In this post, I suggested several of the people recently arrested on trespass charges were likely arrested as a way to facilitate evidence collection about other insurrectionists. Collecting their recordings of events may be necessary to fill certain gaps within the government’s own evidence of the attack.

The court filings for Christopher Quaglin shows the significance of two of those gaps. They show how the failure to outfit the Capitol Police with Body Worn Cameras means there’s lower quality evidence for assaults on them than on DC cops, who wear BWCs. The Quaglin filings also show the limits of the Facebook and Google GeoFence warrants that have gotten a lot of attention.

Capitol Police weren’t protected by Body Worn Cameras

Quaglin was originally arrested on probable cause of assault, resisting cops during a civil disorder, and obstruction of the vote count — not the two trespassing charges charged against almost all defendants.

He’s actually accused of two sets of assaults. First, starting at 1:36, he yelled at some DC Metropolitan Police Department officers guarding one of the barriers. Then, before 2:40, he allegedly started shoving Capitol Police officers guarding the Lower West Terrace. Later, filings against him allege, he sprayed officers from both agencies guarding the Lower West Terrace tunnel with pepper spray.

In other words, he was such a prolific brute, he allegedly assaulted both MPD and CP officers in at least two different places, both outside the building and inside the Tunnel on the Lower West Terrace.

The narrative of the first assaults in his arrest affidavit switches from sourcing to MPD Body Worn Cameras to what those initial filings call Capitol Police surveillance footage.

For some of the interactions, the FBI admits that the evidence is inconclusive (here, whether after Quaglin pushed an unidentified CP officer he or she fell down).

In a subsequent USCP surveillance footage, QUAGLIN walks through the crowd and approaches the USCP Officers located at the police line. QUAGLIN then begins to verbally engage a USCP Officer. QUAGLIN continues to get closer to the USCP Officer while appearing increasingly agitated and pointing his finger towards USCP Officer. QUAGLIN then proceeds to hold and push USCP Officer by the neck, which appeared to contribute to USCP Officer starting to fall. (Note: Due to obstructions in the view of this portion of the event, it is unclear to the affiant whether USCP Officer completed the fall). A still from this video is shown below with a red arrow above QUAGLIN.

In a filing last night, the government described what previously had been called CP “surveillance video” as, “a video of the crowd believed to taken by a USCP officer around 2:14 p.m.” The other “surveillance video” is similarly described as video believed to be taken by USCP officers. In other words, for interactions like this one — where Quaglin shoves a Capitol Police officer — the FBI can’t say whether the cop falls as a result, because the evidence comes from someone generally filming the crowd rather than a BWC on the assaulted officer’s person.

At other times, these filings rely on fairly distant MPD BWC footage of assaults on CP officers.

Then, around 2:34 p.m., as captured on BWC footage, an unidentified rioter pushes down a USCP officer. Another officer steps in front of the fallen officer. QUAGLIN can then be seen lunging forward and pushing that officer down. Multiple officers then drop their shields as they begin to retreat backwards. QUAGLIN and other unidentified individuals can then be seen picking up the shields and passing them backwards, as captured in the stills below with a red box around QUAGLIN.

Compare that with the clear image, from a BWC video worn by an MPD officer,  showing him at the front of the pack mobbing the tunnel.

And here’s the MPD BWC still from which the FBI IDed what Quaglin was spraying.

The BOLO image that an acquaintance of Quaglin cited as one of the things — but not the primary thing — that placed Quaglin at the insurrection also came from a BWC.

Among the weaknesses in Capitol security that General Russel Honoré’s Capitol Security Review described was that BWCs were not, on January 6, part of Capitol Police gear on the day of the attack.

We also recommend the USCP be equipped with Body-Worn Cameras (BWC), an item not currently in their inventory, to improve police accountability and protect officers from false accusations of misconduct. BWC also provide visual and audio evidence that can independently verify what happened in any given situation, leading to better investigations and prosecutions when needed.

The Quaglin filings show pretty clearly how much easier it is to reconstruct some attacks on MDP officers than CP officers because of the differential equipment (though for some reason, later interactions with MDP officers inside the tunnel are sourced to two videos sourced to YouTubes posted to the Internet).

The real risks of such gaps are made clear by the filings against the men alleged to have sprayed Brian Sicknick with bear (not pepper) spray that may have contributed to his death. As with Quaglin’s alleged assaults, the evidence consists of fairly direct BWC (in this case from a named officer standing next to Sicknick and the other officers affected).

But to see what happened to Sicknick himself, you have to refer to “surveillance” video that happened to pick up the after-effect of the attack.

It’s no wonder it took so long to identify what happened to Sicknick: the government had to rely on other video to understand what had happened to him. These and other filings make it clear that CPD’s lack of BWCs has created key gaps in the understanding of what happened on January 6.

The limits of the Facebook and Google GeoFence warrants

As noted above, one of two Quaglin tipsters learned of his presence at the Capitol via several means, including the BOLO based off a MDP BWC.

But that tipster — and another anonymous one who contacted the FBI even earlier — also pointed to some livestreaming that Quaglin did of his participation. In addition to videos taken from his hotel after the event, an anonymous tipster shared and the acquaintance confirmed viewing a video of Quaglin approaching the Capitol and chanting Proud Boy slogans.

Law enforcement received a tip from an anonymous source providing four “Live” videos recorded from a Facebook account with the vanity name “Chris Trump.” The videos did not list the URL of the Facebook account or the official user name. (A Facebook user can display a vanity name that is different than their official user name and a Facebook user can change their vanity name without changing the official user name.) Each video was a selfie-style video showing an individual identified by the anonymous tipster as “Christopher QUAGLIN, NJ. Extremist.” In one of the Live videos provided by the tipster, QUAGLIN, as shown in the still below, can be seen walking towards the Capitol in the same outfit that QUAGLIN is seen wearing in the footage described above and holding a gas mask. QUAGLIN states “Trump is speaking and everyone is walking there. And I am walking there [showing Capitol building to camera]. And I am ready [showing gas mask in hand]. We will see how it goes. Proud of your boy.”

[snip]

In addition, law enforcement interviewed a witness, Witness 1, who has known QUAGLIN for years, although Witness 1 had not seen him in person for several years. Witness 1 has followed and corresponded with QUAGLIN on social media for years. Witness 1 saw QUAGLIN’s Live videos on January 6, 2021 on his account with the vanity name “Chris Trump.” Witness 1 confirmed that the Live videos described above are some of the same videos Witness 1 saw on January 6, 2021 and that those videos all show QUAGLIN. Witness 1 also stated that he/she saw a photograph that the FBI had published seeking additional information from the public and that he recognized that individual as QUAGLIN. (The photograph, “Photograph 58 AFO” below, was taken from BWC footage described in paragraph 40 above.)2

Witness 1 noted that QUAGLIN used multiple accounts on Facebook and Instagram and was frequently been banned for inflammatory posts online. Witness 1 indicated that QUAGLIN frequently posted on his social media accounts about the 2020 Presidential election, about going to the Capitol on January 6, 2021, and pictures of firearms. Many of QUAGLIN’s posts were deleted on January 7, 2021. Witness 1 indicated that QUAGLIN posted multiple pictures of himself prior to the January 6, 2021 events where he was visible with a beard and consistent in appearance with the “Photograph 58-AFO.”

As I’ve described elsewhere, the government asked Facebook for information on everyone who livestreamed or uploaded video from the Capitol itself, and then they IDed the person who uploaded the video from the subscriber information.

The government received information as part of a search warrant return that Facebook UID 100047172724820 was livestreaming video in the Capitol during these events. The government also received subscriber information for Facebook UID 100047172724820 in response to legal process served on Facebook. Facebook UID 100047172724820 is registered to Chris Spencer (“SPENCER”). SPENCER provided subscriber information, including a date of birth; current city/state, and a phone number to Facebook to create the account. [my emphasis]

A recent arrest affidavit makes it clear that FBI obtained this warrant on January 11.

On January 11, 2021, a search warrant was served upon Facebook to identify Facebook accounts utilized to live stream video in a geographic area that included the interior of the United States Capitol building. One such account identified by Facebook was Facebook user ID 100009155779709, an account in the name of “Michael Joseph.”

But there’s good reason to believe that FBI obtained a preservation order on everything uploaded from the Capitol earlier than that, probably within a day.

As yesterday’s filing makes clear, Quaglin deleted his videos before the FBI could collect them directly from Facebook, even though they served warrants on his accounts to Facebook.

(Because the related social media account was deleted shortly afterwards, law enforcement was not able to determine the exact time this video was recorded, although it would have been presumably before he reached the line and was captured on the BWC in Exhibit A.)

More importantly, by description, he did no livestreaming from the Capitol (he was too busy fighting with cops). That’s the right choice from a civil liberties perspective; livestreaming from the Mall or a nearby hotel room is not proof a crime. But in this case, it likely permitted the destruction of evidence pertaining to how closely Quaglin coordinated his efforts — including sustained assaults on cops — with the Proud Boys.

The FBI got a ton of inculpatory evidence from a Facebook warrant. They even got the message on one social media account recording his deletion of the one he used to livestream that day.

A message sent on January 7, 2021 indicating that he had deleted his other account; and

But did not get those livestreams (or anything else he posted on that alternative account).

Likewise, a warrant to Google showed Quaglin in DC, but location data does not place him at the Capitol.

Google location data places the phone belonging to QUAGLIN in and around Washington, D.C. from January 5-7; specifically, at the Motto Hotel, at the Washington Monument, and at the United States Capitol. On January 5, 2021, QUAGLIN conducted multiple searches for “Motto by Hilton Washington DC City Center” and pulled up driving directions for two Chick-fil-A restaurants in Northeast Washington, D.C. On January 6, 2021 Quaglin conducted multiple Google Maps queries for areas near the National Mall in Washington, D.C.

There are many possible explanations for this: He never entered that far into the Capitol, so he may never have been included in the Google GeoFence at all. But given the mob of people inside that tunnel, it’s also likely that cell service (if Quaglin’s phone was on at all) was really overloaded.

That said, Quaglin’s Google searches do show that he was monitoring the news for references to himself.

QUAGLIN’s Google account history shows multiple Google searches indicating his involvement in the storming of the Capitol. For example, on January 8, 2021, it includes multiple searches for “guy gets bear sprayed at capital.” On January 20, 2021 QUAGLIN’s Google account history shows visits to a webpage titled, “Countries where you can buy citizenship, residency, or passport.” QUAGLIN’s Google account history shows eight visits to the FBI’s “seeking information” for Capitol violence between January 28, 2021 and January 31, 2021. Further, a review of QUAGLIN’s Gmail accounts show multiple purchase notifications from a Costco credit card in Washington, D.C. — specifically, multiple charges at the Motto Hotel on January 5, 2021, multiple charges at a Walgreens convenience store at 801 7th St NW, Washington, D.C. on January 6, 2021, and $128.80 spent at China Town Liquor in Washington, D.C. on January 7, 2021 – both businesses that are a short walking distance from the Motto Hotel.

There’s still a ton of evidence against Quaglin. But the video evidence of his multiple alleged assaults on cops are not terrifically clear (and thus far, they haven’t been IDed by name as some of the other officers assaulted have been). And the government has thus far barely mentioned Quaglin’s association with the Proud Boys, even though Ethan Nordean has pointed to his filing to suggest his attempts to hold off Quaglin’s assaults prove he wasn’t a leader of this riot. Nordean disclaims knowing Quaglin.

The January 6 insurrection was one of the most filmed events in history. It was tracked in damning detail across a range of social media platforms.

But even with a notably dressed, prolific user of social media like Quaglin there are gaps in that panopticon.