January 6: A Change of Pace

Although GWU’s tracker, which is still the best way to keep track of all the January 6 defendants (though this visual story from WaPo using their data is nifty) added four new January 6 defendants yesterday, the pace of new defendants has slowed considerably. While there are still some detention fights, several of those disputes (Proud Boys Ethan Nordean and Joe Biggs, and disorganized conspirators Nate DeGrave and Ronnie Sandlin, as well as Neo-Nazi sympathizer Timothy Hale-Cusanelli — have moved to the DC Circuit.

We’re likely to have more bail revocation fights. The other day, for example, Landon Copeland — who made news for his meltdown during a magistrate judge’s hearing last week — was arrested for some still unidentified bail violation. The government has also moved to revoke Patrick Montgomery’s bail because he — a professional hunting guide — shot a mountain lion that he — a felon — cannot legally possess.

But there are a couple of developments this week that point to what’s going on with this investigation.

Delayed phone exploitation

In a hearing in the case against mother and son defendants Deborah and Salvador Sandoval, Deborah’s attorneys were anxious to move to trial based off an apparent misunderstanding that the evidence on her sole computer device, her smart phone, would show she barely entered the Capitol. Meanwhile, the government revealed that because Salvador chose not to share passwords to his multiple devices, those are taking a lot longer to exploit. As I’ve already noted, Ethan Nordean is the only Proud Boys leadership co-conspirator whose phone DOJ was able to exploit without cracking the password first (the FBI got the password from Nordean’s wife). Exploiting all these phones is going to take a lot of time.

In another case, there appear to be privileged communications on Eric Torrens’ phone, which will delay the exploitation of that for up to four weeks as a filter team reviews the content.

In other words, even before you consider any delay created by FBI’s need to respond to Signal’s Moxie Marlinspike’s exposure of vulnerabilities in Cellebrite’s code, it will take some time to process the vast volume of evidence the government has obtained since January 6.

The network analysis

The arrest of Brittiany Dillon gives a sense of another cause of delay.

Bryan Betancur was one of the first wave of January 6 defendants to be arrested, on January 17, after his parole officer alerted the FBI that he had lied about handing out Bibles to get permission to travel from Baltimore to DC that day. The government got a warrant for his phone on January 20. Once they got into his phone, they discovered text messages between Betancur and Dillon in which Dillon described falling in the door of the Capitol during the riot. The government found video of her — falling down as she entered — on surveillance videos by January 23. The government obtained phone and Google warrants to confirm that Dillon had been inside the Capitol the day of the riot. For some reason, the FBI only got around to interviewing Dillon’s father, ostensibly about Betancur, on April 21; the agent got Dillon’s father to confirm Dillon’s ID while they were talking.

This is similar to what happened with Patrick Montgomery, who like Betancur was arrested on January 17. Only after FBI exploited his phone and found some key pictures did they arrest a buddy he was with that day, Brady Knowlton, while pursuing two others.

These arrests of friends of early arrestees may reflect an FBI agent trying to get arrest numbers, but in a number of cases, they seem to reflect larger investigative strategies based on things investigators have found in the profiles of the original defendant. By my count there are about 18 cases of network arrests aside from the militia conspiracies, and about half of those look like they may be more interesting than friends getting scooped up together. I would expect to see more of this going forward.

Delayed arrests

The two month delay between the time DOJ identified active duty Marine, Major Christopher Warnagiris, as the person who played a key role in keeping the East door of the Capitol open after it was first breached on January 6 and when they arrested him on Wednesday is far more interesting.

As the arrest affidavit explains, FBI isolated Warnagiris as a suspect based on his conduct as shown in video, and then published a Be On the Lookout picture to figure out who he was. On March 16, a former co-worker IDed him, and on March 17, the FBI interviewed one of his current co-workers, who positively IDed Warnagiris.

And that’s it–that’s where the narrative in the affidavit, which was signed on Wednesday, ends. They get a BOLO-based tip on March 16, and get military witnesses to confirm his ID on March 17. And that’s all they’re telling us about who he is and what other evidence they have against him.

I’m sure that’s not all that has transpired since FBI discovered an active duty Major played a key role in keeping the East Capitol breach open.

All the while, someone who by dint of being an active duty service member has clearance, has (as far as we know) been going into Quantico every day for the almost two months since they IDed him. That’s … an interesting investigative decision.

Compare that narrative to the one told in the arrest affidavit of Timothy Hale-Cusanelli, the Army reservist and Nazi-sympathizer who worked as a contractor at Naval Weapons Station Earle in New Jersey. On January 12, an informant told the FBI that Hale-Cusanelli was at the riot, on January 14, the informant recorded a conversation in which Hale-Cusanelli admitted to pushing and shoving along with the rest of the mob. Hale-Cusanelli has been jailed since the very next day, January 15 (he is appealing his detention to the DC Circuit). Hale-Cusanelli has not been charged with assault and he is not known to have played such a key role in compromising the Capitol from a second side.

Now, for many defendants, I can see taking your time after the initial rush of arrests. After all, if they were going to delete their Facebook, that would have happened (and did happen, with a goodly number of defendants) by January 9. But Warnagiris seems like a more urgent risk.

And, remarkably, DOJ apparently did not ask for any special conditions on Warnagiris. He has no location monitoring, no restrictions on possessing a gun, no specificity to his travel around DC (most defendants have stay-away orders, but for people like Warnagiris who are local to DC, they’re sometimes restricted to their District). They did not ask him to surrender his passport. Now, perhaps something is also going on with him in the military. But the whole thing — on top of the inevitable shock of having an active duty officer arrested — raises more questions than other cases.

All of which is to say that, with a defendant who genuinely poses unique security risks, the government is now taking their time to flesh out their investigation.

I’ve said from the start that this investigation has been lightning quick. That’s still, absolutely, true. But there’s going to be a lot more happening behind closed doors in the weeks ahead.

21 replies
  1. Rugger9 says:

    I think Major Wanagiris’ connections need to be addressed, and if it were up to me his chain of command would be joining him for being derelict in their oversight duties once he was identified two months ago (almost). We can see. Normally the military justice system will operate after the civilian side is done, but unless I hear something circulating around, there is no reason why SecDef wouldn’t put Wanagiris’ entire command under a most unpleasant microscope since this reflects poorly on the service. I would have expected the Commandant of the USMC to race SecDef to crack down, yet it appears that nothing happened. At the very least Wanagiris needed to put in the USMC version of “hack” or officer restriction to base, preferably on 17 MAR. The lack of (reported) action is stunning to me and really not typical of the Marines I know.

    In our list of Faux News generals, how many Marines are there and how connected are they to our Major?

    • subtropolis says:

      Would we know if the military had already acted in some fashion? Perhaps DoD has been investigating him all along and, for whatever reason, the DoJ has only now made public the fact that he is also among the defendants.

      • Rugger9 says:

        Not necessarily, but there are symptoms of such actions. Restricted men are ordered to stay put and that doesn’t always require a hearing (unless it’s NJP, i.e. mast). By now the Article 32 hearing should have been completed if charges have been considered to determine whether a court martial is appropriate, and that is a formal event with a paper trail that ought to be subject to FOIA requests. I haven’t seen anything about one.

        Also, I doubt that no one between the major or his buddies hasn’t complained about him being restricted when he did nothing wrong (in their view) on their social media networks. Nothing seems to have been reported.

        It was intuitively obvious to the most casual observer (leaving out the GQP, who’s being paid to look the other way) that what happened on January 6 was an assault clearly outside any duties conceivable for a USMC Major. If anything, he should have been holding the line with the Capitol Police against the thugs. There is no way that the USMC as an institution would ever be OK with this, and more than a few of the Marines I know would be livid. Making little rocks out of big ones at Leavenworth is too good for this guy.

      • Paul Spencer Dawkins says:

        Backing up slightly from that, would the FBI be sharing information from an active investigation with his USMC chain of command?

        I really don’t know the answer to that question.

        [Welcome back to emptywheel. Please use the same username each time you comment so that community members get to know you. You’ve used three variants of your name – Paul Spencer Dawkins, Spencer, and Spencer Dawkins. Please pick one and stick with it. Thanks. /~Rayne]

        • timbo says:

          The FBI might not have informed Quantico base command if they (and DHS?) were secretly conducting a counter intelligence investigation at Quantico… that wouldn’t be normal SOP but it might have been deemed highly sensitive if they’d received tips from lower ranking personnel there about this major…

          It’s very odd that this major hasn’t been seen as a flight risk. One should imagine that attempting to disrupt the Congress and regular Constitutional order is a serious offense for a commissioned military officer. My guess is that there aren’t many federal judges that will look kindly on his case should it come to their bench…

        • timbo says:

          So, basically, “What is up with that?!” seems to scream from this particular arrest.

  2. mvario says:

    Am I correct that no trial have begun? Bruno Cua had a tentative trial date of May 11, but since I’ve seen nothing further, I assume that was pushed off when he got Covid in jail.

    • bmaz says:

      No trials have been had. And they are not likely to be so had anytime soon. “Speedy trial” has never been what most people think. Always deflected either upon stipulation or upon motion and “in the interests of justice”. It is pretty malleable.

      • Wajim says:

        And would you say, as someone expert in this subject, that the waiver of the speedy trial “requirement” is exercised more or less equally between the prosecution and the defense depending on the respective interests in the case? It seems sometimes, especially these days, to be somewhat routinely waived by both

        • bmaz says:

          Yes, would agree with that. Honestly, time is often the friend of a defendant. Have had cases were the main officer retired and moved. Had a vehicular homicide case where the key officer literally got hit and killed by a drunk driver (that was tragically ironic).

          But sometimes the prosecution just wants more time. Thing is, the prosecution is only limited by the statute of limitations, so it is not really the same thing. Until a jury is impanelled, the prosecution is fairly free in this regard (up to the statute of limitations).

  3. CD54 says:

    Good reminder about phone exploitation. And as much self-impressed “Rah Rah!” and “Take No Prisoners!” bits these MAGAts traded in real time, I’d be patient as well. Not to mention any of the ancillary criming falling into FBI’s lap. Invasion of the cicadas idiots.

    Contrast them with the bomber — that person is Agent Zero.

  4. P J Evans says:

    Second paragraph: the guy shot the mountain lion with a gun that he can’t legally possess. (“with a gun” got lost somewhere.)

  5. subtropolis says:

    “In another case, there appear to be privileged communications on Eric Torrens’ phone …”

    Please elaborate. I could not find anything about that at the link. Had he been texting with his lawyer previous to his mobile being seized?

  6. The Dark Avenger says:

    Regarding the Active Duty Marine:

    “I refer you to the curious incident of the dog in the moonlight.”
    “But the dog did nothing in the moonlight.”
    “That is the curious incident.”

    Silver Blaze. Sir Arthur Conan Doyle.

    I would not be surprised if they monitored the Marine in question, all his personal communications and so forth after March 17. He’s prolly in so much hot water now his only choices are to cooperate or face military justice slamming him in the face. Sometimes Marines are stupid, but his self-preservation instincts will ultimately win the day.

    • timbo says:

      So far, all we have is speculation like this. I’m trying to think of a mundane explanation for the delay that makes sense but so far all I’ve got (on the mundane side) is… some sort of Cabinet level jurisdictional fight within the Biden Administration?

      • Rugger9 says:

        Or, the DoD is waiting on the civilian side as usually happens in most cases. However, the nature of this offense fairly screams that someone in the USMC chain of command through Quantico would have at least done something.

        As for an FBI counterintelligence op, let’s remember that many of the officers above Major will have very high clearances indeed and may have access to what’s going down. Let’s say the idea is correct, so what does that mean for USMC integrity and their id? Nothing good on any level, so I for one will have to see more evidence to buy the FBI investigation line.

        The USMC considers itself an elite and highly patriotic force, which means Capitol assaults are anathema to them.

        It may be more profitable to dig into the Major’s connections and whether any of them lead to burrowed trumpkins or bushies. Let’s remember that this nightmare started with SDNY FBI agents claiming there were really horrible HRC emails on Abedin’s computer, when they hadn’t even asked Huma to search it yet.

        • Dave_MB says:

          I think Timbo’s earlier statement is correct. There’s something highly unusual about the situation. Any answer would be highly speculative. It will be interesting to see how it shakes out.

  7. MossyBanks says:

    It’s curious to me that an obvious trespasser/seditionist has not been arrested: Justin Winchell, friend of the deceased Rosanne Boyland. He was interviewed on TV right after the insurrection claiming the riot was by antifa, and his face is easily identifiable in many open source videos of Jan 6. Is he being treated with kid gloves because of his friend’s death?

Comments are closed.