Posts

Journalists May Be Most at Risk (as Described) from a Presumed January 6 GeoFence Warrant

On February 22, the Intercept had a thinly sourced story reporting (heavily relying on one “recently retired senior FBI official” whose motive and access weren’t explained and one other even less-defined source) on methods used in the January 6 investigation. It started by describing something unsurprising (some of which had been previously reported): that the FBI was using emergency legal authorities to conduct an investigation in the wake of an insurrection.

Using special emergency powers and other measures, the FBI has collected reams of private cellphone data and communications that go beyond the videos that rioters shared widely on social media, according to two sources with knowledge of the collection effort.

In the hours and days after the Capitol riot, the FBI relied in some cases on emergency orders that do not require court authorization in order to quickly secure actual communications from people who were identified at the crime scene. Investigators have also relied on data “dumps” from cellphone towers in the area to provide a map of who was there, allowing them to trace call records — but not content — from the phones.

From there, the story made conclusions that were not borne out by the evidence presented (which is not to say that such conclusions won’t one day be supported).

In particular, the story suggested that these investigative methods were used to investigate Congress, and likewise suggested that the involvement of Public Integrity prosecutors must mean members of Congress are already the focus of the investigation and further suggesting that the location data collection tied to the investigation of members of Congress.

The cellphone data includes many records from the members of Congress and staff members who were at the Capitol that day to certify President Joe Biden’s election victory.

[snip]

The Justice Department has publicly said that its task force includes senior public corruption officials. That involvement “indicates a focus on public officials, i.e. Capitol Police and members of Congress,” the retired FBI official said.

To make the insinuation, the story misstates the intent of a Sheldon Whitehouse statement aiming to use Congressional authorities to remove coup sympathizers from committees of jurisdiction (and ignores Whitehouse’s earlier statement that calls for the kind of data collection described in the story).

On January 11, Sen. Sheldon Whitehouse, D-R.I., released a statement warning against the Justice Department getting involved in the investigation of the attack, at least regarding members of Congress, asserting that the Senate should oversee the matter.

Thus far, the story seems tailor-made to get Congress — the Republican members of which are already trying to sabotage the investigation — to start tampering with it.

Far down in the story, it also describes the orders used with more specificity — but not yet enough specificity to substantiate the claims made earlier in it.

Federal authorities have used the emergency orders in combination with signed court orders under the so-called pen/trap exception to the Stored Communications Act to try to determine who was present at the time that the Capitol was breached, the source said. In some cases, the Justice Department has used these and other “hybrid” court orders to collect actual content from cellphones, like text messages and other communications, in building cases against the rioters.

At the time I suggested the story’s conclusions went well beyond the evidence included in it. I had several concerns about the story.

First, it didn’t address the granularity of location data collected, explaining whether the data collection focused just on the Capitol building or (as the story claimed) “in the area” generally. The Capitol is, according to multiple experts, incredibly wired up, meaning that one can obtain a great deal of data specific to the Capitol building itself. That matters here, because as soon as Trump insurrectionists entered the Capitol building, they committed the trespass crimes charged against virtually all the defendants. And the people legally in the Capitol that day were largely victims and/or law enforcement. It’s not an exaggeration to say that anyone collected off location collection narrowly targeted to the Capitol building itself is either a criminal, a witness, or a victim (and often some mix of the three).

If location collection was focused on the Capitol building itself (we don’t know whether it was or not, and the reports of collection aiming to the find the person who left pipe-bombs in the neighborhood on January 5 do pose real cause for concern), it mitigates some of the concerns normally raised by the use of IMSI-catchers at public events and protests, which is that such location collection would include a large number of people who were just engaging in protected speech, as many of the people outside the Capitol were. Similarly, unlike with most geofence warrants or tower dumps, which are used to find possible leads for a crime, here, FBI had an overwhelming list of suspects from its mass of tips and video evidence already: it wasn’t relying on location data to find suspects. Plus, with normal geofence warrants and tower dumps, the vast majority of the data obtained comes from uninvolved people, posing a risk that those unrelated people could become false positives who, as a result, would get investigated closely. Here, again, anyone collected from location data inside the Capitol was by definition associated with the crime, either as witness, victim, or perpetrator.

Finally, the story not only didn’t rely on, but showed little familiarity with the hundreds of arrest affidavits released so far, which provide some explanation (albeit undoubtedly parallel constructed) for how the FBI built cases against those hundreds of people.

Well before The Intercept article was written, there were a few interesting techniques revealed in the affidavits. Perhaps the most interesting (and not specifically covered in The Intercept article, unless as a hybrid order) described identifying Christopher Spencer from the livestreams on Facebook he posted from inside the Capitol.

The government received information as part of a search warrant return that Facebook UID 100047172724820 was livestreaming video in the Capitol during these events. The government also received subscriber information for Facebook UID 100047172724820 in response to legal process served on Facebook. Facebook UID 100047172724820 is registered to Chris Spencer (“SPENCER”). SPENCER provided subscriber information, including a date of birth; current city/state, and a phone number to Facebook to create the account.

[snip]

The government received three livestream videos from SPENCER’s Facebook UID 100047172724820 as part of a search warrant return. At different times during the videos, Spencer either used the rear facing camera to show himself talking, or turned the phone toward his face. Your affiant would note that the camera is capturing a reversed image of SPENCER in two of these sections of video as evidenced by the text on SPENCER’s hat. As such, reversed images are also provided below the original screenshot [my emphasis]

The first mention of the Facebook return appears before a paragraph describing an associate of Spencer’s who had seen the videos and recognized his wife, and the later paragraph describes the associate sharing a phone number for Spencer that the FBI seemed to have already received from Facebook. As written (and this structure is matched in the affidavit for Spencer’s wife, Jenny) the narrative may indicate that the FBI obtained the Facebook return before the tip and identified Spencer from the Facebook return even before receiving the tip. This is one of the strongest pieces of evidence that the FBI used data obtained from location-based collection in the Capitol from any social media source to identify an unknown subject. But, as described, it also has some protections built in. The data was obtained with a warrant, not PRTT or d-order. That means the FBI would have had to show probable cause to obtain the content (but, for the reasons I explained above, most people in the Capitol live-streaming were committing a crime). There’s also no indication here that this video was privately posted (though with a warrant the FBI would be able to obtain such videos).

All this is a read of what this paragraph might suggest about data collection. It doesn’t describe whether the data was obtained via a particularized warrant (targeting just Spencer), or whether the FBI asked Facebook to provide all live-streaming posted from within the Capitol during the insurrection (there are other early affidavits that targeted the content of Facebook via individualized warrants). In Spencer’s case, I suspect it’s the latter (there’s nothing that remarkable about Spencer’s video, except he was outside Speaker Pelosi’s office). Even so, for most people, posting from inside the Capitol during the insurrection would amount to probable cause the person was trespassing.

Even before The Intercept piece was posted I had also pointed to the affidavit for the Kansas cell of the Proud Boys. It uses location data to place one after another of the suspects “in or around” the Capitol during the insurrection: cell site data showed that the phones of Christopher Kuehne, Louis Colon, Felicia Konold were “in or around” the Capitol during the insurrection. That of Cory Konold, Felicia’s brother, was not shown to be, but,

Lawfully-obtained cell site records indicated that the FELICIA KONOLD cell called a number associated with CORY KONOLD while in or around the Capitol on January 6, 2021.

The most interesting detail in that affidavit pertained to William Chrestman. His phone wasn’t IDed off a cell site. Rather, it was IDed by connecting to Google services “in or around” the Capitol.

According to records produced by CHRESTMAN’s wireless cell phone provider in response to legal process, CHRESTMAN is listed as the owner of a cell phone number (“CHRESTMAN cell”). Lawfully-obtained Google records show that a Google account associated with the CHRESTMAN cell number was connected to Google services and was present in or around the U.S. Capitol on January 6, 2021.

A more recent document — the complaint against the southern Oath Keepers obtained on February 11 but unsealed long after that — describes the phones of those suspects in an area “includ[ing]” (but not necessarily limited to) the interior of the Capitol.

having utilized a cell site consistent with providing service to the geographic area that includes the interior of the United States Capitol building.

Unlike Spencer, the use of location data in the Proud Boys and Oath Keeper complaints seems to be used to establish probable cause. In both the militia group cases, the individuals appear to have been identified via different means (unsurprisingly, given their flamboyantly coordinated actions), with the location data being used in the affidavit to flesh out probable cause. (Undoubtedly, the FBI exploited this information far more thoroughly in an effort to map out other co-conspirators, but it is equally without doubt that the FBI had adequate probable cause to do so.)

The other day, DOJ unsealed an affidavit — that of Jeremy Groseclose — that provides more detail about the location collection at the Capitol. The FBI describes identifying Groseclose off of two tips, both on January 7, from people who had seen him post about being in the Capitol on Facebook (and in one case, remove his Facebook posts after he posted them).

Groseclose wore a gas mask for much of the time he was inside the Capitol (though wore the same clothes as he had outside), which undoubtedly made it more difficult to prove he was the person illegally inside the Capitol preventing cops from ousting the rioters.

The FBI affidavit describes times when Groseclose appears on security footage from inside the Capitol without the gas mask, but doesn’t include it. To substantiate his presence in the Capitol, the FBI included three paragraphs describing what must be a Google geofence warrant showing the device identifiers for everyone within a certain geographic area.

According to records obtained through a search warrant served on Google, a mobile device associated with [my redaction]@gmail.com was present at the U.S. Capitol on January 6, 2021. Google estimates device location using sources including GPS data and information about nearby Wi-Fi access points and Bluetooth beacons. This location data varies in its accuracy, depending on the source(s) of the data. As a result, Google assigns a “maps display radius” for each location data point. Thus, where Google estimates that its location data is accurate to within 10 meters, Google assigns a “maps display radius” of 10 meters to the location data point. Finally, Google reports that its “maps display radius” reflects the actual location of the covered device approximately 68% of the time. In this case, Google location data shows that a device associated with [my redaction]@gmail.com was within the U.S. Capitol at coordinates associated with the center of the Capitol Building, which I know includes the Rotunda, at 2:56 p.m. Google records show that the “maps display radius” for this location data was 34 meters.

Law enforcement officers, to the best of their ability, have compiled a list (the “Exclusion List”) of any Identification Numbers, related devices, and information related to individuals who were authorized to be inside the U.S. Capitol during the events of January 6, 2021, described above. Such authorized individuals include: Congressional Members and Staffers, responding law enforcement agents and officers, Secret Service Protectees, otherwise authorized governmental employees, and responding medical staff. The mobile device associated with [my redaction]@gmail.com is not on the Exclusion List. Accordingly, I believe that the individual possessing this device was not authorized to be within the U.S. Capitol Building on January 6, 2021. Furthermore, surveillance footage from the Rotunda, time-stamped within a minute of 2:56 p.m., shows GROSECLOSE, in his distinctive clothing, using his cell phone in an apparent attempt to take a picture.

Records provided by Google revealed that the mobile device associated with [my redaction]@gmail.com belonged to a Google account registered in the name of “Jeremy Groseclose.” The Google account also lists a recovery SMS phone number that matches [my redaction]. The recovery email address for this account appears to be in the name of GROSECLOSE’s significant other, with whom he has two children in common. Additionally, I have reviewed subscriber records from U.S. Cellular, related to the phone number [my redaction]. This number, along with another, are connected to an account in the name of GROSECLOSE’s significant other. The billing address for this account is [my redaction]. One of GROSECLOSE’s neighbors identified [my redaction] as GROSECLOSE’s address.

This seems to confirm that FBI obtained a geofence warrant from Google, but — at least as described — it was focused on those at the Capitol, perhaps focused on the Rotunda and anything 100 feet from it. This is the kind of granularity that will exclude most uninvolved people. They may have used it (or included it in the affidavit) because by wearing a gas mask, Groseclose made it difficult to show his face in the existing film of the attack.

The affidavit suggests that the Google geofence relied not just on GPS data of users’ phones, but also Wi-Fi access points (there’s another affidavit where the suspect’s phone triggered the Capitol Wi-Fi) and Bluetooth beacons. Again, given how wired the Capitol is, this would offer a granularity to the data that wouldn’t exist in most geofence warrants.

Finally, and most interestingly, this affidavit (obtained on the same day as the The Intercept story and so presumably after the Intercept called for comment) describes that the FBI has an “Exclusion List” of everyone who had a known legal right to be in the Capitol that day. That suggests that, after such time as the FBI completed this list, they could identify which of those present in the Capitol were probably there illegally.

There are concerns about FBI putting together a list like this. After all, Members of Congress might have good Separation of Power reasons to want to keep their personal phone numbers private. That said, there’s reason to believe that the FBI has used this method of separating out congressional identifiers and creating a white list in the past (including with the Section 215 phone dragnet), with congressional approval.

The concern arises in FBI’s definition of how it describes those legally present:

  • Members of Congress
  • Congressional staffers
  • Law enforcement responding to the insurrection (as distinct from law enforcement joining in it)
  • Secret Service Protectees (AKA, Mike Pence and his family)
  • Other government employees (like custodial staff)
  • Medical staff

Not on this list? Journalists, not even those journalists holding valid congressional credentials covering the vote certification.

Already, there have been several cases where suspects have claimed to be present as media, only to be charged both because of their comments while present and the fact that they don’t have congressional credentials. Three are:

  • Provocateur John Sullivan, who filmed the riot and sold the footage to multiple media outlets and “claimed to be an activist and journalist that filmed protests and riots, but admitted that he did not have any press credentials.”
  • Nick DeCarlo, who told the LA Times he and Nicholas Ochs were there as journalists but who FBI noted, “is not listed as a credentialed reporter with the House Periodical Press Gallery or the U.S. Senate Press Gallery, the organizations that credential Congressional correspondents.”
  • Brian McCreary, who on his own sent the video he took on his phone while inside the Capitol, but who later admitted to the FBI that entering the Capitol “might not have been legal” and also described admitting to cops present that he was not a member of the media.

If the FBI is going to use official credentials to distinguish journalists from trespassers, then it could also use those credentialing lists to white list journalists present at the Capitol. But to do that, the journalists in question would have to be willing to share identifying information for all the devices that were turned on at the Capitol, something they might have good reasons not to want to do.

Plus, I suspect there are a number of journalists without Congressional credentials who were covering the events outside the Capitol and, as the rally turned into a riot, entered the Capitol to cover it. Those journalists risked their lives and provided some of the most important early information about the riot and did so in ways that in no way glorified it. But in doing so, their devices may be in an FBI database relating to the attack.

There is clear evidence that the FBI obtained location data from the Capitol as part of its investigation, including Google and almost certainly Facebook. Thus far, the available evidence suggests that the ability to target that collection narrowly limits the typical concerns about tower dumps and geofence warrants (again, any similar data collection outside the Capitol in an effort to find the person who left the pipe bombs is another issue). Moreover, almost all those legal present in the Capitol appear to be whitelisted.

But not all. And the exception, journalists, include those who have the most at stake not having their devices identified and investigated by the FBI.

All that said, perhaps a similarly controversial question pertains to preservation orders. The Intercept describes a letter from Mark Warner calling on carriers to preserve data (and rightly questioning his legal authority to make such a request), then suggests the carriers have done so on their own.

Some of the telecommunications providers questioned whether Warner has the authority to make such a request, but a number of them appear to have been preserving data from the event anyway because of the large scale of violence, the source said.

The story doesn’t consider the — by far — most likely explanation, which is that FBI served very broad preservation orders on social media companies (though some key ones, such as Facebook, would keep data for a period even after insurrectionists attempted to delete it in the days after the attack as normal practice). In any case, broad preservation orders on social media companies would be solidly within existing precedent. But I suspect it may be one of the more interesting legal questions that will come out of this investigation.

Update March 7: Added McCreary.

The New Recruits on the Front Line on January 6

In addition to adding six more people to the Oath Keeper conspiracy indictment originally charged against Jessica Watkins, DOJ added some new overt acts. Among others, it added training.

Training and recruitment were always part of Watkins’ alleged actions:

On November 9,2020, WATKINS, the self-described “C.O. [Commanding Officer] of the Ohio State Regular Militia,” sent text messages to a number of individuals who had expressed interest in joining the Ohio State Regular Militia. In these messages, WATKINS mentioned, among other things, that the militia had a weekJong “Basic Training class coming up in the beginning of January,” and WATKINS told one recruit, “l need you fighting fit by innaugeration.” WATKINS told another individual, “It’s a military style basic, here in Ohio, with a Marine Drill Sergeant running it. An hour north of Columbus Ohio[.]”

On November 9,2020, WATKINS asked a recruit if he could “download an App called Zello” and stated, “We all use Zello though for operations.”

On November 17 , 2020, when a recruit asked WATKINS for her predictions for 2021 , WATKINS replied, among other statements:

I can’t predict. I don’t underestimate the resolve of the Deep State. Biden may still yet be our President. If he is, our way of life as we know it is over. Our Republic would be over. Then it is our duty as Americans to fight, kill and die for our rights.

and:

[I]f Biden get the steal, none of us have a chance in my mind. We already have our neck in the noose. They just haven’t kicked the chair yet.

The original indictment also described Donovan Crowl attending a training session in December.

On December 12-13,2020, CROWL attended a training camp in North Carolina.

The superseding indictment adds to these details. It includes descriptions of how 54-year old Graydon Young and his 52-year old sister Laura Steele joined the Oath Keepers.

31. On December 3, 2020, YOUNG emailed the Florida chapter of the Oath Keepers with a membership application and wrote, “looking to get involved in helping. . ..”

33. On December 19, 2020, YOUNG wrote to a Facebook group: “Please check out Oath Keepers as a means to get more involved. Recruiting is under way. DM me if you want more info.”

38. On December 26, 2020, YOUNG wrote an email to a Florida company that conducts training on firearms and combat. YOUNG wrote, in part, “l trained with you not long ago. Since then I have joined Oath Keepers. I recommended your training to the team. To that effect, four of us would like to train with you, specifically in your UTM rifle class.”

52. On January 3, 2021, STEELE emailed the Florida chapter of the Oath Keepers with a membership application and wrote, “My brother, Graydon Young told me to submit my application this route to expedite the process.” Later in the day, STEELE emailed KELLY MEGGS and wrote, “My brother, Graydon Young told me to send the application to you so I can be verified for the Events this coming Tuesday and Wednesday.” The following day, STEELE sent an email to an Oath Keepers address, copying both YOUNG and KELLY MEGGS, attaching her Florida Oath Keepers membership application and vetting form, and writing, “I was just requested to send my documents to this email.”

And the arrest affidavit for the Parkers describe them discussing joining Watkins’ militia because their own had largely dissolved.

On December 27, 2020, Bennie Parker texted Watkins, “I may have to see what it takes to join your militia, ours is about gone.” Also on December 27, 202, Bennie Parker texted Watkins, “Yes and you and Sandi and I are like minded you guy [sic] aren’t that far away . . . . “

Effectively, that means that the organized stack (also included as an overt act in the superseding indictment) included at least three people — Crowl, Steele, Young, and Sandi Parker — who had just joined either Watkins’ militia or the Oath Keepers generally (Bennie, who’s 70, is not known to have entered the Capitol).

For all that it attracted media attention for that organized stack, the Oath Keepers weren’t as instrumental to the launch of the coup attempt as the Proud Boys.

But there, too, the militia was relying on new recruits. Dominic Pezzola claims (not entirely convincingly) that the insurrection was just his second action with the Proud Boys (though his first was the December MAGA March, where he was in close proximity to Roger Stone’s Oath Keeper body guard Robert Minuta).

Of more interest are the details Felicia Konold shared about her experience leading the mob.

She did a Snapchat video gleefully describing how much power she had exercised.

I’m watching the new guys

Fuuuck

Dude, I can’t even put into words. I. I. Never.

I never could [unintelligible] have imagined having that much of an influence on the events that unfolded today.

[Laughs]

Dude, people were willing to follow. You fucking lead, and everyone had my back, due, everyone, fucking wall, legit, in the air, up against the fence, [unintelligible], three lines of police, fence, me, not even on the ground, my feet weren’t even on the ground, all my boys, behind me, holding me up in the air, pushing back.

[Laughs]

We fucking did it.

Her arrest affidavit also quotes her on saying she was, “recruited into a fucking chapter from Kansas City,” complete with a challenge coin. The government’s detention memo for William Chrestman describes that he, “readily recruited two individuals from Arizona [Felicia and her brother Cory] to join the group of Kansas City Proud Boys, who then participated in the crime spree on U.S. Capitol grounds.” (It’s likely the case against Chrestman relies on an FBI interview of Konold, which has not been publicly cited.)

And it didn’t stop there. Experts have talked, abstractly, about how January 6 served as a recruiting boon for right wing terrorists. That’s shown tangibly in a detail from Royce Lamberth’s opinion  Zip Tie Guy Eric Munchel granting the government’s motion for his detention. Even as images from Munchel’s antics in the Senate had attracted close focus and on the same day the government obtained a warrant for his arrest, Zip Tie Guy reached out — via Signal — to the Proud Boys in an effort to join up.

There is also no evidence that Munchel is a member of any violent groups, thought the government has presented evidence that Munchel was in contact with a member of the Proud Boys after January 6 and was interested in joining the group. See Signal Chat Tr. (Jan. 9-10, 2021).

On top of being an explicit attempt to prevent Joe Biden from assuming the presidency, January 6 was also a recruitment bonanza, providing both a goal in advance to work towards, but also a networking opportunity permitting in-person recruitment.

The insurrectionists breached the Capitol with flagpoles and bullhorns. And some of the key players leading that breach were recent recruits to the organized militia leading the way. Meanwhile, Stewart Rhodes, Joe Biggs, and Ethan Nordean were watching from relative safety.

Update: I’ve fixed the Stack numbers; I think Crowl may have been training rather than being trained at the came in North Carolina in December.

Proud Boys “Cell Leader” William Chrestman Says He’s Not Organized Crime, Was Just Acting on Orders

I’m working towards posts on how DOJ is treating the different members of the Proud Boys charged with crimes relating to January 6 and how DOJ’s past history with the group makes their failure to warn about January 6 all the more damning.

But first, I want to look at what William Chrestman’s lawyers said in a memo arguing he should not be detained pre-trial.

As a reminder, Chrestman was charged with conspiring with four other people, all wearing orange tape, both to obstruct the counting of the electoral vote, and to impede law enforcement officers during a civil disorder. Of particular note, Chrestman and those with him physically prevented cops from shutting access to tunnels through which members of Congress had been evacuated.

The government’s detention memo calls Chrestman an “apparent leader of this particular cell” and describes that he recruited two people from Arizona (Felicia Konold, whom charging documents say the FBI interviewed, but from which interview they didn’t quote, and her brother Cory) to take part in the riot.

Defendant Chrestman readily recruited two individuals from Arizona to join the group of Kansas City Proud Boys, who then participated in the crime spree on U.S. Capitol grounds.

As such, the action of a group led by Chrestman directly ensured the ongoing threat to members of Congress, to say nothing of the difficulties they caused police trying to limit the incursion of the rioters.

In the memo, Federal Public Defenders Kirk Redmond and Chekasha Ramsey offered a more extended version of an argument other defendants have made, arguing that Chrestman had good reason to believe not just his actions — but the Proud Boys’ generally — must have been sanctioned by the President. [footnotes below replaced with links]

To prefigure how those offenses relate to the likelihood of Mr. Chrestman succeeding on pretrial release, we must start long before January 6.

It is an astounding thing to imagine storming the United States Capitol with sticks and flags and bear spray, arrayed against armed and highly trained law enforcement. Only someone who thought they had an official endorsement would even attempt such a thing. And a Proud Boy who had been paying attention would very much believe he did. They watched as their “pro-America, pro-capitalism and pro-Trump” rhetorical strategy “allowed the Proud Boys to gain entry into the Republican mainstream.”11 They watched as law enforcement attacked Black Lives Matter and anti-fascism protestors, but escorted Proud Boys and their allies to safety.12 They watched as their leader, Enrique Tarrio, was named Florida state director of Latinos for Trump.13 They watched the Trump campaign, “well aware of the organized participation of Proud Boys rallies merging into Trump events. They don’t care.”14 They watched when then-President Trump, given an opportunity to disavow the Proud Boys, instead told them to “stand back and stand by.”15 They understood that phrase as “a call to arms and preparedness. It suggests that these groups, who are eager to do violence in any case, have the implicit approval of the state.”16 Having seen enough, the Proud Boys (and many others who heard the same message)17 acted on January 6.

Their calculations were wrong. The five weeks since January 6 have broken the fever dream. The Proud Boys are “radioactive now.”18 Any “air of respectability is gone.”19 The Proud Boys are in “disarray, as state chapters disavow the group’s chairman and leaders bicker in public and in private about what direction to take the Proud Boys in.”20 Their leader was arrested, then “outed as a longtime FBI informant, a role he has now admitted to.”21 And not insubstantially, a number of their members have been arrested for their roles in the January 6 attack. [my emphasis]

The filing goes on to quote extensively from impeachment evidence and Mitch McConnell’s post-acquittal statement, reiterating Trump’s central role in all this.

Even before it gets there, though, the memo makes an argument I expect we’ll see more of, one which very much resembles the argument Bill Barr’s DOJ made to diminish prior threats from the Proud Boys.

Third, the government’s evidence is a far cry from what courts have found constitutes sufficient evidence of a serious risk of obstruction justifying detention. Threatening to kill a witness,4 injure a witness,5 or manufacture false evidence6 is the kind of stuff that gets one detained under 18 U.S.C. § 3142(f)(2)(B). More similar to our facts is United States v. Demmler, 523 F.Supp.2d 677 (S.D. Ohio 2007). There, the “Government allege[d] that Demmler talked about enlisting other defendants in the underlying Poulsen case in his and Poulsen’s scheme[.]”7 But whether the defendant “would have followed-up on these musings had he not been arrested, and whether he would do so now, are entirely speculative. It is just as likely, on this record, that Demmler’s arrest on federal charges has chastened, rather than emboldened, him.”8 So too here.

4 United States v. Fontanes-Olivo, 937 F.Supp.2d 198, 201 (D. P.R. 2012) (Authorizing detention based on potential obstruction where defendant told witness that “one of ‘his people,’ could ‘get rid of you’ based on a rumor that the UM was cooperating with authorities.”).

5 United States v. Ploof, 851 F.2d 7, 11 (1st Cir. 1988) (When “defendant, if released, will attempt to injure or intimidate other prospective witnesses (and if the evidence supports said conclusion) then, too, detention is authorized”).

6 United States v. Robertson, 608 F.Supp.2d 89, 92 (D. D.C. 2009) (“Given the extraordinary lengths that these defendants went to in their efforts to tamper with witnesses and manufacture utterly false, misleading evidence at trial—and in light of their proven success in achieving a hung jury in one trial already—this Court ultimately has no choice but to detain these defendants prior to trial.”).

7 Demmler, 523 F.Supp.2d at 683.

8 Id.; See also United States v. Simon, 760 F.Supp. 495 (D. V.I. 1990) (Detention inappropriate even when defendant attempted to speak with a juror in his brother’s murder trial; although “conduct is inexcusable, it is a far cry from the venality, corruption and violence of the sort common in organized-crime cases, designed to destroy the integrity of the criminal justice system.”)

A year ago, Bill Barr’s DOJ said threats from the Proud Boys might “technically” be obstruction, but such a sentencing enhancement, “typically applies in cases involving violent offenses, such as armed robbery.” Almost exactly a year later, Chrestman’s attorneys argue that threats from the Proud Boys and the threat of ongoing Proud Boys action, “is a far cry from the venality, corruption and violence of the sort common in organized-crime cases.”

This passage is far less persuasive than those invoking Trump. After all, Chrestman threatened police he would, “take your fucking ass out,” if they shot protestors, and further incited others to fight back.

Defendant Chrestman stood directly in front of Capitol Police officers who were attempting to guard the Capitol. Defendant Chrestman yelled at the Capitol Police officers, “You shoot and I’ll take your fucking ass out!” At a different point, Capitol Police officers attempted to arrest one person from the crowd, and Defendant Chrestman encouraged other members of the crowd to stop the Capitol Police from arresting him. Among other things, Defendant Chrestman said to other members of the crowd, “Don’t let them take him!”

Particularly backed — as Chrestman was — by mobs of thousands, that threat was every bit as serious as the one Chrestman’s lawyers cite in Fontanes-Olivo. And the Proud Boys have long been considered an organized hate group, so the allusion to organized crime is actually on point.

More importantly, Chrestman’s completed act — the success that he and others had at delaying the count of the electoral count vote — did grave damage to the integrity of our democracy, a point prosecutors made in their detention memo.

The nature and circumstances of the charged offenses weigh heavily in favor of detention. Defendant Chrestman, a member of a right-wing militia, knowingly and willfully participated in a riot that was designed to prevent the United States Congress from certifying the results of the 2020 Presidential election. Not only did Defendant Chrestman participate in the riot, he assumed a leadership role by shouting “Whose house is this?” and encouraging the crowd to “Take it!”

Words alone may never communicate the true nature of the crimes that were carried out on January 6. It is an event that cannot be measured in the number dead, injured, or wounded, but rather in the destabilizing effect that it has had on this country. This destabilizing effect is precisely what Defendant Chrestman envisioned when he decided to travel to the Capitol, helped lead others into the U.S. Capitol, and participated in the Proud Boys’ participation in the riot at the Capitol building.

The problem is that not just Donald Trump but even his Department of Justice (to say nothing of the line law enforcement officers cited by Chrestman’s lawyers) have long minimized the risk fo such a threat.

That said, the fact that Donald Trump got precisely the destabilizing blow to democracy and the terror he wanted is no reason to let Chrestman go free. Instead, Chrestman makes a great argument that Trump should be treated as a co-conspirator.

Mike Lee Provides Key Evidence Implicating Trump in the Existing Criminal Conspiracy

Because Donald Trump’s Personal Injury lawyer, Michael Van der Veen, made a specious argument about the First Amendment to successfully give 43 Republicans cover to vote to acquit the Former President in his impeachment trial, the discussion about Trump’s potential criminal exposure for January 6 (which according to CNN he is concerned about) has largely focused on incitement charges.

That’s true even though the trial led Mike Lee to offer up evidence implicating Trump in the same conspiracy charges already charged against 10 defendants: conspiring to delay Congress’ official proceeding to certify the electoral college vote. As I have noted, DOJ has started mapping out conspiracy charges against both the Oath Keepers and the Proud Boys:

While there are differences in the scope of the conspiracy and overt acts involved, all three charging documents charge defendants with conspiring “to stop, delay, and hinder Congress’ certification of the Electoral College vote,” effectively conspiring to commit 18 USC 1512, tampering with the official procedure of certifying the electoral college vote, an official procedure laid out in the Constitution.

And in spite of their votes to acquit the Former President last night, both Tommy Tuberville and Mike Lee provided evidence that the FBI might use to investigate Trump in that conspiracy. As I noted days after the attack, during the attack, Trump twice attempted to reach out to Tuberville to ask him to delay the count. The second time, Rudy Giuliani even left a message specifically asking for a delay as such, precisely the object of the already charged conspiracy charges.

I know they’re reconvening at 8 tonight, but it … the only strategy we can follow is to object to numerous states and raise issues so that we get ourselves into tomorrow—ideally until the end of tomorrow.

I know McConnell is doing everything he can to rush it, which is kind of a kick in the head because it’s one thing to oppose us, it’s another thing not to give us a fair opportunity to contest it. And he wants to try to get it down to only three states that we contest. But there are 10 states that we contest, not three. So if you could object to every state and, along with a congressman, get a hearing for every state, I know we would delay you a lot, but it would give us the opportunity to get the legislators who are very, very close to pulling their vote, particularly after what McConnell did today. [snip]

Over the last few days, both Tuberville and Lee offered up more details on the earlier call. Tuberville confirmed the content of the call, including that he told the President that his Vice President had been evacuated.

Sen. Tommy Tuberville revealed late Wednesday that he spoke to Donald Trump on Jan. 6, just as a violent mob closed in on the the Senate, and informed the then-president directly that Vice President Mike Pence had just been evacuated from the chamber.

“I said ‘Mr. President, they just took the vice president out, I’ve got to go,’” Tuberville (R-Ala.) told POLITICO on Capitol Hill on Wednesday night, saying he cut the phone call short amid the chaos.

And Lee — who twice demanded that references to this call be removed from the Congressional record — ultimately provided phone records showing that even after Pence had been publicly rushed to safety, Trump was still working on delaying the vote rather than addressing the danger. Trump tweeted about Pence at 2:24, specifically complaining that Pence hadn’t given states a chance to “correct” facts, effectively a complaint that Pence had not disrupted the orderly counting of the vote.

Mike Pence didn’t have the courage to do what should have been done to protect our Country and our Constitution, giving States a chance to certify a corrected set of facts, not the fraudulent or inaccurate ones which they were asked to previously certify. USA demands the truth!

And then, two minutes later, Trump attempted to call Tuberville and, after Lee turned over his phone to the former coach, spoke to him for four minutes. It matters that Tuberville told Trump about the evacuations, though it is highly unlikely he had not been informed both informally and formally at that point. But it matters just as much that even after the insurrectionists had breached the building, Trump took two overt acts to attempt to delay the vote.

A Trump defense might argue — as his Personal Injury Lawyer did this week — that he was just trying to count the votes, but Trump had already made an unconstitutional request of Mike Pence, something Trump’s team provided no defense for. And that’s before you consider the evidence that Rudy, at least, was in direct contact with James Sullivan, who is affiliated with the group, the Proud Boys, that has already been accused of conspiring to breach the Capitol (indeed, another conspiracy case, against Proud Boys Dominic Pezzola and William Pepe, charges that they conspired to interfere with cops trying to keep protestors out of the Capitol, and the Chrestman indictment also includes that as a separate conspiracy).

I’m not saying this will definitely happen. The bar to charging a Former President remains high.

But DOJ has already charged ten people for doing what Trump was also demonstrably doing that day. And, partly because of Mike Lee’s desperate effort to avoid having the record of him implicating Trump in the congressional record, Lee ended up making the timeline of the events public without the FBI having to breach speech and debate concerns to obtain it. By doing so, Lee made it easier for the FBI to make a case against Trump if they ever attempt to do so.

Mike Lee may have helped prevent Trump from being barred from running for President again. But Mike Lee also made it easier to prosecute Trump for those very same acts.

Update: NYT just posted a story showing that six of the Oath Keepers Roger Stone was palling around with leading up to the attack entered the Capitol on January 6.