Oath Keepers Learn the Hard Way: Don’t Plan an Insurrection on Facebook

“For every Oath Keeper you see, there are at least two you don’t see.” – email from Oath Keeper head Stewart Rhodes forwarded from Oath Keeper Graydon Young to his sister, Laura Steele, on January 4, 2021

I want to look at filings from the Oath Keepers investigation to show how FBI is juggling to move quickly enough to prevent obvious subjects from obstructing the investigation without tipping off others to the substance of the investigation. The filings confirm that the FBI will get sealed arrest warrants against subjects who are obviously obstructing the investigation, but may not use them right away, so as to obtain more evidence against them and their immediate co-conspirators. The filings also show how hard it is to delete evidence in an age of social media while conspiring with dozens of other co-conspirators.

The investigation from Watkins to Caldwell to the Parkers, Youngs, and Biggs

There’s a story about the Oath Keepers investigation that arises from the nature of the first publicly charged defendants. According to that story, the founder of an Ohio militia affiliated with the Oath Keepers, Jessica Watkins, boasted on Parler about “forcing entry into the Capitol” on the day of the attack. Videos of the Oath Keeper Stack showed up in videos posted within a day of the attack. Then, on January 13, the Ohio Capital Journal posted an interview with Watkins where she described it “the most beautiful thing” until she started hearing glass smashing — which she blamed on an Antifa false flag attack (a subsequent filing suggests Watkins wanted the Oath Keepers to get good press from the attack, threatening to sue some male journalist if he portrayed the Oath Keepers negatively).

That’s the evidence the FBI showed to obtain an arrest warrant on Watkins on January 16.

Meanwhile, as the investigation was closing in on Watkins, her recruit Donovan Crowl did an interview with the New Yorker for a story loaded with more images of coordinated movement from the Oath Keepers. Crowl offered similarly contradictory excuses for his action as Watkins.

On January 17, the FBI tried to conduct an interview with Watkins, only to be told by her partner, Montana Siniff, that she left Ohio on January 14 to stay with her friend and fellow Oath Keeper, “Commander Tom.”

At some point, the FBI obtained information from Facebook — they don’t explain when or on whom it was served, which I’ll return to. The return showed that Caldwell coordinated hotel reservations at the Comfort Inn/Ballston, not just with Watkins, but also others from North Carolina, as well as speaking with Crowl. This content may not have been obtained via Caldwell yet, because Caldwell’s private messages don’t show up in filings until January 19 (alternately they may have delayed that reveal until Caldwell was arrested).

But the FBI used that public Facebook information to obtain a warrant for Crowl on January 17. Watkins and Crowl turned themselves into Urbana, OH police that day, where the FBI took them into custody.

On January 13, the Guardian did a story on Watkins’ use of Zello.

“We are in the main dome right now,” said a female militia member, speaking on Zello, her voice competing with the cacophony of a clash with Capitol police. “We are rocking it. They’re throwing grenades, they’re frickin’ shooting people with paintballs, but we’re in here.”

“God bless and godspeed. Keep going,” said a male voice from a quiet environment.

“Jess, do your shit,” said another. “This is what we fucking lived up for. Everything we fucking trained for.”

The frenzied exchange took place at 2.44pm in a public Zello channel called “STOP THE STEAL J6”, where Trump supporters at home and in Washington DC discussed the riot as it unfolded. Dynamic group conversations like this exemplify why Zello, a smartphone and PC app, has become popular among militias, which have long fetishized military-like communication on analog radio.

On January 19, the government obtained an amended conspiracy complaint against Watkins, Crowl, and Caldwell. It included the following new information:

  • Quotations from the Zello messaging
  • Facebook messaging from Caldwell pictured standing outside the riot calling everyone in Congress a traitor
  • Facebook messages showing planning between Watkins, Crowl, and Caldwell between December 24 and January 8
  • Instructions for making plastic explosives found at Watkins’ house

Of particular interest, the complaint included the first hint that the Oath Keepers had intelligence — shared using Facebook — about the movements of Members of Congress.

On January 6, 2021, while at the Capitol, CALDWELL received the following Facebook message: “All members are in the tunnels under capital seal them in . Turn on gas”. When CALDWELL posted a Facebook message that read, “Inside,” he received the following messages, among others: “Tom take that bitch over”; “Tom all legislators are down in the Tunnels 3floors down”; “Do like we had to do when I was in the core start tearing oit florrs go from top to bottom”; and “Go through back house chamber doors facing N left down hallway down steps.”

Having arrested the two Oath Keepers blabbing to the press and the guy they hid out with, there’s not much more overt sign of the investigation until February 11, when the government submitted filings supporting pre-trial detention for both Watkins and Caldwell.

Arrest affidavits submitted on February 11 and February 12 (but sealed until after February 16) also refer to Watkins’ cell phone returns, including address book information describing Bennie Parker as a recruit, texts between Watkins and Parker coordinating plans for the insurrection and reassuring him the FBI would not prosecute them after the insurrection, and a picture of his wife Sandi Parker. Watkins’ cell phone returns also show a contact for Kelly Meggs in Florida, which she associated in her address book with the Oath Keepers.

Those initially sealed arrest affidavits also rely on surveillance footage and financial records from the Comfort Inn where all the Ohioans  stayed. It shows the Ohioans together in the lobby. It reveals that Kelly Meggs paid for a room that night registered under another suspected Oath Keeper’s name (according to credit card records showing a $302 charge, Meggs apparently stayed at the Hilton Garden Inn the night of January 7). [Update: The indictment clarifies that Meggs paid for two rooms at the Comfort Inn and booked two at the Hilton, of which he paid for one. h/t bb]

The initial affidavit against Kelly and Connie Meggs and Graydon Young and Laura Steele also includes a picture taken — by some unidentified person — from the van from North Carolina.

The same affidavit includes testimony from a witness who interacted with the Oath Keepers on January 6 and was on a text message chain including Young and Steele, who was introduced to them as Gray and Laura and learned they had taken the Metro into DC. It relies on surveillance video from the Metro. It includes returns from Steele and Young’s Google accounts, including Steele’s application to join the Oath Keepers.

It includes location data showing Graydon Young’s phone traveling from Englewood, FL to Thomasville, NC to Springfield, VA, to DC, then back to Thomasville and ultimately, on January 8, back to Englewood. It includes his round trip flight records from Tampa to Greensboro, consistent with the movement of his phone. The affidavit also uses location data to place Steele and the Meggses in a “geographic area that includes the interior of the United States Capitol building.”

It includes subscriber records for Steele, Young, and Kelly Megg’s MeWe accounts, as well as subscriber records for Facebook accounts for everyone. Of particular note, the affidavit used to arrest Young and the others shows advanced legal process for Young, but mostly subscriber information for the others. They also use Young’s Google data to establish probable cause against the Meggs but do not, yet, use it against Young.

It’s likely in the five days between the affidavit and the arrest, more warrants were served for materials on the others.

There wasn’t much added in a February 25 memo supporting Watkins’ pretrial detention — except that aforementioned Watkins text with Stewart Rhodes complaining about media reports making the Oath Keepers look bad (which, because of the timing of the coverage, likely happened almost a week after the insurrection, or later).

If he has anything negative to say about us OATHKEEPERS, I’ll let you know so we can sue harder. Class action style. Oathkeepers are the shit. They rescued cops, WE saved lives and did all the right things. At the end of the day, this guy better not try us. A lawsuit could even put cash in OK coffers. He doesn’t know who he is playing with. I won’t tolerate a defamation of character, mine or the Patriots we served with in DC. Hooah?!

But in a hearing held February 26, prosecutors told Judge Amit Mehta something in an ex parte hearing to support their argument that there really was a Quick Reaction Force outside of DC on the day of the insurrection ready to bring weapons into the Oath Keepers already in DC, which is one of the reasons he denied Watkins’ motion for release.

The earlier investigation into Graydon Young

It took a while for DOJ to unseal all the filings from the other co-conspirators, particularly the long affidavit for the four southerners. But a docket unsealed last week tells another side of that story. On January 15, a tipster identified Graydon Young, one of the Floridians added to the Caldwell and Watkins conspiracy. Based off that tip, the FBI prepared and got authorization for an arrest warrant by January 18. But they didn’t use it, perhaps because FBI was chasing down two false positives based off pictures of Young, as described in the later affidavit (the first of which may have been based off facial recognition).

First, on or around January 14, 2021, after receiving an internet tip and viewing similar photographs and video of Young from the civil unrest on January 6, 2021, an FBI agent drafted an arrest warrant for an individual (Subject-1) other than Young, based on a review of Subject-1’s driver’s license photo and the fact that Subject-1 was affiliated with the Oath Keepers. An FBI agent in Kansas City, Missouri, who was familiar with Subject-1, then determined that Subject-1 was not the individual depicted in the photos at the U.S. Capitol on January 6, 2021. The government did not pursue charges against Subject-1. Second, on or around January 15, 2021, a concerned citizen provided the FBI with a tip that the photograph of Young in the Rotunda was a photograph of Subject-2, who was a co-worker of the concerned citizen in Illinois. On January 18, 2021, SA Wren spoke with the concerned citizen, who stated that Subject-2 had quit the job and moved to Colorado, and “seemed like the type” who would have gone to the Capitol. SA Wren reviewed Subject-2’s driver’s license photo and determined that Subject-2 is not the person depicted in the photographs of Young at the U.S. Capitol.

In other words, FBI was prepared to arrest Young by January 18, within a day of the initial Watkins arrest. But they did not. They kept that arrest warrant sealed while they obtained his location records, travel records (including evidence he drove home from North Carolina rather than flying, and had his sister’s car towed back to North Carolina afterwards), and subscriber information for other social media.

At some point (as noted), FBI obtained Young’s Google account. But on February 11, they used that “solely as evidence against Kelly Meggs. At this time, the government is not seeking to use this email against Young,” suggesting they still needed legal process to use it against him.

Don’t launch an insurrection with a still-active Facebook account

Given that the FBI was ready to arrest Graydon Young on January 18, it’s worth looking more closely at the Facebook evidence in this conspiracy.

The FBI learned on January 15 that Young was probably at the insurrection, had been tagged in planning for the event on January 4, and had attempted to delete his Facebook account on January 7 (it went into effect the next day). Young didn’t delete his related Instagram account until January 13.

At some point, the FBI also learned that Caldwell attempted to unsend messages on January 8, the same day Young shut down his Facebook account.

Nevertheless, Facebook still had Young’s data, including a post from January 6 boasting, “We stormed and got inside.”

The government also obtained highly damning Facebook content from much earlier, including a message he posted to a group, the “War of Northern Aggression,” on November 7. In it, he clearly acknowledges Joe Biden’s victory.

Will this group consider migration to MeWe and Parler? I think censorship is going to get worse with Biden win.

On November 9, he asked again to move from Facebook to MeWe and Parler.

On November 30, he pushed MeWe and Parler again.

I already have MeWe and Parler … waiting for this drama to end before I delete my FB account.

Hey Graydon?!?! The drama for you is just beginning.

Meanwhile, Caldwell didn’t succeed in deleting all his evidence either. As early as January 17, in Crowl’s affidavit, they had a message (it’s unclear whether it’s public or private)

Here is the direct number for Comfort Inn Ballston/Arlington 1-571-397-3955 I strongly recommend you guys get one or two rooms for a night or two. Arrive 5th, depart 7th will work. She says there are five of you including a husband and wife new recruits. This time of year especially you will need to be indoors to set up, etc. Really, press this home, just get somebody to put it on a credit card. Even if you tell the hotel its double occupancy, you can STILL get a couple of people on the floor with bedrolls and the hotel won’t know shit. Paul said he might be able to take one or two in his room as well. I spoke to the hotel last night (actually 2 a.m. this morning) and they still had rooms. This is a good location and would allow us to hunt at night if we wanted to. I don’t know if Stewie has even gotten out his call to arms but it’s a little friggin late. This is one we are doing on our own. We will link up with the north carolina [sic] crew.

The later affidavits include Caldwell Facebook messages sent in November predicting violence.

I am very worried about the future of our country. Once lawyers get involved all of us normal people get screwed. I believe we will have to get violent to stop this, especially the antifa maggots who are sure to come out en masse even if we get the Prez for 4 more years.

On January 6, Caldwell continued to use Facebook, receiving a message informing him,

All members are in the tunnels under capital seal them in. Turn on gas.


Tom all legislators are down in the Tunnels 3floors down

Between Young and Caldwell, Facebook evidence shows that this operation clearly targeted legislators even after they knew Joe Biden had been elected. It turns out that neither of them successfully deleted this Facebook content before the drama really got started.

The delayed reveal

As noted, it took some time for the affidavit for the southern Oath Keepers to be unsealed. In the interim period, the FBI would have been able to investigate the Oath Keeper whose name was on the hotel room Young paid for, and all the other people on the bus on which Young and his sister were pictured. The FBI surely has reviewed any role the War of Norther Aggression Facebook group had in the insurrection. The accounts for which the FBI just had subscriber information on February 11 are probably now being fully exploited (including the WeMe accounts on which they may have been more open about their plotting).

There are still members of The Stack at large, the others on the bus, the group from Mississippi those who provided “security” for Trump’s closest associates. We don’t know where the next Oath Keepers to be arrested are. We do know where the FBI was, 17 days ago.

Timeline of Oath Keeper conspiracy

January 4: Young travels from Englewood, FL to Thomasville, NC. Young tagged in planning messaging for the attack.

January 5: Young travels from Thomasville to Springfield, VA, then heads to DC for the evening.

January 6: Young travels into DC, then back to Thomasville that night. Watkins posts to Parler and Caldwell posts to Facebook. Young posts, “we stormed and got inside” on Facebook.

January 7: Young deleted Facebook content going back to March 2019 (per Facebook record it goes into effect on January 8).

January 8: Caldwell unsends Facebook messages continuing evidence. Young returns to Englewood. Young writes an email saying that his “team leader” during the insurrection was “OK Gator 1” with Kelly Meggs’ phone number.

January 9: Watkins texts Bennie Parker telling him not to worry about the FBI investigating them.

January 11: Young has a vehicle registered to Steele’s address towed from a location near his home to Steele’s home in NC. Young deletes his Instagram account.

January 13: Watkins interview in Ohio Capital Journal. Guardian story on Watkins’ use of Zello. Young closes Instagram account.

January 14: Donovan Crowl story in New Yorker. Watkins and Crowl travel to Caldwell’s property in VA; he gives them OpSec tips for the drive. Bennie Parker texts Watkins asking if she put Sandi “out there” in the Capitol. FBI chases a false positive for Young on an Oath Keeper who lives in Kansas City, MO.

January 15: A tipster who has known Young for 35 years identified Young in an image published by NBC, informs the FBI that on January 4, other people had tagged Young in a discussion about traveling to DC. The tipster further revealed that on January 7, Young deleted his Facebook content going back to March 2019, then deleted the whole thing. FBI chases a false positive for Young to someone in CO.

January 16: Arrest warrant for Watkins.

January 17: Search of Watkins’ house discovers gear and other military items. Interview of her partner reveals she has left to stay with a friend, Commander Tom, and provides a phone registered to him at his VA property as the way to reach Watkins. Arrest warrant for Crowl. Search of a location where Crowl stays finds his tactical vest. Arrest warrant for Caldwell. Both Watkins and Crowl turn themselves in to the Urbana Police, where the FBI takes them into custody.

January 18: First arrest warrant for Graydon Young.

January 19: Caldwell, Crowl arrested by FBI, and Watkins arrested. Amended criminal complaint makes conspiracy charges against Watkins, Crowl, and Caldwell more formal. Search of Caldwell’s property finds Death List targeting election official from a different, a Gadsden flag signed by Crowl and Watkins, and a sales invoice for a weapon designed to look like a phone.

Janaury 21: Stewart Rhodes declares Biden’s “not a constitutional government.” Kelly Meggs closes his Facebook account.

January 27: Indictment for Watkins, Crowl, and Caldwell.

January 29: NYT does video analysis showing the movements of the Oath Keepers from the Ellipse to the Capitol.

February 11: Counterterrorism prosecutors Justin Sher and Alexandra Hughes join team. Motions for pre-trial detention for both Watkins and Caldwell. Sealed complaint filed against Kelly and Connie Meggs, Graydon Young, and Laura Steele.

February 12: Government moves for protective order against the original conspirators; Caldwell objects. Sealed complaint filed against Bennie and Sandi Parker.

February 16: Graydon Young arrested.

February 17: The Meggs and Laura Steele arrested.

February 18: The Parkers arrested.

February 23: Thomas Caldwell appeals detention.

February 26: Amit Mehta grants government motion to detain Jessica Watkins.

Update: I clarified that the email quoted at the top is from Stewart Rhodes, not Graydon Young.

89 replies
  1. Leo Walter says:

    I’m just trying to imagine “Stewie’s” frame of mind right now. He has never struck me as somebody who is mentally as solid as the proverbial rock in the past, let alone currently the way it seems to be going.

  2. Spencer Dawkins says:

    “Between Young and Caldwell, Facebook evidence shows that this operation clearly targeted legislators even after they knew Joe Biden had been elected. It turns out that neither of them successfully deleted this Facebook content before the drama really got started.”

    I don’t have a sense of how “deleted” Facebook content is, when someone hands Facebook a warrant. Do we really think it vanishes, or might it still exist in the log files and backups that any reasonable cloud operator would use to provide reliable user experience?

    Asking for an opponent …

    • BobCon says:

      I think this is a pretty decent summary:


      They keep stuff for a while, they don’t delete much of the data that is also associated with other accounts, and they maintain extensive shadow profiles of everyone regardless of whether they have deleted their accounts or never had one in the first place.

      I’d be surprised if they really delete a lot of what they say is deleted, and there may well be some third party they use for backup purposes which allows FB to say they have deleted the data while papering over where it persists.

        • J R in WV says:

          When I worked designing software systems for WV DEP years ago, we never deleted anything. We had a delete flag, with a time/date stamp and user ID to mark a database record as “deleted” but it never went away, ever.

          I’m pretty sure Facebook / twitter / etc operate the same way, if you are legally liable for information, deleted or not, you need to keep track of it. So we did. cannot believe professional web sites don’t do that as well…

        • Ralf Maximus says:

          You can bank on FB (or any social media site really) *never* deleting anything, merely setting the ‘invisible’ flag. Their entire business is built around crunching user metrics, and removing metrics from the database diminishes that capability. It’s not just legal liability, it’s their core business IP.

    • Lawnboy says:

      Re Stupidity

      Criminals Handbook:

      #1. Never break into jail.
      #2. Never brag on FB, Parler, MeWe, fill_ blank whilst breaking into jail, (or after same)

      • subtropolis says:

        The public information about those is really strange.

        Initial reports about them stated that authorities were saying that they were legit bombs capable of exploding. I don’t question that.

        Photos of a suspect were released. Several days later it was claimed that the suspect appeared to place them at around 8pm on Jan. 5.

        Photos of the devices appear to show manual kitchen timers, with a range of zero to sixty minutes, affixed to the pipes.

        I can understand leaving a perfectly capable, though unarmed, explosive in place in order to lend legitimacy to the threat without actually causing harm or damage. But, doing so more than 12 hours before the Ellipse rally would risk them being found and causing the cancellation of the event. Maximum impact, imho, would have been achieved by having them explode around the same time that the mob reached the Capitol.

        Why go to this trouble — and take that risk — when early discovery could have shut down everything, ruining the excuse for getting the mob in place to storm the Capitol? (Because that’s what the Ellipse rally always was.)

        • Raven Eye says:

          Kitchen timer?

          In some IEDs there is something called a “safe separation device”. The idea is to allow the perp to set the device and get away before the IED becomes fully active. It can close part of a circuit by itself, or in a more complex IED, activate something internal that is out of sight. Anything that has some kind of “life” or countdown capability can be used.

          And that kitchen timer could also be pure theater.

        • subtropolis says:

          They do appear bizarre. Check google images for “DNC pipe bomb”. I was a little bit shocked to see them. But then, I’m not up to speed on the latest pipe bomb methodology.

        • P J Evans says:

          Distracting the cops? The idea might have been to have them so busy investigating the explosive devices that they missed the crowd moving?

        • subtropolis says:

          Yes, that seems the most likely purpose for planting them. My point is that they were placed in those locations long before the rally was set to begin, which left quite a window for them to be found.

        • BobCon says:

          I’ve wondered if those are the only ones or if there are others that were found by authorities but not disclosed.

      • Savage Librarian says:

        Quite a bit of physical information can be determined about that person. Their height relative to surroundings, for example. And the way the person moved. The gait seemed notable. And the kind of shoes have been noted. So, I’m guessing more is known than has yet been shared.

        • John Paul Jones says:

          To me the gait suggested a quite young person, a teen, or not much more, and possibly even a female. As to the timer, it’s possible the intention, to come back later and give the dials a spin for 10 minutes, was somehow interrupted. The locations suggest a sort of “plague on both your houses” mentality.

        • Savage Librarian says:

          “To me the gait suggested a quite young person, a teen, or not much more, and possibly even a female.”

          Yes, that was my impression, too. Maybe it was an “accelerationist.” Maybe somebody we have seen before. But, maybe I just have an overactive imagination…

    • Norskeflamthrower says:

      Yes but they are morons with weapons, police and military backing and frequently training, and supporters and organizers inside the congress of the United States and state and local governments across the country. They publicly assault the idea of constitutional democracy while exposing the very real, lethal power of stupid. What could possibly go wrong??!!

      • ducktree says:

        During my sister’s years as assistant to the city prosecutor in our adopted hometown that was always referred to as “felony stupid.”

      • subtropolis says:

        It may simply be that he wanted to expunge evidence of communications between himself and one or more people which began around then. Either his (now) known co-conspirators, or (please please please) someone who could lead closer to Roger Stone & co.

    • harpie says:

      So, according to the affidavit Marcy links to, “[16] YOUNG deleted his Facebook posts back through March 2019, and subsequently deleted his entire Facebook account.”

      Maybe by early March, YOUNG had become interested in some things that were happening in January and February 2019:

      1/17/19 Coast Guard Lt. Christopher Hasson

      “performed the following Google searches at the following approximate times:
      v. 8:54 a.m.: “what if trump illegally impeached”;
      w. 8:57 a.m.: “best place in dc to see congress people”;
      x. 8:58 a.m.: “where in dc to congress live”;
      y. 10:39 a.m.: “civil war if trump impeached”;
      z. 11:26 a.m.: “social democrats usa”

      2/18/19 TRUMP tweets: “This was an illegal coup attempt on the President of the United States.” Dan Bongino on @foxandfriends True!”
      2/19/19 US files charges against Coast Guard Lt. Christopher HASSON
      [He had a hit list.] [NOTE: there was no DOJ press release about this at the time]

      The defendant is a domestic terrorist bent on committing acts dangerous to human life. [He is] a self-described white nationalist who was plotting a wide-scale attack against lawmakers and members of the news media.

      2/21/19 In court, Roger STONE defends himself for an apparent threat he aimed at Judge Amy Berman Jackson. He has a LONG history of threatening political violence and civil war.
      2/21/19 Joe DIGENOVA to Ingraham: We are in a civil war in this country. […] It’s going to be total war. And as I say to my friends, I do two things – I vote and I buy guns.
      2/27/19 Accused domestic terrorist Christopher HASSON indicted, facing 30 years for three charges of possession of (1) firearms, (2) silencers + (3) controlled substances.


  3. Beth from Santa Monica says:

    “….seal them in. Turn on gas.”
    This is pure, unadulterated evil. From people who claim to be Christians. This line needs to be hurled at Josh Hawley, Tom Cotton, Ted Cruz, and the rest of the”intellectual” “Christian” conservatives staking out a claim that they are saving America from ruin every time they speak. It’s just unbelievable that we’re back to “we had to destroy the village to save it.” I despair at where we go from here and how we move forward.

    • PeterS says:

      Pure, unadulterated evil is, as is alluded to, what Hitler DID. Pure, unadulterated evil is kidnapping, torturing and killing children. Until we’re told of evidence (which may well exist) that this horrible message referred to a viable plan I’ll entertain the possibility that it was a disgusting “thought crime”. Worse because of the context, yes, but not unlike a thousand others typed every day on social media I’m sorry to say.

      • P J Evans says:

        It was an evil plan. They really didn’t care if anyone in the tunnels (without a good gas mask) survived. Intent matters.

        • PeterS says:

          Well of course planning to gas people is evil!! But forgive me if I’d like to know whether or not they had a remotely viable plan, which I guess also goes to intent.

        • Eureka says:

          I’ve not taken that FB statement as necessarily more than someone [wishfully] directing [Caldwell/compatriots inside] to impair/ maim/ harm/ incapacitate/ delay congresspersons (though it would seem to be a statement made without regard for potentially fatal outcomes — compare the possible fate of Officer Sicknick — and it _could_ mean more in any case).

          However in your concern you seem to have lost all context that, as Sund described, these people (many actual/former warriors) came prepared for war. This was a militarized operation fueled by militarized rhetoric, tools, and tactics. Since no one is charged AFAIK as relates to that aspect of the FB comment we can stick to the nebulous “they” for now in wondering if they had a “remotely viable” plan or belief that pertinent materials were available on scene (crimes are ad hoc or opportunistic, too!) and recall the testimony of one witness with expertise (and unhealed chemical burns), USCP Captain Carneysha Mendoza.

          Army and 9-11 recovery veteran Mendoza testified that the rioters were deploying military* grade (in her opinion) CS gas within the Rotunda:


          [I’ll amend harpie’s comment ^ to note that CS gas _is_ a chemical weapon.]

          [Aside, recall also Barr’s summertime gaslighting that “pepper balls” weren’t “chemical” as a means to dance around a related question.]

          More at:

          US Capitol rioters ‘came prepared for war’, Senate hears in testimony | US Capitol breach | The Guardian

          *American (and other) armed forces are exposed to these agents in training, not allowed to use them in war.

        • PeterS says:

          All good points, thank you. But the context of my concern was that “pure, unadulterated evil” requires a lot more than vile words. And saying this doesn’t imply that whoever sent the message is a not a bad person.

        • Ginevra diBenci says:

          This FB message received by CALDWELL has come up before:
          “Do like we had to do when I was in the core start tearing oit florrs go from top to bottom”
          I have wondered since I first saw it if the sender misspelled “corps,” meaning they wanted to reference a background in the Marines (whether real or factitious, since some seem like wannabe military). That’s the only way the post makes sense. And it supports the argument about the serious intent of these criminals.

        • Eureka says:

          Ha- fortunately, delivery is yours: thanks for the side of laughter with your observations on criming.

      • PeterS says:

        Over generous, but yes actions speak louder than words. Vile language urging violence against people, especially women, is all too common on the internet. While someone using social media to call for X to be raped and murdered is to my mind a truly disgusting person, they’re not – and this shouldn’t need saying – as evil as someone who rapes and murders another human being.

        • PeterS says:

          I agree the words of kings, in history, and the words of leaders of organisations based on violence do carry more weight than most people’s FB or parler messages.

        • Parker Dooley says:

          I think that depends on the audience — in this case, the cohort of their social media contacts who are disposed to violence. One doesn’t have to be a king to light a fuse. Perhaps the degree of evil should be assessed according to the likelihood of the words actually precipitating the evil act in their particular context.

  4. subtropolis says:

    I remain very curious about the purported “quick reaction force”. And, the identities and location of those who were communicating through Zello with those inside the Capitol. One and the same? I wonder whether they’d risked smuggling weapons into the Comfort Inn (was it the one that’s in downtown DC?) and left a couple of people there, rather than go with the original plan of a boat on the river.

    Correction: “… Death List targeting election official from a different, …” I believe that the missing last word should be “state”.

  5. Krisy Gosney says:

    Thank you for all this thorough and continued coverage. I’m very curious to know who was sending the messages about the location of the legislators. And if that’s a trail that leads right to some of the legislators. (A FB group called War of Northern Aggression? Jesus H Christ, grow up.)

    • emptywheel says:

      Unclear. Also unclear whether it was solid intelligence yet. But it’s Facebook, so the FBI clearly knows.

      • PeterS says:

        “unclear whether it was solid intelligence yet” – I assume this means that we don’t know if the messages about the location of legislators were accurate or were nasty BS based on some malevolent version of Chinese whispers.

  6. Tom says:

    I wonder if these rioters will ever realize that Donald Trump is basically a con man and that he’s played them for patsies. He probably considers them to be “losers” and “suckers” the same as he said of the Marines who died at Belleau Wood. I’ll be interested to see if he says anything about them at CPAC tonight.

    • Knox Bronson says:

      The short answer is no. The longer answer is absolutely effin’ never. Trump is a master confidence man, a true master, feral and shameless. He tells them he’s a liar, a cheat, and a thief, but he’s their liar, cheat, and thief. He tells them they are in on the con. And they believe him. And always will. No matter what.

      • Peterr says:

        I agree, except for one little thing. A con man fools his marks. A master con man fools everyone. Trump is indeed a con man, but he’s not a master at it.

        But it’s worse for Trump than that.

        Trump is a con man who *thinks* he’s a master — which makes him very vulnerable to being caught out by the non-marks who are on to his game, like Georgia’s AG, NYC DA, etc.

  7. Silly but True says:

    In “Three Types of Trump Pardons” bmaz charged me to:
    “I’ll tell you what, get back to me when that happens. In the meantime I do not think you understand the complexities of what you are so insistent on.”

    Manafort is keeping his millions; well $19 million of his forfeited properties as result of his pardon.

    Manafort now gets to keep:
    three properties of the five he forfeited – an $11 million Hamptons estate, $4 million Brooklyn townhouse and $3.5 million Manhattan apartment;
    He will also get to keep a savings account he had already handed over to US but minus any taxes he still owes the IRS.

    He keeps at least $19m, while forfeiting a life insurance policy & Trump Tower condo.

    This highlights several issues: civil plea bargains based on criminal charges are subject to pardon effects. Manafort’s plea was not so ironclad as Weissman believed in face of full & unconditional pardon. Stall. Stall. Stall. Many of Manafort’s assets were tied up by secondary owner interests, many having own lawsuits against US. And these kept assets out if US hands long enough for pardon to moot forfeiture.

    • bmaz says:

      No, you still do not have a clue what you are talking about. There is no such thing as a “civil plea bargain”. In civil law, it is termed a “settlement”. Were there certain elements of Manafort’s plea that touched on property and other civil interests? Sure, but that was part of a comprehensive plea. But that was also reduced to civil status agreement. How it plays out is nowhere near as clear as you allege.

      • Silly but True says:

        You are correct: there is no such thing as civil plea bargain — an animal Weissman as private citizen has been alleging — which is whole reason the criminal-trial based approach to Mueller’s plea bargain civil settlement disappeared in the blink of a pardon.

        Weissman infamously has been explaining that Manafort’s plea bargain, because its asset forfeitures were part of civil settlement, not merely result of criminal plea agreement — inoculated them against Trump pardon.

        The only thing that trumped a pardon is case law on completed forfeitures. Weissman is not as clever as he thinks he is.

  8. Zinsky says:

    Caldwell is particularly despicable, in my opinion, relative to the January 6th insurrection. He worked in government for many years in security roles, retired and draws a government pension and the government likely pays most or all of his substantial on-going health care costs but yet he feels compelled to attack the U.S. Capitol, hurting and killing cops and looking for liberal lawmakers to “gas” or take hostage. What a traitorous ingrate. He should be incarcerated for the rest of his miserable life for being such a treacherous dirtbag and parasitic leech, mooching off civilized society and bitching about it at the same time.

  9. Dave Whitefield says:

    Off topic. I am not a lawyer, but I am a frequent lurker here, eager to learn. I am wondering why Giuliani hasn’t been questioned and/or charged for incitement for his speech at the rally? From his speech:

    Rudy Giuliani: (02:43 Jan 6, 2021)
    “Over the next 10 days, we get to see the machines that are crooked, the ballots that are fraudulent, and if we’re wrong, we will be made fools of. But if we’re right, a lot of them will go to jail. Let’s have trial by combat. I’m willing to stake my reputation, the President is willing to stake his reputation, on the fact that we’re going to find criminality there.”

    I don’t see or hear anything at all about his actions on that day. I’m interested in the opinions from the frequent contributors here. Thank you.

    • Fran of the North says:

      IANAL either, but I presume the answer to your question is a function of Rudy’s proximity to (being part of??) sanctum sanctorum.

      What the more learned here have taught me is that investigations start at the periphery and build in and up, with the intent of learning more and more about the ultimate perpetrators. At some point a solid case can be built on the next higher layer, charges are filed, and the process repeats, ideally until the whole group is rolled up, nice and tidy.

      I’d suggest that the lack of any perceivable action on Rudy or others actually is a sign of potential danger rather than relative safety.

    • PeterS says:

      Your specific question might suggest you think inflammatory (combative?) rhetoric should be legally actionable. But I’m sure you can see how problematic that is.

      (The relevant test might be in Brandenburg v. Ohio, Google is your friend)

    • Zinsky says:

      Hilariously, Rudy the Weasel said that his “combat” quip on January 6th was a reference to Game of Thrones, apropos of nothing:


      I would remind you, as well, that both Trump and Giuliani were named in a lawsuit filed under the Reconstruction-era Ku Klux Klan Act:



  10. VilnasHoon says:

    Great post as always. Thank you for all that you do here. A comment and a question:

    You don’t introduce Caldwell before referencing him by last name, at least not in this post.

    And for the question – what the hell did they mean by this: “This is a good location and would allow us to hunt at night if we wanted to.” That may be more chilling than “gas the tunnels.”

  11. CD54 says:

    Are there any criminal defense attorneys currently using a two-tiered fee schedule?

    The top tier for clients with cellphones and social media presence and a bottom tier for clients with neither.

  12. harpie says:

    As Marcy says on Twitter, this looks QRFish

    1:14 PM · Mar 1, 2021

    NEW & interesting: While #Capitol was being stormed men w/comms gear loitered at nearby Marine Corps War Memorial in [ARLINGTON] VA. Out-of-state plates. Story to watch in light of “quick reaction force” described in #Oathkeepers indictments. [Link] [PHOTOS] [screenshot]

    ARLINGTON is where the Comfort Inn/Ballston is located, where CALDWELL and friends stayed from 1/5 to 1/7…“maybe can do some night hunting”.

    • harpie says:


      49. On January 1, 2021, CALDWELL wrote to CROWL, “Check with Cap. [WATKINS] I recommended the following hotel to her which STILL has rooms (unbelieveble).” CALDWELL then sent a link to the Comfort lnn Ballston, the same hotel that he recommended to others on January 1. CALDWELL continued, “[PERSON TWO] and I are setting up shop there. [PERSON THREE] has a room and is bringing someone. He will be the quick reaction force. Its going to be cold. We need a place to spend the night before minimum. [PERSON ONE] [Stuart RHODES] never contacted me so [PERSON TWO] and I are going our way. I will probably do pre-strike on the 5th though there are things going on that day. Maybe can do some night hunting. Oathkeeper friends from North Carolina are taking commercial buses up early in the morning on the 6th and back same night. [PERSON THREE] will have the goodies in case things go bad and we need to get heavy.”

    • harpie says:


      28. On December 30, 2020:
      WATKINS: We planned on arriving on the 5th. We want to be in DC by 9am on the 6th. I will reach out to [PERSON THREE], and see if NC boys are coming. If [PERSON ONE] [Stuart RHODES] isn’t making plans, I’ll take charge myself, and get the ball rolling. I think the Metro is smarter than convoy/parking issues. Do you want us to stage ourselves vehicles elsewhere, seeing how you’re going to be gone? We can go to a KOA Campground or something …

      CALDWELL (about two hours later): Talked to [PERSON THREE]. At least one full bus 40+ people coming from N.C. Another group (unclear if Mississippi guys) also a bus. Busses have their own lane on the 14th street bridge so they will be able to get in and out. [PERSON THREE] is driving plus 1 and arriving nite before. As we speak he is trying to book a room at Comfort Inn Ballston/Arlington because of its close-in location and easy access to downtown because he feels 1) he’s too .broken down to be on the ground all day and 2) he is committed to being the quick .reaction force and bringing the tools if something goes to hell. That way the boys don’t have to try to schlep weps on the bus. He’ll bring them in his truck day before. Just got a text from him he WAS · able to book a room in that hotel I recommended which is on Glebe Road in Arlington. However it goes it will be great to see you again! I sure hope your arm is getting better!

      On this map, the War Memorial [upper left] and the 14th St Bridge can be seen:

      And this one shows the comparative location of Comfort Inn, Ballston

    • harpie says:

      Interesting about this article:
      The photographer, Jay Westcott, is a Navy veteran who took the photos at 3:30 PM

      “said the gathering “had the feeling of a rally point.” He shot the scene from a distance with a 600mm lens, reluctant to get any closer due to potential safety concerns.


      At approximately 4:09 p.m. on January 6, the [ACPD] Emergency Communications Center received a report of 9-10 males acting suspiciously and looking around on the Iwo Jima War Memorial property,” Savage said in response to an inquiry from ARLnow. “The United States Park Police was notified to check the park area. ACPD patrol units checked Meade Street and Arlington property, nothing was located and the call was cleared.” […]
      By nightfall, the men had dispersed

      • John Paul Jones says:

        Thanks for posting this. You have an uncanny ability to sniff out details and put things together. Your posts are always interesting and thought-provoking. As to whether these guys were a QRF, that would certainly explain the comms equipment they were carrying, and evidently using. What I wonder is – was this the only such force deployed that afternoon?

    • harpie says:


      “If it gets bad, they QRF to us with weapons for us,” but that, otherwise, “[w]e can have mace, tasers, or night sticks. QRF staged, armed, with our weapons, outside the city” and advised “to be prepared to fight hand to hand” while “guys outside DC with guns, await[] orders to enter DC under permission from Trump, not a minute sooner.”

      3:30 PM Photos taken at Marine War Memorial
      3:32 PM Gov. Ralph Northam announced that he was sending the Virginia National Guard into D.C.
      4:09 PM

      The ACPD Emergency Communications Center received a report of 9-10 males acting suspiciously and looking around on the Iwo Jima War Memorial property […] Patrol units checked Meade Street and Arlington property, nothing was located and the call was cleared.

      XX:XX PM ACPD [says they] notify US Park Police to check the area of the Marine Memorial [Did Park Police check?]
      4:13 PM Jim Acosta [CNN] tweets:

      A source close to the White House who is in touch with some of the rioters at the Capitol said it’s the goal of those involved to stay inside the Capitol through the night.

      4:17 PM TRUMP tweets:

      This was a fraudulent election but we can’t play into the hands of these people. We have to have peace. So go home. We love you. You’re very special. You’ve seen what happens. You’ve seen the way others are treated that are so bad and so evil. I know how you feel, but go home, and go home in peace.

      5:02 PM Sunset in Washington, DC [google search]
      5:06 PM [@08:28 VIDEO]]

      [Man] What’s your message to everyone now? Like what are you yelling at?
      [CHANSLEY] Oh, Donald TRUMP asked everybody to go home. He just said, he just put out a tweet. It’s a minute long. He asked everybody to go home.
      [Man] Why do you think so?
      [Chansley] Because, dude, we won the fucking day. We fucking won.
      [Man] How did we win?
      [Chansley] We won by sending a message to the Senators and the Congressmen. We won by sending a message to Pence, okay. That if they don’t do as they, as it is their oath to do, if they don’t uphold the constitution, then we will remove them from office one way or another.

      By nightfall Men had dispersed from the Marine Memorial
      6:00 PM Va. curfew begins

      VIDEO from
      “Fight for Trump”: Video Evidence of Incitement at the Capitol
      January 25, 2021

      • harpie says:

        That first quote is from WATKINS to a “contact when preparing to attend a November election fraud rally in Washington D.C”.

  13. Observiter says:

    What’s this…Oath Keepers is using words like: “…the boys don’t have to try to schlep weps on the bus” ?

    Isn’t the word “schlep” a Yiddish (Jewish) word?

    • harpie says:

      From: [redacted (b)(6); (b)(7)(C)]
      Sent: 6 Jan 2021 13:44:29 +0000
      To: [redacted (b)(6); (b)(7)(C)]
      and Chiefs; [redacted (b)(6); (b)(7)(C)]
      Subject: (U//FOUO) Demonstration Report for January 6 2020 [sic]
      Attachments: Demonstration Report for January 6 2021.docx

      Good morning All,
      Please see attached Daily Demonstration Report for January 6, 2021.
      Highlighted below are Demonstrations of High Visibility: [<<< red, bold, italics] […]

      [8th on this list]:
      Women for America First (b)(6); (b)(7)(C) 01/06/2021
      Time: 0900 to 1900 hours
      Location: The Ellipse
      Purpose: First Amendment Rally
      Participants: (5,000) listed on permit application
      Source: National Park Service

    • harpie says:

      I wrote about some of these PERMITS here:
      1] https://www.emptywheel.net/2021/02/23/government-uses-t-word-about-the-oath-keepers/#comment-884355
      2] https://www.emptywheel.net/2021/02/21/the-new-recruits-on-the-front-line-on-january-6/#comment-884402

      This PARTICULAR PERMIT is the one where the ATTENDANCE numbers had been AMENDED from 5,000 to 30,000 on 1/4,

      ALSO, [from the second link above]:

      Something DIFFERENT about the TRUMP RALLY permit 1/1 AMENDMENT [embedded at the Washingtonian article]:

      The NAME of the signing official is REDACTED: (b) (7) (A)

      The signers of the other 2 permits [also embedded at the article] are shown.
      The screenshot I linked to of the 1/4 amendment does not show that part of the permit.

      In today’s documents from WaPo, on the morning of 1/6,
      these DHA officials STILL THOUGHT this was a 5,000 person event.
      Were they NOT AWARE of the 1/4 AMENDMENT?

      • harpie says:

        The other permits I saw had been signed by an official from:

        Division of Permits Management
        National Mall & Memorial Parks

Comments are closed.