Posts

The Video Authentication Challenge: Aaron Mostofsky

As January 6 trials move towards sentencing, the government has started submitting motions in limine, which are basically arguments before the trial about the scope of what will be permitted at trial. DOJ seems to have standard motions to prevent people from arguing Trump made them riot and attempting to nullify the jury.

But a motion submitted in Aaron Mostofsky’s case is worth reading in detail for the way it deals with a difficult aspect of the January 6 investigation: how to authenticate all the video that will be used against a defendant at trial. Probably because Mostofsky (whose father is a judge) dressed in pelts and donned a police vest, there’s a lot of video evidence against him. But that’s one thing they plan to use to authenticate the video against him: because so many people (including two journalists) caught him as he moved through the Capitol.

The distinctive characteristics of the defendant’s attire, combined with the distinctive characteristics of other rioters depicted captured on USCP and MPD footage, will further help support authentication of these exhibits.

Mostofsky also traveled much the same path as Kevin Seefried, whose Confederate flag similarly made him a common subject of video (but whom it doesn’t name).

The government wants to use video from cops, from other rioters, from journalists, and from one or two innocent bystanders against Mostofsky:

  • US Capitol Police Surveillance video
  • Metropolitan Police Department bodyworn camera video (remember that Capitol Police were not outfitted with cameras on Jan 6)
  • Publicly posted video from other rioters, including
    • A YouTube posted to the Buggs Media Network showing his approach
    • Videos posted to Parler:
      • Parler video time-stamped at 12:56 p.m, marked near Capitol
      • Parler video time-stamped 2:15 p.m marked inside the Capitol (note: because the person who filmed this was among the first in the Capitol, DOJ must have a good idea of who filmed this, but it doesn’t disclose that nor source it from that person)
      • Parler video time-stamped at 2:22 p.m., marked inside the Capitol
    • A video recorded by a person using the moniker “@statuscoup” live-streamed by JeffMAC Press (replicated in an HBO documentary) showing his approach
    • John Sullivan’s video; the filing notes that it is available on YouTube, but at least one arrest affidavit describes the FBI receiving a copy from an anonymous source on January 8; DOJ relies on Sullivan’s video to show what Mostofsky did under the scaffolding outside
  • HuffPo reporter Igor Bobic’s video of the rioters chasing Officer Goodman
  • An interview with Mostofsky with a NY Post reporter
  • A video captured by a person present at the riot and uploaded to TikTok and Twitter
  • A video, which the filing calls the “upstairs video,” filmed by a person inside the Capitol immediately before it was breached; the person was one or more floors above the Senate Wing Door

The government plans to have a Capitol Police and an MPD witness authenticate those videos (it sounds like, for defendants captured in multiple scenes in MPD video, they’ll need multiple witnesses). As for the video from other sources, it plans to authenticate it by correlating it with the surveillance video:

The government also intends to offer numerous video clips from sources other than USCP and MPD. Some of these were taken from reporters who were present in the Capitol that day. Others were taken by the defendant’s fellow rioters or other members of the crowd. Many were obtained through open-source means and are publicly available. For these videos, as described further below, the government will establish authenticity by asking the jury to compare them with other, authenticated exhibits: USCP and MPD footage.

The filing notes that it will draw on otherwise inadmissible evidence, such as Parler’s labels for where it took videos, to help authenticate the videos posted as the site.

In deciding preliminary questions about the admissibility of these videos, “[t]he court is not bound by evidence rules, except those on privilege.” Fed. R. Evid. 104(a). In other words, the government may rely upon otherwise inadmissible evidence in establishing the authenticity of the video evidence described in this motion. See, e.g., United States v. White, 116 F.3d 903, 914 (D.C. Cir. 1997).1

1 This matters, for instance, in analyzing Parler videos publicly available through ProPublica, and discussed infra at 8-9 and 13-17. The government’s argument for authentication of these videos relies in part on hearsay statements by ProPublica which the government does not intend to elicit at trial. Similarly, the government bases the John Sullivan video, discussed infra at 11-12, in part on portions that are confirmed by USCP footage elsewhere in the building but are unrelated to this defendant.

None of this relies on calling the known defendant-source of video (John Sullivan) or the video from other rioters most of whose identities DOJ must know. Nor does the “upstairs video,” which appears to have been filmed from one of the people legally present in the Capitol as it was stormed.

DOJ only mentions the prosecutions of Jacob Chansley and Sullivan; it does not name Kevin Seefried or Doug Jensen, whose presence in videos DOJ also uses to correlate the videos.

As I said above, both because he was so distinctively dressed and because much of the available video is so clear, Mostofsky is among the easiest defendants to do this with. This process will get more difficult as DOJ moves towards prosecuting people for things that happened where no police footage was available to correlate a person’s actions.

19 Minutes: The Tuberville Call and DOJ’s Use of Obstruction in January 6 Prosecutions

Nine minutes after President Trump called Tommy Tuberville at 2:26PM on January 6 to ask him to raise more objections in an effort to delay the vote count, riot defendant Brady Knowlton entered the Capitol in what DOJ alleges was an intentional effort to delay the vote count.

Nineteen minutes after Trump placed that call, at 2:45PM, Knowlton entered the Senate Gallery, maybe fifteen minutes after Tuberville had told the President he had to hang up because the Senators were being evacuated because people like Knowlton were invading the Capitol.

A number of people have pointed me to this article on Tuesday’s hearing before Judge Randolph Moss in Knowlton’s challenge to DOJ’s use of 1512(c)(2) to charge those who, DOJ alleges, came to the insurrection with the intention of delaying or stopping the certification of the votes. Here’s my live thread of the hearing and my own post on it; I’ve linked some of my other posts on the application of obstruction below.

The article is a good summary of the legal questions around the application. But in my opinion, its emphasis does not adequately convey what went on at the hearing. For example, the headline and first three paragraphs emphasize Judge Moss’ concerns about constitutional vagueness, which Moss didn’t focus on until an hour into the hearing.

Lead felony charge against Jan. 6 defendants could be unconstitutionally vague, U.S. judge warns

A federal judge has warned that the lead felony charge leveled by the government against Capitol riot defendants could be unconstitutionally vague, potentially putting convictions at risk of being overturned on appeal.

U.S. District Judge Randolph D. Moss identified the latest hurdle for federal prosecutors investigating January’s attack on Congress during a two-hour hearing this week over whether to dismiss the “obstruction of an official proceeding” charge from a 10-count indictment against two men from Colorado and Utah.

Moss’s remarks highlight the challenge prosecutors have faced in defining the most severe criminal conduct allegedly committed on Jan. 6. Prosecutors have employed the obstruction charge rather than sedition or insurrection counts in accusing at least 235 defendants of corruptly disrupting Congress’s certification of the 2020 electoral-college vote.

It doesn’t mention how Moss started the hearing — by expressing skepticism about Knowlton’s argument — until the last line of the fourth paragraph.

Attorneys for Brady Knowlton and Patrick Montgomery claimed that specific offense did not apply to them, arguing that the joint House and Senate session that met Jan. 6 does not qualify as an official proceeding of Congress. Moss made clear he was not persuaded by that claim at this point. [my emphasis]

At least before Moss, then, this challenge faces an uphill climb (some of the other challenges to this application of obstruction make a slightly different legal argument that may have more promise of success). And while the WaPo piece notes that Moss asked for additional briefing from both sides, it doesn’t note what I consider a fairly major strategic error from Knowlton’s team: choosing to define an “official proceeding” as one in which the ultimate decision of the proceeding is an adjudication that has real import to the life and liberty of those involved.

In effect, Knowlton lawyer Brent Mayr claimed that Joe Biden (and the 81 million Americans who voted for him) would have suffered no harm if Congress had been so intimidated by the people roaming the hallways threatening their assassination that they certified Donald Trump as the victor of the 2020 election instead of Biden, or if the insurrectionists managed to cause lasting unrest that delayed the certification indefinitely, giving Trump a chance to attempt another desperate ploy to remain in power.

By making that argument, Mayr provided DOJ the opportunity to lay out — in the additional briefing Moss ordered — the real adjudication that took place on January 6 and the import to justice and rule of law that the adjudication had, something DOJ has done, albeit in less focused fashion, in other filings in this investigation. Mayr gave DOJ an opportunity to explain that there was a very real risk that the lawfully elected President of the United States would not have his victory officially recognized, which was precisely the goal, DOJ would argue, that Brady Knowlton sought.

Mayr gave DOJ that opportunity even amid heightened coverage of how real the threat of a travesty of justice was.

The reporting on Jeffrey Rosen’s testimony about Jeffrey Bossert Clark’s attempt to force DOJ to endorse Trump’s Big Lie makes it clear how corrupt all this was (showing corrupt intent is key to proving Knowlton or anyone else guilty of the obstruction charge).

Filling in just one more detail will tie together Trump’s efforts to recruit DOJ in telling his Big Lie and Brady Knowlton’s response to that Big Lie of flying to DC, invading the Capitol, and heading to the place where the vote was supposed to be counted.

[B]ody-worn camera footage from the Metropolitan Police Department [] shows Knowlton and [Knowlton’s co-defendant Patrick] Montgomery outside the Capitol at around 2:00 p.m.  In the video, Knowlton confronts officers who are making their way through the crowed and yells at them saying, “You took an oath! You took an oath!” and pointedly asking them, “Are you our brothers?” Montgomery is standing right behind Knowlton. The government also located another body-worn camera video of both defendants after they left the Senate Gallery, confronting officers inside the Capitol in a hallway near Senate Majority Leader Schumer’s office. In the video, both Knowlton and Montgomery direct officers to move out of the way. Knowlton tells the officers, “We don’t wanna push through there. We do not wanna push through there.” Knowlton also tells the officers, “This is happening. Our vote doesn’t matter, so we came here for change.”

That detail is that Donald Trump made an effort to ensure the Senators would still be there when Knowlton and others arrived.

“How’s it going, Tommy?” the president asked.

Taken a little aback, Lee said this isn’t Tommy.

“Well, who is this? Trump asked. “It’s Mike Lee,” the senator replied. “Oh, hi Mike. I called Tommy.”

Lee told the Deseret News he realized Trump was trying to call Sen. Tommy Tuberville, the newly elected Republican from Alabama and former Auburn University football coach. Lee walked his phone over to Tuberville who was talking to some colleagues.

“Hey, Tommy, I hate to interrupt but the president wants to speak with you,” Lee said.

Tuberville and Trump talked for about five to 10 minutes, Lee said, adding that he stood nearby because he didn’t want to lose his cellphone in the commotion. The two were still talking when panicked police ordered the Capitol to be evacuated because people had breached security.

As police were getting anxious for senators to leave, Lee walked over to retrieve his phone.

“I don’t want to interrupt your call with the president, but we’re being evacuated and I need my phone,” he said.

Tuberville said, “OK, Mr. President. I gotta go.”

To be clear: there’s no evidence that Knowlton had direct ties to Trump (though Knowlton is one of just seven defendants thus far from Utah, and a week after the riot, Rudy Giuliani appears to have been in contact with James Sullivan, the brother of defendant John Sullivan, who told Rudy he had gotten his “agent” and three others from Utah out of trouble). There’s even less evidence that, at the moment Knowlton crossed the threshold of the Capitol, he knew Trump had just tried to convince Tuberville to delay long enough for Knowlton to arrive in the Senate.

This is not yet a conspiracy that ties the President’s actions to obstruct the vote count with Brady Knowlton’s alleged actions to achieve the same goal.

But even as Brady Knowlton’s lawyers have argued that an official proceeding is one in which the parties can suffer dire consequences if rulings don’t go in their favor, more evidence is coming out about how Knowlton’s actions fit into a larger, undeniably corrupt scheme to deprive Joe Biden (and Kamala Harris, who was present and participating on that day) of their electoral win.

If that’s the standard, then Knowlton’s lawyers have made a compelling argument against his case.

The WaPo’s not wrong about the seriousness of this larger challenge. And whether or not this argument succeeds, it’s still not clear that DOJ will be able to prove that Knowlton had the requisite corrupt intent to delay the vote.

But Knowlton’s argument may be overtaken by the new evidence proving just how corrupt this effort was.


Posts on obstruction

July 17, 2021: General thoughts on the application of obstruction in advance of the Paul Hodgkins’ sentencing

June 4, 2021: How Ethan Nordean’s challenge to the application of obstruction degrades the challenge

June 14, 2021: How the III Percenter conspiracy indictment might use the threats of violence enhancement from the obstruction statute

July 31, 2021: How DOJ blew an opportunity to explain the difference between the Brett Kavanaugh protests and the January 6 rioters

July 27, 2021: How Donald Trump might be charged with obstruction

August 3, 2021: Brady Knowlton’s lawyer falsely claimed his client’s alleged obstruction posed no harm of injustice

August 4, 2021: Trump’s Big Lie demonstrates the threat of harm from insurrectionists’ obstruction

List of all obstruction challenges

 

Blind Spots in the Ashli Babbitt Panopticon

In a status hearing for Thomas Baranyi yesterday, AUSA Candice Wong explained why she hadn’t finished discovery for Baranyi, who stood right behind Ashli Babbitt when she was shot: because new discovery from “other investigations” keeps coming in. By “other investigations,” she likely means content recorded by other defendants when they were storming the Capitol.

For example, in the most recent (laudably detailed) discovery notice to Baranyi’s attorney, Wong included 17 files, six sets of which were designated by “D” — probably defendants — and three sets of which designated by “W” — probably uncharged witnesses.

MARKED SENSITIVE: Videos obtained via legal process and otherwise from other Capitol investigations (17 files):

a. D-2 – 3 photographs, 1 video

b. D-3 – 3 videos

c. D-4 – 1 video

d. D-5 – 1 video

e. D-6 – 1 video

f. D-7 – 1 video

g. W-4 – 2 videos

h. W-5 – 1 video

i. W-6 – 3 videos

In the hearing, Wong explained that incoming discovery might be important for either the defense or the government. It significantly consisted of activity that CCTV hadn’t captured. Wong also explained that as important as the video itself, new discovery has recorded the words of rioters that weren’t otherwise recorded.

Wong’s comments confirm something I’ve pointed out before. Even with the flood of video that captured the events of January 6, there are gaps in that coverage, gaps that the government has seemingly attempted to fill by targeting the arrests of those known to have taken their own video.

That there are gaps in the case against Baranyi, who was in one of the most important locations of the entire riot, suggests something else: that there may be limited CCTV coverage from that hallway. Certainly, Wong seems to be saying that prosecutors are relying, in part, on other defendants’ footage to understand what the key defendants were doing.

Here are all the discovery notices for Baranyi, with a description of the types of material provided:

  • February 24: Arrest materials and 302s, T-Mobile and WhatsApp subpoena returns, plus ten open-source videos.
  • April 19: Extracts of Baranyi’s phone, social media posts about Baranyi, two more open-source videos, plus 20 zipped USCP surveillance videos
  • June 1: MPD body cam footage
  • June 24: Bates-stamped discovery, probably significantly replicating earlier discovery
  • July 1: MPD footage from “Upper House Door exit,” CCTV from Crypt East, two officer interview transcripts, four open-source videos described as, “CSPAN; Storyful; two of shooting,” plus, the 17 files described above.

As noted below, Wong gave the four other defendants who were also at the door — Zach Alam, Chad Jones, Christopher Grider, and John Sullivan –a similar discovery notice in the last week or so. That suggests the MPD footage and the “D” and “W” videos cover that confrontation that is common to all five cases.

Some of the USCP video provided to those four defendants may be common. But Alam, the most boisterous of the lot, only received eight of them (and most of these defendants were all over the Capitol). For most of these defendants, then, the government seems to be relying on open-source video and, increasingly, on the video taken by other defendants.


Zach Alam (one, two, three, four): Eight files from USCP surveillance and ten open-source videos. Many of the same files disclosed to Baranyi.

Chad Jones (one, two, three, four, five): Ten open source, 22 USCP videos, MPD body cam, many of the same files as disclosed to Baranyi on July 1, as well as an extra YouTube of Jones outside.

Christopher Grider (one, two, three, four, five): 20 USCP videos, ten open-source videos, two of his own videos, many of the same filings disclosed to Baranyi.

Brian Bingham: No discovery docketed.

Alex Sheppard No discovery docketed.

Kurt Peterson: CCTV footage of the building exit and some BWC, as well as 17 open-source videos.

Ryan Bennett (one, two): only his own videos from Facebook and his phone.

Phillip Bromley: Unclear whether all discovery docketed, though a set of files marked Highly Sensitive (as CCTV would be), including four videos and two images, are included.

David Mish: Discovery mentions video clips but does not detail them.

Brian McCreary: No discovery docketed.

Sam Montoya: 20 USCP videos, 16 MPD BWC videos, nine open-source videos

John Sullivan (one, two, three): Sullivan’s own video, 24 USCP videos plus 2 screenshots, 17 MPD BWC videos.

The Crimes of Violence Ashli Babbitt’s Mob Allegedly Committed

In the Oversight Hearing on January 6 the other day, Paul Gosar suggested that Ashli Babbitt, who was shot while jumping through the last door protecting House members, had been executed.

Paul Gosar: Do you know who executed Ashli Babbitt? … The Capitol Police officer that did that shooting, Ashli Babb — appeared to be hiding, lying in wait, and he gave no warning before killing her.

As it happens, the day after Gosar made these comments, yet another insurrectionist who was standing with Babbitt when she was killed, Kurt Peterson, was arrested in Abraham Lincoln’s birthplace of Hodgenville, KY. According to his arrest warrant, prior to the insurrection, Peterson had accused Democratic lawmakers of treason that should be penalized with death. Peterson claimed to have been at the insurrection with three former Special Forces guys, all in their sixties.

After the insurrection, on January 10, Peterson posted an account on Facebook almost certainly intended to minimize his actions. He claimed, for example, to have entered through a back door that had been opened, and further claimed that when he entered, he told people not to hurt anyone or anything. (He recorded this on voice recognition software so the bracketed corrections are my own.)

When at the back door that we were at open[ed] and there and there were no police to restrain the crowd many people entered at that time. I stood at the door and told everyone that we were not there to hurt anybody or damage anything but as a show of solidarity to right the wrongs of the past election.

In fact, a video cited in his arrest warrant shows someone the government alleges to be him breaking an exterior window to the Capitol screaming, “This is our house. Let us in.”

Peterson is accused of breaking that window, which cost $2,700 to repair. Causing more than $1,000 of damage under 18 U.S.C. §1361 can (and has been invoked to, in this investigation) carry a terrorism enhancement under 18 U.S.C. §2332(b)(g)(5). While it’s unlikely the government will do so with Peterson (they have done so primarily with militia members), given his politicized threats of violence in advance of the insurrection, Peterson could be charged with terrorism for breaking that window.

In the same self-serving account of the day, Peterson gave this account of witnessing Ashli Babbitt’s death.

I did stop men from trying to break down the large wooden doors to the house chamber. Then I saw chairs being brought into the corridor going to the speaker’s lobby. They also grabbed a large sign with a heavy metal base stating no photography. I pushed into the corridor yelling for them to stop trying to break through the doors into the speaker’s lobby. The woman who was shot used the leg of a chair to hit a glass panel on in the door. There were numerous police officers in the stair tower and hallway that I was in.

Before I could get to her the shot rang out from behind the doors in the speaker’s lobby through the glass which shattered hitting many [police] officers and people there. It was a young man in a suit who was supposedly a bodyguard for Chuck [S]chumer.

The bullet hit the woman in the neck which caused her to fall backwards [im]mediately. It could have hit numerous [police] officers that were there. Non lethal force could have been use[d] with out the lethal shot that was made by this body guard in the speaker’s lobby.

I had my 1st aid [gear] with me and asked numerous times to be allowed to render 1st aid to this woman. I was told that they were waiting for the fire department to [respond] and they would not let me give her 1st aid. She died on the floor within 10 minutes of the shot being made.

On the John Sullivan video, there’s no sound of Peterson warning anyone. Rather, there are cries of “Break it down!” with multiple calls before the shot that there was a gun just behind the door the mob was threatening to break down. Everyone in the front line, including Babbitt, should have heard warnings about, if not seen, the gun carefully aimed at the mobsters at the door.

Had non-lethal force been used, the mob might have become more inflamed than they already did. Indeed, many January 6 defendants excuse their behavior, including multiple people accused of assault, as retaliation to the use of non-lethal force.

Peterson suggests that police attending to Babbitt weren’t already giving her First Aid even as they were trying to clear the mob. It appears that another of the rioters, someone with a camera, responded even more quickly than Peterson, along with some of the cops. It is true that Peterson fumbled in his chest as if grabbing for gear. It’s also true that even before that, police were yelling at him to clear out so first responders could get to her. Another video shows that even more closely — as a long line of rioters were clearing a path, Peterson kept talking to the cops.

If the government’s accusations are true, one of the people accusing cops was, himself, dramatically understating his own involvement that day, including his alleged assault on the Capitol that could be (but has not) charged as terrorism.

Breaking down the door

But Peterson is not the only one. While DOJ has thus far charged only a relative handful of people who made up the mob screaming “Break it down!” who were present when Babbitt died, those present range from people accused of trespass to others whose damage to the Capitol could be charged with a terrorism enhancement.

Zach Alam: Zach Alam was the most determined of several men who broke the glass in the door through which Babbitt was trying to enter. Like Peterson, he is accused of damaging the building and obstructing the vote count. In addition, he is charged with assaulting police and civil disorder. A filing opposing his pre-trial release describes his action of the day as “agitated” and rightly notes he stood out among the mob during multiple confrontations with police (including one minutes earlier at the doors to the House Chamber). The video from the Speaker’s Lobby door shows him punching and then kicking the door, then using Christopher Grider’s helmet to hit the panes.

Alam went on the run after January 6 because — as he told a family member — he didn’t want to go back to jail again (he has some recent arrests in DC). During this period on the lam, Alam used at least one assumed name, stolen license plates, and false identification.

Lawfully obtained records show that the defendant has provided multiple false names to service providers, including at least one false name – “Zachary Studabaker” – for services since the events of January 6, 2021.

In addition, according to the government’s information, the defendant was at the time of his arrest driving a vehicle that he had purchased around September 2020 but never registered, and for which the defendant had used multiple license plates, including in recent months. These include a Washington, D.C. license plate, found inside the defendant’s vehicle in Pennsylvania, which was reported stolen in 2018 by an individual who indicated that the front license plate was taken off his vehicle while parked in Northwest D.C. D.C. traffic cameras captured a black Chevy truck matching the description of the defendant’s vehicle bearing this license plate as recently as January 4, 2021. Moreover, when agents located the defendant at the motel in Pennsylvania, they observed the defendant’s black Chevy truck parked outside and noted that it bore Pennsylvania license plates for a Mazda vehicle.

Upon arrest, moreover, the defendant had multiple identification cards in his wallet, including a D.C. driver’s license and a D.C. identification card for one male, a Permanent Resident card for a second male, and University student identification card for a female. Among the items agents seized from the defendant’s motel room nightstand, moreover, were two mobile phones – a Verizon flip phone as well as an iPhone.

Per the same filing, Pennsylvania state authorities are also investigating Alam in conjunction with the January 29, 2021 burglary of an antique store.

This is the kind of defendant whose violence Babbitt was part of. Had Babbitt survived, she might have been on the hook for abetting Alam’s actions at the Speaker’s Lobby.

Chad Jones: Along with Alam, Chad Jones helped to break the panes of the Speaker’s Lobby door. In his case, he hit the window with a flag pole holding a wrapped up Trump flag. Jones was charged with resisting officers and civil disorder on top of the damage to the door.

Christopher Grider: Like Alam, Christopher Grider ran to the Speaker’s Lobby after being turned back at the House Chamber. Like Alam, he is charged helping to break through the Speaker’s Lobby doors through which Babbitt jumped. He handed Alam his own helmet, which Alam used to continue beating on the doors. Even after handing Alam the helmet, Grider allegedly pushed and kicked on the doors himself.

Grider backed away from the door when people started to call out about the gun. But like Peterson, he didn’t leave the scene to let officers respond.

Grider is charged for the destruction to the door, obstruction, and trespassing.

Assault

Brian Bingham: Brian Bingham was arrested June 22 in Alabama (which is neither of the states in which he was known to be living in his arrest warrant, Florida and New Jersey). He had been IDed by people who knew him from the Army with days after the insurrection and posted this photo from minutes after Babbitt’s death to his Facebook account (it’s unclear from the arrest warrant how Bingham’s attempts to shut down his Facebook account failed; possibly they obtained a preservation order).

Bingham appears to have been loitering around the East door as if knowing it would open before it did.

Minutes after Babbitt’s shooting, Bingham got in a tussle with two cops trying to expel him (the best footage of which was captured from another rioter’s phone, which may explain the delay in arresting him).

He yelled at them,

“You won’t hurt ANTIFA, but you’ll murder innocent girls!” “Where do you want me to move? Push me again!”

He bragged about the interaction later in the day.

Individual-5: Are you ok?

BINGHAM: I got to manhandl[e] 5 cops and live to tell

Individual-5: Lol… All of this does not surprise me! Stay safe. Trump2020

Bingham is not charged with obstructing the vote (which is surprising for a number of reasons, but may be consistent with an approach of undercharging those present at Babbitt’s death). But he is charged for the interaction with police.

Obstruction

Alex Sheppard: Like many others, Alex Sheppard ran from the stand-off at the House Chamber to the Speaker’s Lobby door, where he was picked up on Sullivan’s video. Presumably because he explained on social media he was driving from Ohio to DC to protest the RIGGED election, he was also charged with obstruction.

Trespass

Most of the others who directly witnessed Babbitt’s death have been charged with trespass, even though several badgered cops in ways that has gotten others charged with civil disorder or took affirmative steps to halt the vote count that has gotten others charged with obstruction.

Thomas Baranyi: Unlike some others, Thomas Baranyi (who was standing just behind her when she died) admitted that Babbitt died while attempting to breach a heavily guarded door.

We had stormed into the chambers inside and there was a young lady who rushed through the windows. A number of police and Secret Service were saying get down, get out of the way. She didn’t heed the call and as we kind of raced up to try to grab people and pull them back, they shot her in the neck, and she fell back on me.

Like many of the people at the door of the Speaker’s Lobby, he had recently been part of a mob that tried to storm the House side itself, only to try the Speaker’s Lobby next. Baranyi is charged with misdemeanor trespassing.

Ryan Bennett: Bennett was shouting “Break it down” while live-streaming the event as Babbitt was shot.

In Live Video 2, shot from inside the Capitol Building, at approximately the 1:40 minute mark, Bennett seemingly yells “no!” in the direction of a banging noise. In Live Video 4, Bennett seemingly yells “no destruction!” at approximately the 0:40 second mark when someone is seen kicking a door. However, in Live Video 3, Bennett seemingly chants “break it down!” along with the crowd at approximately the 2:47 and 3:54 minute marks. Based on my knowledge of the investigation and the events at the Capitol building, I believe the “break it down” chant was in relation to a door located in the Speaker’s Lobby that was barricaded by USCP and where a woman was later shot. A gunshot can be heard at approximately the 2:42 minute mark of Live Video 4.

Though he wore a Proud Boys hat the day of the riot, which was found when the FBI searched his home, he was charged only with misdemeanor trespass.

Phillip Bromley: According to his arrest affidavit, Bromley witnessed the shooting, and then appeared in a video posted to Parler describing it and stating he was 8 feet away.

In his narrative of events on Video 1, BROMLEY states: “listen…everybody needs to know the truth.” BROMLEY proceeds to describe how he “breached the right side,” “went in,” and “came to two large glass doors.” When he reached the doors, BROMLEY continues by stating he was talking with SWAT officers and reminding them “of their oath,” at which time “a gunshot went off” and a woman was “shot her in the neck.” BROMLEY continues by stating it “did not look like a survivable wound” and that “she [the woman who was shot] was eight feet in front of me on a line.” BROMLEY further describes the clothing he observed the woman to be wearing when she was shot and states “they shot her and she is dead.”

He was charged with misdemeanor trespass.

David Mish: David Mish called cops himself, on January 7, to describe what he knew about Babbitt’s shooting.

According to Mish, Babbitt was telling the cops to open the door before she died.

On approximately January 7, 2021, David Mish contacted the Washington, D.C. Metropolitan Police Department (“MPD”) stating that he had information to provide about the fatal shooting of Ashli Babbitt, who was shot inside the U.S. Capitol during the civil unrest. On January 8, 2020, Detective John Hendrick of the MPD contacted MISH by phone and recorded the ensuing conversation regarding the Babbitt shooting. MISH stated that he, together with several others, had entered the United States Capitol on January 6, 2021. MISH asked “[b]ecause I entered the Capitol Building are you guys gonna take me to jail? I didn’t break anything. . . . I went in, yes.”

[snip]

In his interview with Detective Hendrick, MISH stated that a group of several individuals went into a bathroom adjacent to the Speaker’s Lobby and he objected when one of the group broke a mirror, stating, “we’re trying to get to the politicians because we wanna voice our . . . we wanna voice to ‘em.” MISH described Babbitt saying to the officer who was at the doorway, “Just open the door. They’re not gonna stop,” or words to that effect, referring to the crowd gathered at the doorway. MISH further stated that he had used his cell phone to record some of the activity that occurred within the United States Capitol. MISH told the detective, “from my video you can tell that I was one of the, I was the first group of people to hit that doorway,” referring again to the locked doorway leading to the Speaker’s Lobby that the rioters were attempting to breach.

That said, perhaps because he reached out to cops himself, perhaps because he claims to have tried to talk others out of damaging the Capitol, DOJ only charged Mish with misdemeanor trespass.

The videographers

Brian McCreary: Brian McCreary self-reported his presence in the riot by sharing video he had taken of the day, including from the Babbitt shooting.

After taking this picture; I decided to leave the building. Walking around the building, found a place to take a nice overhead shot of the crowd. Shortly after I made my way there and managed to take one clip of the crowd; people broke into that very side – so I followed them to see what they were doing. -Clip 20210106_144223 Following said crowd. -Clip 20210106_144434 Crowd breaks glass to Speakers Library, hear a shot fired. -Clip 20210106_144544 Crowd begins a game of telephone with Shot and killed a girl over here. At that point; I decided to leave the site. Walked to parking garage; jumped in my car and drove home. Im now just noticing that I am limited to 4 uploads; I will call and follow-up to provide the rest.

Perhaps because he reentered the building after leaving once, the government charged him with obstruction as well as trespassing.

Sam Montoya: Like John Sullivan, Infowar’s Sam Montoya’s video leads up to the Babbitt shooting. Like John Sullivan, Montoya eggs on the crowd as he films it. “We have had enough! We’re not gonna take your fucking vaccines! We’re not gonna take all your bullshit! The people are rising up!” But unlike Sullivan (and perhaps because of his tie to an actual media outlet), Montoya was charged only with misdemeanor trespass.

John Earle Sullivan: John Sullivan, whose name came up in texts between his brother and Rudy Giuliani, is the most enigmatic of January 6 defendants. Banned by lefty activists as a provocateur in the months leading up to the insurrection, Sullivan showed up on January 6 and caught key confrontations on video, while he could be heard egging on rioters in his own recording. At first, he was charged with trespass and civil disorder. His first indictment added obstruction and abetting. A second indictment enhanced his charges for carrying a knife during the protest (which he repeatedly asserted on his own video), false statements for denying it to the FBI, and a forfeiture allegation tied to the $90K he made by selling his video of the day (including Babbitt’s shooting). While Sullivan has been given a damage estimate in discovery — possibly tied to a window he seems to describe himself breaking in an office — he has not yet been charged for doing that damage.

The defendant approaches a window and states, “We did this shit. We took this shit.” The defendant also appears to break a window and says, “I broke it. My bad, my apologies. Well they already broke a window, so, you know, I didn’t know I hit it that hard. No one got that on camera.”

Sullivan used his knife — which the government claims he showed publicly in the mob before the House Chamber — both in that mob and later the Speaker’s Lobby to get others to let him up near the front of the mob.

In the moments before Babbitt’s shooting, Sullivan was, just as Babbitt was, cajoling the police to step away from their posts.

After Babbitt’s death, according to the government’s support of seizure of Sullivan’s funds, Sullivan repeatedly boasted both of riling up the mob and of having video he could — and in fact did — monetize.

The defendant also spoke to someone on speakerphone, stating, “I brought my megaphone to instigate shit. I was like, guys we’re going inside, we’re fucking shit up…. I’m gonna make these Trump supporters f—all this shit up…. But I mean you’ll see. I have it all, I have everything, everything on camera, everything I just told you, and I mean everything. Trust me when I say my footage is worth like a million of dollars, millions of dollars. I’m holding on to that shit.”

So while Sullivan has not been charged for breaking a window — which if he were, would make a fifth person present who could be charged with a terrorism enhancement — he was charged with wielding a knife, lying about it, and inciting those around him to riot.

Update, June 24: I’ve added Bingham.

Rudy Giuliani’s Going To Go Through Some Things

The NYT is breaking the news that Rudy Giuliani’s home was searched this morning and his devices seized.

Federal investigators in Manhattan executed a search warrant on Wednesday at the Upper East Side apartment of Rudolph W. Giuliani, the former New York City mayor who became President Donald J. Trump’s personal lawyer, stepping up a criminal investigation into Mr. Giuliani’s dealings in Ukraine, three people with knowledge of the matter said.

One of the people said the investigators had seized Mr. Giuliani’s electronic devices.

The story explains that this arises out of the investigation into Rudy’s foreign influence peddling with Ukraine.

The federal authorities have been largely focused on whether Mr. Giuliani illegally lobbied the Trump administration in 2019 on behalf of Ukrainian officials and oligarchs, who at the same time were helping Mr. Giuliani search for dirt on Mr. Trump’s political rivals, including President Biden, who was then a leading candidate for the Democratic presidential nomination.

The NYT doesn’t mention that several of these Ukrainians have since been sanctioned by Treasury as Russian agents.

But once they get Rudy’s phones, there’s the possibility they’ll find evidence of all Rudy’s other crimes. For example, in January, Rudy was in contact with James Sullivan, who is the brother of accused January 6 insurrectionist John Sullivan and who himself has ties to the Proud Boys.

This is a lot of information exchange (and a good degree of familiarity) with someone so closely tied to an attack on the Capitol.

So who knows? It might all coalesce: Rudy’s work for Russian Agents in Ukraine to undermine democracy, paving the way for a violent attack on the Capitol.

Update: They searched Victoria Toensing’s home too.

F.B.I. agents on Wednesday morning also executed a search warrant at the Washington-area home of Victoria Toensing, a lawyer close to Mr. Giuliani who had dealings with several Ukrainians involved in the effort to find damaging information about the Bidens, according to people with knowledge of that search. Ms. Toensing has represented Dmitry Firtash, a Ukrainian oligarch under indictment in the United States whose help Mr. Giuliani sought.

Update: Fixed the timing of the search. h/t JM.

Journalists May Be Most at Risk (as Described) from a Presumed January 6 GeoFence Warrant

On February 22, the Intercept had a thinly sourced story reporting (heavily relying on one “recently retired senior FBI official” whose motive and access weren’t explained and one other even less-defined source) on methods used in the January 6 investigation. It started by describing something unsurprising (some of which had been previously reported): that the FBI was using emergency legal authorities to conduct an investigation in the wake of an insurrection.

Using special emergency powers and other measures, the FBI has collected reams of private cellphone data and communications that go beyond the videos that rioters shared widely on social media, according to two sources with knowledge of the collection effort.

In the hours and days after the Capitol riot, the FBI relied in some cases on emergency orders that do not require court authorization in order to quickly secure actual communications from people who were identified at the crime scene. Investigators have also relied on data “dumps” from cellphone towers in the area to provide a map of who was there, allowing them to trace call records — but not content — from the phones.

From there, the story made conclusions that were not borne out by the evidence presented (which is not to say that such conclusions won’t one day be supported).

In particular, the story suggested that these investigative methods were used to investigate Congress, and likewise suggested that the involvement of Public Integrity prosecutors must mean members of Congress are already the focus of the investigation and further suggesting that the location data collection tied to the investigation of members of Congress.

The cellphone data includes many records from the members of Congress and staff members who were at the Capitol that day to certify President Joe Biden’s election victory.

[snip]

The Justice Department has publicly said that its task force includes senior public corruption officials. That involvement “indicates a focus on public officials, i.e. Capitol Police and members of Congress,” the retired FBI official said.

To make the insinuation, the story misstates the intent of a Sheldon Whitehouse statement aiming to use Congressional authorities to remove coup sympathizers from committees of jurisdiction (and ignores Whitehouse’s earlier statement that calls for the kind of data collection described in the story).

On January 11, Sen. Sheldon Whitehouse, D-R.I., released a statement warning against the Justice Department getting involved in the investigation of the attack, at least regarding members of Congress, asserting that the Senate should oversee the matter.

Thus far, the story seems tailor-made to get Congress — the Republican members of which are already trying to sabotage the investigation — to start tampering with it.

Far down in the story, it also describes the orders used with more specificity — but not yet enough specificity to substantiate the claims made earlier in it.

Federal authorities have used the emergency orders in combination with signed court orders under the so-called pen/trap exception to the Stored Communications Act to try to determine who was present at the time that the Capitol was breached, the source said. In some cases, the Justice Department has used these and other “hybrid” court orders to collect actual content from cellphones, like text messages and other communications, in building cases against the rioters.

At the time I suggested the story’s conclusions went well beyond the evidence included in it. I had several concerns about the story.

First, it didn’t address the granularity of location data collected, explaining whether the data collection focused just on the Capitol building or (as the story claimed) “in the area” generally. The Capitol is, according to multiple experts, incredibly wired up, meaning that one can obtain a great deal of data specific to the Capitol building itself. That matters here, because as soon as Trump insurrectionists entered the Capitol building, they committed the trespass crimes charged against virtually all the defendants. And the people legally in the Capitol that day were largely victims and/or law enforcement. It’s not an exaggeration to say that anyone collected off location collection narrowly targeted to the Capitol building itself is either a criminal, a witness, or a victim (and often some mix of the three).

If location collection was focused on the Capitol building itself (we don’t know whether it was or not, and the reports of collection aiming to the find the person who left pipe-bombs in the neighborhood on January 5 do pose real cause for concern), it mitigates some of the concerns normally raised by the use of IMSI-catchers at public events and protests, which is that such location collection would include a large number of people who were just engaging in protected speech, as many of the people outside the Capitol were. Similarly, unlike with most geofence warrants or tower dumps, which are used to find possible leads for a crime, here, FBI had an overwhelming list of suspects from its mass of tips and video evidence already: it wasn’t relying on location data to find suspects. Plus, with normal geofence warrants and tower dumps, the vast majority of the data obtained comes from uninvolved people, posing a risk that those unrelated people could become false positives who, as a result, would get investigated closely. Here, again, anyone collected from location data inside the Capitol was by definition associated with the crime, either as witness, victim, or perpetrator.

Finally, the story not only didn’t rely on, but showed little familiarity with the hundreds of arrest affidavits released so far, which provide some explanation (albeit undoubtedly parallel constructed) for how the FBI built cases against those hundreds of people.

Well before The Intercept article was written, there were a few interesting techniques revealed in the affidavits. Perhaps the most interesting (and not specifically covered in The Intercept article, unless as a hybrid order) described identifying Christopher Spencer from the livestreams on Facebook he posted from inside the Capitol.

The government received information as part of a search warrant return that Facebook UID 100047172724820 was livestreaming video in the Capitol during these events. The government also received subscriber information for Facebook UID 100047172724820 in response to legal process served on Facebook. Facebook UID 100047172724820 is registered to Chris Spencer (“SPENCER”). SPENCER provided subscriber information, including a date of birth; current city/state, and a phone number to Facebook to create the account.

[snip]

The government received three livestream videos from SPENCER’s Facebook UID 100047172724820 as part of a search warrant return. At different times during the videos, Spencer either used the rear facing camera to show himself talking, or turned the phone toward his face. Your affiant would note that the camera is capturing a reversed image of SPENCER in two of these sections of video as evidenced by the text on SPENCER’s hat. As such, reversed images are also provided below the original screenshot [my emphasis]

The first mention of the Facebook return appears before a paragraph describing an associate of Spencer’s who had seen the videos and recognized his wife, and the later paragraph describes the associate sharing a phone number for Spencer that the FBI seemed to have already received from Facebook. As written (and this structure is matched in the affidavit for Spencer’s wife, Jenny) the narrative may indicate that the FBI obtained the Facebook return before the tip and identified Spencer from the Facebook return even before receiving the tip. This is one of the strongest pieces of evidence that the FBI used data obtained from location-based collection in the Capitol from any social media source to identify an unknown subject. But, as described, it also has some protections built in. The data was obtained with a warrant, not PRTT or d-order. That means the FBI would have had to show probable cause to obtain the content (but, for the reasons I explained above, most people in the Capitol live-streaming were committing a crime). There’s also no indication here that this video was privately posted (though with a warrant the FBI would be able to obtain such videos).

All this is a read of what this paragraph might suggest about data collection. It doesn’t describe whether the data was obtained via a particularized warrant (targeting just Spencer), or whether the FBI asked Facebook to provide all live-streaming posted from within the Capitol during the insurrection (there are other early affidavits that targeted the content of Facebook via individualized warrants). In Spencer’s case, I suspect it’s the latter (there’s nothing that remarkable about Spencer’s video, except he was outside Speaker Pelosi’s office). Even so, for most people, posting from inside the Capitol during the insurrection would amount to probable cause the person was trespassing.

Even before The Intercept piece was posted I had also pointed to the affidavit for the Kansas cell of the Proud Boys. It uses location data to place one after another of the suspects “in or around” the Capitol during the insurrection: cell site data showed that the phones of Christopher Kuehne, Louis Colon, Felicia Konold were “in or around” the Capitol during the insurrection. That of Cory Konold, Felicia’s brother, was not shown to be, but,

Lawfully-obtained cell site records indicated that the FELICIA KONOLD cell called a number associated with CORY KONOLD while in or around the Capitol on January 6, 2021.

The most interesting detail in that affidavit pertained to William Chrestman. His phone wasn’t IDed off a cell site. Rather, it was IDed by connecting to Google services “in or around” the Capitol.

According to records produced by CHRESTMAN’s wireless cell phone provider in response to legal process, CHRESTMAN is listed as the owner of a cell phone number (“CHRESTMAN cell”). Lawfully-obtained Google records show that a Google account associated with the CHRESTMAN cell number was connected to Google services and was present in or around the U.S. Capitol on January 6, 2021.

A more recent document — the complaint against the southern Oath Keepers obtained on February 11 but unsealed long after that — describes the phones of those suspects in an area “includ[ing]” (but not necessarily limited to) the interior of the Capitol.

having utilized a cell site consistent with providing service to the geographic area that includes the interior of the United States Capitol building.

Unlike Spencer, the use of location data in the Proud Boys and Oath Keeper complaints seems to be used to establish probable cause. In both the militia group cases, the individuals appear to have been identified via different means (unsurprisingly, given their flamboyantly coordinated actions), with the location data being used in the affidavit to flesh out probable cause. (Undoubtedly, the FBI exploited this information far more thoroughly in an effort to map out other co-conspirators, but it is equally without doubt that the FBI had adequate probable cause to do so.)

The other day, DOJ unsealed an affidavit — that of Jeremy Groseclose — that provides more detail about the location collection at the Capitol. The FBI describes identifying Groseclose off of two tips, both on January 7, from people who had seen him post about being in the Capitol on Facebook (and in one case, remove his Facebook posts after he posted them).

Groseclose wore a gas mask for much of the time he was inside the Capitol (though wore the same clothes as he had outside), which undoubtedly made it more difficult to prove he was the person illegally inside the Capitol preventing cops from ousting the rioters.

The FBI affidavit describes times when Groseclose appears on security footage from inside the Capitol without the gas mask, but doesn’t include it. To substantiate his presence in the Capitol, the FBI included three paragraphs describing what must be a Google geofence warrant showing the device identifiers for everyone within a certain geographic area.

According to records obtained through a search warrant served on Google, a mobile device associated with [my redaction]@gmail.com was present at the U.S. Capitol on January 6, 2021. Google estimates device location using sources including GPS data and information about nearby Wi-Fi access points and Bluetooth beacons. This location data varies in its accuracy, depending on the source(s) of the data. As a result, Google assigns a “maps display radius” for each location data point. Thus, where Google estimates that its location data is accurate to within 10 meters, Google assigns a “maps display radius” of 10 meters to the location data point. Finally, Google reports that its “maps display radius” reflects the actual location of the covered device approximately 68% of the time. In this case, Google location data shows that a device associated with [my redaction]@gmail.com was within the U.S. Capitol at coordinates associated with the center of the Capitol Building, which I know includes the Rotunda, at 2:56 p.m. Google records show that the “maps display radius” for this location data was 34 meters.

Law enforcement officers, to the best of their ability, have compiled a list (the “Exclusion List”) of any Identification Numbers, related devices, and information related to individuals who were authorized to be inside the U.S. Capitol during the events of January 6, 2021, described above. Such authorized individuals include: Congressional Members and Staffers, responding law enforcement agents and officers, Secret Service Protectees, otherwise authorized governmental employees, and responding medical staff. The mobile device associated with [my redaction]@gmail.com is not on the Exclusion List. Accordingly, I believe that the individual possessing this device was not authorized to be within the U.S. Capitol Building on January 6, 2021. Furthermore, surveillance footage from the Rotunda, time-stamped within a minute of 2:56 p.m., shows GROSECLOSE, in his distinctive clothing, using his cell phone in an apparent attempt to take a picture.

Records provided by Google revealed that the mobile device associated with [my redaction]@gmail.com belonged to a Google account registered in the name of “Jeremy Groseclose.” The Google account also lists a recovery SMS phone number that matches [my redaction]. The recovery email address for this account appears to be in the name of GROSECLOSE’s significant other, with whom he has two children in common. Additionally, I have reviewed subscriber records from U.S. Cellular, related to the phone number [my redaction]. This number, along with another, are connected to an account in the name of GROSECLOSE’s significant other. The billing address for this account is [my redaction]. One of GROSECLOSE’s neighbors identified [my redaction] as GROSECLOSE’s address.

This seems to confirm that FBI obtained a geofence warrant from Google, but — at least as described — it was focused on those at the Capitol, perhaps focused on the Rotunda and anything 100 feet from it. This is the kind of granularity that will exclude most uninvolved people. They may have used it (or included it in the affidavit) because by wearing a gas mask, Groseclose made it difficult to show his face in the existing film of the attack.

The affidavit suggests that the Google geofence relied not just on GPS data of users’ phones, but also Wi-Fi access points (there’s another affidavit where the suspect’s phone triggered the Capitol Wi-Fi) and Bluetooth beacons. Again, given how wired the Capitol is, this would offer a granularity to the data that wouldn’t exist in most geofence warrants.

Finally, and most interestingly, this affidavit (obtained on the same day as the The Intercept story and so presumably after the Intercept called for comment) describes that the FBI has an “Exclusion List” of everyone who had a known legal right to be in the Capitol that day. That suggests that, after such time as the FBI completed this list, they could identify which of those present in the Capitol were probably there illegally.

There are concerns about FBI putting together a list like this. After all, Members of Congress might have good Separation of Power reasons to want to keep their personal phone numbers private. That said, there’s reason to believe that the FBI has used this method of separating out congressional identifiers and creating a white list in the past (including with the Section 215 phone dragnet), with congressional approval.

The concern arises in FBI’s definition of how it describes those legally present:

  • Members of Congress
  • Congressional staffers
  • Law enforcement responding to the insurrection (as distinct from law enforcement joining in it)
  • Secret Service Protectees (AKA, Mike Pence and his family)
  • Other government employees (like custodial staff)
  • Medical staff

Not on this list? Journalists, not even those journalists holding valid congressional credentials covering the vote certification.

Already, there have been several cases where suspects have claimed to be present as media, only to be charged both because of their comments while present and the fact that they don’t have congressional credentials. Three are:

  • Provocateur John Sullivan, who filmed the riot and sold the footage to multiple media outlets and “claimed to be an activist and journalist that filmed protests and riots, but admitted that he did not have any press credentials.”
  • Nick DeCarlo, who told the LA Times he and Nicholas Ochs were there as journalists but who FBI noted, “is not listed as a credentialed reporter with the House Periodical Press Gallery or the U.S. Senate Press Gallery, the organizations that credential Congressional correspondents.”
  • Brian McCreary, who on his own sent the video he took on his phone while inside the Capitol, but who later admitted to the FBI that entering the Capitol “might not have been legal” and also described admitting to cops present that he was not a member of the media.

If the FBI is going to use official credentials to distinguish journalists from trespassers, then it could also use those credentialing lists to white list journalists present at the Capitol. But to do that, the journalists in question would have to be willing to share identifying information for all the devices that were turned on at the Capitol, something they might have good reasons not to want to do.

Plus, I suspect there are a number of journalists without Congressional credentials who were covering the events outside the Capitol and, as the rally turned into a riot, entered the Capitol to cover it. Those journalists risked their lives and provided some of the most important early information about the riot and did so in ways that in no way glorified it. But in doing so, their devices may be in an FBI database relating to the attack.

There is clear evidence that the FBI obtained location data from the Capitol as part of its investigation, including Google and almost certainly Facebook. Thus far, the available evidence suggests that the ability to target that collection narrowly limits the typical concerns about tower dumps and geofence warrants (again, any similar data collection outside the Capitol in an effort to find the person who left the pipe bombs is another issue). Moreover, almost all those legal present in the Capitol appear to be whitelisted.

But not all. And the exception, journalists, include those who have the most at stake not having their devices identified and investigated by the FBI.

All that said, perhaps a similarly controversial question pertains to preservation orders. The Intercept describes a letter from Mark Warner calling on carriers to preserve data (and rightly questioning his legal authority to make such a request), then suggests the carriers have done so on their own.

Some of the telecommunications providers questioned whether Warner has the authority to make such a request, but a number of them appear to have been preserving data from the event anyway because of the large scale of violence, the source said.

The story doesn’t consider the — by far — most likely explanation, which is that FBI served very broad preservation orders on social media companies (though some key ones, such as Facebook, would keep data for a period even after insurrectionists attempted to delete it in the days after the attack as normal practice). In any case, broad preservation orders on social media companies would be solidly within existing precedent. But I suspect it may be one of the more interesting legal questions that will come out of this investigation.

Update March 7: Added McCreary.

Some Key Gaps in the January 6 Story [Updated]

DOJ continues to roll out arrests of people involved in the January 6 coup attempt.

But there are some obvious gaps in the (public) story so far.

Arrests relating to over 100 police assaults

In a filing submitted over the weekend, the government asserted that 139 cops were assaulted during the insurrection.

In the course of the insurrection, approximately 81 Capitol Police and 58 MPD officers were assaulted,

In its website tracking the people arrested so far, DOJ describes assault charges being filed against 12 people (updated on 2/1 to total 17 people):

  1. Daniel Page Adams, whose arrest affidavit describes engaging in a “direct struggle with [unnamed] law enforcement officers” (his cousin, Cody Connell, described the exchange as a “civil war”).
  2. Zachary Alam, who pushed cops around as he was trying to break into the Speaker’s Lobby.
  3. Matthew Caspel, who charged the National Guard.
  4. Scott Fairlamb, who was caught in multiple videos shoving and punching officers (one who whom is identified but not named); Cori Bush has said she was threatened by him last summer.
  5. Kyle Fitzsimons, who charged officers guarding the doorway of the Capitol.
  6. Alex Harkrider, who after being filmed fighting with police at the door of the Capitol, posted a picture with a crowbar labeled, “weapon;” he was charged with abetting Ryan Nichols’ assault.
  7. Michael Foy, a former Marine who was caught on multiple videos beating multiple cops with a hockey stick.
  8. Robert Giswein, who appears to have ties to the Proud Boys and used a bat to beat cops.
  9. Emanuel Jackson, whom videos caught punching one officer, and others show beating multiple officers with a metal baseball bat.
  10. Chad Jones, who used a Trump flag to break the glass in the Speaker’s Lobby door just before Ashli Babbitt was shot and may have intimidated three officers who were pursuing that group.
  11. Edward Jacob Lang, who identified himself in a screen cap of a violent mob attacking cops and who was filmed slamming a riot shield into police and later fighting them with a red baseball bat.
  12. Mark Jefferson Leffingwell, whom a Capitol Police officer described in an affidavit punching him.
  13. Patrick Edward McCaughey III, who was filmed crushing MPD Officer Daniel Hodges in one of the doors to the Capitol.
  14. Ryan Nichols, who was filmed wielding a crowbar and yelling, “This is not a peaceful protest,” then spraying pepper spray against police trying to prevent entry to the Capitol.
  15. Dominic Pezzola, a Proud Boy who stole a shield from cops.
  16. Ryan Samsel, who set off the riot by giving a cop a concussion; he appears to have coordinated with Joe Biggs.
  17. Robert Sanford, who was filmed hitting Capitol Police Officer William Young on the head with a fire extinguisher.
  18. Peter Schwartz, a felon who maced several cops.
  19. Barton Wade Shively, who pushed and shoved some police trying to get into the Capitol, punched another, then struck one of those same cops later and kicked another.

While a number of these men — Fairlamb, Jackson, Nichols, Shively, among others — allegedly assaulted multiple cops, that’s still far below the total of 139 alleged assaults.

That says the FBI is still looking for a significant number of people in assaults on police. Over the weekend, the FBI released BOLO posters showing 12 other men believed to have assaulted police — including two targeting individuals specifically.

The murder of Brian Sicknick

Of particular note, while the FBI has released a BOLO poster focused on the men who assaulted MPD Officer Michael Fanone, no such post has identified suspects as those suspected of killing Brian Sicknick (though note that Robert Sanford did assault a different officer with a fire extinguisher). There are many possible explanations for why his murder might be treated differently (not least that the culprits are more likely to flee).

But we haven’t seen anything to suggest who assaulted Sicknick badly enough to lead to his death.

The DNC and RNC bomber

On January 21, the FBI increased their reward for information leading to the guy believed to have planted pipe bombs at the DNC and RNC. But there’s no sign they’ve found the guy yet.

Rudy’s interlocutors

On January 15, Rudy Giuliani posted texts involving “James Sullivan” claiming he was going to blame the riot on “John,” that he had gotten “my agent out of trouble along with three other” Utahans, and mentioning “Kash.”

“John” is James’ brother, John Sullivan, someone long ago IDed by leftist activists as a provocateur who had been charged two days earlier. He was arrested on January 14, but bailed the next day.

“Kash,” is Kash Lee Kelly, whose parole officer IDed him at the scene. His bail in the gang-related drug conviction he was awaiting sentencing for in IL was revoked on January 14.

John Sullivan is the only Utahan that GWU identifies as being from Utah, meaning the three Utahans, in addition to James Sullivan, he claims to have gotten out of trouble thus far are (publicly at least) still not in trouble. No one yet arrested is identifiable as his “agent,” either.

That means, key people who might be a pivot between the rioters and Rudy Giuliani, who was coordinating events in Congress with an eye to how much time the rioters would give him, remain (again, publicly at least) at large.

There are around 73 sealed cases in the DC District, many of which probably having nothing to do with the January 6 insurrection and some of which are surely defendants already publicly charged whose cases have not yet been unsealed in the DC docket. The reasons for unsealing could vary — though the most common would be that someone hasn’t been arrested yet). Still, some of these sealed cases may be people who’ve already moved to cooperate.

Update, 2/1: I’ve updated the list of those charged with assault.

Rudy Giuliani and Jack Posobiec Claim a False Flag

Yesterday, the FBI arrested John Sullivan, one of the guys who took video showing Ashli Babbitt’s shooting in the January 6 insurrection. As the arrest affidavit describes, in an interview the day after the riot, Sullivan claimed he had been acting as a journalist at the riot.

SULLIVAN claimed to be an activist and journalist that filmed protests and riots, but admitted that he did not have any press credentials.

[snip]

23. At various times in his statements to law enforcement, to others inside the U.S. Capitol that were recorded in his video, and to news outlets, SULLIVAN has claimed he was at the U.S. Capitol only to document and report. In addition, your affiant is aware that, at various times, SULLIVAN has claimed to be a journalist. He has admitted, however, that he has no press credentials and the investigation has not revealed any connection between SULLIVAN and any journalistic organizations.

The affidavit describes that, at some protest in DC, Sullivan made anti-Trump comments.

The United States obtained a video of SULLIVAN, posted on YouTube, in which, while attending a protest in Washington, D.C., SULLIVAN can be seen telling a crowd, over a microphone, “we about to burn this shit down,” “we got to rip Trump out of office . . . fucking pull him out of that shit . . . we ain’t waiting until the next election . . . we about to go get that motherfucker.” SULLIVAN then can be seen leading the crowd in a chant of, “it’s time for a revolution.”1

But it quotes from a video he shared with the FBI repeatedly speaking of “we,” including himself in the mob. On several occasions, Sullivan convinced police to stand down (including in front of the Speaker’s Lobby, just before Babbitt was shot). And it provides evidence that Sullivan broke a window in one of the offices.

h. At one point in the video, SULLIVAN enters an office within the U.S. Capitol, as seen in the screenshot below. Once inside the office, SULLIVAN approaches a window, also seen in the screenshot below, and states, “We did this shit. We took this shit.”

i. While at the window, a knocking noise is heard off-screen. The camera then pans to show more of the window and a broken pane can be seen that was not broken on SULLIVAN’s approach to the window:

SULLIVAN can then be heard saying, “I broke it. My bad, my apologies. Well they already broke a window, so, you know, I didn’t know I hit it that hard. No one got that on camera.” SULLIVAN then exits the office.

Sullivan is charged with violent entry of Congress and impeding police officers during a civil disorder. He is not charged with breaking the window.

Even before his arrest, left wing activists had described concerns in that community, going back some time, that Sullivan was a provocateur working with others, including his brother James, who has ties to the Proud Boys and runs a pro-Trump organization.

But shortly after Sullivan’s arrest was reported, right wing propagandist Jack Posobiec pounced on his arrest, claiming it showed that BLM was behind the attacks and and that Sullivan’s actions led to Babbitt’s death (remember these screen caps have GMT, so subtract 5 for ET).

Then, in the middle of the night Rudy’s time, he posted a text from what appears to be John’s brother James.

Rudy presents this as proof that the riot was conducted by Antifa. But it instead seems to show that John’s brother (the phone number is in Utah, where they’re from) claimed to be, “working with the FBI,” had gotten his “agent” and three others out of trouble (Rudy did not show when he received this text, so it may have predated John’s arrest). It also showed that Sullivan seemed to have ties with someone named Kash, who might be Patel, the Devin Nunes flunky who got installed as DOD’s Chief of Staff. Patel would likely have had a key role in ensuring the National Guard delayed any response to the riot last week.

A Nazi sympathizer and the President’s lawyer seemed prepared to speak from the script that Donald Trump seems to have written the day before the riot, when he moved towards naming Antifa a terrorist organization. The OANN propagandist and chief purveyor of fraudulent claims about the election are attempting to use the arrest of John Sullivan to claim that their own people did not plan out this coup attempt.

In the process, however, Rudy Giuliani may have tied the President and the Proud Boys, and the Pentagon together in the plot. And Rudy’s calls to Tommy Tuberville after people had already died, that ties people n Congress to the attempts to assassinate members of Congress.

Update: I’ve been persuaded that “Kash” is someone else who was detained after the raid, so deleted references to Kash Patel. That person, Kash Kelly, is probably a convicted gang member awaiting his sentencing.

Update: Corrected that the anti-Trump comments may not have been at this protest.