker hampered his defense, yes or no, Salesses again invoked the chain of command, again leaving out the Command-in-Chief.

Senator, General Walker, in fairness to him, can’t respond to a civil defense — a Civil Disturbance Operation without the authority of the Secretary of Defense.

Finally, Salesses explained a further 36-minute delay, from 4:32 until 5:08, when Walker was given approval to move, this way:

Salesses: In fairness to General Walker too, that’s when the Secretary of Defense made the decision, at 4:32. As General Walker has pointed out, cause I’ve seen all the timelines, he was not told that til 5:08.

Roy Blunt: How is that possible, Mr. Salazar [sic], do you think that the decision, in the moment we were in, was made at 4:32 and the person that had to be told wasn’t told for more than a half an hour after the decision.

Salesses: Senator, I think that’s an issue.

It’s not just that the people who were actually involved didn’t show up to explain all this to Congress. It’s not just that there were big gaps in the timeline, or gaps explained by dithering even after DOD learned about explosives and shots fired.

It’s that the guy sent to provide improbable answers seems to have removed the Commander-in-Chief, who was watching all this unfold on TV and now wants credit for proactively telling DOD they would need at least 10,000 people, from the chain of command he used to justify the delay.

That’s all the more striking given that — as Dana Milbank noted — the delay until Miller’s authorization (to say nothing of the 36-minute delay in informing Walker) also meant that DOD did not respond until after Trump had instructed his insurrection to go home.

Curiously, the Pentagon claims Miller’s authorization came at 4:32 — 15 minutes after Trump told his “very special” insurrectionists to “go home in peace.” Was Miller waiting for Trump’s blessing before defending the Capitol?

DOD’s selected witness yesterday said that General Walker couldn’t send the Guard to help protect the Capitol because of the chain of command. But the Commander-in-Chief seems to be AWOL from that chain of command.

Update: On Twitter AP observed that there is a discrepancy between Miller’s 10,000 person claim and Trump’s: Trump says it happened days before January 6, which would place it before Miller’s letter imposing new restrictions on the Guard.

Federal Protective Services Looking for Terrorists on Facebook, Not TheDonald or Parler

/12 Comments/in , /by

Federal Protective Services released 81 of 95 pages it had pertaining to January 6 to BuzzFeed and other news outlets. Mostly consisting of emails, the release shows that FPS knew several of the things to look for. They knew that anticipated attendees at the Trump rally had been raised from 5,000 to 30,000 but expected even more attendees. They knew which hotels were sold out and which one the Proud Boys initially planned on staying at. They were tracking the Proud Boy contingent that was moving on the Capitol in advance of Trump’s speech.

But the most telling thing about the release is its sourcing. The information on event expectations was sourced to how many people signed up on Facebook.

One of the sources for the Proud Boys’ movement was a journalist’s tweet. And FPS sourced its awareness that the Proud Boys were not going to wear typical Proud Boy colors during the events to Business Insider, not directly to Enrique Tarrio’s Parler post announcing the plan.

While there are a few sources redacted under a law enforcement sources and methods redaction and (as noted above) 14 pages either withheld entirely or referred to another agency, there are no unredacted references to Parler or TheDonald (the latter of which is where someone predicted war), where some of Trump’s most ardent supporters organized their trips to DC.

There was a discussion during yesterday’s hearing on January 6 about what, legally, DHS and FBI are permitted to access (FBI’s Assistant Director for Counterterrorism Jill Sanborn suggested FBI can’t refer to social media, though in other forums, that has been described as a limitation on including social media posts in finished intelligence). But, obviously, FPS was using social media — Facebook — to prepare for these events.

You’re not going to find potential terrorists in posts by official organizers on Facebook, and aspiring terrorists are unlikely to register their attendance plans on that site either. These people were planning in plain sight.

Just not on official Facebook pages.

The Passport and the Antifa Hunt: The Militia Counter-Stories Emerge

/54 Comments/in , /by

In both the case against Proud Boy Leader Ethan Nordean and accused Oath Keeper Thomas Caldwell, the defendants are arguing that the government has made errors about their activities.

With regards to the former, Nordean’s wife submitted a sworn declaration stating, among other things, that the passport the government has pointed to as evidence that Nordean might flee was not — as the government claimed — on the dresser by the bed, but instead inside a jewelry box on the dresser. She also claimed that Nordean received a Baofeng radio on January 7, the day after the insurrection, and that to her knowledge, he “did not possess” one before that date.

The government responded with a picture showing that, at a time they claim precedes the search, a picture they took to show the weapons they had secured shows the passports were on the dresser.

Additionally, she claimed that Nordean’s cell phone “was without power” on the day of the insurrection, which is irrelevant to why he stashed it in the drawer or whether it would have useful evidence.

Ms. Nordean responded with her own picture showing that, in a picture taken on December 8, 2020, the jewelry box was closed.

This would be a matter of he-said she-said, FBI agents against the wife of a suspect, except for one thing. In her original affidavit, Ms. Nordean tries to rebut the government’s focus on the Baofeng (the government claims the Baofeng he got on January 7 is a different one than the one he used the day of the riot, but in any case the one they seized was set to the channel used by the Proud Boys during the riot), she noted that “it is [her] understanding that his mobile phone was without power throughout January 6, 2021,” a detail the defense relied on to suggest, first of all, that the government was purposefully withholding that detail, and that that — and not the evidence of the Proud Boys discussing obtaining the radios and using a specific channel — is why the government had focused on the Baofeng.

But it does the opposite. A bunch of the Proud Boys brought live cell phones to their insurrection on January 6. William Chrestman appears to have tried avoiding using cell coverage, but got geolocated using his Google account. For Nordean to spend an entire day his phone powered off suggests an operational security that many of his buddies didn’t have. It certainly suggests he might have the wherewithal to search for a passport he might make use of, suggesting it’s possible that he, not the FBI, took the passports out of the jewelry box (though they would have been out there for a day because, per Ms. Nordean, Ethan wasn’t home the night before the raid.

Meanwhile, Thomas Caldwell says the government has similarly misunderstood everything about his involvement in an insurrection. There’s a claim he makes that I find quite compelling: that Jessica Watkins and Donovan Crowl hid out at his home — and tried to lose a tail on the way there — to hide from the press, not the FBI.

Contrary to the Court’s understanding, Caldwell informed FBI agents that Watkins and Crowl contacted him—not vice-versa–and requested to come to his farm to get away from the media, not law enforcement.22 That is, subsequent to a New Yorker article that identified Watkins and Crowl as being involved in entering the Capitol, their small town Ohio residences were surrounded by scores of media. 23

22 Undersigned counsel reviewed over a thousand social media messages in discovery. Multiple messages from Watkins and Crowl express a desire to run away from the media throng that descended on their small Ohio hometown. Not one message evinces an intent to avoid authorities, who had not yet charged the two with a crime. In fact, Watkins’ mother, who is not a suspect in this case, fled Ohio and hid from the media in Florida. Also, discovery confirms that Watkins and Crowl reached out to Caldwell, not vice-versa.

23 Similarly, the Government’s claim that Caldwell advised Watkins and Crowl to “avoid law enforcement” by making sure that they were not followed to his farm is misplaced. Caldwell’s concern was that the pair weren’t followed by the media to his farm. Caldwell did not want a hundred reporters camped outside his farm.

But in the rest of the filing, Caldwell spins a fairy tale while at the same time he admitted he spends a lot of time spinning fairy tales.

To put his personality in more context, Caldwell is an amateur screen writer. Specifically, Caldwell has written screenplays with military style plots.17 Undersigned counsel has read a couple of these screenplays, which are heavy on hyperbolic military language. To give the Court a sample of his writings, in one screenplay Caldwell depicts a “dog fight” between rival aircraft, with one pilot radioing out “Buzzard One, this is Slingshot, I got two bogies on my six; say again, two bogies on my six; May-day, May-day.” What the Government misunderstands is that Caldwell’s language and personality center around his military career and his addiction to Hollywood.18

Ultimately, the fairy tale Caldwell spins in this filing is that he didn’t conspire to interfere with the vote count, but instead was just aiming to hunt Antifa.

He explained his contacts with the Oath Keepers, who he viewed as a self-styled group of patriots who sought to protect Trump supporters from Antifa and who provided security at Trump events. The concerning social media posts Caldwell made, he explained, all referred to fear that Antifa would attack Trump supporters on January 6th . 21

21 This fear was well-founded. In fact, contrary to the Government’s suggestion that Antifa is a virtuous group with a few bad apples, this organization is a domestic terrorist organization that has taken over cities like Portland and Seattle, burned buildings and churches, killed and injured police officers, defaced and destroyed public monuments, and violently injured hundreds of Trump supporters across the country. In fact, just a month before the Capitol was breached, Antifa attacked elderly Trump supporters at a December rally in Washington.

As part of this fairy tale Caldwell argues that the government has the timeline of the Zello chats included in the evidence against him, and therefore mistook a plan to guard people like Roger Stone for a plan involving the Capitol.

The Court placed great weight on this evidence, as it purported to show a specific, contemporaneous plan to breach the Capitol. In court papers, the Government described the Zello communications as follows:

“At the approximate 5 minute mark, the voice believed to be [codefendant] Watkins reports, “We have a good group. We have about 30-40 of us. We are sticking together and sticking to the plan.”

“At the approximate 7 minute 44 mark, an unknown male states, “You are executing citizen’s arrest. Arrest this assembly, we have probable cause for acts of treason, election fraud.”

The voice believed to be WATKINS responds, “We are in the mezzanine. We are in the main dome right now. We are rocking it . . .[.]” ECF 1-1, ¶27 (ZMF-21-119) (second criminal complaint) (emphasis added).9

The latest indictment includes the same chronological representation, only without time-stamps. The Government’s inference is clear: The Oath Keepers had a plan to invade the Captiol and arrest elected officials, discussed this “invasion plan” at the “5 minute mark,” and were inside the Capitol a few minutes later executing the plan (at the 7:44 mark). Unfortunately, the Court has been misinformed by the Government. Upon receipt of discovery, undersigned counsel discovered that the Government’s Zello evidence actually consists of a National Public Radio (NPR) report, which aired random snippets of Zello communications. The above timestamps the Government referenced are time-stamps in the NPR report, not from Zello. In other words, the referenced Zello communications did not take place 2 minutes and 44 seconds apart in real time.

Ironically, after listening to these Zello communications, the Government’s smoking-gun proof of premeditation fizzles. Specifically, it is clear that the communication regarding “sticking to the plan” happened several hours before the Capitol breach, and probably in the very early morning, as there is no crowd noise in the background. 10 By contrast, the second Zello communication (from inside the Capitol) had substantial background noise.

10 Published reports suggest that as many as 500,000 demonstrators showed up to the rally. The fact that the audio reveals no crowd noise suggests that this particular Zello communication happened before hundreds of thousands of rally-goers entered the streets of Washington.

I’ll return to the temporal claim later. But there are several things that mark this story as a fairy tale. First, he’s complaining that the male voice has no background noise whereas Watkins’ does have background noise. Caldwell is comparing messages from different people in different places.

Moreover, while he nods to the NPR original of this (which he doesn’t cite, but I assume is this WNYC interview), he doesn’t acknowledge two sets of texts that the government has yet to rely on (but surely will), which make it clear the plan was prospective and tied to the Capitol. First, from two blocks away, Watkins reports that everyone is marching on the Capitol.

MILITIA What kind of numbers do we have going into the capital? Any estimates? What percentage of the crowd is going to the capital?

WATKINS One hundred percent. Everybody’s marching on the capital. All million of us. It’s insane. We’re about two blocks away from it now and police are doing nothing. They’re not even trying to stop us at this point. [END CLIP]

And then, a block away, Watkins informs her interlocutor that she’s going to go silent because “Imma be a little busy.”

WATKINS Yeah, we’re one block away from the Capitol now. I’m probably going to go silent when I get there because Imma be a little busy.

INFORMANT Hey, my girlfriend is at the Capitol right now and she said that cops are coming in from the right of the building. [END CLIP]

Even assuming the rest of the excerpts are a jumble (and I expect we’ll get clarity on this point shortly), it’s clear that Watkins’ objective is the Capitol, not guarding Roger Stone.

But there’s one more part of the texts that make that clear: the channel name. “Stop the Steal J6” The Oath Keepers didn’t arrange radio communications to keep Roger Stone safe. They arranged radio communications to stay in touch as they jointly assaulted the Capitol.

But there’s a bigger tell in this filing of fairy tales, the filing that argues Caldwell’s communications can’t be taken literally because he lives in a fantasy world, presents a claim that he believed Antifa presented a serious threat, and then claims that Caldwell’s denials must be believed because, “The word of a 20-year military veteran with no prior criminal record is evidence, and it is strong evidence, of his innocence.” Caldwell tells a fairy tale about the crimes of which he is accused.

Caldwell absolutely denies that he ever planned with members of the Oath Keepers, or any other person or group, to storm the Capitol. Caldwell absolutely denies that he obstructed justice. 3

The issue as to whether Caldwell violated 18 U.S.C. § 1752(a)(1) (Entering and Remaining in a Restricted Building or Grounds) is still being researched by undersigned counsel. Obviously, however, this charge is the least of the Court’s concerns in weighing the factors under the Bail Reform Act.

Caldwell is personally accused of two counts of obstruction. The first, 18 U.S.C. § 1512(c)(1), accuses him (like Graydon Young) of attempting to delete damning Facebook content, an accusation this filing rebuts.  But he is singularly and as part of the conspiracy also accused of violating 18 U.S.C. §§ 1512(c)(2), 2. The object of the conspiracy is not, as Caldwell would suggest, to storm the Capitol. It was, instead, to stop the electoral vote count.

The purpose of the conspiracy was to stop, delay, and hinder Congress’s certification of the Electoral College vote.

This is an accusation his entire fairy tale story doesn’t deny, nor does his narrative about his own actions that day (or the planning leading up to it) rebut the claim.

As I’ve said, at least one part of Caldwell’s story may well be true: that Watkins and Crowl were hiding out from the press, not (yet) the FBI. But none of Caldwell’s re-imagining of the record even attempts to rebut that he and his terrorist buddies were attempting to interfere with the counting of the vote as laid out in the Constitution.

Then again, Judge Mehta may not be his desired audience. Instead, his claim this was all about Antifa may be an attempt to feed GOP efforts to deny they encouraged a terrorist attack on the Capitol.

Update: Took out a reference to Nordean’s phone in his daughter’s drawer. That was William Chrestman, not Nordean. I thought I had removed it.

Update: Beryl Howell granted Nordean home detention yesterday, judging that the government (which backed off some of its earlier claims about Nordean’s role) had not proven that Nordean had directed the breach of the Capitol.