Posts

Accused Terrorist* Leader Ethan Nordean Complains He Got Charged with Trespassing

The biggest advantages that Ethan Nordean and the other men charged in the Proud Boys Leadership conspiracy have are a judge, Tim Kelly, who is very sympathetic to the fact that they’re being held in jail as the government fleshes out the case against them, and the 450 other January 6 defendants who have been charged with one or another of the same charges the Proud Boys were charged with. The biggest disadvantages are that, as time passes, the government’s case gets stronger and stronger and the fact that seditious conspiracy or insurrection charges not only remain a real possibility, but are arguably are a better fit than what they got charged with.

That’s why it baffles me that, minutes after Judge Kelly noted that every time Nordean files a new motion, Nordean himself tolls the Speedy Trial clock, Nordean’s lawyer, Nick Smith, filed a motion to dismiss the entirety of the indictment against Nordean.

Don’t get me wrong; I think Smith is a good lawyer and I’m grateful for the January 6 defense attorneys who are making aggressive challenges to the charges against their clients; it’s an important check on the First Amendment risks of this prosecution. And I imagine the filing was all ready to go before yesterday’s status hearing, where Kelly kept repeating that he is sympathetic to the plight of the defendants, but noted that the last motion Smith filed — a motion for a Bill of Particulars, a kind of motion that, in general, rarely succeeds — probably tolls the Speedy Trial clock whether or not Kelly were prepared to rule against prosecutors’ request for more time.

But tactically, trying to throw out every single crime, up to and including his trespassing charge, charged against one of the key leaders of a terrorist attack that put our very system of government at risk trades away the two biggest advantages Nordean has on legal challenges that won’t eliminate the prosecution against Nordean.

The 66-page motion goes one by one, arguing that every charge against Nordean is vague or wrongly applied. Obstruction — 1512 — only applies for Congress when it is engaged in an investigative function, not what Nordean claims (notwithstanding the questions that sympathetic members of Congress raised about the vote count) was just a formal technicality. Leading an insurrection also doesn’t have the requisite corrupt nature, because threatening the Vice President and the Speaker of the House with assassination would not have the effect of influencing members of Congress to do what the mob wanted. Civil disorder — 231 — was designed to jail civil rights leaders and so (it suggests) shouldn’t be used against a guy trying to invalidate the votes of 81 million Americans. A riot affecting a vote count that affects every state and shut down much of DC did not affect interstate commerce. There were other police, in addition to the Secret Service at the Capitol, and so the specific terms of 1752 — the trespassing charge — don’t apply here. Plus, poor Ethan Nordean had no way of knowing that barriers that were clearly in place when he started the approach to the Capitol were barriers meant to keep him out. And, finally (though this comes off as half-hearted), Nordean has no idea what property his conspiracy depredated even though it has been discussed ad nauseum in past hearings.

Along the way, Smith shades the case in ways that prosecutors will easily rebut, as when he suggests Nordean, whom the indictment cites invoking revolution as early as November 27 (and so even before the states certified their votes), was motivated out of a sincere belief that the election was stolen because of voter fraud.

Nordean did so, the government alleges, in the misguided belief that the legislature should refuse to certify the vote upon a review of evidence that he mistakenly contended showed voter fraud.

[snip]

Instead, it contends he allegedly obstructed the session in support of the sincerely held political belief that the 2020 presidential election was not fairly decided.

He lays out the legislative history for many of these laws. He provides the entire history of the Executive Mansion. He falsely represents that the only people who are being charged with 1512 are gang members like Nordean. More ridiculous still is the claim that hundreds or thousands of other people aren’t being charged with 1752 and so Nordean’s charge must solely stem from his gang membership, when in fact, virtually every person who is being charged, is being charged with 1752.

Some of these arguments have merit. For example, I’ve repeatedly raised concerns about the way the government has hung all its felony counts on a fairly novel reading of obstruction (basically, the argument that the insurrectionists were obstructing the official proceeding of certifying the vote). But other defendants — albeit mostly Proud Boys — are already bringing these challenges (and more are likely to now that Paul Hodgkins’ plea has made it clear that the government will insist defendants plead to that count). The DC Circuit is far more likely to assess those arguments on their legal merits if someone like business owner Jenny Cudd, who actually attended Trump’s rally before heading to the Capitol, and who didn’t preassemble a mob of 100 gang members to attack the Capitol even before Trump’s speech (that said, Cudd’s challenges thus far have been motions to change venue and to sever).

I would like the 231 challenge to succeed, but similar challenges have thus far failed when launched by people in actual states rather than the nation’s capital that by its geographic nature can carry out little commerce without transit through Maryland and/or Virginia, and in protests that would have been prosecuted solely by state cops if Billy Barr didn’t bigfoot on the events

Even Smith’s challenge to the trespassing charge was genuinely interesting when he made the same argument for another of his clients, Couy Griffin, who attended Trump’s rally and is not alleged to have entered the Capitol itself. But it works very differently for a guy who, rather than attending Trump’s rally, instead spent the morning of January 6 preparing a mob to march on an event that was important precisely because Mike Pence, along with his Secret Service detail, would be there conducting official business.

That’s the thing about being charged along with 450 other people: Where a claim has legal merit, other defendants are going to make such challenges. Those other defendants will be taken more seriously by the DC Circuit (the detention case for Chris Worrell has already shown that the DC Circuit sees the Proud Boys’ role in this as distinct from the unaffiliated defendants). And most of those defendants, if they succeed, won’t be promptly charged with insurrection or seditious conspiracy to sustain the prosecution.

And if any of these challenges brought by others succeed, then at that point, Nordean could point to the appellate decision and get his charges dropped along with hundreds of other people. But launching the challenge now, and in an omnibus motion claiming that poor Ethan didn’t know he was trespassing, is apt to get the whole package treated with less seriousness. Meanwhile, Nordean will be extending his own pre-trial detention. The government will be given more time to try to flip other members of a famously back-stabbing group, possibly up to and including Nordean’s co-conspirators (whose pre-trial detention Nordean will also be extending). And Judge Kelly will be left wondering why Nordean keeps undermining Kelly’s stated intent to limit how much the government can draw this out.

The worst thing about this motion, though, is that both the substance of it and that it was filed by one of the key terrorist leaders of this attack serves as the single best argument I’ve seen for passing a domestic terrorism statute. I don’t want January 6 to lead to passage of a domestic terrorism statute so the government has a way to criminalize membership in the Proud Boys. But claiming that Ethan Nordean shouldn’t even be held accountable for trespassing is a good way to ensure that one is passed.


*I believe it is legally accurate to use the term “terrorist” with Nordean because the government has charged him with a crime that can carry a terrorist enhancement — and in fact the government laid that out explicitly in the superseding Front Door indictment. I also believe the January 6 attack was a classical case of terrorism: the use of political violence to achieve a political goal.

Y’all Qaeda Northwest: Ethan Nordean Provides Yet More Proof of the Proud Boys’ Sophistication and Resilience

The government and Ethan Nordean are having a dispute that is, at least procedurally, about whether by giving Nordean the Telegram text messages he demanded in prioritized fashion, the government committed a Brady violation. Nordean started this dispute on April 29 with a filing admitting that the texts he received before his detention hearing were the ones he asked for specifically but still complaining that he didn’t get all his texts at once.

Today, the government produced for the first time additional Telegram messages extracted from Nordean’s phone. The government provided no explanation as to why they were produced after the hearing on its third detention motion and not beforehand.1 Like the Telegram chats it used to support detention, today’s production was drawn from the same device (Nordean’s phone), the same app (Telegram), and only postdate by some days the chats the government used to detain Nordean. In reviewing the following chats, the Court may recall that because the Telegram messages are encrypted and, according to the government, “designed to evade law enforcement,” the government would have the Court believe the app users are speaking candidly in Telegram.

On March 25, Nordean requested that the government produce, at least by March 30, Telegram chats on Nordean’s phone sent and received between 1/4/21 and 1/8/21. Nordean did not say that no other chats should be produced, nor did he waive any right to Brady material of which the government was aware. On March 9, Nordean served a discovery letter on the government seeking all of the defendant’s statements and requesting that Brady material be produced according to the schedule in Rule 5.1.

The government response doesn’t point out that they gave Nordean precisely what Nordean asked for. It does describe how they provided Nordean’s Telegram chats in three waves, with the entire content of his phone provided by April 30.

On April 29, 2021, the government produced to defendant Nordean eleven (11) strings of text messages, totaling over 5,000 pages, that contained the terms “Ministry of Self-Defense” or “MOSD,” and that were recovered from defendant Nordean’s phone.

Thereafter, on April 30, 2021, a full copy of an extraction from defendant Nordean’s phone was produced to Nordean’s counsel. That production included approximately 1,172 Telegram message strings (totaling over 1.3 million messages). The extracted text of the Telegram messages in Nordean’s phone runs over 204,000 pages when printed in .pdf format, which does not include any of the images, audio, or video files that are associated with the message strings. In addition to the Telegram messages, the phone contains hundreds of other communications using other platforms, including other encrypted platforms such as Signal and WhatsApp. The government’s review of these message strings, hundreds of which contained communications between December 2020 and January 2021, is ongoing, and all of this information is in defendant Nordean’s possession.

Nordean’s reply doubles down on the accusations of misconduct, now claiming the government intentionally withheld substantiation of Nordean’s claim to have disavowed rallies.

Nordean had presented an audio recording of himself in a conversation with members of his group in which he rejected political rallying. The recording shows him annoyed with how often he had to “repeat himself” on the point. The clip was recorded in February, shortly before his arrest. It is not “self-serving,” as he was communicating with his in-group and through the medium that the government alleges was used “to evade detection.”1 The Court found that the clip “does suggest that, at some point, [Nordean] agreed that the Proud Boys should stop rallying.” Hr’g Trans., 4/19/21, p. 55:21. However, the Court also found that “without any further context there’s no indication that that was some kind of permanent decision.” Id., p. 55:22.

At the time of the hearing, there was “further context.” The government knew it and did not inform the defense or the Court. Shortly after that hearing, on April 29, the government produced late January chats in which Nordean repeatedly discussed “bans on rallies”; in which Nordean said, “fuck politics, build communities and local economy” (Cf. the Court: “politics has not [passed]”); where Nordean endorses the doubly capital notion “THE PROUD BOYS ARE NOT MARCHING ON CAPITAL BUILDINGS”; and in which Nordean reacts dismissively, in real time, to the conspiracy charge supposedly predicating his detention. On its own, the government’s late production of these chats is unequivocally a violation of the Due Process Protections Act and Local Criminal Rule 5.1. It is also a violation of Rule 3.8(e) of the D.C. Rules of Professional Conduct for prosecutors.2

2 “The prosecutor in a criminal case shall not . . . Intentionally fail to disclose to the defense, upon request and at a time when use by the defense is reasonably feasible, any evidence or information that the prosecutor knows or reasonably should know tends to negate the guilt of the accused or mitigate the offense.” Rule 3.8(e) of the D.C. Rules of Professional Conduct.

In his reply Nordean asks a fair question — why the government didn’t just keep screen-capping texts that were a “two-second scroll” down Nordean’s phone from the chats the government had turned over in response to Nordean’s specific request. It seems the government has a reasonable answer: because it was responding to a specific request, though they have yet to say that specifically.

Nevertheless, neither side is treating this as a dispute over misconduct. The government notes that his original motion asks for no relief.

Defendant Nordean’s notice alleging a violation of those provisions (ECF 79) seeks no relief, and no relief or further action by the Court is necessary or appropriate.

Nordean’s reply asks for no relief either. It instead says that he is “developing evidence,” but once again asks for no relief.

The government concludes its response by saying Nordean’s “notice seeks no relief because defendant is entitled to no relief.” ECF No. 84, p. 12. The government is mistaken. The notice sought no relief because Nordean is developing further evidence of the government’s misconduct in filing a series of misleading claims in this matter and in withholding evidence so that it cannot be timely used.

And Nordean goes from that comment — stating that it is incorrect that he asks for no relief by once again asking for no relief — to instead make an argument about bail. (This series of exchanges is actually about preparing a record for Nordean’s detention challenge at the DC Circuit.)

Nordean points to this declaration from Daniel Aurellano stating that Ethan Nordean is no longer the President of Proud Boys Seattle Chapter, because he, Aurellano, was elected to replace him.

Nordean is also developing evidence showing that the premises for revoking his release order are factually mistaken. For example, although Nordean’s leadership role in the Proud Boys was cited to detain him, he is no longer a leader, in any sense of the word, in that organization, nor does he have any decision-making authority, as sworn statements indicate and will further indicate.

Aurellano says he was elected to replace Nordean “in February 2021,” but doesn’t say when that happened. Nor does Aurellano say when, in February 2021, the Proud Boys Northwest chose to dissociate from the national Proud Boys. He does, however, say Nordean stopped participating in Proud Boys Internet communications after his arrest in February 2021. Which suggests Aurellano got elected to replace Nordean at a meeting that Nordean called for while still the head of the chapter, on January 20, and at which Nordean planned to discuss “bugout bags” and “bulk armor deals” because they were “on the brink of absolute war.”

Nordean makes much of the fact that subsequent to this January 20 statement, and so also subsequent to Joe Biggs’ arrest on January 20, he made a series of comments forswearing rallies.

But that means one of the last things Nordean did while still in charge was call for and prepare for war — not to mention to call for bugout bags for which the old passport of one’s ex-wife, such as the one the government alleges (though the allegation is contested) was out on Nordean’s bedroom dresser when the FBI came to search his house — would be acutely valuable. And then everyone started getting arrested and the Proud Boys took steps to cover their tracks.

Amid this whole bail dispute pretending to be a misconduct dispute, however, Nordean has helped to lay out both that this is a remarkably organized militia, and it is adopting a tactic other terrorist groups have in the past: to splinter and rebrand as a way to attempt to evade prosecution, as if the Proud Boys Northwest had adopted the name Y’All Qaeda Northwest like African branches of the Islamic State did.

Thus far, filings in the Proud Boys Leadership conspiracy case have shown that:

  • The Proud Boys started preparing a compartmented cell structure in anticipation of the January 6 insurrection on December 29
  • Enrique Tarrio anticipated he would be arrested when he came to DC on January 4 and so provided for a succession plan
  • Charles Donohoe allegedly attempted to destroy evidence of past planning in the wake of Tarrio’s arrest, specifically in an attempt to avoid gang charges (whether he succeeded or not remains contested)
  • In the aftermath of January 6, the Proud Boys (and Nordean specifically) took steps to prepare for war
  • In Seattle, the Proud Boys responded to Nordean’s arrest by ensuring the continuity of the organization

Again, none of this is exculpatory for Nordean. It shows the Proud Boys operating like sophisticated terrorist groups have operated in the past, in an attempt to retain viability while under government scrutiny.

And along the way, Nordean and the government have been drawing an utterly convincing argument — with two attempts to access passports and an explicit call for bugout bags — that he would flee the country the first chance he got.

January 6: A Change of Pace

Although GWU’s tracker, which is still the best way to keep track of all the January 6 defendants (though this visual story from WaPo using their data is nifty) added four new January 6 defendants yesterday, the pace of new defendants has slowed considerably. While there are still some detention fights, several of those disputes (Proud Boys Ethan Nordean and Joe Biggs, and disorganized conspirators Nate DeGrave and Ronnie Sandlin, as well as Neo-Nazi sympathizer Timothy Hale-Cusanelli — have moved to the DC Circuit.

We’re likely to have more bail revocation fights. The other day, for example, Landon Copeland — who made news for his meltdown during a magistrate judge’s hearing last week — was arrested for some still unidentified bail violation. The government has also moved to revoke Patrick Montgomery’s bail because he — a professional hunting guide — shot a mountain lion that he — a felon — cannot legally possess.

But there are a couple of developments this week that point to what’s going on with this investigation.

Delayed phone exploitation

In a hearing in the case against mother and son defendants Deborah and Salvador Sandoval, Deborah’s attorneys were anxious to move to trial based off an apparent misunderstanding that the evidence on her sole computer device, her smart phone, would show she barely entered the Capitol. Meanwhile, the government revealed that because Salvador chose not to share passwords to his multiple devices, those are taking a lot longer to exploit. As I’ve already noted, Ethan Nordean is the only Proud Boys leadership co-conspirator whose phone DOJ was able to exploit without cracking the password first (the FBI got the password from Nordean’s wife). Exploiting all these phones is going to take a lot of time.

In another case, there appear to be privileged communications on Eric Torrens’ phone, which will delay the exploitation of that for up to four weeks as a filter team reviews the content.

In other words, even before you consider any delay created by FBI’s need to respond to Signal’s Moxie Marlinspike’s exposure of vulnerabilities in Cellebrite’s code, it will take some time to process the vast volume of evidence the government has obtained since January 6.

The network analysis

The arrest of Brittiany Dillon gives a sense of another cause of delay.

Bryan Betancur was one of the first wave of January 6 defendants to be arrested, on January 17, after his parole officer alerted the FBI that he had lied about handing out Bibles to get permission to travel from Baltimore to DC that day. The government got a warrant for his phone on January 20. Once they got into his phone, they discovered text messages between Betancur and Dillon in which Dillon described falling in the door of the Capitol during the riot. The government found video of her — falling down as she entered — on surveillance videos by January 23. The government obtained phone and Google warrants to confirm that Dillon had been inside the Capitol the day of the riot. For some reason, the FBI only got around to interviewing Dillon’s father, ostensibly about Betancur, on April 21; the agent got Dillon’s father to confirm Dillon’s ID while they were talking.

This is similar to what happened with Patrick Montgomery, who like Betancur was arrested on January 17. Only after FBI exploited his phone and found some key pictures did they arrest a buddy he was with that day, Brady Knowlton, while pursuing two others.

These arrests of friends of early arrestees may reflect an FBI agent trying to get arrest numbers, but in a number of cases, they seem to reflect larger investigative strategies based on things investigators have found in the profiles of the original defendant. By my count there are about 18 cases of network arrests aside from the militia conspiracies, and about half of those look like they may be more interesting than friends getting scooped up together. I would expect to see more of this going forward.

Delayed arrests

The two month delay between the time DOJ identified active duty Marine, Major Christopher Warnagiris, as the person who played a key role in keeping the East door of the Capitol open after it was first breached on January 6 and when they arrested him on Wednesday is far more interesting.

As the arrest affidavit explains, FBI isolated Warnagiris as a suspect based on his conduct as shown in video, and then published a Be On the Lookout picture to figure out who he was. On March 16, a former co-worker IDed him, and on March 17, the FBI interviewed one of his current co-workers, who positively IDed Warnagiris.

And that’s it–that’s where the narrative in the affidavit, which was signed on Wednesday, ends. They get a BOLO-based tip on March 16, and get military witnesses to confirm his ID on March 17. And that’s all they’re telling us about who he is and what other evidence they have against him.

I’m sure that’s not all that has transpired since FBI discovered an active duty Major played a key role in keeping the East Capitol breach open.

All the while, someone who by dint of being an active duty service member has clearance, has (as far as we know) been going into Quantico every day for the almost two months since they IDed him. That’s … an interesting investigative decision.

Compare that narrative to the one told in the arrest affidavit of Timothy Hale-Cusanelli, the Army reservist and Nazi-sympathizer who worked as a contractor at Naval Weapons Station Earle in New Jersey. On January 12, an informant told the FBI that Hale-Cusanelli was at the riot, on January 14, the informant recorded a conversation in which Hale-Cusanelli admitted to pushing and shoving along with the rest of the mob. Hale-Cusanelli has been jailed since the very next day, January 15 (he is appealing his detention to the DC Circuit). Hale-Cusanelli has not been charged with assault and he is not known to have played such a key role in compromising the Capitol from a second side.

Now, for many defendants, I can see taking your time after the initial rush of arrests. After all, if they were going to delete their Facebook, that would have happened (and did happen, with a goodly number of defendants) by January 9. But Warnagiris seems like a more urgent risk.

And, remarkably, DOJ apparently did not ask for any special conditions on Warnagiris. He has no location monitoring, no restrictions on possessing a gun, no specificity to his travel around DC (most defendants have stay-away orders, but for people like Warnagiris who are local to DC, they’re sometimes restricted to their District). They did not ask him to surrender his passport. Now, perhaps something is also going on with him in the military. But the whole thing — on top of the inevitable shock of having an active duty officer arrested — raises more questions than other cases.

All of which is to say that, with a defendant who genuinely poses unique security risks, the government is now taking their time to flesh out their investigation.

I’ve said from the start that this investigation has been lightning quick. That’s still, absolutely, true. But there’s going to be a lot more happening behind closed doors in the weeks ahead.

DOJ’s Curious Militia Math

The government has responded to Ethan Nordean’s claim that texts that confirmed he was a recognized leader in the Proud Boys were exculpatory. In a filing that lays out more of how the Proud Boys responded — first with glee, then with cover stories, then with plans to regroup — to the events of January 6, DOJ includes a curious paragraph describing Enrique Tarrio establishing a very hierarchical upper leadership of the militia.

On December 29, 2020, the Proud Boys Chairman announced the leadership and structure of the Ministry of Self-Defense. The leadership and structure included an “upper tier leadership” of six people, which included Proud Boys Chairman, Nordean, Biggs, and Rehl. Later that evening, Donohoe explained the structure with reference to the upcoming trip to Washington, D.C. Among other things, Donohoe explained that the MOSD was a “special chapter” within the organization. The “special chapter” was not to have any interaction with other Proud Boys attending the event.

Other Proud Boys attending the event were to coordinate with their own chapters and “do whatever you guys want.”1

The filing goes on to describe the statements of, “one member (“Person-1”) of the upper tier leadership” and “another member of MOSD leadership (Person-2).” In addition, it describes the comments of our old friend UCC-1, an unindicted co-conspirator, clearly distinguishing that person’s legal risk from the others.

When UCC-1 was first introduced in the indictment against the Proud Boys Leadership, it was implied that both he and Charles Donohoe were also in the leadership MOSD, and described the total membership as the four indicted defendants plus “a handful of additional members.”

39. On after Chairman’s January 4, 2021, shortly after Proud Boys Chairman’s arrest pursuant to a warrant issued by D.C. Superior Court, DONOHOE expressed concern that encrypted communications that involved Proud Boys Chairman would be compromised when law enforcement examined Proud Boys Chairmans’ phone. DONOHOE then created a new channel on the encrypted messaging application, entitled, “New MOSD,” and took steps to destroy or “nuke” the earlier channel. After its creation, the “New MOSD” channel included NORDEAN, BIGGS, REHL, DONOHOE, and a handful of additional members.

40. On January 2021, at 7:15 p.m., DONOHOE posted a message on various encrypted messaging channels, including New MOSD, which read, “Hey have been instructed and listen to me real good! There is no planning of any sorts. I need to be put into whatever new thing is created. Everything is compromised and we can be looking at Gang charges.” DONOHOE then wrote, “Stop everything immediately” and then “This comes from the top.”

41. On January 4, 2021, at 8:20 p.m., an unindicted co-conspirator (“UCC-1”) posted to New MOSD channel: “We had originally planned on breaking the guys into teams. Let’s start divying them up and getting baofeng channels picked out.”

Perhaps it’s because I’m what one of Nordean’s buddies calls a “purple haired faggot,” and so can’t understand Tarrio hierarchical logic. But by my math, these two filings suggest the MOSD leadership looks like this:

  1. Enrique Tarrio (who correctly anticipated he’d be arrested in advance of the insurrection)
  2. UCC-1
  3. Joe Biggs
  4. Ethan Nordean
  5. Zach Rehl
  6. Person 1
  7. Person 2

One-two-three-four-five-six-seven. Not six, seven. And that’s assuming Donohoe is not part of the group, though the indictment had suggested he was.

Whether UCC-1 is in or out of that leadership group is a key distinction. The government has a presumed informant who said some of the most inflammatory things in advance of the insurrection:

UCC-1: I want to see thousands of normies burn that city to ash today

UCC-1: The state is the enemy of the people

If this person was an active informant for the FBI going in — as an Aram Rostom story suggests — it means someone at the FBI lost control of their informant and rather than punishing the informant for participating in an insurrection and not informing the FBI about it, it is giving the person a pass. It would mean that because this person had made accusations to feed Billy Barr’s demand for dirt on Antifa, he is getting a pass on insurrection.

But if this informant provided the FBI some kind of warning, then it means the Bureau failed, badly, because the FBI has claimed that it had no warning of events of the day, not even with multiple Proud Boys in its informant ranks, including, possibly, one with top level access.

Not to mention the fact, if this guy had the access some of these filings suggest, it raises real questions about why the FBI still doesn’t know precisely how the operation rolled out.

David Headley and Tamerlan Tsarnaev demonstrate that one way to plan a terrorist attack without the FBI seeing it is to serve as an informant. And if the Proud Boys managed to carry out fairly complex planning for an insurrection because so many of them were trading information on Antifa, it would mean FBI’s handing of informants, plus DOJ’s commitment, from the very top, to prioritize Antifa at the expense of right wing militia, were key ingredients to the success of January 6.

DOJ Got All the Proud Boy Telegram Texts from Ethan Nordean’s Phone

Judge Tim Kelly just wrapped up a status hearing with three of the four Leadership Proud Boy conspiracy defendants: Ethan Nordean, Joe Biggs, and Charles Donohoe (Zach Rehl’s attorney is still arranging her appearance before the DC court).

A really important detail came out about the Telegram texts that have been central to the conspiracy case against the defendants: According to Nordean’s attorney Nick Smith, they call came from Nordean’s phone.

He said that, in part, to anticipate some of the challenges he’ll make to the evidence. First, he’s going to claim the search was illegal and move to suppress it based off a ruling that the government has dropped that theory of crime (that won’t work under Fourth Amendment precedents, but you have to try).

More importantly, he said the government had gotten into the phone — rather than be forced to crack it, as they are doing with everyone else’s phone — because Nordean’s wife gave the FBI the passcode.

It had seemed like someone listed as Unindicted Co-Conspirator 1 may have shared them with the government. That person says some pretty damning things in the chats.

39. On after Chairman’s January 4, 2021, shortly after Proud Boys Chairman’s arrest pursuant to a warrant issued by D.C. Superior Court, DONOHOE expressed concern that encrypted communications that involved Proud Boys Chairman would be compromised when law enforcement examined Proud Boys Chairmans’ phone. DONOHOE then created a new channel on the encrypted messaging application, entitled, “New MOSD,” and took steps to destroy or “nuke” the earlier channel. After its creation, the “New MOSD” channel included NORDEAN, BIGGS, REHL, DONOHOE, and a handful of additional members.

40. On January 4, 2021, at 7:15 p.m., DONOHOE posted a message on various encrypted messaging channels, including New MOSD, which read, “Hey have been instructed and listen to me real good! There is no planning of any sorts. I need to be put into whatever new thing is created. Everything is compromised and we can be looking at Gang charges.” DONOHOE then wrote, “Stop everything immediately” and then “This comes from the top.”

41. On January 4, 2021, at 8:20 p.m., an unindicted co-conspirator (“UCC-1”) posted to New MOSD channel: “We had originally planned on breaking the guys into teams. Let’s start divying them up and getting baofeng channels picked out.”

42. On January 5, 2021, at 1:23 p.m., a new encrypted messaging channel entitled “Boots on the Ground” was created for communications by Proud Boys members in Washington, D.C. In total, over sixty users participated in the Boots on the Ground channel, including NORDEAN, BIGGS, REHL, DONOHOE, and UCC-1.

That, in turn, had led to speculation, and in no way just from me, that UCC1 had already flipped on his buddies and was cooperating.

What was said today appears to be inconsistent with that. Indeed, it seems all the talk of four informants from the Proud Boys working with the FBI mostly pertained to helping Attorney General Billy Barr gin up claims against Antifa, and not (yet, at least) informing on each other.

Ethan Nordean’s Funny Idea of Exculpatory

In a filing overnight probably designed to feature in his appeal of his detention, Ethan Nordean accuses the government of sitting on exculpatory information.

Among the Telegram texts that Nordean posts is one showing that he remained in a leadership position — able to make a decision to ban Proud Boy rallies for three months — on January 21, over two weeks after the insurrection (the “owner” moniker may also suggest he ran the Proud Boy channel in question).

Another thing that Nordean thinks is exculpatory is another commenter claiming that “nothing could be further than the truth” than that the Proud Boys “led the Trump rally to the capitol.”

It’s a fair point from Captain Trump actually.

But that’s because the Proud Boys weren’t at the Trump rally. Instead, they were at the Capitol, with no excuse about coming to hear Trump.

Which makes Nordean’s citation to his own comment about Joe Biggs’ complaint pretty damning as well.

Biggs’ complaint, which was built entirely off public comments about Proud Boy planning, shows a picture of a large Proud Boys group already close to the Capitol by 12:15. It shows their use of radios (they would get details of the preplanned channel they used weeks later). It shows a group wearing pre-coordinated orange hats.

It also describes how Proud Boys started recruiting people to come to DC no later than December 29.

9. For example, on December 29, 2020, Tarrio posted a message on the social media site Parler1 about the demonstration planned for January 6, 2021. Among other things, Tarrio announced that the Proud Boys would “turn out in record numbers on Jan 6th but this time with a twist… We will not be wearing our traditional Black and Yellow. We will be incognito and we will be spread across downtown DC in smaller teams. And who knows….we might dress in all BLACK for the occasion.” I believe the statement about dressing in “all BLACK” is a reference to dressing like the group known as “Antifa,” who the Proud Boys have identified as an enemy of their movement and are often depicted in the media wearing all black to demonstrations.

10. On or around the same day, BIGGS posted a similar message to his followers on Parler in which he stated, among other things, “we will not be attending DC in colors. We will be blending in as one of you. You won’t see us. You’ll even think we are you . . .We are going to smell like you, move like you, and look like you. The only thing we’ll do that’s us is think like us! Jan 6th is gonna be epic.” I understand that BIGGS was directing these statements at “Antifa.”

11. Separately, BIGGS has described the Proud Boys’ efforts, in general, to plan for demonstrations and events attended by the Proud Boys. In an interview that was purportedly taped in December 2020 and posted online on or about January 3, 2021, BIGGS described how he, as an organizer of Proud Boys events, sets about planning them. BIGGS explained, in part:

When we set out to do an event, we go alright, what is or main objective? And that’s the first thing we discuss. We take three months to plan an event. And we go, what’s our main objective? And then we plan around that, to achieve that main objective, that goal that we want.

In other words, the complaint that Nordean complains (at a time when a number of people he interacted that day had already been arrested) shows pre-planning not to attend a Trump speech — which is what tens of thousands of people were planning on doing that day, but instead to not attend a Trump speech, and instead wait by the Capitol for key events to transpire.

In any case, Nordean explains one reason why these texts weren’t provided right away: because he asked just for five days of Telegram chats at first, not the later ones. These aren’t the texts that, Nordean believed, were going to be the most helpful.

On March 25, Nordean requested that the government produce, at least by March 30, Telegram chats on Nordean’s phone sent and received between 1/4/21 and 1/8/21. Nordean did not say that no other chats should be produced, nor did he waive any right to Brady material of which the government was aware. On March 9, Nordean served a discovery letter on the government seeking all of the defendant’s statements and requesting that Brady material be produced according to the schedule in Rule 5.1.

Another likely reason is that a protective order has not been signed in this case yet, as compared to a slew of other ones, meaning prosecutors are still going to focus on the evidence backing the indictment (and so the texts from before the insurrection, not after).

The charges already allege that Charles Donohoe encouraged everyone to write exculpatory things in their Telegram chats starting on January 5, in the wake of the Enrique Tarrio arrest. And here, Nordean managed to still provide evidence of a claim he has earlier contested: that he had a leadership role in this militia group.

In Adding Matthew Greene to a Conspiracy with Dominic Pezzola, DOJ Formally Alleges the Proud Boys Committed a Crime of Terrorism

At a detention hearing for Charles Donohoe yesterday, Magistrate Judge Michael Harvey asked a long series of questions, including what a “normie” is, what Telegram is (it is stunning that a DC Magistrate doesn’t know that, but that’s a testament they won’t accept US legal process), and whether “Milkshake,” who had been described saying a lot of really damning things in an organizational channel, was part of the conspiracy. AUSA Jason McCullough said that DOJ is still assessing Milkshake’s — whose real name is Daniel Lyons Scott — criminal liability, but since he was filmed fighting with some cops, I’d be arranging legal representation if I were him.

Along the way, however, the questions led McCullough to provide several new details on the Proud Boy conspiracy. One question he didn’t answer is whether the government knows that Donohoe succeeding in “nuking” some texts describing organizational efforts, as he described wanting to do after Enrique Tarrio got arrested.

McCullough also revealed something that was not yet public: the government had rounded up another Proud Boy, Matthew Greene, and indicted him in what I call the Proud Boy “Front Door” conspiracy along with Dominic Pezzola and William Pepe. In doing so, they did something more important for their larger case. First, they changed the purpose of the conspiracy from what it was originally charged to match all the other militia conspiracies (from busting through the first door to obstructing the vote count). Here’s what the militia conspiracies currently look like as a result:

It was probably fairly urgent for DOJ to do this (and Greene’s inclusion may have been just a convenient rationale). Here’s how the indictment changed from the original Indictment to the Superseding one (S1):

In general, the government is charging Pepe and now Greene with more than they originally charged Pepe with based on a theory that they abetted Pezzola’s alleged crimes. But the critical change is highlighted. Originally (marked in pink), just Pezzola was charged for breaking the window through which the initial breach of the Capitol happened. But in this indictment (marked in yellow), DOJ charges Pepe and Greene for abetting Pezzola in breaking that window.

The reason they did this is because 18 USC 1361 is the crime for which DOJ is arguing that all key Proud Boy defendants can be detained pre-trial, not just Pezzola, but also Joe Biggs, Ethan Nordean, Zach Rehl, and Charles Donohoe. In detention hearings, the government has argued that it counts not just as a crime of violence that allows the government to argue that a defendant is eligible for detention, but also that, because it was done to coerce the conduct of government, it triggers a terrorism designation for detention purposes.

This is how the argument looks in detention memos:

As it did before, the United States moves for detention pursuant to 18 U.S.C. § 3142(e)(3)(C), which provides a rebuttable presumption in favor of detention for an enumerated list of crimes, including Destruction of Property in violation of 18 U.S.C. § 1361. The United States also seeks detention pursuant to 18 U.S.C. § 3142(f)(1)(A), because Destruction of Property, in violation of 18 U.S.C. § 1361, is a crime of violence. Moreover, when Destruction of Property is “calculated to influence or affect the conduct of government by intimidation or coercion,” it also qualifies as a federal crime of terrorism. See 18 U.S.C. § 2332b(g)(5)(B).

This was an issue in the Monday detention hearing before Judge Tim Kelly for Biggs and Nordean. After the hearing, he required the government to submit a picture of Pezzola breaking that window.

And it will likely become an issue when Joe Biggs, at least, appeals his detention, as he noticed he would do yesterday (it would be a still bigger issue in Nordean or Donohoe’s case).

In fact, the government has been making this argument for some time.

But it wasn’t until this supserseding indictment that the government formally aligned Pezzola’s actions — including spectacularly breaking that first window with a riot shield — with the rest of the Proud Boy indictments, in fact making them (as the government has already argued) the same conspiracy, a conspiracy involving terrorism.

Christopher Quaglin: Illuminating the Gaps in the January 6 Panopticon

In this post, I suggested several of the people recently arrested on trespass charges were likely arrested as a way to facilitate evidence collection about other insurrectionists. Collecting their recordings of events may be necessary to fill certain gaps within the government’s own evidence of the attack.

The court filings for Christopher Quaglin shows the significance of two of those gaps. They show how the failure to outfit the Capitol Police with Body Worn Cameras means there’s lower quality evidence for assaults on them than on DC cops, who wear BWCs. The Quaglin filings also show the limits of the Facebook and Google GeoFence warrants that have gotten a lot of attention.

Capitol Police weren’t protected by Body Worn Cameras

Quaglin was originally arrested on probable cause of assault, resisting cops during a civil disorder, and obstruction of the vote count — not the two trespassing charges charged against almost all defendants.

He’s actually accused of two sets of assaults. First, starting at 1:36, he yelled at some DC Metropolitan Police Department officers guarding one of the barriers. Then, before 2:40, he allegedly started shoving Capitol Police officers guarding the Lower West Terrace. Later, filings against him allege, he sprayed officers from both agencies guarding the Lower West Terrace tunnel with pepper spray.

In other words, he was such a prolific brute, he allegedly assaulted both MPD and CP officers in at least two different places, both outside the building and inside the Tunnel on the Lower West Terrace.

The narrative of the first assaults in his arrest affidavit switches from sourcing to MPD Body Worn Cameras to what those initial filings call Capitol Police surveillance footage.

For some of the interactions, the FBI admits that the evidence is inconclusive (here, whether after Quaglin pushed an unidentified CP officer he or she fell down).

In a subsequent USCP surveillance footage, QUAGLIN walks through the crowd and approaches the USCP Officers located at the police line. QUAGLIN then begins to verbally engage a USCP Officer. QUAGLIN continues to get closer to the USCP Officer while appearing increasingly agitated and pointing his finger towards USCP Officer. QUAGLIN then proceeds to hold and push USCP Officer by the neck, which appeared to contribute to USCP Officer starting to fall. (Note: Due to obstructions in the view of this portion of the event, it is unclear to the affiant whether USCP Officer completed the fall). A still from this video is shown below with a red arrow above QUAGLIN.

In a filing last night, the government described what previously had been called CP “surveillance video” as, “a video of the crowd believed to taken by a USCP officer around 2:14 p.m.” The other “surveillance video” is similarly described as video believed to be taken by USCP officers. In other words, for interactions like this one — where Quaglin shoves a Capitol Police officer — the FBI can’t say whether the cop falls as a result, because the evidence comes from someone generally filming the crowd rather than a BWC on the assaulted officer’s person.

At other times, these filings rely on fairly distant MPD BWC footage of assaults on CP officers.

Then, around 2:34 p.m., as captured on BWC footage, an unidentified rioter pushes down a USCP officer. Another officer steps in front of the fallen officer. QUAGLIN can then be seen lunging forward and pushing that officer down. Multiple officers then drop their shields as they begin to retreat backwards. QUAGLIN and other unidentified individuals can then be seen picking up the shields and passing them backwards, as captured in the stills below with a red box around QUAGLIN.

Compare that with the clear image, from a BWC video worn by an MPD officer,  showing him at the front of the pack mobbing the tunnel.

And here’s the MPD BWC still from which the FBI IDed what Quaglin was spraying.

The BOLO image that an acquaintance of Quaglin cited as one of the things — but not the primary thing — that placed Quaglin at the insurrection also came from a BWC.

Among the weaknesses in Capitol security that General Russel Honoré’s Capitol Security Review described was that BWCs were not, on January 6, part of Capitol Police gear on the day of the attack.

We also recommend the USCP be equipped with Body-Worn Cameras (BWC), an item not currently in their inventory, to improve police accountability and protect officers from false accusations of misconduct. BWC also provide visual and audio evidence that can independently verify what happened in any given situation, leading to better investigations and prosecutions when needed.

The Quaglin filings show pretty clearly how much easier it is to reconstruct some attacks on MDP officers than CP officers because of the differential equipment (though for some reason, later interactions with MDP officers inside the tunnel are sourced to two videos sourced to YouTubes posted to the Internet).

The real risks of such gaps are made clear by the filings against the men alleged to have sprayed Brian Sicknick with bear (not pepper) spray that may have contributed to his death. As with Quaglin’s alleged assaults, the evidence consists of fairly direct BWC (in this case from a named officer standing next to Sicknick and the other officers affected).

But to see what happened to Sicknick himself, you have to refer to “surveillance” video that happened to pick up the after-effect of the attack.

It’s no wonder it took so long to identify what happened to Sicknick: the government had to rely on other video to understand what had happened to him. These and other filings make it clear that CPD’s lack of BWCs has created key gaps in the understanding of what happened on January 6.

The limits of the Facebook and Google GeoFence warrants

As noted above, one of two Quaglin tipsters learned of his presence at the Capitol via several means, including the BOLO based off a MDP BWC.

But that tipster — and another anonymous one who contacted the FBI even earlier — also pointed to some livestreaming that Quaglin did of his participation. In addition to videos taken from his hotel after the event, an anonymous tipster shared and the acquaintance confirmed viewing a video of Quaglin approaching the Capitol and chanting Proud Boy slogans.

Law enforcement received a tip from an anonymous source providing four “Live” videos recorded from a Facebook account with the vanity name “Chris Trump.” The videos did not list the URL of the Facebook account or the official user name. (A Facebook user can display a vanity name that is different than their official user name and a Facebook user can change their vanity name without changing the official user name.) Each video was a selfie-style video showing an individual identified by the anonymous tipster as “Christopher QUAGLIN, NJ. Extremist.” In one of the Live videos provided by the tipster, QUAGLIN, as shown in the still below, can be seen walking towards the Capitol in the same outfit that QUAGLIN is seen wearing in the footage described above and holding a gas mask. QUAGLIN states “Trump is speaking and everyone is walking there. And I am walking there [showing Capitol building to camera]. And I am ready [showing gas mask in hand]. We will see how it goes. Proud of your boy.”

[snip]

In addition, law enforcement interviewed a witness, Witness 1, who has known QUAGLIN for years, although Witness 1 had not seen him in person for several years. Witness 1 has followed and corresponded with QUAGLIN on social media for years. Witness 1 saw QUAGLIN’s Live videos on January 6, 2021 on his account with the vanity name “Chris Trump.” Witness 1 confirmed that the Live videos described above are some of the same videos Witness 1 saw on January 6, 2021 and that those videos all show QUAGLIN. Witness 1 also stated that he/she saw a photograph that the FBI had published seeking additional information from the public and that he recognized that individual as QUAGLIN. (The photograph, “Photograph 58 AFO” below, was taken from BWC footage described in paragraph 40 above.)2

Witness 1 noted that QUAGLIN used multiple accounts on Facebook and Instagram and was frequently been banned for inflammatory posts online. Witness 1 indicated that QUAGLIN frequently posted on his social media accounts about the 2020 Presidential election, about going to the Capitol on January 6, 2021, and pictures of firearms. Many of QUAGLIN’s posts were deleted on January 7, 2021. Witness 1 indicated that QUAGLIN posted multiple pictures of himself prior to the January 6, 2021 events where he was visible with a beard and consistent in appearance with the “Photograph 58-AFO.”

As I’ve described elsewhere, the government asked Facebook for information on everyone who livestreamed or uploaded video from the Capitol itself, and then they IDed the person who uploaded the video from the subscriber information.

The government received information as part of a search warrant return that Facebook UID 100047172724820 was livestreaming video in the Capitol during these events. The government also received subscriber information for Facebook UID 100047172724820 in response to legal process served on Facebook. Facebook UID 100047172724820 is registered to Chris Spencer (“SPENCER”). SPENCER provided subscriber information, including a date of birth; current city/state, and a phone number to Facebook to create the account. [my emphasis]

A recent arrest affidavit makes it clear that FBI obtained this warrant on January 11.

On January 11, 2021, a search warrant was served upon Facebook to identify Facebook accounts utilized to live stream video in a geographic area that included the interior of the United States Capitol building. One such account identified by Facebook was Facebook user ID 100009155779709, an account in the name of “Michael Joseph.”

But there’s good reason to believe that FBI obtained a preservation order on everything uploaded from the Capitol earlier than that, probably within a day.

As yesterday’s filing makes clear, Quaglin deleted his videos before the FBI could collect them directly from Facebook, even though they served warrants on his accounts to Facebook.

(Because the related social media account was deleted shortly afterwards, law enforcement was not able to determine the exact time this video was recorded, although it would have been presumably before he reached the line and was captured on the BWC in Exhibit A.)

More importantly, by description, he did no livestreaming from the Capitol (he was too busy fighting with cops). That’s the right choice from a civil liberties perspective; livestreaming from the Mall or a nearby hotel room is not proof a crime. But in this case, it likely permitted the destruction of evidence pertaining to how closely Quaglin coordinated his efforts — including sustained assaults on cops — with the Proud Boys.

The FBI got a ton of inculpatory evidence from a Facebook warrant. They even got the message on one social media account recording his deletion of the one he used to livestream that day.

A message sent on January 7, 2021 indicating that he had deleted his other account; and

But did not get those livestreams (or anything else he posted on that alternative account).

Likewise, a warrant to Google showed Quaglin in DC, but location data does not place him at the Capitol.

Google location data places the phone belonging to QUAGLIN in and around Washington, D.C. from January 5-7; specifically, at the Motto Hotel, at the Washington Monument, and at the United States Capitol. On January 5, 2021, QUAGLIN conducted multiple searches for “Motto by Hilton Washington DC City Center” and pulled up driving directions for two Chick-fil-A restaurants in Northeast Washington, D.C. On January 6, 2021 Quaglin conducted multiple Google Maps queries for areas near the National Mall in Washington, D.C.

There are many possible explanations for this: He never entered that far into the Capitol, so he may never have been included in the Google GeoFence at all. But given the mob of people inside that tunnel, it’s also likely that cell service (if Quaglin’s phone was on at all) was really overloaded.

That said, Quaglin’s Google searches do show that he was monitoring the news for references to himself.

QUAGLIN’s Google account history shows multiple Google searches indicating his involvement in the storming of the Capitol. For example, on January 8, 2021, it includes multiple searches for “guy gets bear sprayed at capital.” On January 20, 2021 QUAGLIN’s Google account history shows visits to a webpage titled, “Countries where you can buy citizenship, residency, or passport.” QUAGLIN’s Google account history shows eight visits to the FBI’s “seeking information” for Capitol violence between January 28, 2021 and January 31, 2021. Further, a review of QUAGLIN’s Gmail accounts show multiple purchase notifications from a Costco credit card in Washington, D.C. — specifically, multiple charges at the Motto Hotel on January 5, 2021, multiple charges at a Walgreens convenience store at 801 7th St NW, Washington, D.C. on January 6, 2021, and $128.80 spent at China Town Liquor in Washington, D.C. on January 7, 2021 – both businesses that are a short walking distance from the Motto Hotel.

There’s still a ton of evidence against Quaglin. But the video evidence of his multiple alleged assaults on cops are not terrifically clear (and thus far, they haven’t been IDed by name as some of the other officers assaulted have been). And the government has thus far barely mentioned Quaglin’s association with the Proud Boys, even though Ethan Nordean has pointed to his filing to suggest his attempts to hold off Quaglin’s assaults prove he wasn’t a leader of this riot. Nordean disclaims knowing Quaglin.

The January 6 insurrection was one of the most filmed events in history. It was tracked in damning detail across a range of social media platforms.

But even with a notably dressed, prolific user of social media like Quaglin there are gaps in that panopticon.

Politico Claims It Embarrasses Joe Biden that Non-Violent Civil Disobedience Merits Little or No Jail Time

Last week, Politico reported as news that non-violent January 6 trespassers might get little to no jail time which — it further claimed — might embarrass the Biden Administration.

Many Capitol rioters unlikely to serve jail time

The cases could embarrass the Biden administration, which has portrayed the Jan. 6 siege as a dire threat to democracy.

I have tremendous respect for the reporters involved, Josh Gerstein and Kyle Cheney. Yet the fact that experienced DOJ beat reporters could claim, as news, that non-violent civil disobedience might get no jail time made me really rethink the reporting on January 6, including my own. It’s crazier still that reporters might claim — generally, or in this situation — that a Democratic President might be embarrassed by DOJ treating civil disobedience as a misdemeanor offense.

In fact, Gerstein and Cheney are reporting on a subset of all the January 6 defendants, fewer than 60 of the 230 who had been formally charged by the time they wrote this, which they nevertheless describe as “many” of them.

A POLITICO analysis of the Capitol riot-related cases shows that almost a quarter of the more than 230 defendants formally and publicly charged so far face only misdemeanors. Dozens of those arrested are awaiting formal charges, even as new cases are being unsealed nearly every day.

Then, four paragraphs later, Politico explains why (they say) this might embarrass the Biden Administration: because both Biden himself and Merrick Garland called the larger event — in which 1,000 people, including 200 for assault and 100 for roles in a militia conspiracy, many still at large, must now be suspects — as a heinous attack.

The prospect of dozens of Jan. 6 rioters cutting deals for minor sentences could be hard to explain for the Biden administration, which has characterized the Capitol Hill mob as a uniquely dangerous threat. Before assuming office, Biden said the rioters’ attempt to overturn the election results by force “borders on sedition”; Attorney General Merrick Garland has called the prosecutions his top early priority, describing the storming of Congress as “a heinous attack that sought to disrupt a cornerstone of our democracy, the peaceful transfer of power to a newly elected government.”

Nowhere in the article do they provide any evidence that the assault on the Capitol wasn’t a heinous attack.

They base their claim that Biden might be embarrassed on expectations that DOJ prosecutors set, without noting that the first charges were filed before Biden was inaugurated and long before Garland was confirmed.

Justice Department prosecutors sent expectations sky-high in early statements and court filings, describing elaborate plots to murder lawmakers — descriptions prosecutors have tempered as new details emerged.

Jacob “QAnon Shaman” Chansley was arrested on January 8 and indicted on January 11. Eric “Zip Tie Guy” Munchel was arrested on January 10 and indicted, with his mother, on February 12. Thomas Caldwell was arrested on January 19 and indicted along with Oath Keepers Jessica Watkins and Donovan Crowl on January 27. They (including Caldwell but not Watkins and Crowl) are the main defendants, of more than 350, about whom prosecutors can fairly be said to have tempered “sky-high” expectations. Their arrests and that expectation-setting happened under Jeffrey Rosen and Michael Sherwin, not under Biden and definitely not under Merrick Garland (under whom DOJ referred Sherwin to OPR for investigation after he did some expectation-setting on 60 Minutes). Even still, for all four (as well as other edge cases about whom the press set high expectations, like Riley June Williams), the investigation remains ongoing and there are reasons, including ties to the militia conspiracies, to believe there was some basis for the original suspicions about these people.

Likewise, the decision to arrest first and investigate later, a decision that led to the flood of arrests before prosecutors really knew who had done the most egregious things during the attack, also occurred under the prior Administration.

Indeed, under Garland (though not necessarily because of Garland or the departure of Sherwin), DOJ seems to have focused more of their ongoing misdemeanor arrests on suspects who might have video footage of interest to prosecutors or defense attorneys, with far more of a focus in recent weeks on arresting assault and militia suspects. And one of the reasons for the delays described in the story is that after Garland came in, DOJ asked for 60 days to catch up on discovery. We may yet learn that he and his subordinates decided to change the “arrest first, investigate later” approach adopted before he came in.

Sure, the press has claimed that the government has backed off some of its claims in the militia conspiracies. They did so, for example, when prosecutors backed off certain claims solely for the purpose of an Ethan Nordean detention hearing that, filings submitted weeks later suggested, may have been an effort to protect a pending conspiracy indictment and, probably, a cooperating witness. They’ve done so with the Oath Keepers, even though recent developments suggest even Jessica Watkins’ lawyer may now understand her role in what appears to be a larger conspiracy coordinated in Signal leadership chats is more damning than Watkins originally claimed. If anything, the Oath Keeper and Proud Boy conspiracies may be more sophisticated tactically than originally claimed, and that’s before any explanation about things like who paid for vans of Proud Boys to travel from FL and what happened at twin events in DC and Florida in December, in which conspirators (and key Trump figures) played central roles. That’s also while the person who laid a pipe bomb the night before the the attack remains at large.

To further back its claim that Biden might be embarrassed, Politico implies that all the plea deals expected in weeks ahead will be misdemeanor pleas without jail time, which will be “awkward” for DOJ to defend.

Prosecutors have signaled that plea offers for some defendants will be coming within days and have readily acknowledged that some of the cases are less complicated to resolve than others.

“I think we can work out a non-trial disposition in this case,” Assistant U.S. Attorney Emory Cole told Judge Dabney Friedrich last week in the case of Kevin Loftus, who was charged with unlawful presence and disrupting official business at the Capitol, among other offenses that have become the boilerplate set lodged against anyone who walked into the building that day without authorization.

The Justice Department will soon be in the awkward position of having to defend such deals, even as trials and lengthy sentences for those facing more serious charges could be a year or more away. [my emphasis]

Politico makes this claim even though at least some of the expected pleas may be cooperation agreements. For example, Ryan Samsel — who breached the west side of the Capitol in coordination with Proud Boys Dominic Pezzola and William Pepe, knocking out a cop along the way — asked for a continuance to discuss a plea. One of the main Oath Keeper prosecutors, Ahmed Baset, asked for a continuance before indicting Oath Keeper associate Jon Schaffer, who was among the worst treated defendants and who agreed to the continuance in spite of remaining in pre-trial detention. Kash Kelly, currently charged with trespassing but also someone raised in discussions between Proud Boys affiliate James Sullivan and Rudy Giuliani, got a continuance to discuss a plea. Bryan Betancur, a Proud Boy who got jailed for a probation violation after he lied to his probation officer to attend the event, also got a continuance to discuss a plea to resolve his trespassing charges. The aforementioned Riley Williams, who was charged with obstructing the vote count and stealing a laptop from Nancy Pelosi, was filmed directing movement inside the Capitol, and has ties with Nick Fuentes, also got a continuance to discuss pleading before indictment. All five of these people likely have information that would be of use to prosecutors. All could limit their prison time (which would likely be significant for Samsel, who is accused of assault, played a key role in the insurrection, and has a criminal record) by cooperating with prosecutors. If any of these people sign plea deals — especially Samsel — it will likely provide new insight into how the conspiracy worked. Even with a plea deal, Samsel may still face a stiff sentence.

In other places, Politico conflates the discussions about the fate of misdemeanor defendants with discussions about detention (which prosecutors have only requested with a few accused trespassers), discussions about discovery, and Speedy Trial, all different things, many more urgent issues for misdemeanor defendants not included among those the story is purportedly about.

After I went on a rant about this story on Twitter, Gerstein defended the story by saying that people (none of whom were quoted in the story) seem to be surprised.

I agree with Gerstein that people have certain expectations. But that was clear before the end end of January. The record laid out here shows that such expectations did not come from Garland or Biden. Even Sherwin, with his totally inappropriate 60 Minutes interview, also explained from the start that DOJ was arresting the low hanging fruit at first while further investigating more serious suspects.

The fault, instead, lies with journalists, myself and these Politico journalists included, for not consistently and repeatedly explaining the various different roles people played on January 6, including that there were a number — though currently a shrinking fraction of the total set of defendants — who neither pre-meditated any effort to stop the vote count nor assaulted cops. I have tried to engage in this nuance (I included a list of such posts below), but given the sheer amount of court filings, much of the focus is currently on the militia conspiracies, suggesting a gravity that the MAGA tourists don’t merit. But in this article, rather than simply laying out the full range of defendants, describing how the MAGA Tourists played a key role in the success of the more serious conspirators (explicitly so for the Proud Boys, who talked about getting “normies” to do stuff they otherwise wouldn’t have done), describing how violence spread among participants and often as not among people who aren’t militia members, this Politico piece further distorts the record, not least by using this subset of “MAGA Tourists” — calling them “many” even though they represent just a quarter of defendants who have been formally charged — to stand in for the larger investigation, while minimizing the import of those charged with obstruction (likening that role to a CodePink interruption of a congressional hearing) because, evidence shows, they premeditated an attempt to undermine the election outcome.

So even while the piece describes how both judges and prosecutors understand that the mob as a whole posed a grave threat while some individual defendants did no more than provide cover for the more dangerous defendants (and many of the DC judges presiding over these cases have made such comments), Politico claims that there’s some embarrassment to this, including some kind of political risk for Biden.

Judges are also attempting to reckon with separating the individual actions of rioters from the collective threat of the mob, which they have noted helped inspire and provide cover for violent assaults, property destruction and increased the overall terror and danger of the assorted crimes committed.

That reckoning is coming sooner rather than later, lawyers say, putting prosecutors in the position of wrist-slapping many participants in the riot despite framing the crimes as part of an insurrection that presented a grave threat to American democracy.

If the MAGA tourists provided cover and helped overwhelm cops, thereby serving a useful role in the plans of those who had a more nefarious and organized purpose, then that’s the story that should be told, not some kind of both-sides political spin, particularly one that pits Biden’s claims about the seriousness of this on the footing as Trump’s outright lies about it. In spite of the overwhelming number of defendants, the record shows, DOJ is still assessing each one on the merits, which is what should happen. Declaring that politically embarrassing is an abdication of fair reporting on the legal system.

I believe DOJ has gotten it wrong, in both directions, in some cases. In addition to those listed above, I think DOJ has gone too harshly on some people who have openly supported far right, even Nazi views. But I also think DOJ has only considered whether militia members were members of premeditated conspiracies, focusing less on localized activist networks that have been implicated in violent (often anti-mask) pro-Trump actions in the past, taken on leadership roles at the riot, and engaged in ongoing communications about plans to shut down the vote, just like militias did. I think DOJ hasn’t come to grips with the organizational import of QAnon even while arguing that individual adherents of the cult must be jailed because they are delusional. And until DOJ decides how it will treat Trump’s actions and those of some close associates — something they likely cannot do without more investigation and cooperation deals from key participants — parts of this investigation will remain unsettled.

There are definitely things DOJ has reason to be embarrassed about: Gerstein has written more than any journalist about the unforgivable delays in moving defendants around the country and getting them arraigned. This piece also focuses on one of the handful of misdemeanor defendants who has been detained since being charged. While I understand the complexity of an investigation in which so much of the evidence — both exculpatory and inculpatory — remains in the hands of participants, defendants have a right to complain about the delay, especially those in detention. Defendants — particularly those in detention — are entitled to a Speedy Trial, even if DOJ moved too quickly to arrest them. While many of these things were exacerbated by COVID, they also largely arise from a decision to arrest first on those trespassing charges, and investigate later (which also has led to more defendants being charged with obstruction after the fact).

But none of those things have to do with Biden or Garland’s views about the investigation, or even the prosecutors who made decisions that created some of these problems in the first place (in part, probably, to avoid their own embarrassment at missing all warning signs, in part because they hadn’t investigated these threats aggressively enough and so had to make mass arrests to mitigate any immediate follow-on threats).

In short, this piece is an (uncharacteristic) mess, shoehorning complexity into a simplistic claim of political conflict, one inventing embarrassment out of thin air for Biden. If Politico has evidence that this wasn’t an unprecedented disruption to Congress, one that could have had a far worse outcome, including a threat to our democracy, or that this right wing violence is less of a threat than FBI says it is, by all means they should present that. At the same time, they can reveal the identity of the pipe bomber and the role (if any) that person played in the plot, without which no one can claim to actually know how serious this was.

Until then, they and all experienced DOJ beat reporters would be far better off by simply laying out a description of the different kinds of defendants we’re seeing, the different roles they played in disrupting the vote count and assaulting or undermining law enforcement, and explaining how those defendants are the same or different from defendants that have gone before them, on a spectrum of severity that stretches from CodePink to ISIS terrorists.

If people are going to be surprised when the subset of participants in January 6 who engaged in non-violent civil disobedience are treated as misdemeanor offenders, it’s not Joe Biden’s fault. It is a failure of journalism, my own included, for not making that more clear starting in January and reiterating it since then.

Update: Meanwhile, Jon Schaffer just agreed to two more weeks in jail.

Update: Corrected Munchel’s arrest date, which was January 10.

Update: Christopher Kelly (no relation to Kash) is another person with a consent continuance to discuss what would almost certainly be a cooperation agreement. He drove to and from the insurrection with some Proud Boys.


Posts attempting to contextualize the investigation

Here are some past attempts I’ve made at explaining how the parts of the January 6 investigation fit together:

Were Proud Boys Using Livestream for Command and Control … and Other Operational Questions

Mapping out both the four charged conspiracy indictments against the Proud Boys as well as some — not all — of those with links to the groups who have not been included in the conspiracy indictments, has raised specific questions for me about how the Proud Boys operated that day and how they’re being prosecuted.

Were the Proud Boys using livestreams for command and control?

I’ve had this question more generally: whether someone offsite from the Capitol was providing Command and Control guidance for the assault on the Capitol. But the new “Leadership conspiracy” indictment against Ethan Nordean and Joe Biggs mentions that Gabriel Garcia — along with Joshua Pruitt — were among those who charged on the Capitol in the first wave, along with Dominic Pezzola.

That, by itself, makes me wonder if DOJ is going to expand that “Front Door” conspiracy to include Garcia and Pruitt.

But the content of Garcia’s charging document raises more questions for me.

Garcia is a former Army Captain, so one of the higher ranking former veterans among the Proud Boy defendants. He may have been IDed by what we now know was a request that Facebook provide the IDs associated with all the livestream video uploaded during the insurrection from inside the Capitol (indeed, it was Garcia’s complaint that first led me to suspect the FBI had used one).

Based on information provided by Facebook, Facebook User ID (“UID”) 100000183142825 has a Facebook account under the name “GABRIEL GARCIA.” GARCIA uploaded to his Facebook account at least two “Facebook live” videos taken inside of the Capitol building on January 6, 2021. Additionally, GARCIA uploaded at least one video before entering the Capitol building.

[snip]

In the video, GARCIA is walking east on Constitution Avenue towards the Capitol building with a large group of people. 2

Approximately 20 minutes later, at 19:19:08 UTC, or 02:19pm, GARCIA uploaded to Facebook a video filmed from inside the Capitol building:

If you were following Garcia’s livestreams in real time — even from a remote location — you would have visibility on what was going on inside almost immediately after the first group of the Proud Boys breached the Capitol.

In a later livestream, Garcia narrated what happened in the minutes after the Proud Boys had breached the Capitol.

GARCIA states, “We just went ahead and stormed the Capitol. It’s about to get ugly.” Around him, a large crowd chants, “Our house!”

Then, as a standoff with some cops ensued, Garcia filmed himself describing, tactically, what was happening, and also making suggestions to escalate violence that were heeded by those around him.

At minute 1:34, a man tries to run through the line of USCP officers. The officers respond with force, which prompts GARCIA to shout, “You fucking traitors! You fucking traitors! Fuck you!” As the USCP officers try to maintain positive control of the man that just rushed the police line, GARCIA yells, “grab him!” seemingly instructing the individuals around him to retrieve the man from USCP officers. GARCIA is holding a large American flag, which he drops into the skirmish in an apparent attempt to assist the individuals who are struggling with the USCP officers.

USCP officers maintain control of the line, holding out their arms to keep the crowd from advancing. At least one USCP officer deploys an asp. GARCIA turns the camera on himself and offers tactical observations regarding the standoff. [my emphasis]

Garcia’s livestream was such that you would obtain crowd size estimates from it, as well as specific names of officers on the front line, as well as instructions to “keep ’em coming,” seemingly asking for more bodies for this confrontation.

At minute 3:26, GARCIA, who is still in extremely close proximity to the USCP officer line again yells, “Fucking traitors!” He then joins the crowd chanting “Our house!” At minute 3:38, GARCIA states, “You ain’t stopping a million of us.” He then turns the camera to the crowd behind him and says, “Keep ‘em coming. Keep ‘em coming. Storm this shit.” GARCIA chants with the crowd, “USA!”

Soon after, GARCIA stops chanting and begins speaking off camera with someone near him. At minute 4:28, GARCIA says, “do you want water?” Though unclear, GARCIA seems to be asking the person with whom he is speaking. GARCIA is so close to an officer that, as the camera shifts, the only images captured are those of the officer’s chest and badge. [my emphasis]

Remarkably, Garcia filmed himself successfully ordering the rioters to hold the line — which they do — and then filmed them charging the police.

GARCIA yells, “Back up! Hold the line!” Shortly thereafter, the crowd begins advancing, breaching the USCP officer line. GARCIA says, “Stop pushing.” The last moments captured in the video are of the crowd rushing the USCP officers.

In the arrest affidavit for the Kansas City Proud Boys, a footnote describes how Nicholas Ochs and Nicholas DeCarlo were similarly filming what was going on as the Kansas City Proud Boys successfully thwarted police efforts to shut down access to the tunnels.

Proud Boys Nicholas Ochs and Nicholas DeCarlo can be seen in the background recording the unlawful conduct with their phones and other devices.

While their arrest documents don’t show the two livestreaming on Facebook (and Ochs would later complain about the connectivity inside the Capitol), if they were livestreaming somewhere, it would mean live video of tactically important moments from the siege would have been available to someone outside the Capitol or even someone watching more remotely, from a hotel room or even Florida.

Certainly, Garcia’s stream would be operationally useful if someone were providing command and control remotely. Was someone?

Does DOJ now have a list of all the teams from the Telegram channels?

The latest detention motions for Ethan Nordean and Joe Biggs (as well as the Leadership Conspiracy indictment) describe the process of divvying up the Proud Boys in attendance into teams, which process involves an unindicted co-conspirator who presumably is cooperating.

January 4, 8:20 PM, unindicted co-conspirator: “We had originally planned on breaking the guys into teams. Let’s start divying them up and getting baofeng channels picked out.”

January 5, 9:30 to 9:32 AM, Biggs: “What are the teams. I keep hearing team [sic] are picked already.” A few minutes later, [Biggs] stated “Who are we going to be with. I have guys with me in other chats saying teams are being put together.”

January 5, 9:17 to 9:20 PM, Biggs: “We just had a meeting woth [sic] a lot of guys. Info should be coming out” … “I was able to rally everyone here together who came where I said” … “We have a plan. I’m with [Nordean]. [my emphasis]

The replication of these Telegram chats, from two different channels, stops at 10AM on January 6 (they presumably continued after that time, but we know that Nordean’s phone was turned off during the day).

That suggests DOJ is likely to know what the various teams were and who led them. There were 60 people on the participants’ Telegram channel from that day, which means they may have a lot more teams to indict.

Who paid for the vans from Florida to DC?

The detention memo for Christopher Worrell, a Proud Boy who sprayed law enforcement with pepper spray, reveals that he and his girlfriend traveled to DC on vans paid for by someone else and stayed in hotels also paid for by someone else.

According to Worrell’s live-in girlfriend, who was interviewed by law enforcement on March 12, 2021, she and Worrell traveled to Washington D.C. in the days leading up to January 6, 2021, with other Proud Boys in vans paid for by another individual. Their hotel rooms were also paid for by another individual.

Particularly given that these vans were from Florida — where Tarrio, Biggs, and the key figures from the Oath Keepers all hung out (and hung out with Roger Stone) — the person that paid for these things may be on the hook for any conspiracy ultimately charged as a whole.

What kind of cooperation will DOJ get from the Front Door co-conspirators?

As of right now, just Dominic Pezzola and William Pepe are charged in what I call the “Front Door” conspiracy — the group of people who first breached the Capitol on the west side of the building. As noted above, DOJ itself identified Garcia and Pruitt to have some tie to this group (which makes me wonder if an expanded conspiracy obtained Friday will be released before I’m done with this post!).

But DOJ has not included Robert Gieswein or Ryan Samsel, who were also part of this initial assault. Neither is described as a Proud Boy in their charging documents, but both were with the Proud Boys before the operation. Both men are also on the hook for fairly serious assault charges (a cop that Samsel pushed over got a concussion and Gieswein brought a bat he used). Samsel has not been indicted and the joint request for a continuance (filed way back on February 17) explaining why explicitly states the two sides are seeking a “resolution,” (that is, a plea deal).

The government and counsel for the defendant have conferred, and are continuing to communicate in an effort to resolve this matter.

As to Gieswein, he has been indicted. But his docket has none of the proceedings that cases moving towards trial would have, such as a motion for a protective order (though given the delays on PACER postings that doesn’t definitely mean anything). And well after his magistrate docket in Colorado was closed, he submitted several sealed filings to it.

If I were someone that the government had dead to rights with not just brutal assault, but assault that was tactically important to the success of the entire operation, particularly if I had a criminal record that would add to prison time at sentencing (as Samsel does), I would sure want to help prosecutors assign some responsibility for those assaults to those who guided my actions on that day. Thus far, assault is not included in any of the conspiracy indictments (it is individually charged against Pezzola and a threatened assault was charged against William Chrestman), but if it were, it would raise the stakes of them significantly.

I’m also interested in the case of Chris Kelly. He’s not a Proud Boy. But in advance of his trip, he made it public that he was traveling to DC from NY with some members of the Proud Boys.

I’ll be with ex NYPD and some proud boys. This will be the most historic event of my life.

Kelly also made it clear the NYPD officer was his brother.

The Kelly Facebook Account also shows on January 2, 2021 KELLY messaged another user and stated, “Me and [NAME] plus a couple of others are headed down the 5th and staying 2 nights. Ill be frequency 462.662 on a ham radio if cell service goes down.” Public records databases also revealed Christopher M Kelly has a brother (“S1”) of New City, New York with the same first name used in the above statement. New York City Police Department records confirm S1 is a retired police officer. Based on this statement, and the statement above about traveling with “ex NYPD and some proud boys” your affiant believes that this comment indicated that KELLY planned to travel to Washington, D.C. with S1.

We still don’t know who a cooperating witness against Pezzola and Pepe is, who described to the FBI, almost immediately, a conversation promising that the Proud Boys would have killed Mike Pence had they found him that day. Pezzola had suspected that it was the guy who first recruited him into the Proud Boys and further speculated the conversation reported by the witness occurred on the trip home (which would help to explain how Pepe, also from NY, got included in conspiracy charges with Pezzola). That is, Pezzola believed that the cooperating witness must have been in a car with him from DC to NY.

But the government revealed that they are not prosecuting this cooperating witness.

The defendant speculates that W-1 is a “cooperating witness” with deeper ties to the Proud Boys than the defendant. The defense is incorrect. W-1 has not been charged with a crime in connection with the events of January 6, 2021, and the government is unaware of any affiliation between W-1 and the Proud Boys or any indication that W-1 knew the defendant prior to January 5, 2021.

Kelly can’t be that witness. He had already been charged at the time. But unless I missed his arrest, Kelly’s brother might be. And if his brother were cooperating (which would require honest testimony about what brother Chris had done), then it would raise the chances that Chris Kelly would be too. And why not? If I had traveled to DC with the people who initiated the entire insurrection, I’d want to make damned clear that I wasn’t part of that. Like Samsel, Kelly has not been indicted (publicly) yet.

For some time, the government had been saying they weren’t prepared to make plea deals yet. The inclusion of Co-Conspirator 1 in the Leadership indictment strongly suggests that’s done. And if Samsel and the government were discussing a plea over a month ago, you can be sure he has already proffered testimony to the government.

So the government likely has some cooperators in the “Front Door” conspiracy. The question is only, how much?