Posts

A Taxonomy of the [Visible] January 6 “Crime Scene” Investigation

In preparation for a post about how DOJ might or might not make the move beyond prosecuting pawns who breached the Capitol to those who incited them to come to the Capitol, I want to describe a taxonomy of the January 6 “crime scene” investigation — which I mean to encompass the investigation as it has worked up from the people who actually stormed the Capitol. This is my understanding of how the many already-charged defendants fit together.

DOJ has arrested close to 700 people (probably more than that once you consider cases that haven’t been unsealed). Those defendants generally fit into the following categories, all of which are non-exclusive, meaning lots of people fall into more than one category:

  • Militia conspirators and militia associates
  • Assault defendants
  • Mobilized local networks
  • Other felony defendants
  • Misdemeanants
  • Organizer inciters

In my discussion below, these are all allegations, most of the felony defendants have pled not guilty, and are presumed innocent.

Militia conspirators and militia associates

The most newsworthy prosecutions, thus far, are the militia conspiracies, though not all militia members have been charged as part of a conspiracy.

There are 17 people facing charges in the Oath Keeper conspiracy, plus four cooperators, as well as another cooperator and two more Oath Keepers not charged in the conspiracy.

There are 17 Proud Boys currently charged in various conspiracies, including four, thus far, charged in what I call the Leader conspiracy. I suspect in the near future there will be consolidation of the core Proud Boy cases. In addition, there are a significant number of Proud Boys charged either in group indictments (such as the five men who followed Joe Biggs around that day), or individually, some with assault (such as Christopher Worrell, David Dempsey, and Dan “Milkshake” Scott), and some with just trespassing (such as Lisa Homer or Micajah Jackson).

There is one conspiracy indictment against mostly 3%ers, along with Guy Reffitt, who was individually charged, and a few others whose 3% ties are less well-established in charging papers.

All of which is to say that a small but significant minority of the January 6 defendants have some tie to an organized militia group.

That’s important, because the government is very close to showing that there was a plan — led at the Capitol by the Proud Boys, but seemingly coordinated closely with some members of the Oath Keepers. The plan entailed initiating a breach, surrounding the Capitol, opening up multiple additional fronts (of which the East appears to be the most important), and inciting the “normies” to do some of the worst violence and destruction, making the Capitol uninhabitable during the hours when Congress was supposed to be making Joe Biden President. Until about 4PM — when cops began to secure the Capitol and DOD moved closer to sending in the National Guard — the plan met with enormous success (though I wouldn’t be surprised if the conspirators hoped that a normie might attack a member of Congress, giving Trump cause to invoke harsher measures).

People complain that DOJ has been doing nothing in the 11 months since the riot. But this has been a central focus of DOJ’s effort: understanding how this plan worked, and then assembling enough evidence and cooperating witnesses to be able to lay out several intersecting conspiracies that will show not just that these groups wanted to prevent the certification of the vote (what they’re currently charged with), but pursued a plan to lead a mob attack on the Capitol to ensure that happened.

Proving these interlocking conspiracies would be vital to moving up from the militias, because it shows the premeditation involved in the assault on the Capitol. DOJ hasn’t rolled this out yet, but they seem to be very very close.

Assault defendants

Close to 150 people have been charged with assault (DOJ has a higher number but they’re tracking two different crimes, 18 USC 111, assault, and 18 USC 231, whereas I’m tracking just the former). The assaults charged against these defendants range from pushing a cop once to tasing someone and nearly killing him. Much of this amounted to mob violence, albeit at times the mob violence was pretty finely coordinated.

That said, there are a handful of defendants charged with assaults that were tactically critical to the plan implemented by the Proud Boys (again, these are just allegations and all have pled not guilty and are presumed innocent):

  • After speaking with Proud Boy Joe Biggs, Ryan Samsel kicked off the riot by storming over the first barricade, knocking over a female cop
  • Ronnie Sandlin and Nate DeGrave helped open both the East Door and Senate gallery doors
  • Jimmy Haffner allegedly sprayed something at the cops trying to stave off the crowd on the East side
  • George Tenney pushed cops away from the East door and opened it (he is charged with civil disorder, not assault)
  • Active duty Marine Chris Warnagiris kept cops from closing the East door after Tenney had opened it

It’s important to understand whether those defendants who committed tactically critical assaults were operating with knowledge of the larger plan.

For most of the rest of the assault defendants, though, it’s a matter of identifying them, assembling the video and other evidence to prove the case, and finding them to arrest them.

The FBI has posted close to 500 total assault suspect BOLOs (Be On the Lookout posters, basically a request for help identifying someone), which means there may be up to 350 assault suspects still at large.

I expect assault arrests to continue at a steady pace, perhaps even accelerate as the government completes the investigations required with people who either used better operational security or fled.

Mobilized local networks

Something DOJ appears to be investigating are key localized networks through which people were radicalized.

This is most obvious for Southern California. The 3%er indictment is geographically based (and as I’ll argue in a follow-up, is investigatively important for that geographic tie.) In addition, after months of contemplating what seemed like it might be a larger conspiracy indictment, DOJ recently charged Ed Badalian and a guy nicknamed Swedish Scarf, in a conspiracy with one of the people accused of tasering Michael Fanone, Danny Rodriguez.

Recent arrest affidavits, most notably that of Danean MacAndrews, also show that FBI shared identifiers from the various geofence warrants obtained targeting the Capitol on January 6 and shared them with regional intelligence centers to identify local participants in the mob.

There have been recent case developments, too, which suggest DOJ is letting people from Southern Californian plead down in an effort to obtain their testimony (which I’ll explain more in my discussion of misdemeanants).

Some of this localized investigation feeds back into the larger investigation, as evidenced by the two conspiracy indictments coming out of Southern California. But it also shows how these various radicalized networks fit together.

While it is less visible (and perhaps because there’s not always the same terrorist and drug war intelligence infrastructure as LA has, potentially less formalized), I assume similar localized investigations are going on in key organizing hotspots as well, including at least PA and FL, and probably also the Mountain West.

Other felony defendants

There are other defendants charged with a felony for their actions on January 6, most often for obstruction of the vote count (under 18 USC 1512c2) and/or civil disorder. As of November 6, DOJ said 265 people had been charged with obstruction. A number of those obstruction defendants have been permitted to plead down to a trespassing charge, usually the more serious 18 USC 1752.

It’s hard to generalize about this group, in part because some of the mobilizing networks that got these people to the Capitol would not be visible (if at all) until sentencing, particularly given that few of them are being detained.

But the group includes a lot of QAnoners — which, I have argued, actually had more success at getting bodies into place to obstruct the vote count than the militias (which were busy opening multiple fronts). The PodCast Finding Q revealed that the FBI started more actively investigating QAnon as a mobilizing force in the days after the insurrection. So the FBI may well be investigating QAnon from the top down. But it’s not as easy to understand as — for example — investigative steps targeting QAnoners as it is the militia networks, in part because QAnon doesn’t require the same kind of network ties to radicalize people.

These defendants also include people mobilized in other networks — some anti-mask, some military, some more directly tied to institutional right wing organizations, and some who simply responded to the advertising for the event. Understanding how and why these people ended up at the Capitol is a critical step to understanding how the event worked. But it is harder to discern that from the court filings available.

Aside from better known right wing personalities, it’s also harder to identify potentially significant defendants from this group.

In the days ahead, a number of DC judges will be ruling on DOJ’s application of obstruction. Unless all rule for the government (which I find unlikely), it means DOJ will face a scramble of what to do with these defendants, especially those not otherwise charged with a felony like civil disorder. And until judges rule, there will be a significant number of felony defendants who are deferring decisions on plea offers, to see whether the felony charge against them will really survive.

The fact that most of the least serious felony defendants are delaying plea decisions creates an artificial appearance that the vast majority of those charged in January 6 were charged with trespassing. It’s not that there aren’t a huge number of felony defendants; it’s just that they’re not making the news because they’re not pleading guilty, yet.

Misdemeanants

The most common complaint about the January 6 investigation — from both those following from afar and the judges facing an unprecedented flood of trespassing defendants in their already crowded court rooms — the sheer number of trespassing defendants.

It is true that, in the days after the riot, DOJ arrested the people who most obviously mugged for the cameras.

But in the last six months or so, it seems that DOJ has been more selective about which of the 2,000 – 2,500 people who entered the Capitol they choose to arrest, based off investigative necessities. After all, in addition to being defendants, these “MAGA Tourists” are also witnesses to more serious crimes. Now that DOJ has set up a steady flow of plea deals for misdemeanors, people are pleading guilty more quickly. With just a few exceptions, the vast majority of those charged or who have pled down to trespassing charges have agreed to a cooperation component (entailing an FBI interview and sharing social media content) as part of their plea deal. And DOJ seems to be arresting the trespassers who, for whatever reason, may be useful “cooperating” witnesses for the larger investigation. I started collecting some of what misdemeanant’ cooperation will yield, but it includes:

Video or photographic evidence

Hard as it may be to understand, there were parts of the riot that were not, for a variety of reasons, well captured by government surveillance footage. And a significant number of misdemeanor defendants seem to be arrested because they can be seen filming with their phones on what surveillance footage does exist, and are known to have traveled to places where such surveillance footage appears to be unavailable or less useful. The government has or seems to be using evidence from other defendants to understand what happened:

  • Under the scaffolding set up for the inauguration
  • At the scene of Ashli Babbitt’s killing (though this appears to be as much to get audio capturing certain defendants as video)
  • In the offices of the Parliamentarian, Jeff Merkley, and Nancy Pelosi
  • As Kelly Meggs and other Oath Keepers walked down a hallway hunting for Nancy Pelosi
  • Some of what happened in the Senate, perhaps after Leo Bozell and others rendered the CSPAN cameras ineffective

In other words, these misdemeanor arrests are necessary building blocks for more serious cases, because they are in possession of evidence against others.

Witness testimony

TV lawyers seem certain that Trump could be charged with incitement, without considering that to charge that, DOJ would first have to collect evidence that people responded to his words by invading the Capitol or even engaging in violence.

That’s some of what misdemeanor defendants would be available to testify to given their social media claims and statements of offense. For example, trespasser defendants have described:

  • What went on at events on January 5
  • The multiple signs that they were not permitted to enter whatever entrance they did enter, including police lines, broken windows and doors, loud alarms, and tear gas
  • Directions that people in tactical gear were giving
  • Their response to Rudy Giuliani and Mo Brooks’ calls for violence
  • Their response to Trump’s complaint that Mike Pence had let him down
  • The actions they took (including breaching the Capitol) after Alex Jones promised they’d get to hear Trump again if they moved to the East front of the Capitol

Securing the testimony of those purportedly incited by Trump or Rudy or Mo Brooks or Alex Jones is a necessary step in holding them accountable for incitement.

Network information

Some misdemeanor defendants are being arrested because their buddies already were arrested (and sometimes these pleas are “wired,” requiring everyone to plead guilty together). Other misdemeanor defendants are part of an interesting network (including the militias). By arresting them (and often obtaining and exploiting their devices), the government is able to learn more about those with more criminal exposure on January 6.

Misdemeanor plea deals

In its sentencing memo for Jacob Hiles, the guy who otherwise would probably be fighting an obstruction charged if he hadn’t helped prosecute Capitol Police Officer Michael Riley, the government stated that, “no previously sentenced defendant has provided assistance of the degree provided by the defendant in this case.” The comment strongly suggests there are other misdemeanor defendants who have provided such assistance, but they haven’t been sentenced yet.

This category is harder to track, because, unless and until such cooperation-driven misdemeanor pleas are publicly discussed in future sentencing memos, we may never learn of them. But there are people — Baked Alaska is one, but by no means the only one, of them — who suggested he might be able to avoid obstruction charges by cooperating with prosecutors (there’s no sign, yet, that he has cooperated). We should assume that some of the defendants who’ve been deferring charges for months on end, only to end up with a misdemeanor plea, cooperated along the way to get that charge. That is, some of the misdemeanor pleas that everyone is complaining about likely reflect significant, completed cooperation with prosecutors, the kind of cooperation without which this prosecution will never move beyond the crime scene.

Organizer inciters

In this post, I have argued that DOJ is very close to rolling out more details of the plot to seize the Capitol, a plot that was implemented (at the Capitol) by the Proud Boys in coordination with other militia-tied people. I have also argued that one goal of the misdemeanor arrests has been to obtain evidence showing that speeches inciting violence, attacks on Mike Pence, or directing crowds to (in effect) trespass brought about violence, the targeting of Mike Pence, and the breach of the Capitol.

If I’m right about these two observations, it means that the investigation has reached a step where the next logical move would be to charge those who incited violence or directed certain movement. The next logical step would be to hold those who caused the obstruction accountable for the obstruction they cultivated.

This is why I focused on Alex Jones in this post: because there is a great deal of evidence that Alex Jones, the guy whom Trump personally ordered to lead mobs to the Capitol, was part of the plot led by his former employee, Joe Biggs, to breach a second front of the Capitol. If this investigation is going to move further, people like Alex Jones and other people who helped organize and incite the riot, will be the next step.

In fact, DOJ has made moves towards doing this for months — though at the moment, they seem woefully inadequate. For example DOJ charged Brandon Straka, who had a key role in inciting violence both before and at the event, in January; he pled guilty to a misdemeanor in October (his sentencing just got moved from December 17 to December 22). DOJ charged Owen Shroyer, Jones’ sidekick as the Pied Piper of insurrection, but just for trespassing, not for the obvious incitement he and Jones did. The one case where DOJ has already moved to hold someone accountable for his role in inciting violence is Russell Taylor, who was charged in the 3%er conspiracy, but that conspiracy indictment will test DOJ’s ability to hold those who incited violence accountable.

Back in August, when these three developments were clear, I noted that DOJ had only barely begun to unpack what happened on January 5 (to say nothing of events in DC in December), which played a key role in the success of January 6. It has provided scant new detail of having done so (though there are signs they are collecting such information).

The investigation at the crime scene is not the only investigation into January 6 going on. Merrick Garland made it clear DOJ was following the money. The FBI conducted investigative steps targeting QAnon just days after the riot. Daily Beast broke the news of a grand jury investigation into Sidney Powell’s grifting, an investigation that may be assisted by recriminations between her, Mike Flynn, and Patrick Byrne.

But the investigation building off of the crime scene will proceed, or not, based on DOJ’s ability to build cases against the organizer inciters.

How Google’s GeoFence Captured “Lions Not Sheep” Lisa Homer

Over the course of the January 6 investigation, I have repeatedly looked at the role several geofences — warrants collecting the identifiers of those who accessed cell sites in the vicinity of a crime — have played in the investigation. The FBI has relied on such geofence data from at least AT&T and Verizon (a recent arrest affidavit revealed that there were “significantly fewer devices in the T-Mobile data” from that day “than the company would expect”), as well as Google. There’s reason to believe the FBI obtained similar data from Facebook, perhaps identifying all those who livestreamed from inside the Capitol, but the scope of the collection time and place of that data remains obscure.

I’d like to revisit that discussion as part of a review of the arrest affidavit for Lisa Anne Homer/Boisselle. She was charged on November 15 with just trespassing, and arrested Monday, two weeks during which she may have been under close surveillance.

A word about her trespassing charges. In the initial days after the riot, FBI was arresting the people who most visibly mugged in videos, whether or not they had engaged in violence. In the days after the riot, FBI Director Christopher Wray explained that they were using arrests to understand the extremist networks they had missed before the attack.

The more arrests we make, the more from those cases we learn about who else their contacts are, what their tactics are, what their strategies are, et cetera. And that makes us smarter, better able to get in front of the threat going forward.

In many cases, those initial trespassing charges would lead to far more serious charges.

The number of trespassing arrests has significantly tailed off since then (and if DOJ believes these misdemeanors have a one-year statute of limitation, it will stop altogether next month). Indeed, for many of the more recent trespassing arrests, the FBI seems to have a specific purpose in arresting the people. Very often, the arrest affidavits focus on photos or videos the defendant obviously took during the insurrection. In some cases, the FBI seems to be looking for footage that might show what more serious participants did that wasn’t fully captured by CCTV. That’s definitely true of the events leading up to Ashli Babbitt’s shooting, and seems to be true for Kelly Meggs’ hunt for the Speaker after he broke into the Capitol.

In other cases, DOJ is arresting friends or accomplices of existing defendants on trespassing charges. That may be an attempt to be thorough, or it may be an effort to collect evidence about a primary target that accompanied the person to insurrection.

In some cases, such as with InfoWars personality Owen Shroyer, the government seems to have arrested people because they are key witnesses in the larger plot and DOJ can easily sustain a trespassing prosecution against them.

There are probably a slew of reasons why the FBI prioritized arresting Homer (who in June, legally changed her last name back to her maiden name, Boisselle, after a divorce). She did, in fact, film key scenes at the riot and she was wearing a GoPro under her chin.

She must also be someone of interest from a networking standpoint. For example, she lives or lived in AZ (indeed, the sole AUSA on her case right now, a detailee on Jan 6 cases who first filed notices of appearance on September 30, is located there), whence the siblings Konold traveled to insurrection; like Felicia Konold, Homer was standing next to Billy Chrestman as he riled up the crowd.

But the FBI suggests there may be a far more significant reasons for their interest later in her arrest affidavit. More than with virtually any of the Proud Boy or even Oath Keeper defendants, the FBI focuses on Homer’s attendance (and photography at) the November 2020 Proud Boys protest in DC.

The events of the November and December events in DC are undoubtedly central to the government’s investigation of the planning and networking that made January 6 happen. The government must be focused closely on it. They’ve just been very coy about sharing details of the key players at those earlier events., which seems a deliberate effort to shield what they know of those lead-up events from defendants (who, after all, are not charged for crimes committed in November and December). Nevertheless, in this case, FBI makes the November 2020 Proud Boy event central to the story they tell about Homer.

Indeed, the big reveal at the end of her arrest affidavit is a photo, which the FBI says was taken at the November 2020 Proud Boy event, that Homer posted on Instagram just weeks before she was charged. Her caption for the photo suggests that some guy — whose identity the FBI obscures but who surely can ID himself in the picture — “took my hand that night” is proof for her that “miracles can happen.”

It appears to be a love story wrapped inside an insurrection — a compelling story indeed.

But it starts (or at least, the FBI claims it started) with the Google GeoFence.

To be clear: The FBI likes to “parallel construct” investigative stories. To hide a sensitive investigative source (something like sensitive investigative methods, classified intelligence, or a cooperating witness), the FBI will often tell a story that suggests their investigation that ended with a big reveal — a love story wrapped inside an insurrection, perhaps — started with something totally innocuous, like a Google GeoFence that collected on everyone who trespassed on January 6.

And that’s how, the FBI suggests, this story started, with Homer tripping the Google GeoFence by entering the Capitol on January 6.

Again, there’s no reason to believe this is what really happened, but the FBI suggests they found Homer’s ID in the Google GeoFence, that led to “additional investigation,” that provided her phone and email information, which led to discovery of her travel records (which might have led to discovery of her trip to the November 2020 event), which made it very easy for the FBI to know where in all the video of from January 6 to find the photos that proved the figure whose face was hidden by a gaiter and glasses while inside the Capitol was the same person who showed her face freely outside of it.

One reason I’m amused by this story is that, for whatever reason, the FBI Agent failed to obscure what most affidavits including Google GeoFence Reports hide, which is that the GeoFence includes in the report the information that FBI claimed required “additional information:” Homer’s email, her Google ID, her SMS recovery number, her recovery email, her account creation date, as well as the map itself showing the points both in and outside the Capitol itself where she tripped the GeoFence. Normally, the FBI can obtain all this information with a subscriber request (or an NSL, in the case of national security cases), so it’s not treated as very sensitive and would require just one additional step to get in any case. But if the government has obtained a GeoFence including everyone recognizable to Google who trespassed that day, along with selectors that would form part of the subscriber information for other social media providers, such as the Instagram account that forms a key part of the rest of Homer’s affidavit, then it is really powerful data.

To date, we don’t know how much of this GeoFence data Google collected and included in individualized reports in response to a request in the immediate aftermath of January 6, how much these reports reflect reports done in response to individualized requests after the fact, based on preserved data, or whether it’s a mix (such as that Google provided the initial identifiers to the FBI, which the FBI then used to cross-reference with other investigative materials, leading them to prioritize certain requests for more detailed reports). The FBI could obtain this information via a warrant for the GeoFence or via individualized warrants served months later (and Google surely has carefully preserved all investigative information tied to the event).

But this report provides a clue: it says that Homer last logged into Google on January 19, 2021.

It would take unbelievable amounts of discipline for someone to go ten months without logging into Google one way or another, the kind of discipline not exhibited by a person who doesn’t delete user location and who also posts incriminating photos to Instagram from a year earlier. So this report was presumably finalized much closer to January 19, not long after she had logged into Google, than November.

Maybe that Google GeoFence really is where this apparent love story started.