The Three Key Details the Proud Boy Unindicted Co-Conspirator Likely Revealed to Prosecutors

/65 Comments/in , /by

By March 1, the government had three pieces of evidence that form a key part of a conspiracy indictment accusing Ethan Nordean, Joe Biggs, Zachary Rehl, and Charles Donohoe of conspiring to breach the Capitol and by doing so, delaying the certification of the vote:

  • The Proud Boys used Baofeng radios set to a specific channel (which channel prosecutors knew)
  • After Enrique Tarrio’s arrest, Ethan Nordean got put in charge of the January 6 operation
  • The gang had a plan to split up to optimize the chances of success

A detention motion for Nordean submitted on that day included all three of these details. It described how the Proud Boys distributed Baofeng radios to use in the operation.

Arrangements were made to program and distribute multiple Baofeng radios5 for use by Proud Boys members to communicate during the event. Baofeng is a Chinese communications equipment manufacturer. Baofeng radios can be programmed to communicate on more than 1,000 different frequencies, making them far more difficult to monitor or overhear than common “walkie talkie” type radios. Specific radio frequencies were communicated to the Proud Boys.

5 Law enforcement recovered a Baofeng radio from Defendant’s home during the execution of a search warrant—the Baofeng radio recovered from Defendant’s home was still tuned to frequency that had been communicated to the group.

[snip]

The group led by Defendant arrived at the east side of the Capitol before noon. Several of the men in the group were holding Baofeng radios. Others had them clipped to their belts or jackets.

It described how Nordean was put in charge after Tarrio’s arrest.

Moreover, following the arrest of the Proud Boys’ Chairman on January 4, 2021, Defendant was nominated from within to have “war powers” and to take ultimate leadership of the Proud Boys’ activities on January 6, 2021.

[snip]

On January 4, 2021, Henry “Enrique” Tarrio, the self-proclaimed “Chairman” of the Proud Boys was arrested shortly after arriving in Washington, D.C., pursuant to a warrant issued by D.C. Superior Court. In communications between Proud Boys members following Tarrio’s arrest, it was acknowledged that Defendant would be among those that led the Proud Boys on the ground on January 6, 2021.

And it described a decision to split people up in an effort to increase the likelihood of actually shutting down the certification of the vote.

As noted more fully below, Defendant—dressed all in black, wearing a tactical vest—led the Proud Boys through the use of encrypted communications and military-style equipment, and he led them with the specific plans to: split up into groups, attempt to break into the Capitol building from as many different points as possible, and prevent the Joint Session of Congress from Certifying the Electoral College results.

[snip]

In order to increase the odds that their plan would succeed, Defendant and those Proud Boys following him dressed “incognito” and spread out to many different locations from which they could force entry into the Capitol. Defendant and others responsible for the January 6 Proud Boys event likely knew from experience that their typical tactic of marching in “uniform,” and in unison, would draw a concentrated law enforcement response to their location. By blending in and spreading out, Defendant and those following him on January 6 made it more likely that either a Proud Boy—or a suitably-inspired “normie”—would be able to storm the Capitol and its ground in such a way that would interrupt the Certification of the Electoral College vote

Even after prosecutors shared these damning claims, their bid to keep Nordean in jail failed. Nordean’s wife filed a declaration stating in part that Nordean obtained the radio on January 7 and, to her knowledge, he did not possess such a radio before that date.

An indictment against Nordean obtained on March 3 to comply with the Speedy Trial Act (but not released publicly until after the detention hearing) mentioned none of that.

And at the March 3 detention hearing before Beryl Howell, according to Zoe Tillman, the government withdrew the claim that Nordean had the Proud Boys split into groups as a factor for that detention hearing. In what the WaPo described as, “a remarkable stumble for prosecutors,”Judge Howell released Nordean to home detention, saying there was little evidence that Nordean played that leadership role.

Nordean “was a leader of a march to the Capitol. But once he got there it is not clear what leadership role this individual took at all for the people who went inside,” Howell said. “Evidence that he directed other defendants to break into or enter the Capitol is weak, to say the least.”

Nordean’s release marked a stumble for prosecutors, who have cast him as a key figure based on what Howell agreed were “ominous” communications before Jan. 6 that they said indicated he and other Proud Boys were planning “violent action” to overwhelm police and force entry to the Capitol. The judge’s decision sets back for now the government’s efforts to establish that there was a wider plot to that end.

[snip]

“The government has backed down from saying that he directly told them to split into groups and that they had this strategic plan,” Howell remarked.

Howell said that although Nordean’s release was a “close call,” she agreed with the defense that “there’s no allegation that the defendant caused injury to any person, or that he even personally caused damage to any particular property.”

Prosecutors claimed they had this evidence on March 1. But after failing to present it at that March 3 hearing, Nordean got released.

On March 15, the judge assigned to the case after Nordean got indicted, Timothy Kelly, issued an order delaying the arraignment scheduled for the next day. He offered no explanation.

What didn’t become clear until this week is that, on March 10, the government obtained the superseding indictment against Nordean and others. And then, on March 12, the government asked Judge Kelly to delay Nordean’s arraignment on his original indictment because of the superseding indictment. Prosecutors explained that revealing the indictment ahead of time would risk alerting Rehl and Donohoe before they could be arrested and their houses searched.

On March 10, 2021, a federal grand jury sitting in the District of Columbia returned a Superseding Indictment charging Defendant, and three co-defendants (two of whom were not previously charged), with Conspiracy, in violation of 18 U.S.C. § 371; Obstruction of an Agency Proceeding, in violation of 18 U.S.C. §§ 1512(c)(2), and 2; Obstructing Law Enforcement During a Civil Disorder, in violation of 18 U.S.C. §§ 231(a)(3), and 2; 18 U.S.C. §§ 1361, and 2; Entering and Remaining in a Restricted Building or Grounds, in violation of 18 U.S.C. § 1752(a)(1); and Disorderly and Disruptive Conduct in a Restricted Building or Grounds, in violation of 18 U.S.C. § 1752(a)(2).

The Superseding Indictment is under seal, pending the arrest of newly charged defendants and the execution of search warrants. Law Enforcement anticipates executing the arrests and search warrants of the new defendants in a coordinated operation on Wednesday, March 17, 2021. Once the arrests are executed, the Superseding Indictment will be unsealed.

The evidence the superseding indictment provides to substantiate claims first made on March 1 may explain an even bigger reason why prosecutors didn’t provide their evidence for those three claims in time to keep Nordean in custody: They had an unindicted co-conspirator (presumably someone cooperating with prosecutors) who was, along with the four conspiracy defendants, on an encrypted channel created after Enrique Tarrio’s arrest on January 4 that Proud Boy leaders used to continue planning for January 6. That unindicted co-conspirator was personally involved in all three details included in that detention memo against Nordean. He helped divvy up the Proud Boys to be spread out during the January 6 operation.

39. On after Chairman’s January 4, 2021, shortly after Proud Boys Chairman’s arrest pursuant to a warrant issued by D.C. Superior Court, DONOHOE expressed concern that encrypted communications that involved Proud Boys Chairman would be compromised when law enforcement examined Proud Boys Chairmans’ phone. DONOHOE then created a new channel on the encrypted messaging application, entitled, “New MOSD,” and took steps to destroy or “nuke” the earlier channel. After its creation, the “New MOSD” channel included NORDEAN, BIGGS, REHL, DONOHOE, and a handful of additional members.

40. On January 2021, at 7:15 p.m., DONOHOE posted a message on various encrypted messaging channels, including New MOSD, which read, “Hey have been instructed and listen to me real good! There is no planning of any sorts. I need to be put into whatever new thing is created. Everything is compromised and we can be looking at Gang charges.” DONOHOE then wrote, “Stop everything immediately” and then “This comes from the top.”

41. On January 4, 2021, at 8:20 p.m., an unindicted co-conspirator (“UCC-1”) posted to New MOSD channel: “We had originally planned on breaking the guys into teams. Let’s start divying them up and getting baofeng channels picked out.”

Note: If “New MOSD” was a channel of State leaders of the Proud Boys, it would likely have included Nicholas Ochs, who heads the Hawaii chapter of the Proud Boys. Ochs was the first senior Proud Boy to be arrested, on January 7, at the airport when he arrived back in Hawaii (and therefore carrying anything he had with him at the insurrection, potentially including his cell phone and any radios he kept). Kathryn Rakoczy, who has since moved onto the team prosecuting the Oath Keepers, was the original prosecutor on Ochs’ case. But now Christopher Berridge, who is on all the other Proud Boy cases but not the Nordean and Biggs one, is prosecuting Ochs. Ochs is charged in a parallel conspiracy indictment, with the very same goal and many of the same means as the Nordean and Biggs one, but which for some reason was not identified as a related case to the other three Proud Boy ones and so was not assigned to Judge Kelly; Judge Howell is presiding over Ochs’ case. Ochs has a superb defense attorney, Edward McMahon. Many of these details, which make the curious treatment of the Ochs-DeCarlo conspiracy indictment clear, are in this post or this expanded table.

Whoever the unindicted co-conspirator is, he’s the one who set the channel of the Baofeng radios the night before the insurrection. And he’s the one who stated that Nordean was in charge.

46. At 9:03 p.m., REHL notified NORDEAN, BIGGS, DONOHOE and others that he had arrived in Washington, D.C. DONOHOE responded by requesting one of the radios that REHL had brought.

47.  At 9:09 p.m., UCC-1 broadcast a message to MOSD and Boots on the Ground channels that read: “Stand by for the shared baofeng channel and shared zello channel, no Colors, be decentralized and use good judgement until further orders” UCC-1 also wrote, Rufio is in charge, cops are the primary threat, don’t get caught by them or BLM, don’t get drunk until off the street.” UCC-1 then provided a specific radio frequency of 477.985.

It is highly likely that prosecutors learned the three details included in that detention motion — that Nordean had been put in charge, that the Proud Boys were using Baofeng radios set to frequency 477.985, and that part of the plan was to disperse the men to increase chances of success — from the unindicted co-conspirator and or devices seized from him when he was first arrested.

And it took them less than two months to learn those details of the plot.

Update: The government has moved to detain both Nordean and Biggs now. Those motions cite from the Telegram chats the Proud Boys used to organize the day before the attack, including (I’ve combined them from both motions):

On January 5, between 9:30 – 9:32am [Biggs] stated “What are the teams. I keep hearing team [sic] are picked already.” A few minutes later, [Biggs] stated “Who are we going to be with. I have guys with me in other chats saying teams are being put together.”

On January 5, at 9:32am, a member of a Proud Boys Telegram group stated “It seems like our plan has totally broken down and rufio has taken control as a singke [sic] point of contact.”

On January 5, between 5:22 – 5:25pm, [Biggs] stated “Woth [sic] [coconspirator Ethan Nordean] trying to get numbers so we can make a plan.” Defendant then stated “Just trying to get our numbers. So we can plan accordingly for tonight and go over tomorrow’s plan.”

On January 5, at 5:52pm, [Biggs] stated “We are trying to avoid getting into any shit tonight. Tomorrow’s the day” and “I’m here with [co-conspirator Nordean] and a good group[.]”

On January 5, at 9:07pm, co-conspirator Charles Donohoe asked “Hey who’s boots on ground with a plan RN [ … ] Guys are asking.” A participant in the encrypted chat stated “Supposed to be Rufio.”

Within minutes, an unindicted co-conspirator broadcast a message to those in the group chat, “Rufio is in charge, cops are the primary threat, don’t get caught by them or BLM, don’t get drunk until off the street.”

On January 5, between 9:17 and 9:20pm, [Biggs] stated “We just had a meeting woth [sic] a lot of guys. Info should be coming out” and then “I was able to rally everyone here together who came where I said” and then, “We have a plan. I’m with [co-conspirator Nordean].”

On January 5, at 9:34pm [Biggs] told co-conspirator Charles Donohoe to communicate to Proud Boys members a message stating that the group in Washington, D.C. would meet at the Washington Monument at 10am on January 6.

On the morning of January 6, Donohoe stated that he was on his way to the Washington Monument, and “I have the keys until Rufio and [co-conspirator Zachary Rehl] show up.”

Update: As I note in a footnote to this post, Nicholas Ochs can’t be the unindicted co-conspirator. That’s true for two reasons. First, because DOJ does not believe UCC-1 was at the Capitol on January 6 (though doesn’t say where he was). DOJ knows Ochs was inside the Capitol. Also, DOJ has now started treating all the Proud Boy conspiracies as the same conspiracy. So Ochs could not, then, be considered un-indicted in that conspiracy.

Share this entry

The State of the Five Now-Intersecting January 6 Militia Conspiracies

/61 Comments/in , /by

Paragraph 64 of a new conspiracy indictment including Proud Boys Ethan Nordean, Joe Biggs, and the newly arrested Proud Boys Zachary Rehl and Charles Donohoe includes a seemingly gratuitous reference to the Oath Keepers. The paragraph describes how Biggs, after having entered the Capitol once already from the northwest side, then moved to the opposite side of the building and forced his way in on the east side. He did so right in front of a group of Oath Keepers.

Thirty minutes after first entering the Capitol on the west side, BIGGS and two other members of the Proud boys, among others, forcibly re-entered the Capitol through the Columbus Doors on the east side of the Capitol, pushing past at least one law enforcement officer and entering the Capitol directly in front of a group of individuals affiliated with the Oath Keepers.

This would have been around 2:44 PM. The Oath Keeper “stack” went in the east side of the Capitol at around 2:40.

That reference, along with the common use of the Zello application, brings two parallel conspiracies laid out over a month ago closer together, arguably intersecting. As of right now, DOJ has charged 25 people in five different conspiracy indictments, four of which share precisely the same goal: to stop, delay, and hinder Congress’s certification of the Electoral College vote, with many similar means and methods. Three conspiracy indictments also share roughly the same goal of obstructing law enforcement. Those indictments are:

Here’s what a simplified version of the five different conspiracies looks like:

This is not the end of it: there are three Oath Keepers not included in that conspiracy, and a random bunch of Proud Boys who might eventually be included, as well as anyone else who coordinated this effort [wink]. But these conspiracy indictments will remain separate only for prosecutorial ease. They are, for all intents and purposes, now-intersecting conspiracies.

Update: Last night, NYT’s visual team released new videos showing that the Oath Keepers Stack was involved in forcing entry into the East entrance of the Capitol. These videos depict what happened moments after Biggs reentered the Capitol, as described above.

Update: To see how the other pieces of any coordinated action fit, I will list the other Oath Keepers and Proud Boys that have played a part in this operation.

Oath Keepers

Stewart Rhodes: The Oath Keeper President. He is not charged, but implicated in the existing Oath Keepers indictment and the Minuta complaint.

Roberto Minuta: Minuta was arrested on March 8. An SDNY Magistrate judge released him on bail (he almost put up silver bars for his security, but ended up coming up with the money itself), ignoring the government request he stay the order. Minuta’s arrest affidavit–which was written 12 days before James’ but executed roughly the same day–focuses primarily on Minuta’s harassment of cops. It doesn’t mention, as James’ affidavit does, Minuta’s role in providing security, including for Roger Stone. Minuta also deleted his Facebook account on January 13, for which he was charged with obstruction.

Joshua James: James was arrested on March 9 and held without bail (in part because of a past arrest associated with claiming to be a military police officer in 2011). His arrest affidavit makes it clear he was a close contact with Minuta as well as Kelly Meggs. The affidavit repeatedly describes James offering security to VIPs we know to include Roger Stone. According to public reporting, James received payment for his “security” services on January 6, which Stone was publicly fundraising for in advance (then denied spending).

Jon Ryan Schaffer: The front man for the heavy metal band Iced Earth and an Oath Keeper lifetime member, Schaffer was arrested for spraying some police with bear spray. But two months after his arrest and detention, he has not been (publicly) indicted and only arrived in DC on March 17. The government has not publicly responded to his motion to dismiss his case on Speedy Trial grounds. All of which suggests there’s something more there that we can’t see.

Person Four: The James affidavit refers to Minuta as “Person Five.” It uses that number, it says, because “Persons Two [Caldwell’s spouse], Three [the NC-based Oath Keeper who might serve as a Quick Reaction Force], and Four are not included in this affidavit, but are already-numbered individuals associated with United States v. Thomas Caldwell, et al, Case No. 21-cr-28 (APM). To maintain consistent nomenclature, the referenced individual here will be defined as ‘Person Five.'” I haven’t been able to find the reference to Person Four (though it might be Watkins’ partner, references to whom are inconsistent).

Three more Stack participants and four others who operated with Minuta and James on January 6: This image, from James’ complaint, identifies three other Stack members (the second, third, and last yellow arrow) and four others who interacted with James and Minuta during the day on January 6.

Proud Boys

Enrique Tarrio: Tarrio is the head of the Proud Boys, but got arrested as he entered DC on January 4 on charges relating to vandalizing a Black church in December, onto which possession charges were added. He is referred to in all the Proud Boy conspiracies, repeatedly in the Leader one (because they scrambled to figure out what to do after his arrest). While it’s unlikely he was on the Telegram channels used to organize the insurrection, he was in touch with members via other, thus far unidentified channels.

Joshua Pruitt: Pruitt was arrested for a curfew violation on the night of the insurrection. He told the FBI he hadn’t engaged in any unlawful activity and was just trying to deescalate the situation. But he was indicted on his own weeks later for obstructing the vote count and interfering with cops, and abetting the destruction of property, along with trespassing. The Nordean conspiracy indictment notes that he went in the West entrance shortly after Dominic Pezzola breached it (suggesting the government may now know he was part of a cell with Pezzola). Pruitt is being prosecuted by the same prosecutor as on most Proud Boy cases, Christopher Berridge, and before the same judge, Timothy Kelly.

Gabriel Garcia: Garcia, a former Army Captain, appears to have originally been identified by the Facebook order showing who livestreamed from the Capitol. It’s possible his livestreams were intended to serve as live reporting for those coordinating outside (he catches the names of cops, the size of the crowd, and instructs, “keep ’em coming.” He incites a big push through a line of cops. Later, he calls for “Nancy” to “come out and play” and calls to “Free Enrique” [Tarrio]. He was charged by complaint on January 16 and by indictment on February 16 with obstruction and resisting cops during civil disorder. The Nordean conspiracy indictment notes he went in the West entrance shortly after Pezzola breached it.

Christopher Worrell: The government originally charged Worrell, a committed Proud Boy who traveled to DC in vans of Proud Boys paid for by someone else and wore comms equipment, with trespass crimes on March 10. Among his criminal background, he pretended to be a cop to intimidate a woman. He lied in his first interview with the FBI, hiding that he sprayed pepper spray on some police who were the last line of defense on the West side of the Capitol. According to a witness who knows him, he also directed other likely Proud Boys. After first being released, he was subsequently detained and is awaiting indictment on what the government suggests are likely to be assault charges.

Robert Gieswein: Ethan Nordean spoke to Giswein shortly before he and Pezzola launched the attack on the Capitol suggesting that Gieswein, who had known ties to the 3% movement, was coordinating with the Proud Boys that day. Over the course of breaking into the Capitol, he allegedly assaulted 3 cops with a bat or pepper spray, and broke a window to break in. He was first charged on January 16, indicted on January 27. His docket shows none of the normal proceedings, such as a protective order, but his magistrate’s docket shows two sealed documents placed there in recent weeks.

Ryan Samsel: There’s no indication I know of that ties Samsel to the Proud Boys. But he marched with them and initiated the assault on the West side of the Capitol with Dominic Pezzola and William Pepe. He was charged with assault and obstruction on January 29 and arrested on February 3. In his case, he allegedly did so by assaulting a cop at the first line of barriers, knocking her out. He and the government are in talks for a guilty plea.

Ryan Bennett: Bennett was IDed off his own Facebook livestreaming, while wearing a Proud Boys hat, of the event, including his direct witness to the shooting of Ashli Bennett, with his voice yelling “Break it down!” in the background. He was arrested on January 26 and charged in a still-sealed March 17 indictment over which James Boasberg will preside.

Bryan Betancur: Betancur was busted by his Maryland Probation Officer, to whom he had lied about distributing Bibles to get permission to go to DC. He wore a Proud Boys shirt to the insurrection and is a known white supremacist who espouses violence. He was charged with misdemeanor trespass charges. His defense attorney is already discussing a guilty plea.

Daniel Goodwyn: Goodwyn’s online identity is closely associated with the Proud Boys. He was identified via an interview he did with Baked Alaska during the insurrection and texts sent to an associate; he was arrested on January 29. He was originally charged with trespass, with obstruction added in his indictment on February 24. Charles Berridge was originally the prosecutor on this case but has been replaced on it.

Christopher Kelly: Kelly revealed on Facebook before he headed to DC that he would be going with, “ex NYPD and some proud boys.” While inside, he bragged that they had “stopped the hearing, they are all headed to the basement.” He was originally charged with trespass and obstruction on January 20; he has yet to be (publicly) indicted yet. He has the same defense attorney, Edward McMahon, as Nicholas Ochs.

Around 40 other people who used the Proud Boys “Boots on the Ground” Telegram channel: As I noted here, the government must have at least monikers for — and likely email and/or device identifiers — for around 40 people who used the organizing channel set up less than a day before the operation. It will be interesting to see if they attempt to track all of them down.

Rolling Updates:

Marc Bru, a Proud Boy with ties to Nordean, was charged on March 9.

Paul Rae, a Proud Boy from Florida who trailed Biggs both times he entered the Capitol.

Arthur Jackman: a Proud Boy from Florida who trailed Biggs both times he entered the Capitol, including into the Senate.

 

Share this entry

How to Arrest Someone (Almost) Entirely Off Social Media

/78 Comments/in , /by

Brandon and Stephanie Miller are, like Jeremy Groseclose, really minor players who entered the Capitol on January 6 while there was an insurrection going on around them. The one amusing tidbit in the arrest affidavit for the married couple quoted Brandon, stating on Facebook the day after the riot, that he hadn’t yet gotten into trouble, two months before he would get into trouble.

“Went in the capital [sic] building.” This user asked Brandon Miller, “You didn’t get into any trouble,” to which he responded, “No not yet anyway lol I’m home now I’m banded on Facebook for me going live while I was there we just walked down the main hallway we did see the blood trail from the girl that got shot and killed then I just seen a post saying 3 people died not sure on that one tho.”

What’s interesting about the affidavit is it shows how the FBI arrested the two largely off their social media use.

A Facebook geofence

The investigation started when the FBI obtained Brandon’s Facebook ID in response to a request for everyone who had live-streamed or posted video from inside the Capitol — a kind of Facebook geofence I described likely was used in this post. So at the very start, they didn’t know who Brandon was, but they knew he had trespassed and created his own record of doing so.

The Federal Bureau of Investigations sought information from Facebook as part of the federal investigation that began in the aftermath of the January 6, 2021 events at the U.S. Capitol Building. Specifically, the FBI requested that Facebook identify any “Facebook Live” videos which may have been streamed and/or uploaded to Facebook from physically within the building of the U.S. Capitol during the time on January 6, 2021 that the mob had stormed and occupied the Capitol Building.

Facebook responded by providing the Object IDs for multiple videos linked to specific Facebook accounts/user IDs. Among the accounts provided by Facebook was Facebook account number 100011360648175.

The FBI presumably obtained the Facebook ID for everyone who posted from inside the Capitol that day. I suspect they immediately got preservation orders for everyone whose account came up, which wasn’t a problem here (the Millers did not attempt to delete any of this), but likely explains why others were unsuccessful in their efforts to delete damning evidence on Facebook.

Warrant on Facebook

Remember, virtually every outsider who was in the Capitol that day was trespassing. That made it easy for the FBI to say that anyone who had, like Brandon, uploaded video from inside the Capitol had probably been committing a crime (to say nothing that such videos might provide evidence of other people committing a crime), because by being there to livestream the content, they were trespassing. The FBI got a warrant return from Facebook by January 14 (meaning turnaround and seeking those warrants was almost immediate after the riot). That gave the FBI Brandon’s credit card information, his address, his phone number, and Stephanie’s name and status as Brandon’s spouse.

On or about January 14, 2021, Facebook provided a response to a search warrant for Brandon Miller’s Facebook. Subscriber information provided by Facebook included credit cards associated with the account. The credit card had a zip code of 45308, which resolves to Bradford, OH. Brandon Miller’s Facebook account listed him as living in Bradford, Ohio. The registered phone number to the account is was (***) ***-6025.

[snip]

His Facebook profile as indicated that Brandon Miller was married to Facebook user Stephanie Miller.

The FBI used this information to obtain their driver’s license records, one of the few things that didn’t come directly from social media.

Public commentary on January 6 on Facebook

Both Brandon and Stephanie had their Facebook content accessible to the public (but the FBI would have obtained Brandon’s with their warrant anyway). In addition to the comment, above, where Brandon said he was not yet in trouble, they posted a bunch of other things confirming that they had entered the Capitol. Among other things, though, they posted content that showed they did not have the intent to prevent the vote count (thereby saving themselves the felony charge others have gotten off their pre-January 6 postings).

On or about January 5, 2021, Brandon Miller, in direct messages with another Facebook user wrote, “Heading to DC for tomorrow the 6th the really not sure if you have seen anything about it but me and Stephanie are going to witness history.”

On or about January 6, 2021, Brandon Miller’s Facebook timeline showed he was with Stephanie Miller at a hotel in Washington, D.C. with the accompanying message: “Cant’ wait to witness history”

They were in DC to witness history, not to upend it.

One live witness from Facebook — probably IDed on Facebook

FBI then did the one thing that isn’t obviously from Facebook, but probably is: interview one of the Millers’ family members, twice.

On or about January 26, 2021, a witness, (hereinafter referred to as “W-1”), was interviewed by the FBI. W-1 informed the FBI that he was a family member of Brandon and Stephanie Miller’s. W-1 had heard from another family member that Brandon and Stephanie Miller were at the Capitol and went inside. W-1 observed a Facebook Live video on Brandon Miller’s Facebook account that showed himself and Stephanie Miller inside the Capitol. W-1 provided both Brandon and Stephanie Miller’s phone number as (***) ***-6025. W-1 also provided an address for the Millers in Bradford, Ohio, which matched the Miller’s address in their respective BMV records.

In a subsequent interview, W-1 was shown the photograph above from Brandon Miller’s Facebook. W-1 identified the man in the foreground of the photo as “Brandon Miller” and the woman behind him as “Stephanie Miller” by writing their names next to their respective images. W-1 also viewed the below photograph taken inside the Capitol. W-1 identified the woman in the foreground of the photo as “Stephanie Miller” by writing her name next to her image.

This person honestly told the FBI that they knew the couple had been to the Capitol, had seen Brandon’s Live video, and corroborated all the other data the FBI had already collected off Facebook. The same witness subsequently confirmed the IDs of the pictures that would have been identifiable from Facebook anyway.

The FBI could have IDed this person via many means (such as public records). But Facebook would probably be the easiest and most likely way they did so. Moreover, by doing so using Facebook, the FBI would have known precisely what answers a particular witness could answer, such as their awareness that the couple had been inside the Capitol. Effectively, when they did those interviews, they knew every single answer they’d get, and they knew the witness knew the answers.

FBI could ID family members from tags, pictures, and Facebook content, and then get those family members to corroborate everything made clear in Facebook anyway.

A Google Geofence tour around the Capitol

Then the FBI took two steps to obtain a Google Geofence showing Stephanie (likely with Brandon at her side) wandering around the Capitol. First, by February 4, they got Brandon and Stephanie’s Google identities, using either their phone number and/or Google IDs that would have been returned by Facebook. This would have been a subpoena. Then they used that information to get a warrant for the Geofence showing where Stephanie went in the Capitol, likely with Brandon walking by her side.

Obtain cell site location within the Capitol

The FBI agent who did this work must be really anal (or maybe he’s just showing the work that every agent is doing), because after having obtained location data from Google and Facebook placing the couple inside the Capitol, he obtained cell site location data placing them … in the Capitol.

According to records obtained through a search warrant which was served on AT&T on January 6, 2021, in and around the time of the incident at the U.S. Capitol Building, the cellphones associated with phone numbers (***) ***-5898 and (***) ***-6025 were identified as having utilized a cell site consistent with providing service to a geographic area that included the interior of the U.S. Capitol Building.

The agent got this information two days after the subscriber information from Google, February 6, one month after the riot.

At this point, the agent had three pieces of evidence — the Facebook “geofence,” the Google geofence, and the AT&T location data — placing them inside the Capitol.

Match all that location data to security footage

Then, on February 11, the agent got security footage corresponding with all that location data. Sure enough, they were walking together through the Capitol, gaping at history, just like they said they were going to.

This is what you can do with the power of social media with two people who were doing nothing to hide their actions. Lucky for them, everything they said corroborated their claim they were just there to see history. The FBI has obligingly given them more souvenir pictures for their trouble … and two misdemeanor charges. Along with a very good lesson about how intrusive social media can be.

Remember: this entire process was predicated off the reasonable suspicion that someone live-streaming from the Capitol on January 6 was trespassing. The very act of live-streaming was, in virtually all cases, either evidence from victims or evidence of a misdemeanor. That’s what makes this reasonable rather than a privacy nightmare.

But it’s also a ready lesson about what kind of privacy nightmare it could be, if the FBI were to come up with some other, less obvious basis for probable cause.

Update: After I wrote this I realized I wasn’t as clear about something as I’d like. This data is not — as might be imagined from reading how it served to capture this couple in misdemeanor trespassing charges — worthless data for the larger project of figuring out what plans to overthrow democracy people had coming in. Not only was this social media approach really useful in collecting on the Oath Keepers, who have been charged in a conspiracy to prevent the vote certification, but many of these techniques were first obvious, though not explicitly explained, in the first William Chrestman cell affidavit. This same granular data helped the FBI identify precisely where Proud Boy Chrestman was at any given time he was in the Capitol, who was with him, and what measures they were taking that put members of Congress a significant risk. With the Millers this might seem like overkill. But with a bunch of militia groups that FBI should have had investigations on but didn’t, this data is proving key to being able to reconstruct what happened.

Share this entry

86 Minutes: Two Arrests Thwarted and Three Cops Disabled by “Bear Shit”

/37 Comments/in /by

In the 86 minutes after the Capitol Police first asked for help from the National Guard on January 6, police had to drop two arrests of violent rioters, and three cops — including Brian Sicknick — were temporarily disabled after being sprayed with “bear shit.”

At 1:49 on January 6, Capitol Police Chief Steven Sund asked the Commander of the DC National Guard, General William Walker, for urgent help pushing back the riot attacking the Capitol. According to Walker’s testimony, he loaded Guardsmen onto busses to be able to respond as soon as he got authority, but that approval was not granted and communicated to him for over three hours. Walker testified that he could have reinforced the Capitol within 15 minutes, and indeed, once DOD granted approval, according to Walker’s testimony the Guard arrived within 20 minutes (DOD says it took almost 40 minutes).

At 1:49pm I received a frantic call from then Chief of U.S. Capitol Police, Steven Sund, where he informed me that the security perimeter at the Capitol had been breached by hostile rioters. Chief Sund, his voice cracking with emotion, indicated that there was a dire emergency on Capitol Hill and requested the immediate assistance of as many Guardsmen as I could muster.

Immediately after the 1:49pm call with Chief Sund, I alerted the Army Senior Leadership of the request. The approval for Chief Sund’s request would eventually come from the Acting Secretary of Defense and be relayed to me by Army Senior Leaders at 5:08pm – 3 hours and 19 minutes later. We already had Guardsmen on buses ready to move to the Capitol. Consequently, at 5:20pm (in under 20 minutes) the District of Columbia National Guard arrived at the Capitol.

Had DOD worked the way they had in the past then, the Capitol Police might have had reinforcements from the Guard at the Capitol by around 2:10 PM.

About five minutes after the time General Walker says the Guard could have arrived, around 2:15, Hunter Ehmke allegedly started trying to punch through a window from a ledge outside the Rotunda.

Officer Fluke observed Ehmke pointing towards the window, followed by looking at the crowd to his south and waving his hand as if to summon others over to his position. Ehmke repeated the sequence of gestures again. Officer Fluke shouted out, “They’re going to break the window” during this time in hopes to bring attention from fellow officers.

An officer who saw what Ehmke was doing looked at the hundreds of rioters he was trying to repel then back towards Ehmke, only to see that Ehmke had punched the window and broken it.

Officer Fluke looked east to focus back on the crowd pushing on the shields and gave orders for the growing crowd to get back. Officer Fluke turned to look north again and observed Ehmke with a balled fist, pulling his arm back and twisting his upper body. Ehmke then swung forward striking a pane of the window about shoulder level of Ehmke. Officer Fluke began to run toward Ehmke while continuing to hold his shield in both hands.

Officer Fluke managed to knock Ehmke down and two other officers came to help arrest him. Others attempted to set up a perimeter to protect the now-broken window and create space for an arrest. But as confrontations elsewhere grew more urgent and a crowd started demanding that the cops let Ehmke go, police released him and told him not to come back.

As the officers discussed an action plan, the disturbance caused individuals of the crowd facing the Rotunda doors to divert their attention towards the approximately 10 officers in the northwest corner of the landing. Individuals in the throng began to show aggression by pointing fingers and shouting obscenities. One unidentified individual threatened Officer Fluke and the other officers, stating “you’re not leaving with him”, while pointing in the direction of Officer Fluke and Ehmke. Due to the growing aggression of the large crowd that far outnumbered the officers and the exigent circumstances at the time, officers made the decision to allow Ehmke depart under his own power.

Eight minutes after the confrontation with Ehmke began, at 2:23, Julian Khater and others were wrestling with police over a set of bike rack barriers. Khater appears to have sprayed what he had called, “bear shit” towards the cops. Three cops, including Brian Sicnick, withdrew from their position. All three took at least 20 minutes recovering from the toxic spray before they could return to the fight against the insurrectionists.

Officer Chapman’s BWC shows that at 2:23 p.m., the rioters begin pulling on a bike rack to Chapman’s left, using ropes and their hands to pull the rack away. Seconds later, KHATER is observed with his right arm up high in the air, appearing to be holding a canister in his right hand and aiming it in the officers’ direction while moving his right arm from side to side. Officer Chapman’s BWC confirms that KHATER was standing only five to eight feet away from the officers.

[snip]

In reviewing the surveillance footage and BWC video, your affiant observes that Officers Sicknick, Edwards and Chapman, who are standing within a few feet of KHATER, all react, one by one, to something striking them in the face. The officers immediately retreat from the line, bring their hands to their faces and rush to find water to wash out their eyes, as described in further detail below and as captured in the following screen shots.

While Sicknick returned to his work, that spray may have contributed to his death.

About eight minutes after Khater sprayed Sicknick and two others, starting at 2:31, Mark Ponder appears on camera beating an officer’s shield with a pole. After he broke that pole, he found another more substantial one.

Moments later, shortly before 2:32 p.m. PONDER reemerges from the crowd holding another long pole. This second pole appears to be thicker than the first pole and is colored with red, white, and blue stripes.

17 minutes after Ponder first grabbed the pole, at 2:49, he started swinging it more aggressively at individual cops, striking one.

As PONDER swings the pole in the direction of the officers, he struck Officer #3 once in the left shoulder.

Officer 3 and others tackled Ponder and started moving to arrest him. They found his ID at 3:03, but Ponder apparently lied about where he currently lived. By 3:15 — 86 minutes after Sund first requested assistance — the officers learn there’s no transport available to complete the arrest of Ponder at that time. So, as happened with Ehmke less than an hour earlier, the cops let him go, instructing him not to come back.

Ponder remained at the riot for almost two more hours.

At 4:32, according to DOD’s timeline, Acting Secretary of Defense Christopher Miller approved a deployment of the Guard to help at the Capitol. General Walker didn’t receive that order for another 30 minutes. Sometime between 5:20 (per Walker) and 5:40 (per DOD), the Guard arrived at the Capitol and started to help.

That is, in the first 86 minutes of the three hour period between when Sund asked for help and the Guard showed up, police moved to arrest two violent insurrectionists, only to be forced to let them go, and (as NYT had noted in a story some time ago), Brian Sicknick was sprayed with a toxic substance that may have led to his death.

It took 70 days for the FBI to track Ponder down after he was first released, and almost as long — 67 days — to arrest Julian Khater (likely delaying efforts to identify of the substance used against Sicknick in the process). Part of that delay must be attributed to the three hours it took DOD to provide relief to the Capitol Police.

Share this entry

The FBI Was Still Collecting Evidence Yesterday that Might Explain Brian Sicknick’s Death

/62 Comments/in , /by

I want to make some observations about timing that may help to explain why the government wasn’t prepared to charge Julian Khater and George Tanios in Brian Sicknick’s death, if indeed they ever will be able to, when they arrested the men yesterday.

The investigation really seems to have come together in recent weeks and the FBI seems to have spent much of the last ten days investigating Tanios, who brought the substance Khater allegedly sprayed at Sicknick to the Capitol.

The arrest affidavit suggests it would have been difficult to have IDed Khater (much less establish probable cause) without the footage from MPD Officer Chapman’s body camera.

On the video, KHATER continues to talk animatedly with TANIOS. At approximately 2:20 p.m., KHATER walks through the crowd to within a few steps of the bike rack barrier. KHATER is standing directly across from a line of law enforcement officers to include U.S. Capitol Police (“USCP”) Officers B. Sicknick and C. Edwards, and Metropolitan Police Department (“MPD”) Officer D. Chapman, who was equipped with a functioning body worn camera (“BWC”) device.

Officer Chapman’s BWC shows that at 2:23 p.m., the rioters begin pulling on a bike rack to Chapman’s left, using ropes and their hands to pull the rack away. Seconds later, KHATER is observed with his right arm up high in the air, appearing to be holding a canister in his right hand and aiming it in the officers’ direction while moving his right arm from side to side. Officer Chapman’s BWC confirms that KHATER was standing only five to eight feet away from the officers.

That’s some of the video that has taken longest to exploit (or longest for the FBI to be willing to share publicly), not least because there wasn’t a publicly curated set like the Parler videos released by ProPublica that allowed open source investigation.

Chapman’s BWC video would permit the FBI to ID Khater (the guy who actually used the spray). Still, he’s got a fairly late FBI Be On the Lookout number: 190, meaning it took some time for the FBI to isolate a still to release.

Once the FBI IDed Khater, though, they would have seen that he was clearly working in tandem with Tanios (which is effectively what the arrest affidavit says). Not only was Khater working with him, but Tanios was the guy carrying the bear spray, and so is more likely to be the guy who’d have another can of the substance in his backpack at home or receipts to identify precisely what was used.

The FBI tweeted out Tanios’ BOLO on March 4 (they released it with the pictures of two other guys; I’m not sure what to make of that).

The arrest warrant for the two men was approved on March 6, which would be quick work if they really were working off a BOLO released March 4 (though they likely got a warrant as soon as they obtained probable cause in case they had to arrest the men quickly).

That said, the arrest warrant wasn’t executed until March 14. That’s not that surprising–the FBI would have wanted to get this arrest right, coordinating teams so that both men would be arrested at the same time. This warrant for Tanios’ house, business, car, and devices, shows that the FBI was physically surveilling Tanios from March 5 through March 8 to identify his movements, his home, his business, and his car.

As late as March 14, the day FBI obtained the warrant, they were still waiting to receive returns from a warrant served on AT&T for Tanios’ phone records. Interestingly, Tanios called Khater at 2:42PM on January 6, less than twenty minutes after Khater allegedly sprayed Sicknick and others (another cop sprayed Khater, so he may have been recovering from pepper spray himself, but Tanios didn’t stick around to help Khater — they were separated by then).

Still, the FBI has been working all of these January 6 cases on an arrest first, further investigate later basis, partly because of the timing of the attack, and partly because FBI had done so little investigation into almost all the subjects of investigation. As Chris Wray said in testimony recently, the arrest of these subjects (sometimes just for trespass crimes) is often just the beginning of the investigation into them. With virtually all the defendants, the FBI is getting enough to arrest them, then doing the kind of investigation that normally precedes in an arrest, such as subpoenaing social media, to say nothing of searching the smart phones where subjects store much of the evidence about intent.

All of which is to say that the FBI likely only obtained evidence that would be needed to charge Khater and Tanios in Sicknick’s death yesterday — including, possibly, identifying what substance Khater allegedly sprayed at Sicknick — and that will take some weeks to fully exploit.

So it’s too soon to know whether the FBI will be able to tie that bear spray to Sicknick’s death.

Share this entry

Two Arrested in Officer Sicknick Assault

/31 Comments/in , /by

On Sunday, the government arrested two men, Julian Elie Khater and George Pierre Tanios, on charges of conspiring to attack three police officers, including Brian Sicknick.

According to the affidavit in support of the criminal complaint, Khater and Tanios were at the U.S. Capitol on Jan. 6, 2021, and were observed in video footage working together to assault law enforcement officers with an unknown chemical substance by spraying officers directly in the face and eyes.  During the investigation, it is alleged that law enforcement discovered video that depicted Khater asking Tanios to “give me that bear s*it.” Tanios replied, “Hold on, hold on, not yet, not yet… it’s still early.”  Khater then retrieved a canister from Tanios’ backpack and walked through the crowd to within a few steps of the police perimeter.  The video shows Khater with his right arm up high in the air, appearing to be holding a canister in his right hand and aiming it at the officers’ direction while moving his right arm from side to side.  The complaint affidavit states that Officers Sicknick, Edwards, and Chapman, who were all standing within a few feet of Khater, each reacted to being sprayed in the face.  The officers retreated, bringing their hands to their faces and rushing to find water to wash out their eyes.

The substance Khater allegedly sprayed caused scabs on the face of one of the officers hit, Officer Edwards, for weeks. All struck with it said the substance was as strong as anything they’ve encountered in their experience as police officers. In addition to assault charges, both were charged with conspiracy to assault police reflecting a degree of planning and intentionality.

Share this entry

“I Started the Fire:” DOJ Reveals Another Missed Advance Warning about January 6

/53 Comments/in , /by

In a motion laying out why accused insurrectionist Guy Reffitt is so dangerous he must be detained pre-trial, the government revealed that, in December, one of his family members (likely his son) contacted the FBI and warned them about Reffitt’s dangerous plans for legislators.

In late December 2020, one of Reffitt’s family members informed the FBI that Reffitt was “going to do some serious damage” related to federal legislators in Washington, D.C.

At around the same time, Reffitt was bragging on a Telegram chat with fellow militia members that he was going to go to DC in “full battle rattle.”

After FBI had received that warning, Reffitt put his AR-15 and a pistol into his car, and drove to DC from Texas promising to “drag[] those people out of the Capitol by their ankles” and install a new government. He sent messages on Telegram about coming to the riot armed and arranged for a “rendezvous point.” He donned body armor and a helmet and brought zip ties. According to comments he made to his kid, he brought the pistol to the Capitol. According to his own description of events, he resisted two officers trying to keep him from climbing the stairs they were trying to protect. He claimed he “started the fire” that allowed others to breach the Capitol. And, in days after the attack, Reffitt promised his kid that he was not done, that the attack on the Capitol was just the beginning. He attempted to recruit two other rioters to join the Three Percenter militia. He threatened both his children that he would kill them if they reported him to the FBI. His adult son has since moved out of his house.

The government has since discovered that Reffitt had an unregistered silencer in his home and had set up a company as a front to use to obtain law enforcement grade weapons to stockpile for his revolution.

The government now argues, persuasively and using his own claims, some of them made prior to the insurrection, that Reffitt, “presents a serious danger to the community—not only to his family and Congress, but to the entire system of justice.”

And yet — unlike the case of QAnoner Kevin Strong after an associate reported him as a danger in advance of his participation in the insurrection, into whom the FBI at least opened an investigation — there’s no sign that the FBI took any action in response to a specific warning about plans to target Members of Congress.

The FBI has claimed that the only warning it got of the insurrection planned for January 6 came via a pseudonymous threat made on TheDonald chat list, one they didn’t have a chance to verify before the attack itself. They have claimed they had no advance warning to share with the Capitol Police and DC Police.

Except someone in Texas shared a specific warning about a threat to Congress at least a week before the attack, a warning that might have corroborated a different tip FBI had received about plans for World War III, and — by all appearances — FBI did nothing with that warning.

Share this entry

Thomas Caldwell’s “Storming the Castle” Ploy Succeeds

/63 Comments/in , /by

Judge Amit Mehta just released Thomas Caldwell to home confinement in the Oath Keeper conspiracy case.

Caldwell’s attorney, David Fischer, made some easily rebuttable arguments about Caldwell’s honesty, which I’ll return to. Fischer also tried to convince Judge Mehta that Caldwell was operating out of a sincere belief that he was defending against Antifa, not arming against the US government; I’ll return to that too (Judge Mehta had no patience for that ploy). While Mehta did come away believing Caldwell had been more cooperative than prosecutors had suggested, that’s not why he released Caldwell.

It’s important background, that in Fischer’s motion to reconsider Caldwell’s detention dismissed several references Caldwell made to “storming” the Capitol as an allusion to the fictional narrative of The Princess Bride.

Some of the lines that the Government cites in its papers are straight from Hollywood. The best example is “storming the castle” and “I’m such an instigator.” These are classic lines from the 1980s classic movie The Princess Bride.

Fischer suggested Caldwell’s own use of the same word everyone else used to describe assaulting the Capitol was just fiction.

The claim is important because the key reason that Caldwell got bailed is because of a feint that Fischer made in his motion for reconsideration. He argued that there is no evidence that Caldwell planned in advance to storm the Capitol.

On January 6th, at the urging of former President Donald J. Trump, hundreds of thousands of disgruntled, patriotic Americans came to Washington to protest what they viewed as an unfair election. Caldwell joined this protest to exercise his First Amendment right, a right he defended for 20 years in military service. Caldwell absolutely denies that he ever planned with members of the Oath Keepers, or any other person or group, to storm the Capitol. Caldwell absolutely denies that he obstructed justice. 3 The word of a 20-year military veteran with no prior criminal record is evidence, and it is strong evidence, of his innocence.

[snip]

In short, despite having an army of federal agents working around the clock intensively investigating for almost three months, the Government has not provided the Court with a confession, witness statement, or physical evidence backing up their claim that any person or group had a premeditated plan to storm the Capitol. Caldwell asks rhetorically: Doesn’t the Court find it odd that the Government hasn’t outlined the specifics of the premeditated plan? What time was the “invasion” scheduled to begin? Who would lead the attack? What was the goal once the planners entered the Capitol?

[snip]

The Government’s fanciful suggestion that right-wing tactical commandos were waiting in the wings to storm the Capitol is one for the ages.

In response to Judge Mehta’s questions about this claim, AUSA Kathryn Rakoczy conceded that the alleged co-conspirators didn’t have hard and fast plans as to what would happen before the event. This was a plan made of “possibilities,” which included the possibility (the facetious excuse offered by Caldwell) that other groups would resort to violence if Vice President Pence threw out the vote and the Oath Keepers would have to respond with force, or that President Trump would invoke the Insurrection Act and the Oath Keepers would come in to institute martial law. As Rakoczy described, they were “watching and waiting to see what leadership did” to achieve the goal of preventing the vote count, which goal the “government submits was unlawful and corrupt.”

They were waiting to see what leadership did. When leadership did what they referred to as “nothing,” they did take matters into their own hands. They were waiting and watching to see what was happening.

So when asked to respond to Caldwell’s misrepresentation that he was charged with conspiring to storm the Capitol, Rakoczy responded that it wasn’t certain they would storm the Capitol; the group was prepared to act, they just weren’t sure how — given the uncertainties of the day — they would act.

Based on that response and his conclusion that Caldwell actually had never entered the Capitol, Judge Mehta ruled that Caldwell was differently situated than the other defendants insofar as the evidence that he participated in the conspiracy (to storm the Capitol, Fischer said) was weaker given that he never did enter the Capitol.

Only later, after Judge Mehta had announced his decision, did Rakoczy point out the problem with this argument: Caldwell is not charged with conspiring to storm the Capitol. As she noted, the language Fischer kept quoting about storming the Capitol came from a background paragraph of the superseding indictment:

23. As described more fully herein, CALDWELL, CROWL, WATKINS, SANDRA PARKER, BENNIE PARKER, YOUNG, STEELE, KELLY MEGGS, and CONNIE MEGGS, planned with each other, and with others known and unknown, to forcibly enter the Capitol on January 6, 2021, and to stop, delay, and hinder the Congressional proceeding occurring that day.

The actual conspiracy as charged was to impede the certification of the Electoral College vote.

24. [… the defendants] did knowingly combine, conspire, confederate, and agree with each other and others known and unknown, to commit an offense against the United States, namely, to corruptly obstruct, influence, and impede an official proceeding, that is, Congress’s certification of the Electoral College vote, and to attempt to do so, in violation of Title 18, United States Code, Section 1512(c)(2).

Purpose of the Conspiracy

25. The purpose of the conspiracy was to stop, delay, and hinder Congress’s certification of the Electoral College vote.

This is a problem I saw going in (though I doubted that Fischer would be able to confuse Mehta as well as he did).

But the results of this hearing, particularly given Rakoczy’s answers, reveal something about the way this conspiracy is charged (and the ones most of the Proud Boy are charged).

They assume the any action conspirators took would be effectuated on Congress, that that was the only eventuality conspirators were planning for.

The conspiracy is all built off an obstruction charge which itself, while valid, is fairly inapt. It likens the counting of the vote to a trial, which legally holds, but doesn’t get at the scope of what co-conspirators (and Trump) were trying to accomplish. The focus — Caldwell’s, as well as those who actually did storm the Capitol — was all on Congress, because that was the next event in question (just as the previous December mob had been focused on the electoral certifications in the states). But the goal was not (just) to stop the certification of the vote count on Congress. The ultimate goal was to ensure that Trump would remain President, via whatever means. And as Rakoczy acknowledged, one possibility that co-conspirators Kelly Meggs and Jessica Watkins believed might happen was that Trump would declare martial law, and the Oath Keepers would become the glorious army to save their fantastic dreams. That would have had the effect of preventing the certification of the electoral vote, but it would have (if successful) been a more direct route to the actual goal of the conspiracy: to keep Trump in power and prevent the lawfully elected President from taking over.

That’s why Fischer’s ploy worked: because all the planning wasn’t primarily about the Capitol. It was primarily about Trump.

This charge is built like it is, I’ve always been convinced, because no one has yet made the commitment to charge seditious conspiracy (ideally in parallel with this conspiracy). The real goal, after all, was to overthrow the democratic system, and impeding the vote count was just one means to achieve that conspiracy. The conspiring that started even before the election was about overthrowing democracy, not just January 6.

This may not be a fatal weakness for these conspiracy charges. Now that prosecutors have seen Fischer work this feint so well, they’ll be better prepared for it from others.

But one reason it worked is because the real goal of the conspiracy — the one that Caldwell’s lawyer all but conceded to today — was to do whatever it took to prevent the lawfully elected President from taking power.

Share this entry

An Inventory of the January 6 Investigation on Merrick Garland’s First Day

/45 Comments/in /by

Overnight on the day that Merrick Garland got his first briefing on the January 6 investigation, DOJ asked for a 60-day extension of time in the Oath Keepers’s conspiracy case. As part of the motion, they cite what has been done on the investigation so far. That inventory includes:

  • Over 900 search warrants, executed in almost all fifty states and the District of Columbia
  • More than 15,000 hours of surveillance and body-worn camera footage from multiple law enforcement agencies
  • Approximately 1,600 electronic devices
  • The results of hundreds of searches of electronic communication providers
  • Over 210,000 tips, of which a substantial portion include video, photo and social media
  • Over 80,000 reports and 93,000 attachments related to law enforcement interviews of suspects and witnesses and other investigative steps
  • Involvement of 14 law enforcement agencies, including:
    • U.S. Capitol Police
    • DC Metropolitan Police Department
    • FBI
    • DHS
    • Bureau of Alcohol, Tobacco, Firearms and Explosives
    • US Secret Service
    • US Park Police
    • Virginia State Police
    • Arlington County Police Department
    • Prince William County Police Department
    • Maryland State Police
    • Montgomery County Police Department
    • Prince George’s County Police Department

As the filing lays out, the government and the DC Public Defender’s office are trying to set up a system making available the general set of evidence to all defendants, while providing more specific evidence directly to the defendant. Some of that has started in this case.

The government has already provided defense counsel with preliminary discovery, including: arrest paperwork; recordings of custodial interviews, where available; paperwork and photographs relating to premises search warrants; data extracted from several of the defendants’ cellular telephones and social media accounts; some defendants’ hotel records; and some photographs and video recordings, from publicly available sources, of the defendants participating in the alleged offenses.

But most of the defendants in this case have already opposed a continuance, including Donovan Crowl, Kelly and Connie Meggs, Graydon Young, and Thomas Caldwell.

Not only must they be aware that others will get added to the conspiracy, broadening the scope of their potential criminal exposure under the conspiracy. But the government also clearly envisions the potential of more charges (possibly including seditious conspiracy).

Some of the conspiratorial activity being investigated, such as the activity under investigation in this matter, involves a large number of participants. The spectrum of crimes charged and under investigation in connection with the Capitol Attack includes (but is not limited to) trespass, engaging in disruptive or violent conduct in the Capitol or on Capitol grounds, destruction of government property, theft of government property, assaults on federal and local police officers, firearms offenses, civil disorder, obstruction of an official proceeding, possession and use of destructive devices, and conspiracy. [my emphasis]

Given Amit Mehta’s inclinations in any case, he might grant the continuance but put several of the defendants on home detention. We’ll know more about his inclinations at a hearing at 3.

Share this entry

GoToInsurrection and Other Astounding Oath Keeper Social Media Habits

/38 Comments/in , /by

DOJ has now charged the following Oath Keeper associates:

Between all the charges, prosecutors have laid out a breathtaking scope of social media use by the militia:

  • A leadership list on Signal they appear to have obtained from either Watkins and/or Kelly Meggs
  • Open channels on Zello, possibly separate ones for each large event
  • Telephony chats and texts, including during January 6
  • MeWe accounts
  • Way too much blabbing on Facebook, followed by a foolish belief they could delete such content
  • Parler for further blabbing
  • Stripe for payment processing (possibly for dues)
  • GoToMeeting for operational planning

Plus, most of the people arrested thus far had their cell phones on, pinging cell towers, while they were in the Capitol (thus far, two of the accused did not enter the Capitol).

It’s the GoToMeeting revelation, in Harrelson’s affidavit, that gets me:

Pursuant to legal process, the government obtained records from Go To Meeting showing that a user named “gator 6” was the organizer for a meeting titled “dc planning call” on January 3, 2021. The user “gator 6” accessed the meeting from a mobile device using the same IP address ending in 158 [as Harrelson used to access Apple servers], and the user listed themselves as living in Titusville, Florida. Between September 30, 2020, and January 3, 2021, the user with the same IP address ending in 158 attended or organized approximately 30 meetings on Go To Meeting affiliated with the Oath Keepers, using the names “gator 6,” “hotel 26,” or kenneth harrelson.”

GoToMeeting is basically spyware for your computer, because it has to access so many features of your computer to work. As a default it collects a great deal of data on participants, and can be set to collect more. It is end-to-end encrypted, but with legal process FBI might be able to get a great deal of information from GTM, if the Oath Keepers kept it.

Between these twelve people, then, DOJ has served legal process on enough databases to create a veritable dossier on the Oath Keepers. While some of these comms (such as the Zello comms) are ephemeral, Facebook and GoToMeeting and Stripe are data vacuums.

With a database like this, the government can be choosy about which Oath Keepers they arrest. Reportedly, DOJ says they may add 6 more people to their collection of Oath Keeper defendants.

Indeed, it’s not really clear why they’ve charged the last three — Minuta, James, and Harrelson — before charging the last several members of the Stack that entered the Capitol together.

Harrelson was not part of the Stack, but the affidavit justifying his arrest shows him — and another guy — in communication as the Stack came up the Capitol steps, with Harrelson interacting with Graydon Young inside the Capitol. But his organizing efforts in Florida would put him in close touch with the Meggses (Kelly leads the Florida chapter) and James (who lives in Alabama but seems to be tied to the Florida chapter), along with Young (who lives in Titusville).

These Florida Oath Keepers were providing “security” for Roger Stone well before the January insurrection, including an event in Florida. (MoJo had a summary of who provided security when yesterday.)

As for Minuta, in addition to serving as Stone’s security on January 5 and 6, he also was abusive to cops before entering the Capitol and on his way out, when he promised the Second Amendment option came next. Like Young, Minuta is also accused of deleting Facebook, probably just as unsuccessfully.

In James’ case, DOJ seems particularly interested in the communications he had with Minuta, called Person Five in the affidavit even though he was already arrested by the time it was approved.

While James stood with the other Oath Keepers, at least one of them (who will be referred to below as “Person Five”)2 aggressively berated and taunted U.S. Capitol police officers responsible for protecting the Capitol and the representatives inside.

[snip]

Records indicate that phone number XXX-XXX-4304 (associated with James) exchanged a number of phone calls throughout November and December 2020 with a person who will be referred to herein as Person Five.

On November 13 and 14, 2020, for example, phone number XXX-XXX-4304 (associated with James) exchanged approximately eight calls with the number associated with Person Five. Your affiant is aware that certain Oath Keepers attended rallies in Washington, D.C., held on November 14, 2020, at which some Oath Keepers, to include Person Five, operated as a personal security detail for one or more speakers at the events.

Later, on or around November 20 and December 11, 2020, records indicate that phone number XXX-XXX-4304 (associated with James) exchanged two phone calls with Person Five. Your affiant is aware that certain Oath Keepers attended rallies in Washington, D.C., held on December 12, 2020, to protest the results of the 2020 election—at which some Oath Keepers, to include Person Five, operated as a personal security detail for speakers at the events.

Finally, records indicate that, on or around January 5, 2021, phone number XXXXXX-4304 (associated with James) exchanged six calls with the number associated with Person Five. That day, James, Person Five, and other individuals wearing apparel with the Oath Keepers name and/or insignia provided security to a speaker at the “Stop the Steal” events planned for that day.

Note that Minuta was hanging out with Proud Boy Dominic Pezzola in that December MAGA event.

James’ affidavit ends with this group photo, identifying Connie Meggs, two still uncharged Stack participants, four uncharged people who tracked with James and Minuta during the insurrection, Kelly Meggs, and another Stack member.

Both the Minuta and James affidavits focus on Oath Keeper head Stewart Rhodes, described as Person One, as does this detailed filing opposing bail for Caldwell.

James stayed in touch with others during the time of active investigation:

Since January 6, 2021, phone number XXX-XXX-4304 (known to be associated with James) has exchanged multiple phone calls and text messages with the number associated with Person Five. The number associated with James has also placed at least one call as recently as February 2021, to a phone number known to be associated with Kelly Meggs, the now-arrested self-described Florida Oath Keeper leader.

Thus far, DOJ isn’t explaining why Minuta, James, and Harrelson were arrested in the weeks after FBI started exploiting the Signal chats that organized Oath Keeper efforts on January 6 and, particular, Kelly Meggs’ communications.

But because the Oath Keepers were such promiscuous users of all kinds of social media tools, the FBI has a remarkable collection of data about the group’s activities since last fall. And they’ve picked these guys to arrest.

Update: In his detention hearing today, the FBI focused on James’ providing security for Stone.

The FBI agent who testified at Thursday’s hearing said several firearms were found during a search warrant executed at James’ home. All of the firearms were legal, and none were confiscated. They included a shotgun, a hunting rifle, a few “AR-15 style rifles,” and two pistols, the agent said.

James was paid $1,500 for security at two events, including a “Stop the Steal” rally on January 6, according from testimony from his wife, Audrey James. Stone and other pro-Trump figures held several events in Washington in addition to the official rally that Trump spoke at shortly before the attack.

Audrey James said she was sent “around $1,500 total” directly from the Oath Keepers over a mobile app. She stated the funds were paid out over a couple of months to assist her and her children during Joshua James’ absence to Texas and Washington, DC, while he was providing security. She said she didn’t know where the money originated from.

This story, by itself, presents real problems with the story Stone told. He raised funds for “security” in advance of the insurrection, but then said he couldn’t find paid security so relied on volunteers.

Share this entry