As I noted in this post, partly due to the way Krysten Sinema restated Assistant FBI Director Jill Sanborn’s response, the woman in charge of FBI’s counterterrorism efforts mistakenly claimed that the Bureau cannot monitor public social media communications. The reality — as confirmed by NBC — is that they can’t persistently target a person’s communications, but they can monitor open source postings.
In a statement to NBC News, the FBI acknowledged that it can and does look at public social media information. An FBI official said Sanborn understood Sinema’s question to be referring to “whether the FBI persistently and passively examines internet traffic and social media conversations, to include direct messages between two users.” In fact, her question referred to comments made on public-facing social media services.
“The FBI may observe and collect information from open sources as long as the FBI activities are done for a valid law enforcement or national security purpose and in a manner that does not unduly infringe upon the speaker or author’s ability to deliver his or her message,” an FBI official said. “The authorized purpose must specifically be tied to federal criminal or national security purposes, usually to further an FBI assessment or … investigation.”
Given that the FBI can monitor open source communications, it makes this earlier exchange, between Sanborn and Maggie Hassan, more significant. Senator Hassan asked Sanborn how many of the people already arrested in the January 6 insurrection had been under investigation before it.
Maggie Hassan: Of the individuals charged to day in relation to the attacks of January 6, how many were already under investigation by the Bureau.
Jill Sanborn: Ma’am, I’d have to get you the specific number, but I can only recall, from my memory, one, of the individuals that was under investigation prior.
While Sanborn was speaking from memory and promised to get an exact number, Sanborn could only remember one open investigation among the people arrested so far.
FBI appears to have done an assessment on at least three people arrested so far (assuming that the MPD arrest of Enrique Tarrio for targeting a Black Church in December is not the one Sanborn was thinking of).
For example, in December, an associate of Kevin Strong contacted the FBI to alert them that the FAA employee had started stock-piling goods, warned someone else that World War 3 was going to start on January 6, and was pushing Parler as a legitimate source of information. That led the FBI to open an investigation on Strong on December 30.
On December 30, 2020, the FBI initiated an investigation of STRONG based on reporting from Witness #1 (“W-1”). W-1 is familiar with STRONG and his previous residence. W-1 told the FBI that STRONG had been showing signs of behavioral changes over the last few months including stock-piling items and telling others to get ready for Marshal Law, rioting, and protesting. Specifically, W-1 was aware that STRONG had sent messages to another individual claiming World War 3 is going to occur on January 6, 2021, and that the military was coming in and getting involved. W-1 was aware that STRONG hung a flag with the logo “WW1WGA” on his house. W-1 told the FBI that he/she looked it up on the Internet and found that that “WWG1WGA” was a QAnon slogan standing for “Where We Go One, We Go All.” STRONG was known to declare that he had “Q clearance” and believed he was part of a “movement” that was greater than himself. He had recently purchased a new truck and believed that QAnon would cover the debt. STRONG had also been promoting the “Parler” application as a place to get information.
STRONG is currently employed by the Federal Aviation Administration (FAA) in San Bernardino, California. On January 7, 2021, an employee in the Internal Investigations Branch of the FAA contacted the FBI and reported STRONG was observed at the United States Capitol building during the unlawful entry that took place on January 6, 2021. According to the FAA employee, STRONG was seen on a news broadcast.1 The employee provided a screengrab from the news broadcast to law enforcement.
Strong was charged with the two misdemeanor trespassing crimes virtually everyone who entered the Capitol was charged with but not, as those who posted conspiracies about the election in advance of January 6 generally were, with obstruction of the vote count.
Even though they had an investigation into Strong, it still took a tip from the FAA to alert the FBI that Strong had entered the Capitol on January 6, to which he readily confessed when he was interviewed on January 16.
Then there’s Bryan Betancur. While out on probation after serving time for burglary, Betancur was explicitly talking about following the lead of James Field, the Neo-Nazi who murdered Heather Heyer.
BETANCUR is a self-professed white supremacist who has made statements to law enforcement officers that he is a member of several white supremacy organizations. BETANCUR has voiced homicidal ideations, made comments about conducting a school shooting, and has researched mass shootings. BETANCUR voiced support for James Fields, the individual convicted for killing an individual with his car during protests in Charlottesville, Virginia. BETANCUR has stated he wanted to run people over with a vehicle and kill people in a church. BETANCUR subsequently stated that he had changed his mind about hurting people.
After being released following a conviction for fourth degree burglary, BETANCUR continued to engage racially motivated violent extremist groups on the internet. BETANCUR also made increased verbalizations about his desire to be a “lone wolf killer.” BETANCUR has repeatedly violated the terms of his parole and probation.
Betancur’s arrest affidavit describes a Task Force officer interviewing Betancur repeatedly during what it calls an investigation of him.
A FBI Task Force Officer who has interviewed BETANCUR multiple times throughout the FBI’s investigation of BETANCUR also believes the individual on the left side of the image to be BETANCUR.
Betancur lied to his probation officer — claiming he was going to hand out Bibles in DC — to get permission to go to DC that day. And he showed up wearing a Proud Boys shirt and flashing white supremacist symbols and (in another picture) waving a Confederate flag.
In spite of the fact that this guy was aspiring to replicate Field’s attack and the apparent fact he was under investigation, the FBI affidavit suggests they needed a cooperating witness to ID Betancourt’s social media accounts.
Your affiant has also reviewed screenshots of accounts believed to belong to BETANCUR, provided by a cooperating witness (hereafter “CW1”). CW1 submitted an image to the tip-line established in the aftermath of the events of January 6, 2021. CW1 provided comments with this image stating that the individual in the screenshot had participated in the events at the U.S. Capitol on January 6, 2021 and posted numerous images using social media accounts with the names Bryan Clooney and Maximo Clooney. In the image CW1 submitted to the tip-line, a social media user with the user name “bryan_patriot_1776” appears to stand on scaffolding erected on the western side of the U.S. Capitol Building holding the corner of a confederate battle flag.
Like Strong, Betancur was charged with just misdemeanor trespassing charges, though he’s back in trouble in Maryland for violating probation.
A third defendant the FBI investigated before the insurrection is perhaps the most damning for what it says about the social media activity the FBI will notice.
The FBI is coy about two details in the arrest affidavit for Rasha Abual-Ragheb: One is when the Newark Office obtained Abual-Ragheb’s Facebook data, before or after January 6.
In addition, FBI Newark Division (FBI Newark) recently obtained, through legal process, records associated with the Facebook account with the display name Rasha Abu. The Facebook records link the Rasha Abu account to the same phone number that Rasha Abual-Ragheb provided the interviewing agents in November of 2020. FBI Newark also recently obtained, through legal process, records associated with the phone number provided by Rasha Abual-Ragheb, which confirmed Rasha Abual-Ragheb was in fact the subscriber.
And given that so many people have written affidavits in this investigation, it’s unclear whether the two people identified as “Confidential Human Sources” reporting back to the Philadelphia FBI Office in Abual-Ragheb’s arrest warrant are, as the name would normally suggest, FBI informants, or whether they’re just concerned citizens calling in tips as happened with the vast majority of tips on January 6 defendants.
On January 7, 2021, CHS 1 reported to the FBI Philadelphia Division (FBI Philadelphia) that he/she observed Rasha Abual-Ragheb’s Facebook page (display name Rasha Abu) showing Rasha Abual-Ragheb at the protest in Washington, DC on January 6, 2021 (attachment 1). A post made by Rasha Abual-Ragheb on the Facebook page revealed she checked into the Kimpton George Hotel (attachment 2). In another Facebook post (attachment 3), Rasha Abual-Ragheb posted the following: “Just left Dc… I got tear gas, paper spray!!! But I was part of the history. We the people won’t take it anymore. Antifa were between us, i and other MAGA people told Dc police, get that Antifa they didn’t do anything. He had black metal chair… The police would order to use full force on us from the beginning when we start marching to the capital, the use teargas and pepper spray and rubber bullet, they shot the woman that was standing peacefully without a a weapon, they hit women’s kids. They hit people with the pat metal one.”
On January 6, 2021, Confidential Human Source #2 (CHS 2) advised the FBI Philadelphia that on the night of January 6, 2021, CHS 2 encountered a woman on the sidewalk of the Kimpton George Hotel in Washington D.C. dressed in distinct clothing and making a scene (attachment 4, which was photo taken by CHS). The woman on the sidewalk identified herself as “Rasha,” admitted to being in the U.S. Capitol, and showed CHS 2 a picture of herself in the building (attachment 5). CHS 2 further reported Rasha Abual-Ragheb said she was in the U.S. Capitol and saw a woman get shot.
Still, what is clear is that, back in November, the FBI responded to Abual-Ragheb making inflammatory comments and repeating Donald Trump’s “Stand By” comment on social media by conducting — at a minimum — an Assessment against her, including an FBI interview.
In November 2020, a Facebook account with display name Rasha Abu participated in Facebook and Telegram group chats involving the New Jersey chapter of the American Patriot 3%. In the Facebook chat, user Rasha Abu advised the revolution will start not by standing by but by standing up. In addition, she advised civil war is coming and they need to show support, and rise up and fight for our Constitution. Open Source research identified an individual named Rasha Abual-Ragheb, residing at a specific address in New Jersey, as the possible user of the Facebook account. As part of the FBI’s assessment of Rasha Abual-Ragheb, she was interviewed. During the interview, she advised she was a Trump supporter, attended Trump rallies, and was blocked from making posts on Facebook and Twitter for pro-Trump postings. Additionally, Rasha AbualRagheb advised she was born in Lebanon and fled to Jordan when she was a child due to the civil war there. She further advised that she has lived in the United States for 21 years and she provided the interviewing agents with her telephone number.
Like Strong and Betancur, Abual-Ragheb was charged with just the two misdemeanor charges.
While her attorney, Elia Amato, could provide no clarity on whether the investigation into Abual-Ragheb continued from November through January 6 — possibly up to and including arranging for informants to track her movements on the day of the attack — Amato did emphasize that, “What ever prior investigative concerns law enforcement may have had appear to have been quashed.”
Still, it’s clear that, almost alone among 300 people charged so far, the FBI had noticed Abual-Ragheb’s public comments on social media and taken further investigative steps.
Jill Sanborn excused FBI’s failure to see the insurrection in advance based off obfuscation about the Bureau’s ability to observe and react to comments in public. But the Bureau did identify a potential threat and conduct an assessment in Abual-Ragheb’s case.
That also means they did that — almost uniquely — with an immigrant who has a Middle Eastern name, while ignoring others, many with criminal records, who made far more substantive or inflammatory comments.
The FBI didn’t respond to Proud Boy Enrique Tarrio’s plans for January 6 in plain sight, even though he had committed a racially motivated attack the last time he had been in DC.
They didn’t see and respond to Facebook posts from Three Percenter Michael Lopatic, the former Marine who spent the months after the election naming his hunting kill after Joe Biden, Kamala Harris, Chuck Schumer, Nancy Pelosi, Jerry Nadler, and Adam Schiff, posted a “Call to Arms,” in advance of January 6, and is accused of assaulting at least two cops at the insurrection.
They did see the woman on Three Percenter sites with an Arab name.
Meanwhile, by dint of opening an investigation into Kevin Strong, the FBI had evidence that delusional QAnon followers believed there would be Martial law and World War 3 on January 6, a description of January 6 as “war” in the FBI’s hands a week before the January 5 Norfolk report.
But that didn’t raise a wider alarm, either.
Now that the FBI has conceded that it had the authority to look at any of the social media discussions that led others to anticipate that January 6 would be something different, it has more some explaining to do — not least why one of the only January 6 participants it discovered in advance was virtually the only one with an Arab name.