Posts

Journalists May Be Most at Risk (as Described) from a Presumed January 6 GeoFence Warrant

On February 22, the Intercept had a thinly sourced story reporting (heavily relying on one “recently retired senior FBI official” whose motive and access weren’t explained and one other even less-defined source) on methods used in the January 6 investigation. It started by describing something unsurprising (some of which had been previously reported): that the FBI was using emergency legal authorities to conduct an investigation in the wake of an insurrection.

Using special emergency powers and other measures, the FBI has collected reams of private cellphone data and communications that go beyond the videos that rioters shared widely on social media, according to two sources with knowledge of the collection effort.

In the hours and days after the Capitol riot, the FBI relied in some cases on emergency orders that do not require court authorization in order to quickly secure actual communications from people who were identified at the crime scene. Investigators have also relied on data “dumps” from cellphone towers in the area to provide a map of who was there, allowing them to trace call records — but not content — from the phones.

From there, the story made conclusions that were not borne out by the evidence presented (which is not to say that such conclusions won’t one day be supported).

In particular, the story suggested that these investigative methods were used to investigate Congress, and likewise suggested that the involvement of Public Integrity prosecutors must mean members of Congress are already the focus of the investigation and further suggesting that the location data collection tied to the investigation of members of Congress.

The cellphone data includes many records from the members of Congress and staff members who were at the Capitol that day to certify President Joe Biden’s election victory.

[snip]

The Justice Department has publicly said that its task force includes senior public corruption officials. That involvement “indicates a focus on public officials, i.e. Capitol Police and members of Congress,” the retired FBI official said.

To make the insinuation, the story misstates the intent of a Sheldon Whitehouse statement aiming to use Congressional authorities to remove coup sympathizers from committees of jurisdiction (and ignores Whitehouse’s earlier statement that calls for the kind of data collection described in the story).

On January 11, Sen. Sheldon Whitehouse, D-R.I., released a statement warning against the Justice Department getting involved in the investigation of the attack, at least regarding members of Congress, asserting that the Senate should oversee the matter.

Thus far, the story seems tailor-made to get Congress — the Republican members of which are already trying to sabotage the investigation — to start tampering with it.

Far down in the story, it also describes the orders used with more specificity — but not yet enough specificity to substantiate the claims made earlier in it.

Federal authorities have used the emergency orders in combination with signed court orders under the so-called pen/trap exception to the Stored Communications Act to try to determine who was present at the time that the Capitol was breached, the source said. In some cases, the Justice Department has used these and other “hybrid” court orders to collect actual content from cellphones, like text messages and other communications, in building cases against the rioters.

At the time I suggested the story’s conclusions went well beyond the evidence included in it. I had several concerns about the story.

First, it didn’t address the granularity of location data collected, explaining whether the data collection focused just on the Capitol building or (as the story claimed) “in the area” generally. The Capitol is, according to multiple experts, incredibly wired up, meaning that one can obtain a great deal of data specific to the Capitol building itself. That matters here, because as soon as Trump insurrectionists entered the Capitol building, they committed the trespass crimes charged against virtually all the defendants. And the people legally in the Capitol that day were largely victims and/or law enforcement. It’s not an exaggeration to say that anyone collected off location collection narrowly targeted to the Capitol building itself is either a criminal, a witness, or a victim (and often some mix of the three).

If location collection was focused on the Capitol building itself (we don’t know whether it was or not, and the reports of collection aiming to the find the person who left pipe-bombs in the neighborhood on January 5 do pose real cause for concern), it mitigates some of the concerns normally raised by the use of IMSI-catchers at public events and protests, which is that such location collection would include a large number of people who were just engaging in protected speech, as many of the people outside the Capitol were. Similarly, unlike with most geofence warrants or tower dumps, which are used to find possible leads for a crime, here, FBI had an overwhelming list of suspects from its mass of tips and video evidence already: it wasn’t relying on location data to find suspects. Plus, with normal geofence warrants and tower dumps, the vast majority of the data obtained comes from uninvolved people, posing a risk that those unrelated people could become false positives who, as a result, would get investigated closely. Here, again, anyone collected from location data inside the Capitol was by definition associated with the crime, either as witness, victim, or perpetrator.

Finally, the story not only didn’t rely on, but showed little familiarity with the hundreds of arrest affidavits released so far, which provide some explanation (albeit undoubtedly parallel constructed) for how the FBI built cases against those hundreds of people.

Well before The Intercept article was written, there were a few interesting techniques revealed in the affidavits. Perhaps the most interesting (and not specifically covered in The Intercept article, unless as a hybrid order) described identifying Christopher Spencer from the livestreams on Facebook he posted from inside the Capitol.

The government received information as part of a search warrant return that Facebook UID 100047172724820 was livestreaming video in the Capitol during these events. The government also received subscriber information for Facebook UID 100047172724820 in response to legal process served on Facebook. Facebook UID 100047172724820 is registered to Chris Spencer (“SPENCER”). SPENCER provided subscriber information, including a date of birth; current city/state, and a phone number to Facebook to create the account.

[snip]

The government received three livestream videos from SPENCER’s Facebook UID 100047172724820 as part of a search warrant return. At different times during the videos, Spencer either used the rear facing camera to show himself talking, or turned the phone toward his face. Your affiant would note that the camera is capturing a reversed image of SPENCER in two of these sections of video as evidenced by the text on SPENCER’s hat. As such, reversed images are also provided below the original screenshot [my emphasis]

The first mention of the Facebook return appears before a paragraph describing an associate of Spencer’s who had seen the videos and recognized his wife, and the later paragraph describes the associate sharing a phone number for Spencer that the FBI seemed to have already received from Facebook. As written (and this structure is matched in the affidavit for Spencer’s wife, Jenny) the narrative may indicate that the FBI obtained the Facebook return before the tip and identified Spencer from the Facebook return even before receiving the tip. This is one of the strongest pieces of evidence that the FBI used data obtained from location-based collection in the Capitol from any social media source to identify an unknown subject. But, as described, it also has some protections built in. The data was obtained with a warrant, not PRTT or d-order. That means the FBI would have had to show probable cause to obtain the content (but, for the reasons I explained above, most people in the Capitol live-streaming were committing a crime). There’s also no indication here that this video was privately posted (though with a warrant the FBI would be able to obtain such videos).

All this is a read of what this paragraph might suggest about data collection. It doesn’t describe whether the data was obtained via a particularized warrant (targeting just Spencer), or whether the FBI asked Facebook to provide all live-streaming posted from within the Capitol during the insurrection (there are other early affidavits that targeted the content of Facebook via individualized warrants). In Spencer’s case, I suspect it’s the latter (there’s nothing that remarkable about Spencer’s video, except he was outside Speaker Pelosi’s office). Even so, for most people, posting from inside the Capitol during the insurrection would amount to probable cause the person was trespassing.

Even before The Intercept piece was posted I had also pointed to the affidavit for the Kansas cell of the Proud Boys. It uses location data to place one after another of the suspects “in or around” the Capitol during the insurrection: cell site data showed that the phones of Christopher Kuehne, Louis Colon, Felicia Konold were “in or around” the Capitol during the insurrection. That of Cory Konold, Felicia’s brother, was not shown to be, but,

Lawfully-obtained cell site records indicated that the FELICIA KONOLD cell called a number associated with CORY KONOLD while in or around the Capitol on January 6, 2021.

The most interesting detail in that affidavit pertained to William Chrestman. His phone wasn’t IDed off a cell site. Rather, it was IDed by connecting to Google services “in or around” the Capitol.

According to records produced by CHRESTMAN’s wireless cell phone provider in response to legal process, CHRESTMAN is listed as the owner of a cell phone number (“CHRESTMAN cell”). Lawfully-obtained Google records show that a Google account associated with the CHRESTMAN cell number was connected to Google services and was present in or around the U.S. Capitol on January 6, 2021.

A more recent document — the complaint against the southern Oath Keepers obtained on February 11 but unsealed long after that — describes the phones of those suspects in an area “includ[ing]” (but not necessarily limited to) the interior of the Capitol.

having utilized a cell site consistent with providing service to the geographic area that includes the interior of the United States Capitol building.

Unlike Spencer, the use of location data in the Proud Boys and Oath Keeper complaints seems to be used to establish probable cause. In both the militia group cases, the individuals appear to have been identified via different means (unsurprisingly, given their flamboyantly coordinated actions), with the location data being used in the affidavit to flesh out probable cause. (Undoubtedly, the FBI exploited this information far more thoroughly in an effort to map out other co-conspirators, but it is equally without doubt that the FBI had adequate probable cause to do so.)

The other day, DOJ unsealed an affidavit — that of Jeremy Groseclose — that provides more detail about the location collection at the Capitol. The FBI describes identifying Groseclose off of two tips, both on January 7, from people who had seen him post about being in the Capitol on Facebook (and in one case, remove his Facebook posts after he posted them).

Groseclose wore a gas mask for much of the time he was inside the Capitol (though wore the same clothes as he had outside), which undoubtedly made it more difficult to prove he was the person illegally inside the Capitol preventing cops from ousting the rioters.

The FBI affidavit describes times when Groseclose appears on security footage from inside the Capitol without the gas mask, but doesn’t include it. To substantiate his presence in the Capitol, the FBI included three paragraphs describing what must be a Google geofence warrant showing the device identifiers for everyone within a certain geographic area.

According to records obtained through a search warrant served on Google, a mobile device associated with [my redaction]@gmail.com was present at the U.S. Capitol on January 6, 2021. Google estimates device location using sources including GPS data and information about nearby Wi-Fi access points and Bluetooth beacons. This location data varies in its accuracy, depending on the source(s) of the data. As a result, Google assigns a “maps display radius” for each location data point. Thus, where Google estimates that its location data is accurate to within 10 meters, Google assigns a “maps display radius” of 10 meters to the location data point. Finally, Google reports that its “maps display radius” reflects the actual location of the covered device approximately 68% of the time. In this case, Google location data shows that a device associated with [my redaction]@gmail.com was within the U.S. Capitol at coordinates associated with the center of the Capitol Building, which I know includes the Rotunda, at 2:56 p.m. Google records show that the “maps display radius” for this location data was 34 meters.

Law enforcement officers, to the best of their ability, have compiled a list (the “Exclusion List”) of any Identification Numbers, related devices, and information related to individuals who were authorized to be inside the U.S. Capitol during the events of January 6, 2021, described above. Such authorized individuals include: Congressional Members and Staffers, responding law enforcement agents and officers, Secret Service Protectees, otherwise authorized governmental employees, and responding medical staff. The mobile device associated with [my redaction]@gmail.com is not on the Exclusion List. Accordingly, I believe that the individual possessing this device was not authorized to be within the U.S. Capitol Building on January 6, 2021. Furthermore, surveillance footage from the Rotunda, time-stamped within a minute of 2:56 p.m., shows GROSECLOSE, in his distinctive clothing, using his cell phone in an apparent attempt to take a picture.

Records provided by Google revealed that the mobile device associated with [my redaction]@gmail.com belonged to a Google account registered in the name of “Jeremy Groseclose.” The Google account also lists a recovery SMS phone number that matches [my redaction]. The recovery email address for this account appears to be in the name of GROSECLOSE’s significant other, with whom he has two children in common. Additionally, I have reviewed subscriber records from U.S. Cellular, related to the phone number [my redaction]. This number, along with another, are connected to an account in the name of GROSECLOSE’s significant other. The billing address for this account is [my redaction]. One of GROSECLOSE’s neighbors identified [my redaction] as GROSECLOSE’s address.

This seems to confirm that FBI obtained a geofence warrant from Google, but — at least as described — it was focused on those at the Capitol, perhaps focused on the Rotunda and anything 100 feet from it. This is the kind of granularity that will exclude most uninvolved people. They may have used it (or included it in the affidavit) because by wearing a gas mask, Groseclose made it difficult to show his face in the existing film of the attack.

The affidavit suggests that the Google geofence relied not just on GPS data of users’ phones, but also Wi-Fi access points (there’s another affidavit where the suspect’s phone triggered the Capitol Wi-Fi) and Bluetooth beacons. Again, given how wired the Capitol is, this would offer a granularity to the data that wouldn’t exist in most geofence warrants.

Finally, and most interestingly, this affidavit (obtained on the same day as the The Intercept story and so presumably after the Intercept called for comment) describes that the FBI has an “Exclusion List” of everyone who had a known legal right to be in the Capitol that day. That suggests that, after such time as the FBI completed this list, they could identify which of those present in the Capitol were probably there illegally.

There are concerns about FBI putting together a list like this. After all, Members of Congress might have good Separation of Power reasons to want to keep their personal phone numbers private. That said, there’s reason to believe that the FBI has used this method of separating out congressional identifiers and creating a white list in the past (including with the Section 215 phone dragnet), with congressional approval.

The concern arises in FBI’s definition of how it describes those legally present:

  • Members of Congress
  • Congressional staffers
  • Law enforcement responding to the insurrection (as distinct from law enforcement joining in it)
  • Secret Service Protectees (AKA, Mike Pence and his family)
  • Other government employees (like custodial staff)
  • Medical staff

Not on this list? Journalists, not even those journalists holding valid congressional credentials covering the vote certification.

Already, there have been several cases where suspects have claimed to be present as media, only to be charged both because of their comments while present and the fact that they don’t have congressional credentials. Three are:

  • Provocateur John Sullivan, who filmed the riot and sold the footage to multiple media outlets and “claimed to be an activist and journalist that filmed protests and riots, but admitted that he did not have any press credentials.”
  • Nick DeCarlo, who told the LA Times he and Nicholas Ochs were there as journalists but who FBI noted, “is not listed as a credentialed reporter with the House Periodical Press Gallery or the U.S. Senate Press Gallery, the organizations that credential Congressional correspondents.”
  • Brian McCreary, who on his own sent the video he took on his phone while inside the Capitol, but who later admitted to the FBI that entering the Capitol “might not have been legal” and also described admitting to cops present that he was not a member of the media.

If the FBI is going to use official credentials to distinguish journalists from trespassers, then it could also use those credentialing lists to white list journalists present at the Capitol. But to do that, the journalists in question would have to be willing to share identifying information for all the devices that were turned on at the Capitol, something they might have good reasons not to want to do.

Plus, I suspect there are a number of journalists without Congressional credentials who were covering the events outside the Capitol and, as the rally turned into a riot, entered the Capitol to cover it. Those journalists risked their lives and provided some of the most important early information about the riot and did so in ways that in no way glorified it. But in doing so, their devices may be in an FBI database relating to the attack.

There is clear evidence that the FBI obtained location data from the Capitol as part of its investigation, including Google and almost certainly Facebook. Thus far, the available evidence suggests that the ability to target that collection narrowly limits the typical concerns about tower dumps and geofence warrants (again, any similar data collection outside the Capitol in an effort to find the person who left the pipe bombs is another issue). Moreover, almost all those legal present in the Capitol appear to be whitelisted.

But not all. And the exception, journalists, include those who have the most at stake not having their devices identified and investigated by the FBI.

All that said, perhaps a similarly controversial question pertains to preservation orders. The Intercept describes a letter from Mark Warner calling on carriers to preserve data (and rightly questioning his legal authority to make such a request), then suggests the carriers have done so on their own.

Some of the telecommunications providers questioned whether Warner has the authority to make such a request, but a number of them appear to have been preserving data from the event anyway because of the large scale of violence, the source said.

The story doesn’t consider the — by far — most likely explanation, which is that FBI served very broad preservation orders on social media companies (though some key ones, such as Facebook, would keep data for a period even after insurrectionists attempted to delete it in the days after the attack as normal practice). In any case, broad preservation orders on social media companies would be solidly within existing precedent. But I suspect it may be one of the more interesting legal questions that will come out of this investigation.

Update March 7: Added McCreary.

Some Key Gaps in the January 6 Story [Updated]

DOJ continues to roll out arrests of people involved in the January 6 coup attempt.

But there are some obvious gaps in the (public) story so far.

Arrests relating to over 100 police assaults

In a filing submitted over the weekend, the government asserted that 139 cops were assaulted during the insurrection.

In the course of the insurrection, approximately 81 Capitol Police and 58 MPD officers were assaulted,

In its website tracking the people arrested so far, DOJ describes assault charges being filed against 12 people (updated on 2/1 to total 17 people):

  1. Daniel Page Adams, whose arrest affidavit describes engaging in a “direct struggle with [unnamed] law enforcement officers” (his cousin, Cody Connell, described the exchange as a “civil war”).
  2. Zachary Alam, who pushed cops around as he was trying to break into the Speaker’s Lobby.
  3. Matthew Caspel, who charged the National Guard.
  4. Scott Fairlamb, who was caught in multiple videos shoving and punching officers (one who whom is identified but not named); Cori Bush has said she was threatened by him last summer.
  5. Kyle Fitzsimons, who charged officers guarding the doorway of the Capitol.
  6. Alex Harkrider, who after being filmed fighting with police at the door of the Capitol, posted a picture with a crowbar labeled, “weapon;” he was charged with abetting Ryan Nichols’ assault.
  7. Michael Foy, a former Marine who was caught on multiple videos beating multiple cops with a hockey stick.
  8. Robert Giswein, who appears to have ties to the Proud Boys and used a bat to beat cops.
  9. Emanuel Jackson, whom videos caught punching one officer, and others show beating multiple officers with a metal baseball bat.
  10. Chad Jones, who used a Trump flag to break the glass in the Speaker’s Lobby door just before Ashli Babbitt was shot and may have intimidated three officers who were pursuing that group.
  11. Edward Jacob Lang, who identified himself in a screen cap of a violent mob attacking cops and who was filmed slamming a riot shield into police and later fighting them with a red baseball bat.
  12. Mark Jefferson Leffingwell, whom a Capitol Police officer described in an affidavit punching him.
  13. Patrick Edward McCaughey III, who was filmed crushing MPD Officer Daniel Hodges in one of the doors to the Capitol.
  14. Ryan Nichols, who was filmed wielding a crowbar and yelling, “This is not a peaceful protest,” then spraying pepper spray against police trying to prevent entry to the Capitol.
  15. Dominic Pezzola, a Proud Boy who stole a shield from cops.
  16. Ryan Samsel, who set off the riot by giving a cop a concussion; he appears to have coordinated with Joe Biggs.
  17. Robert Sanford, who was filmed hitting Capitol Police Officer William Young on the head with a fire extinguisher.
  18. Peter Schwartz, a felon who maced several cops.
  19. Barton Wade Shively, who pushed and shoved some police trying to get into the Capitol, punched another, then struck one of those same cops later and kicked another.

While a number of these men — Fairlamb, Jackson, Nichols, Shively, among others — allegedly assaulted multiple cops, that’s still far below the total of 139 alleged assaults.

That says the FBI is still looking for a significant number of people in assaults on police. Over the weekend, the FBI released BOLO posters showing 12 other men believed to have assaulted police — including two targeting individuals specifically.

The murder of Brian Sicknick

Of particular note, while the FBI has released a BOLO poster focused on the men who assaulted MPD Officer Michael Fanone, no such post has identified suspects as those suspected of killing Brian Sicknick (though note that Robert Sanford did assault a different officer with a fire extinguisher). There are many possible explanations for why his murder might be treated differently (not least that the culprits are more likely to flee).

But we haven’t seen anything to suggest who assaulted Sicknick badly enough to lead to his death.

The DNC and RNC bomber

On January 21, the FBI increased their reward for information leading to the guy believed to have planted pipe bombs at the DNC and RNC. But there’s no sign they’ve found the guy yet.

Rudy’s interlocutors

On January 15, Rudy Giuliani posted texts involving “James Sullivan” claiming he was going to blame the riot on “John,” that he had gotten “my agent out of trouble along with three other” Utahans, and mentioning “Kash.”

“John” is James’ brother, John Sullivan, someone long ago IDed by leftist activists as a provocateur who had been charged two days earlier. He was arrested on January 14, but bailed the next day.

“Kash,” is Kash Lee Kelly, whose parole officer IDed him at the scene. His bail in the gang-related drug conviction he was awaiting sentencing for in IL was revoked on January 14.

John Sullivan is the only Utahan that GWU identifies as being from Utah, meaning the three Utahans, in addition to James Sullivan, he claims to have gotten out of trouble thus far are (publicly at least) still not in trouble. No one yet arrested is identifiable as his “agent,” either.

That means, key people who might be a pivot between the rioters and Rudy Giuliani, who was coordinating events in Congress with an eye to how much time the rioters would give him, remain (again, publicly at least) at large.

There are around 73 sealed cases in the DC District, many of which probably having nothing to do with the January 6 insurrection and some of which are surely defendants already publicly charged whose cases have not yet been unsealed in the DC docket. The reasons for unsealing could vary — though the most common would be that someone hasn’t been arrested yet). Still, some of these sealed cases may be people who’ve already moved to cooperate.

Update, 2/1: I’ve updated the list of those charged with assault.

Rudy Giuliani and Jack Posobiec Claim a False Flag

Yesterday, the FBI arrested John Sullivan, one of the guys who took video showing Ashli Babbitt’s shooting in the January 6 insurrection. As the arrest affidavit describes, in an interview the day after the riot, Sullivan claimed he had been acting as a journalist at the riot.

SULLIVAN claimed to be an activist and journalist that filmed protests and riots, but admitted that he did not have any press credentials.

[snip]

23. At various times in his statements to law enforcement, to others inside the U.S. Capitol that were recorded in his video, and to news outlets, SULLIVAN has claimed he was at the U.S. Capitol only to document and report. In addition, your affiant is aware that, at various times, SULLIVAN has claimed to be a journalist. He has admitted, however, that he has no press credentials and the investigation has not revealed any connection between SULLIVAN and any journalistic organizations.

The affidavit describes that, at some protest in DC, Sullivan made anti-Trump comments.

The United States obtained a video of SULLIVAN, posted on YouTube, in which, while attending a protest in Washington, D.C., SULLIVAN can be seen telling a crowd, over a microphone, “we about to burn this shit down,” “we got to rip Trump out of office . . . fucking pull him out of that shit . . . we ain’t waiting until the next election . . . we about to go get that motherfucker.” SULLIVAN then can be seen leading the crowd in a chant of, “it’s time for a revolution.”1

But it quotes from a video he shared with the FBI repeatedly speaking of “we,” including himself in the mob. On several occasions, Sullivan convinced police to stand down (including in front of the Speaker’s Lobby, just before Babbitt was shot). And it provides evidence that Sullivan broke a window in one of the offices.

h. At one point in the video, SULLIVAN enters an office within the U.S. Capitol, as seen in the screenshot below. Once inside the office, SULLIVAN approaches a window, also seen in the screenshot below, and states, “We did this shit. We took this shit.”

i. While at the window, a knocking noise is heard off-screen. The camera then pans to show more of the window and a broken pane can be seen that was not broken on SULLIVAN’s approach to the window:

SULLIVAN can then be heard saying, “I broke it. My bad, my apologies. Well they already broke a window, so, you know, I didn’t know I hit it that hard. No one got that on camera.” SULLIVAN then exits the office.

Sullivan is charged with violent entry of Congress and impeding police officers during a civil disorder. He is not charged with breaking the window.

Even before his arrest, left wing activists had described concerns in that community, going back some time, that Sullivan was a provocateur working with others, including his brother James, who has ties to the Proud Boys and runs a pro-Trump organization.

But shortly after Sullivan’s arrest was reported, right wing propagandist Jack Posobiec pounced on his arrest, claiming it showed that BLM was behind the attacks and and that Sullivan’s actions led to Babbitt’s death (remember these screen caps have GMT, so subtract 5 for ET).

Then, in the middle of the night Rudy’s time, he posted a text from what appears to be John’s brother James.

Rudy presents this as proof that the riot was conducted by Antifa. But it instead seems to show that John’s brother (the phone number is in Utah, where they’re from) claimed to be, “working with the FBI,” had gotten his “agent” and three others out of trouble (Rudy did not show when he received this text, so it may have predated John’s arrest). It also showed that Sullivan seemed to have ties with someone named Kash, who might be Patel, the Devin Nunes flunky who got installed as DOD’s Chief of Staff. Patel would likely have had a key role in ensuring the National Guard delayed any response to the riot last week.

A Nazi sympathizer and the President’s lawyer seemed prepared to speak from the script that Donald Trump seems to have written the day before the riot, when he moved towards naming Antifa a terrorist organization. The OANN propagandist and chief purveyor of fraudulent claims about the election are attempting to use the arrest of John Sullivan to claim that their own people did not plan out this coup attempt.

In the process, however, Rudy Giuliani may have tied the President and the Proud Boys, and the Pentagon together in the plot. And Rudy’s calls to Tommy Tuberville after people had already died, that ties people n Congress to the attempts to assassinate members of Congress.

Update: I’ve been persuaded that “Kash” is someone else who was detained after the raid, so deleted references to Kash Patel. That person, Kash Kelly, is probably a convicted gang member awaiting his sentencing.

Update: Corrected that the anti-Trump comments may not have been at this protest.