Posts

Joseph Hackett’s Detention Argument: Guns, Operational Security, and Involvement in Kelly Meggs’ Plans for Nancy Pelosi

In a status hearing in the Oath Keeper conspiracy case on August 10, Kathryn Rakoczy revealed the government had provided “certain information” to defendants that might limit or shape defense theories. She then mentioned uncharged individuals or unindicted co-conspirators.

How Person Fifteen became D-2

Then yesterday, in a memo supporting continued pretrial detention for Joseph Hackett, the government rolled out a new way to refer to those who’ve entered into cooperation agreements against their former co-conspirators (and siblings): D-1 and D-4, as opposed to Person One, Person Two, and Person Ten.

D-1, who shared details of the organizational structure of the Florida Oath Keepers, may be Graydon Young, whom the indictment describes getting operational security instructions from Hackett shortly after he joined the Oath Keepers and who lives about 30 miles from Sarasota.

According to a defendant who has pled guilty pursuant to a cooperation plea agreement (and who will be referred to as D-1), Defendant Hackett was the “leader” of the Oath Keeper CPT5 group of approximately five men from the Sarasota area. According to D-1, the organization’s hierarchy had D-1 reporting to the CPT team leader (here, Hackett), who would report to the State lead (here, Kelly Meggs).

5 D-1 did not know what CPT stood for, but other Oath Keeper materials suggest it stood for “community preparedness team.”

D-4, who shared details of what Hackett did on January 7, may be Caleb Berry, who drove to and from the insurrection from Florida.

According to a defendant who has pled guilty pursuant to a cooperation plea agreement (and who will be referred to as D-4), Defendant Hackett was one of the members of the Oath Keepers who deposited long guns at the Comfort Inn Ballston on January 5 and collected them on January 7.

[snip]

In other words, while Defendant Hackett had his phone with him at the Capitol – he is seen on surveillance video holding it up to take a picture or video, and he admitted to D-4 that he had recorded a video that he later deleted – he took substantial efforts to ensure that he would not be linked to the phone, and that the phone would not be linked to the Capitol attack.

[snip]

According to D-4, on January 7, 2021, while Defendant Hackett was in a car driving from Washington, D.C., to Florida, with co-defendant Kelly Meggs and others, he admitted that he had already deleted from his iPhone a video he had taken while inside the Capitol the prior day

But the numbering system is bound to make Oath Keepers and conspiracists like Darren Beattie, Tucker Carlson, and Glenn Greenwald more paranoid. That’s because, if my assumptions above are correct, the counting appears to start with Young, not the first Oath Keeper known to enter a cooperation agreement, Jon Schaffer, who did so on April 14 (Young was second, Mark Grods was third, and Berry was fourth; the subtitle of this section is based on a wildarse guess that in this scheme, Grods, who was described before he flipped as Person Fifteen, would become D-2). That suggests someone else may have flipped, possibly between June 28 (when Grods pled) and July 7 (when Berry did).

Checking the East Door

The detention motion includes a long description of Hackett’s attempts to use operational security while hanging out with a bunch of people who weren’t, such as this picture showing him using his customary face covering while hanging out with a bunch of people who didn’t.

It also elaborates on a narrative that had shown up in earlier detention motions. It describes Hackett moving inside the Capitol with (it says) Kelly Meggs and Kenneth Harrelson, from the Rotunda to outside of Nancy Pelosi’s door. From there, Hackett walked back to the East Door of the Capitol, as if he was waiting for someone, and then returned to (the government presumes, though they may have video of this now from other defendants) Pelosi’s door.

Attached as Exhibit 3 is a compilation of Defendant Hackett’s movements within the Capitol for the approximately 12 minutes he remained inside, as captured on surveillance video. Notably, he spent most of his time with his co-conspirators Kelly Meggs, Moerschel, and Harrelson. At around 2:45 p.m., Defendant Hackett left the Rotunda through the south door, headed towards the House of Representatives (and the office of Speaker Pelosi).

[snip]

Defendant Hackett was not visible on camera for approximately one minute. He then went to check on the exterior doors through which the group entered, before returning to his coconspirators south of the Rotunda, near the Speaker’s office, where he remained, off camera, for approximately 5 minutes. This is the area and the time that Kelly Meggs and Harrelson were similarly not visible on surveillance video.

Exhibit 3 consists of 26 photos showing which of his actions from inside the Capitol were captured on CCTV — far more detail than the three paragraphs describing Hackett’s movement included in the indictment.

146. After they penetrated the Capitol building, CROWL, WATKINS, SANDRA PARKER, Young, STEELE, KELLY MEGGS, CONNIE MEGGS, HARRELSON, HACKETT, DOLAN, ISAACS, MOERSCHEL, Berry, and the others in the Stack collectively moved into an area inside the building known as the Capitol Rotunda.

[snip]

155. At2:45 p.m, KELLY MEGGS, CONNIE MEGGS, HARRELSON, HACKETT, DOLAN, MOERSCHEL, and Berry walked southbound outof the Rotunda and towards the House ofRepresentatives.

[snip]

158. At2:54 p.m. HACKETT and MOERSCHEL exited the Capitol.

After milling about the Rotunda, Hackett walks across it to talk to Meggs and Harrelson. Berry — who may be D-4, but who definitely has agreed to tell the government everything he knows — was present.

The detention memo suggests they — apparently including Berry and Connie Meggs, though the detention motion doesn’t mention them — went from here to stand outside Pelosi’s office, and then Hackett — apparently by himself — came back through the Rotunda, stood outside the East Door, looking outward, as if waiting to meet with someone.

Hackett then enters back into the Capitol, goes back to where he (apparently) left Moerschel, Harrelson, and Meggs, along with Berry and Connie Meggs (though they aren’t mentioned) and then he and Moerschel exit the building.

Joseph Hackett’s detention motion is about Kelly Meggs

The government largely substantiates their argument that Hackett is too much a threat to be released with their evidence that he’s a leader of an organized militia, armed, and went to great lengths — both in real time and after the fact — to obscure his actions. Hackett’s actions inside the Capitol — unlike many of his co-defendants, he is not charged with an additional resisting cops or civil disorder charge for anything he did inside the building — would seem to add little.

The government gets there, repeatedly, by tying Hackett’s own actions to those of Meggs, to whom (D-1 has testified) he reported in the Oath Keeper hierarchy. In Hackett’s detention motion, for example, the government adds to a text they had included, in similar associative fashion, in Kenneth Harrelson’s detention motion showing Meggs admitting that “we looked for[] her.

In Hackett’s detention memo, they show that the night of the election (they get the conversation from UTC wrong and falsely claim this happened very late the night of the election; it would have happened before polls closed in much of the country), Meggs was threatening to “go on a killing spree … Pelosi first.”

And, almost gratuitously, the government uses a reference to the DC Circuit’s decision upholding Christopher Worrell’s detention as a way to remind Judge Amit Mehta that Meggs had purportedly orchestrated a plan with the Proud Boys.

In Worrell, the D.C. Circuit held that the “district court’s dangerousness determination was [not] clearly erroneous,” based in part on the defendant’s “membership in and alleged coordination with the Proud Boys, some of whose members have been indicted for conspiring to attack Congress.” 848 F. App’x at 5-6.8 The same heightened dangerousness applies here, as the actions of self-proclaimed members of the Proud Boys and Oath Keepers are similarly situated in terms of their dangerousness based both on their personal actions and their coordination with their coconspirators. And not only have 18 Oath Keeper members and affiliates (Defendant Hackett included) been indicted in this case, but there is also evidence of coordination between the Oath Keepers and the Proud Boys. (See Gov’t Opp to Kelly Meggs’ Motion for Pretrial Release (ECF 98) at 8 (quoting December 22, 2020, Facebook message: “we have made Contact with PB and they always have a big group”)), and 10 (quoting December 25, 2020, Facebook message: “we have orchestrated a plan with the proud boys. I have been communicating with [redacted] the leader.”).)

It’s as if to say that Hackett is dangerous by himself, but he’s especially dangerous (or just as likely, important to flip) because he was part of what Kelly Meggs was involved with on the day of the insurrection.

The pictures included as an exhibit seem to suggest that not just Hackett — but also Connie Meggs (who would have spousal privilege but who also just got a new lawyer) and Caleb Berry, who may be D-4, a witness to efforts to try to destroy evidence about what happened during the insurrection — were witnesses to whatever Meggs was up to when he went to the office of the woman he threatened to kill on the night Biden won the election. What Hackett would know is why he went back to the door of the Capitol, as if awaiting someone.

According to the government, that makes him dangerous and likely to obstruct the investigation.

Update: This analysis adds to the evidence that Berry is the guy standing by the stair doors at the QRF hotel, and therefore almost certainly D-4.

Graydon Young: Trading a Potential Terrorism Enhancement for Testimony against His Sister

As of this moment, the government has obtained five misdemeanor guilty pleas, one straight up felony plea, and two cooperation pleas in the January 6 investigation. With an eye towards understanding the Graydon Young plea, I’d like to look at the stories — or lack thereof — that the government is telling with its Statements of Offense.

DOJ’s reticent Statements of Offense

Thus far, the government is using Statements of Offense for their functional purpose, to lay out how the defendant’s behavior meets the elements of the offense to which they plead guilty, and not to tell a larger story about the investigation (as, for example, in the Robert Mueller did with some of his guilty pleas).

Generally, the misdemeanor SOO are more succinct than the arrest affidavit for the same defendant. For example, in their SOO, there’s less detail of Jessica and Joshua Bustle’s social media postings or evidence from the geofence warrants than in their arrest affidavit. Instead the SOO lays out that they were in the Capitol, that they carried anti-vaccine signs (which supports their parading charge), and adds that the reason they were there was to “demonstrate against the certification of the vote count.” Similarly, Robert Reeder’s SOO doesn’t include details of the pictures he took while inside the Capitol, which were described in his arrest warrant; it focuses on the alarms ringing when Reeder entered the building, that Reeder ignored a cop’s response that “We don’t have any water in here, sir” when he walked past the cop into the building, and his second trip inside, all evidence making it clear his trespass was knowing and intentional. There is something new in Bryan Ivey’s SOO that wasn’t in his arrest affidavit: that he deleted all the photos and videos he took inside the Capitol which, if the FBI wasn’t able to restore them, would represent the loss of valuable evidence about the first rioters inside the building.

That will likely be used in sentencing to distinguish Ivey at sentencing from someone like Anna Morgan-Lloyd who was able to fully cooperate with law enforcement.

Similarly, the SOO for the one straight felony plea, that of Paul Hodgkins, adds almost nothing from his arrest affidavit, aside from a paragraph establishing his intent to obstruct the vote count, which is an element of the obstruction charge he pled guilt to.

Hodgkins knew at the time he entered the U.S. Capitol Building that that he did not have permission to enter the building, and the defendant did so with the intent to corruptly obstruct, influence, and impede an official proceeding, that is, a proceeding before Congress, specifically, Congress’s certification of the Electoral College vote as set out in the Twelfth Amendment of the Constitution of the United States and 3 U.S.C. §§ 15-18.

There’s not even any language explaining the import of Hodgkins having helped occupy the Senate, as compared to those charged with misdemeanors.

There’s nothing at all wrong with this. Indeed, with the conveyor belt of plea deals that are about to go forward, doing this as efficiently and soundly, from a legal standpoint, as possible makes sense.

The cooperation deals also don’t tip DOJ’s hand

It’s not surprising, then, that the SOOs for the two cooperation deals provide little hint of what the men, Oath Keepers Jon Schaffer and Graydon Young, traded in hopes of working off their sentences. Admittedly, Schaffer’s SOO included two comments he made at the Million MAGA March on November 14, 2020 that were also included in his arrest affidavit. But like the arrest affidavit, the only link made between Schaffer’s actions on January 6 and the Oath Keepers is the Oath Keepers hat he wore to insurrection.

Instead, Schaffer’s SOO focuses on the elements needed to sustain Schaffer’s obstruction and trespassing with a deadly weapon (bear spray) charges.

Wearing a tactical vest and armed with bear spray, SCHAFFER unlawfully entered the building with the purpose of influencing, affecting, and retaliating against the conduct of government by stopping or delaying the Congressional proceeding by intimidation or coercion.

We know that Schaffer is cooperating against other Oath Keepers. A discovery letter Kathryn Rakoczy sent on April 23 explained that,

On Wednesday, April 21, 2021, we emailed you about Jon Schaffer, who pled guilty last week, with respect to the information we have at this time about whether Mr. Schaffer has had communications with your clients.

But the SOO doesn’t reveal any of what Schaffer might say.

Similarly, Graydon Young’s SOO doesn’t reveal what he might have offered prosecutors in hopes of working away the estimated 63 to 78 months he faces on the charges to which he pled guilty. Though by examining the history of the charges against him with what did get included in his SOO, we might guess what he offered.

How Graydon Young ended up pleading out of terrorism exposure

The government was prepared to arrest Young with a January 18 arrest warrant charging him with trespassing, obstruction of the vote count, and obstruction for deleting his Facebook account. Instead, they held off until February, when they arrested Young along with his sister, Laura Steele, and Kelly and Connie Meggs as part of the First Superseding Indictment, which added conspiracy and aiding and abetting the destruction of government property (18 U.S.C. §1361) charges to Young’s legal woes. The Third Superseding Indictment added no charges against Young. But the Fourth added a civil disorder charge that also implicated his sister and Jessica Watkins (as well as civil disorder, assault, and obstruction charges for some others). As I described at the time, the government was effectively turning the screws, enhancing most defendants’ legal jeopardy — albeit with charges that were already foreshadowed in case filings — as they awaited discovery. It was utterly ruthless, and about par for the course for DOJ, particularly for a complex conspiracy case.

By pleading guilty, Young not only got 3 levels of credit for pleading guilty, but the civil disorder and damage to the building charge were dismissed. Notably, the latter charge is what can be used to add a terrorism enhancement at sentencing, so by pleading, Young basically avoided being treated, legally, as a terrorist if and when DOJ decides to go there. In addition, Young’s initial charge for deleting his Facebook account got added as a two level enhancement to his obstruction charge. Had he been convicted of everything at trial, Young probably would have been sentenced to that as a separate crime concurrently, so effectively by pleading it just made his existing obstruction exposure worse.

Here’s what all that looks like in the mumbo jumbo of sentencing levels, which gives a sense of how DOJ is treating the Oath Keepers’ obstruction of the vote count as distinct from Paul Hodgkins, whose base level calculation (which did not include the threats of violence and damage, the extensive planning, or the obstruction charged against Young himself) was 17.

U.S.S.G. § 2J1.2 Base Offense Level 14

U.S.S.G. § 2J1.2(b)(1)(B) Causing/Threatening Injury or Damage +8

U.S.S.G. § 2J1.2(b)(2) Substantial Interference With Justice +3

U.S.S.G. § 2J1.2(b)(3)(C) Extensive Scope, Planning, or Preparation +2

U.S.S.G. § 3C1.1 Obstruction (destroying documents) +2

Total 29

Apropos of nothing (except that this conspiracy is getting closer to Roger Stone), this is precisely the same guidelines calculation as DOJ used with Stone, and — except for threatening a judge rather than deleting Facebook — for the same reasons.

So Paul Hodgkins, who obstructed the vote by going alone to the Senate floor and occupying that space with people like Jacob Chansley, faces 15 to 21 months, whereas Young, by planning ahead with a militia and going into the day planning for violence, faces 63 to 78 months (though avoids the terrorism enhancement that DOJ has been hinting they may use against the conspirators).

What is and is not in Young’s Statement of Offense

With that as background, I’d like to look at what got included and excluded in Young’s SOO, and what got excluded (which I’ll argue may hint at what he’ll cooperate with DOJ on).

The core of Young’s SOO substantiates the obstruction charge in language similar to that used with Hodgkins:

16. At the time Mr. Young forcibly entered the building, Mr. Young believed that he and the co-conspirators were trying to obstruct, influence, and impede an official proceeding, that is, a proceeding before Congress, specifically, Congress’s certification of the Electoral College vote as set out in the Twelfth Amendment of the Constitution of the United States and the statutes listed in sections 15 through 18 of title 3 of the U.S. Code.

17. Mr. Young acted to affect the government by stopping or delaying the Congressional proceeding, and, in fact, did so. He accomplished this by intimidating and coercing government personnel who were participating in or supporting the Congressional proceeding.

In addition, ¶¶20-21 describe Young deleting his Facebook account and some of what he deleted, and ¶¶8-15 and ¶¶18-20 describe most of the overt acts attributed to him in the Fourth Superseding, correlating this way:

¶8 of the SOO describes making plans.

¶9 describes Young and “at least some of the co-conspirators” discussing the need for operational security includes a Proton Mail exchange in which Joseph Hackett described sending pictures to discuss, “locations, identities, Ops planning … to avoid digital reads.”

¶10 describes Young traveling with “at least one of the co-conspirators” — language of his SOO that will be used as evidence against his own sister, Laura Steele — to DC.

¶11 describes the Trump rally in very oblique terms: “an event near the White House.”

¶12 describes — again, in innocuous terms, “marched with at least some of the co-conspirators towards the U.S. Capitol” — as described as The Stack “preparing for battle and marching to the Capitol” in ¶101 of the Fourth Superseding.

¶13 describes entering the restricted grounds of the Capitol (one of the trespass charges) and what gear he wore.

¶14 describes The Stack entering the Capitol, as described in ¶132 of the Fourth Superseding.

¶15 describes The Stack walking through a damaged door (substantiating the 18 USC 1361 charge Young is no longer charged with) and tussling with cops.

As noted, ¶¶16-17 allocute the obstruction of the vote count.

¶18 describes six members of The Stack specifically pushing against a line of cops guarding the hallway (substantiating the Civil Disorder charge Young is no longer charged with but his sister is).

¶19 describes Young exiting the Capitol.

¶20 describes the content of something Young tried to delete from his Facebook account: “At around 4:22 p.m., Mr. Young posted on Facebook, “We stormed and got inside.'”

Even on its face, the SOO has Young admitting to overt acts, under oath, that implicate a number of his co-conspirators, especially Jessica Watkins, Hackett, and his sister, Laura Steele. That’s part of what DOJ got from Young in this plea deal: sworn testimony and therefore more pressure to plead against other alleged conspirators. This probably won’t be the last time in the January 6 investigation — possibly even in this conspiracy — that DOJ requires family members to testify against family members to get a plea deal.

But there are other things described in the Fourth Superseding that either don’t show up in the SOO or show up in such oblique fashion that they likely point to area where Young gave prosecutors something they didn’t have.

For example, the Fourth Superseding describes Young’s own effort to join the Oath Keepers, his efforts to recruit others, and his role in rushing his sister through the process (an utterly disastrous favor that Steele’s big brother did for her). If that’s covered in his SOO, it’s only in this vague language.

In advance of January 6, 2021, Mr. Young coordinated with certain individuals and affiliates of the Oath Keepers – referred to here as “the co-conspirators” – in making plans for what Mr. Young and the co-conspirators would be doing in Washington, D.C., on January 6.

In addition, the Fourth Superseding included details of a Signal planning chat in which Young was included.

At least as early as January 3, 2021, WATKINS, KELLY MEGGS, YOUNG, HARRELSON, HACKETT, DOLAN, ISAACS, and others known and unknown joined an invitation-only encrypted Signal group message titled “OK FL DC OP Jan 6” (hereinafter the “Florida Signal Chat”).

We know nothing of what was said on this chat. The uncertainty about when it was established suggests that the government may have obtained what it has of this chat via someone whose phone took some time to exploit, someone (possibly including Young) who was a relatively late addition to it. But certainly, whatever did take place on this chat would be one of the things incorporated into the “making plans” bullet described in the indictment, and key to showing not just that the Oath Keepers had entered into a conspiracy to conduct this operation, but probably details of how they coordinated with other militias in Florida

Relatedly, there’s the firearms training session Young set up, which is not included in his SOO but is included in the larger conspiracy.

47. On December 26, 2020, YOUNG wrote an email to a Florida company that conducts training on firearms and combat. YOUNG wrote, in part, “I trained with you not long ago. Since then I have joined Oath Keepers. I recommended your training to the team. To that effect, four of us would like to train with you, specifically in your UTM10 rifle class.”

Given how obliquely the SOO refers both to Young’s activities at the Trump rally and the decision to leave before it ended to head to the Capitol, I suspect he provided new details on that, as well.

We may not learn these details for weeks if not months (we still have no idea what Schaffer has been doing since he pled in April).

All DOJ’s telling us is that Graydon Young’s plea deal will make things worse for his co-conspirators, giving them even more incentive to flip on their own right.

Update: Benny Bryant reminds me that we do know some stuff about that Florida Signal chat, because it shows up in the government’s response to Kenneth Harrelson’s bid for bail. He also argues that the weapons training Young signed up for is not the training that the Meggses set up. [Deleted reference to Stone there.]

The Three Key Details the Proud Boy Unindicted Co-Conspirator Likely Revealed to Prosecutors

By March 1, the government had three pieces of evidence that form a key part of a conspiracy indictment accusing Ethan Nordean, Joe Biggs, Zachary Rehl, and Charles Donohoe of conspiring to breach the Capitol and by doing so, delaying the certification of the vote:

  • The Proud Boys used Baofeng radios set to a specific channel (which channel prosecutors knew)
  • After Enrique Tarrio’s arrest, Ethan Nordean got put in charge of the January 6 operation
  • The gang had a plan to split up to optimize the chances of success

A detention motion for Nordean submitted on that day included all three of these details. It described how the Proud Boys distributed Baofeng radios to use in the operation.

Arrangements were made to program and distribute multiple Baofeng radios5 for use by Proud Boys members to communicate during the event. Baofeng is a Chinese communications equipment manufacturer. Baofeng radios can be programmed to communicate on more than 1,000 different frequencies, making them far more difficult to monitor or overhear than common “walkie talkie” type radios. Specific radio frequencies were communicated to the Proud Boys.

5 Law enforcement recovered a Baofeng radio from Defendant’s home during the execution of a search warrant—the Baofeng radio recovered from Defendant’s home was still tuned to frequency that had been communicated to the group.

[snip]

The group led by Defendant arrived at the east side of the Capitol before noon. Several of the men in the group were holding Baofeng radios. Others had them clipped to their belts or jackets.

It described how Nordean was put in charge after Tarrio’s arrest.

Moreover, following the arrest of the Proud Boys’ Chairman on January 4, 2021, Defendant was nominated from within to have “war powers” and to take ultimate leadership of the Proud Boys’ activities on January 6, 2021.

[snip]

On January 4, 2021, Henry “Enrique” Tarrio, the self-proclaimed “Chairman” of the Proud Boys was arrested shortly after arriving in Washington, D.C., pursuant to a warrant issued by D.C. Superior Court. In communications between Proud Boys members following Tarrio’s arrest, it was acknowledged that Defendant would be among those that led the Proud Boys on the ground on January 6, 2021.

And it described a decision to split people up in an effort to increase the likelihood of actually shutting down the certification of the vote.

As noted more fully below, Defendant—dressed all in black, wearing a tactical vest—led the Proud Boys through the use of encrypted communications and military-style equipment, and he led them with the specific plans to: split up into groups, attempt to break into the Capitol building from as many different points as possible, and prevent the Joint Session of Congress from Certifying the Electoral College results.

[snip]

In order to increase the odds that their plan would succeed, Defendant and those Proud Boys following him dressed “incognito” and spread out to many different locations from which they could force entry into the Capitol. Defendant and others responsible for the January 6 Proud Boys event likely knew from experience that their typical tactic of marching in “uniform,” and in unison, would draw a concentrated law enforcement response to their location. By blending in and spreading out, Defendant and those following him on January 6 made it more likely that either a Proud Boy—or a suitably-inspired “normie”—would be able to storm the Capitol and its ground in such a way that would interrupt the Certification of the Electoral College vote

Even after prosecutors shared these damning claims, their bid to keep Nordean in jail failed. Nordean’s wife filed a declaration stating in part that Nordean obtained the radio on January 7 and, to her knowledge, he did not possess such a radio before that date.

An indictment against Nordean obtained on March 3 to comply with the Speedy Trial Act (but not released publicly until after the detention hearing) mentioned none of that.

And at the March 3 detention hearing before Beryl Howell, according to Zoe Tillman, the government withdrew the claim that Nordean had the Proud Boys split into groups as a factor for that detention hearing. In what the WaPo described as, “a remarkable stumble for prosecutors,”Judge Howell released Nordean to home detention, saying there was little evidence that Nordean played that leadership role.

Nordean “was a leader of a march to the Capitol. But once he got there it is not clear what leadership role this individual took at all for the people who went inside,” Howell said. “Evidence that he directed other defendants to break into or enter the Capitol is weak, to say the least.”

Nordean’s release marked a stumble for prosecutors, who have cast him as a key figure based on what Howell agreed were “ominous” communications before Jan. 6 that they said indicated he and other Proud Boys were planning “violent action” to overwhelm police and force entry to the Capitol. The judge’s decision sets back for now the government’s efforts to establish that there was a wider plot to that end.

[snip]

“The government has backed down from saying that he directly told them to split into groups and that they had this strategic plan,” Howell remarked.

Howell said that although Nordean’s release was a “close call,” she agreed with the defense that “there’s no allegation that the defendant caused injury to any person, or that he even personally caused damage to any particular property.”

Prosecutors claimed they had this evidence on March 1. But after failing to present it at that March 3 hearing, Nordean got released.

On March 15, the judge assigned to the case after Nordean got indicted, Timothy Kelly, issued an order delaying the arraignment scheduled for the next day. He offered no explanation.

What didn’t become clear until this week is that, on March 10, the government obtained the superseding indictment against Nordean and others. And then, on March 12, the government asked Judge Kelly to delay Nordean’s arraignment on his original indictment because of the superseding indictment. Prosecutors explained that revealing the indictment ahead of time would risk alerting Rehl and Donohoe before they could be arrested and their houses searched.

On March 10, 2021, a federal grand jury sitting in the District of Columbia returned a Superseding Indictment charging Defendant, and three co-defendants (two of whom were not previously charged), with Conspiracy, in violation of 18 U.S.C. § 371; Obstruction of an Agency Proceeding, in violation of 18 U.S.C. §§ 1512(c)(2), and 2; Obstructing Law Enforcement During a Civil Disorder, in violation of 18 U.S.C. §§ 231(a)(3), and 2; 18 U.S.C. §§ 1361, and 2; Entering and Remaining in a Restricted Building or Grounds, in violation of 18 U.S.C. § 1752(a)(1); and Disorderly and Disruptive Conduct in a Restricted Building or Grounds, in violation of 18 U.S.C. § 1752(a)(2).

The Superseding Indictment is under seal, pending the arrest of newly charged defendants and the execution of search warrants. Law Enforcement anticipates executing the arrests and search warrants of the new defendants in a coordinated operation on Wednesday, March 17, 2021. Once the arrests are executed, the Superseding Indictment will be unsealed.

The evidence the superseding indictment provides to substantiate claims first made on March 1 may explain an even bigger reason why prosecutors didn’t provide their evidence for those three claims in time to keep Nordean in custody: They had an unindicted co-conspirator (presumably someone cooperating with prosecutors) who was, along with the four conspiracy defendants, on an encrypted channel created after Enrique Tarrio’s arrest on January 4 that Proud Boy leaders used to continue planning for January 6. That unindicted co-conspirator was personally involved in all three details included in that detention memo against Nordean. He helped divvy up the Proud Boys to be spread out during the January 6 operation.

39. On after Chairman’s January 4, 2021, shortly after Proud Boys Chairman’s arrest pursuant to a warrant issued by D.C. Superior Court, DONOHOE expressed concern that encrypted communications that involved Proud Boys Chairman would be compromised when law enforcement examined Proud Boys Chairmans’ phone. DONOHOE then created a new channel on the encrypted messaging application, entitled, “New MOSD,” and took steps to destroy or “nuke” the earlier channel. After its creation, the “New MOSD” channel included NORDEAN, BIGGS, REHL, DONOHOE, and a handful of additional members.

40. On January 2021, at 7:15 p.m., DONOHOE posted a message on various encrypted messaging channels, including New MOSD, which read, “Hey have been instructed and listen to me real good! There is no planning of any sorts. I need to be put into whatever new thing is created. Everything is compromised and we can be looking at Gang charges.” DONOHOE then wrote, “Stop everything immediately” and then “This comes from the top.”

41. On January 4, 2021, at 8:20 p.m., an unindicted co-conspirator (“UCC-1”) posted to New MOSD channel: “We had originally planned on breaking the guys into teams. Let’s start divying them up and getting baofeng channels picked out.”

Note: If “New MOSD” was a channel of State leaders of the Proud Boys, it would likely have included Nicholas Ochs, who heads the Hawaii chapter of the Proud Boys. Ochs was the first senior Proud Boy to be arrested, on January 7, at the airport when he arrived back in Hawaii (and therefore carrying anything he had with him at the insurrection, potentially including his cell phone and any radios he kept). Kathryn Rakoczy, who has since moved onto the team prosecuting the Oath Keepers, was the original prosecutor on Ochs’ case. But now Christopher Berridge, who is on all the other Proud Boy cases but not the Nordean and Biggs one, is prosecuting Ochs. Ochs is charged in a parallel conspiracy indictment, with the very same goal and many of the same means as the Nordean and Biggs one, but which for some reason was not identified as a related case to the other three Proud Boy ones and so was not assigned to Judge Kelly; Judge Howell is presiding over Ochs’ case. Ochs has a superb defense attorney, Edward McMahon. Many of these details, which make the curious treatment of the Ochs-DeCarlo conspiracy indictment clear, are in this post or this expanded table.

Whoever the unindicted co-conspirator is, he’s the one who set the channel of the Baofeng radios the night before the insurrection. And he’s the one who stated that Nordean was in charge.

46. At 9:03 p.m., REHL notified NORDEAN, BIGGS, DONOHOE and others that he had arrived in Washington, D.C. DONOHOE responded by requesting one of the radios that REHL had brought.

47.  At 9:09 p.m., UCC-1 broadcast a message to MOSD and Boots on the Ground channels that read: “Stand by for the shared baofeng channel and shared zello channel, no Colors, be decentralized and use good judgement until further orders” UCC-1 also wrote, Rufio is in charge, cops are the primary threat, don’t get caught by them or BLM, don’t get drunk until off the street.” UCC-1 then provided a specific radio frequency of 477.985.

It is highly likely that prosecutors learned the three details included in that detention motion — that Nordean had been put in charge, that the Proud Boys were using Baofeng radios set to frequency 477.985, and that part of the plan was to disperse the men to increase chances of success — from the unindicted co-conspirator and or devices seized from him when he was first arrested.

And it took them less than two months to learn those details of the plot.

Update: The government has moved to detain both Nordean and Biggs now. Those motions cite from the Telegram chats the Proud Boys used to organize the day before the attack, including (I’ve combined them from both motions):

On January 5, between 9:30 – 9:32am [Biggs] stated “What are the teams. I keep hearing team [sic] are picked already.” A few minutes later, [Biggs] stated “Who are we going to be with. I have guys with me in other chats saying teams are being put together.”

On January 5, at 9:32am, a member of a Proud Boys Telegram group stated “It seems like our plan has totally broken down and rufio has taken control as a singke [sic] point of contact.”

On January 5, between 5:22 – 5:25pm, [Biggs] stated “Woth [sic] [coconspirator Ethan Nordean] trying to get numbers so we can make a plan.” Defendant then stated “Just trying to get our numbers. So we can plan accordingly for tonight and go over tomorrow’s plan.”

On January 5, at 5:52pm, [Biggs] stated “We are trying to avoid getting into any shit tonight. Tomorrow’s the day” and “I’m here with [co-conspirator Nordean] and a good group[.]”

On January 5, at 9:07pm, co-conspirator Charles Donohoe asked “Hey who’s boots on ground with a plan RN [ … ] Guys are asking.” A participant in the encrypted chat stated “Supposed to be Rufio.”

Within minutes, an unindicted co-conspirator broadcast a message to those in the group chat, “Rufio is in charge, cops are the primary threat, don’t get caught by them or BLM, don’t get drunk until off the street.”

On January 5, between 9:17 and 9:20pm, [Biggs] stated “We just had a meeting woth [sic] a lot of guys. Info should be coming out” and then “I was able to rally everyone here together who came where I said” and then, “We have a plan. I’m with [co-conspirator Nordean].”

On January 5, at 9:34pm [Biggs] told co-conspirator Charles Donohoe to communicate to Proud Boys members a message stating that the group in Washington, D.C. would meet at the Washington Monument at 10am on January 6.

On the morning of January 6, Donohoe stated that he was on his way to the Washington Monument, and “I have the keys until Rufio and [co-conspirator Zachary Rehl] show up.”

Update: As I note in a footnote to this post, Nicholas Ochs can’t be the unindicted co-conspirator. That’s true for two reasons. First, because DOJ does not believe UCC-1 was at the Capitol on January 6 (though doesn’t say where he was). DOJ knows Ochs was inside the Capitol. Also, DOJ has now started treating all the Proud Boy conspiracies as the same conspiracy. So Ochs could not, then, be considered un-indicted in that conspiracy.

Thomas Caldwell’s “Storming the Castle” Ploy Succeeds

Judge Amit Mehta just released Thomas Caldwell to home confinement in the Oath Keeper conspiracy case.

Caldwell’s attorney, David Fischer, made some easily rebuttable arguments about Caldwell’s honesty, which I’ll return to. Fischer also tried to convince Judge Mehta that Caldwell was operating out of a sincere belief that he was defending against Antifa, not arming against the US government; I’ll return to that too (Judge Mehta had no patience for that ploy). While Mehta did come away believing Caldwell had been more cooperative than prosecutors had suggested, that’s not why he released Caldwell.

It’s important background, that in Fischer’s motion to reconsider Caldwell’s detention dismissed several references Caldwell made to “storming” the Capitol as an allusion to the fictional narrative of The Princess Bride.

Some of the lines that the Government cites in its papers are straight from Hollywood. The best example is “storming the castle” and “I’m such an instigator.” These are classic lines from the 1980s classic movie The Princess Bride.

Fischer suggested Caldwell’s own use of the same word everyone else used to describe assaulting the Capitol was just fiction.

The claim is important because the key reason that Caldwell got bailed is because of a feint that Fischer made in his motion for reconsideration. He argued that there is no evidence that Caldwell planned in advance to storm the Capitol.

On January 6th, at the urging of former President Donald J. Trump, hundreds of thousands of disgruntled, patriotic Americans came to Washington to protest what they viewed as an unfair election. Caldwell joined this protest to exercise his First Amendment right, a right he defended for 20 years in military service. Caldwell absolutely denies that he ever planned with members of the Oath Keepers, or any other person or group, to storm the Capitol. Caldwell absolutely denies that he obstructed justice. 3 The word of a 20-year military veteran with no prior criminal record is evidence, and it is strong evidence, of his innocence.

[snip]

In short, despite having an army of federal agents working around the clock intensively investigating for almost three months, the Government has not provided the Court with a confession, witness statement, or physical evidence backing up their claim that any person or group had a premeditated plan to storm the Capitol. Caldwell asks rhetorically: Doesn’t the Court find it odd that the Government hasn’t outlined the specifics of the premeditated plan? What time was the “invasion” scheduled to begin? Who would lead the attack? What was the goal once the planners entered the Capitol?

[snip]

The Government’s fanciful suggestion that right-wing tactical commandos were waiting in the wings to storm the Capitol is one for the ages.

In response to Judge Mehta’s questions about this claim, AUSA Kathryn Rakoczy conceded that the alleged co-conspirators didn’t have hard and fast plans as to what would happen before the event. This was a plan made of “possibilities,” which included the possibility (the facetious excuse offered by Caldwell) that other groups would resort to violence if Vice President Pence threw out the vote and the Oath Keepers would have to respond with force, or that President Trump would invoke the Insurrection Act and the Oath Keepers would come in to institute martial law. As Rakoczy described, they were “watching and waiting to see what leadership did” to achieve the goal of preventing the vote count, which goal the “government submits was unlawful and corrupt.”

They were waiting to see what leadership did. When leadership did what they referred to as “nothing,” they did take matters into their own hands. They were waiting and watching to see what was happening.

So when asked to respond to Caldwell’s misrepresentation that he was charged with conspiring to storm the Capitol, Rakoczy responded that it wasn’t certain they would storm the Capitol; the group was prepared to act, they just weren’t sure how — given the uncertainties of the day — they would act.

Based on that response and his conclusion that Caldwell actually had never entered the Capitol, Judge Mehta ruled that Caldwell was differently situated than the other defendants insofar as the evidence that he participated in the conspiracy (to storm the Capitol, Fischer said) was weaker given that he never did enter the Capitol.

Only later, after Judge Mehta had announced his decision, did Rakoczy point out the problem with this argument: Caldwell is not charged with conspiring to storm the Capitol. As she noted, the language Fischer kept quoting about storming the Capitol came from a background paragraph of the superseding indictment:

23. As described more fully herein, CALDWELL, CROWL, WATKINS, SANDRA PARKER, BENNIE PARKER, YOUNG, STEELE, KELLY MEGGS, and CONNIE MEGGS, planned with each other, and with others known and unknown, to forcibly enter the Capitol on January 6, 2021, and to stop, delay, and hinder the Congressional proceeding occurring that day.

The actual conspiracy as charged was to impede the certification of the Electoral College vote.

24. [… the defendants] did knowingly combine, conspire, confederate, and agree with each other and others known and unknown, to commit an offense against the United States, namely, to corruptly obstruct, influence, and impede an official proceeding, that is, Congress’s certification of the Electoral College vote, and to attempt to do so, in violation of Title 18, United States Code, Section 1512(c)(2).

Purpose of the Conspiracy

25. The purpose of the conspiracy was to stop, delay, and hinder Congress’s certification of the Electoral College vote.

This is a problem I saw going in (though I doubted that Fischer would be able to confuse Mehta as well as he did).

But the results of this hearing, particularly given Rakoczy’s answers, reveal something about the way this conspiracy is charged (and the ones most of the Proud Boy are charged).

They assume the any action conspirators took would be effectuated on Congress, that that was the only eventuality conspirators were planning for.

The conspiracy is all built off an obstruction charge which itself, while valid, is fairly inapt. It likens the counting of the vote to a trial, which legally holds, but doesn’t get at the scope of what co-conspirators (and Trump) were trying to accomplish. The focus — Caldwell’s, as well as those who actually did storm the Capitol — was all on Congress, because that was the next event in question (just as the previous December mob had been focused on the electoral certifications in the states). But the goal was not (just) to stop the certification of the vote count on Congress. The ultimate goal was to ensure that Trump would remain President, via whatever means. And as Rakoczy acknowledged, one possibility that co-conspirators Kelly Meggs and Jessica Watkins believed might happen was that Trump would declare martial law, and the Oath Keepers would become the glorious army to save their fantastic dreams. That would have had the effect of preventing the certification of the electoral vote, but it would have (if successful) been a more direct route to the actual goal of the conspiracy: to keep Trump in power and prevent the lawfully elected President from taking over.

That’s why Fischer’s ploy worked: because all the planning wasn’t primarily about the Capitol. It was primarily about Trump.

This charge is built like it is, I’ve always been convinced, because no one has yet made the commitment to charge seditious conspiracy (ideally in parallel with this conspiracy). The real goal, after all, was to overthrow the democratic system, and impeding the vote count was just one means to achieve that conspiracy. The conspiring that started even before the election was about overthrowing democracy, not just January 6.

This may not be a fatal weakness for these conspiracy charges. Now that prosecutors have seen Fischer work this feint so well, they’ll be better prepared for it from others.

But one reason it worked is because the real goal of the conspiracy — the one that Caldwell’s lawyer all but conceded to today — was to do whatever it took to prevent the lawfully elected President from taking power.

Oath Keepers Learn the Hard Way: Don’t Plan an Insurrection on Facebook

“For every Oath Keeper you see, there are at least two you don’t see.” – email from Oath Keeper head Stewart Rhodes forwarded from Oath Keeper Graydon Young to his sister, Laura Steele, on January 4, 2021

I want to look at filings from the Oath Keepers investigation to show how FBI is juggling to move quickly enough to prevent obvious subjects from obstructing the investigation without tipping off others to the substance of the investigation. The filings confirm that the FBI will get sealed arrest warrants against subjects who are obviously obstructing the investigation, but may not use them right away, so as to obtain more evidence against them and their immediate co-conspirators. The filings also show how hard it is to delete evidence in an age of social media while conspiring with dozens of other co-conspirators.

The investigation from Watkins to Caldwell to the Parkers, Youngs, and Biggs

There’s a story about the Oath Keepers investigation that arises from the nature of the first publicly charged defendants. According to that story, the founder of an Ohio militia affiliated with the Oath Keepers, Jessica Watkins, boasted on Parler about “forcing entry into the Capitol” on the day of the attack. Videos of the Oath Keeper Stack showed up in videos posted within a day of the attack. Then, on January 13, the Ohio Capital Journal posted an interview with Watkins where she described it “the most beautiful thing” until she started hearing glass smashing — which she blamed on an Antifa false flag attack (a subsequent filing suggests Watkins wanted the Oath Keepers to get good press from the attack, threatening to sue some male journalist if he portrayed the Oath Keepers negatively).

That’s the evidence the FBI showed to obtain an arrest warrant on Watkins on January 16.

Meanwhile, as the investigation was closing in on Watkins, her recruit Donovan Crowl did an interview with the New Yorker for a story loaded with more images of coordinated movement from the Oath Keepers. Crowl offered similarly contradictory excuses for his action as Watkins.

On January 17, the FBI tried to conduct an interview with Watkins, only to be told by her partner, Montana Siniff, that she left Ohio on January 14 to stay with her friend and fellow Oath Keeper, “Commander Tom.”

At some point, the FBI obtained information from Facebook — they don’t explain when or on whom it was served, which I’ll return to. The return showed that Caldwell coordinated hotel reservations at the Comfort Inn/Ballston, not just with Watkins, but also others from North Carolina, as well as speaking with Crowl. This content may not have been obtained via Caldwell yet, because Caldwell’s private messages don’t show up in filings until January 19 (alternately they may have delayed that reveal until Caldwell was arrested).

But the FBI used that public Facebook information to obtain a warrant for Crowl on January 17. Watkins and Crowl turned themselves into Urbana, OH police that day, where the FBI took them into custody.

On January 13, the Guardian did a story on Watkins’ use of Zello.

“We are in the main dome right now,” said a female militia member, speaking on Zello, her voice competing with the cacophony of a clash with Capitol police. “We are rocking it. They’re throwing grenades, they’re frickin’ shooting people with paintballs, but we’re in here.”

“God bless and godspeed. Keep going,” said a male voice from a quiet environment.

“Jess, do your shit,” said another. “This is what we fucking lived up for. Everything we fucking trained for.”

The frenzied exchange took place at 2.44pm in a public Zello channel called “STOP THE STEAL J6”, where Trump supporters at home and in Washington DC discussed the riot as it unfolded. Dynamic group conversations like this exemplify why Zello, a smartphone and PC app, has become popular among militias, which have long fetishized military-like communication on analog radio.

On January 19, the government obtained an amended conspiracy complaint against Watkins, Crowl, and Caldwell. It included the following new information:

  • Quotations from the Zello messaging
  • Facebook messaging from Caldwell pictured standing outside the riot calling everyone in Congress a traitor
  • Facebook messages showing planning between Watkins, Crowl, and Caldwell between December 24 and January 8
  • Instructions for making plastic explosives found at Watkins’ house

Of particular interest, the complaint included the first hint that the Oath Keepers had intelligence — shared using Facebook — about the movements of Members of Congress.

On January 6, 2021, while at the Capitol, CALDWELL received the following Facebook message: “All members are in the tunnels under capital seal them in . Turn on gas”. When CALDWELL posted a Facebook message that read, “Inside,” he received the following messages, among others: “Tom take that bitch over”; “Tom all legislators are down in the Tunnels 3floors down”; “Do like we had to do when I was in the core start tearing oit florrs go from top to bottom”; and “Go through back house chamber doors facing N left down hallway down steps.”

Having arrested the two Oath Keepers blabbing to the press and the guy they hid out with, there’s not much more overt sign of the investigation until February 11, when the government submitted filings supporting pre-trial detention for both Watkins and Caldwell.

Arrest affidavits submitted on February 11 and February 12 (but sealed until after February 16) also refer to Watkins’ cell phone returns, including address book information describing Bennie Parker as a recruit, texts between Watkins and Parker coordinating plans for the insurrection and reassuring him the FBI would not prosecute them after the insurrection, and a picture of his wife Sandi Parker. Watkins’ cell phone returns also show a contact for Kelly Meggs in Florida, which she associated in her address book with the Oath Keepers.

Those initially sealed arrest affidavits also rely on surveillance footage and financial records from the Comfort Inn where all the Ohioans  stayed. It shows the Ohioans together in the lobby. It reveals that Kelly Meggs paid for a room that night registered under another suspected Oath Keeper’s name (according to credit card records showing a $302 charge, Meggs apparently stayed at the Hilton Garden Inn the night of January 7). [Update: The indictment clarifies that Meggs paid for two rooms at the Comfort Inn and booked two at the Hilton, of which he paid for one. h/t bb]

The initial affidavit against Kelly and Connie Meggs and Graydon Young and Laura Steele also includes a picture taken — by some unidentified person — from the van from North Carolina.

The same affidavit includes testimony from a witness who interacted with the Oath Keepers on January 6 and was on a text message chain including Young and Steele, who was introduced to them as Gray and Laura and learned they had taken the Metro into DC. It relies on surveillance video from the Metro. It includes returns from Steele and Young’s Google accounts, including Steele’s application to join the Oath Keepers.

It includes location data showing Graydon Young’s phone traveling from Englewood, FL to Thomasville, NC to Springfield, VA, to DC, then back to Thomasville and ultimately, on January 8, back to Englewood. It includes his round trip flight records from Tampa to Greensboro, consistent with the movement of his phone. The affidavit also uses location data to place Steele and the Meggses in a “geographic area that includes the interior of the United States Capitol building.”

It includes subscriber records for Steele, Young, and Kelly Megg’s MeWe accounts, as well as subscriber records for Facebook accounts for everyone. Of particular note, the affidavit used to arrest Young and the others shows advanced legal process for Young, but mostly subscriber information for the others. They also use Young’s Google data to establish probable cause against the Meggs but do not, yet, use it against Young.

It’s likely in the five days between the affidavit and the arrest, more warrants were served for materials on the others.

There wasn’t much added in a February 25 memo supporting Watkins’ pretrial detention — except that aforementioned Watkins text with Stewart Rhodes complaining about media reports making the Oath Keepers look bad (which, because of the timing of the coverage, likely happened almost a week after the insurrection, or later).

If he has anything negative to say about us OATHKEEPERS, I’ll let you know so we can sue harder. Class action style. Oathkeepers are the shit. They rescued cops, WE saved lives and did all the right things. At the end of the day, this guy better not try us. A lawsuit could even put cash in OK coffers. He doesn’t know who he is playing with. I won’t tolerate a defamation of character, mine or the Patriots we served with in DC. Hooah?!

But in a hearing held February 26, prosecutors told Judge Amit Mehta something in an ex parte hearing to support their argument that there really was a Quick Reaction Force outside of DC on the day of the insurrection ready to bring weapons into the Oath Keepers already in DC, which is one of the reasons he denied Watkins’ motion for release.

The earlier investigation into Graydon Young

It took a while for DOJ to unseal all the filings from the other co-conspirators, particularly the long affidavit for the four southerners. But a docket unsealed last week tells another side of that story. On January 15, a tipster identified Graydon Young, one of the Floridians added to the Caldwell and Watkins conspiracy. Based off that tip, the FBI prepared and got authorization for an arrest warrant by January 18. But they didn’t use it, perhaps because FBI was chasing down two false positives based off pictures of Young, as described in the later affidavit (the first of which may have been based off facial recognition).

First, on or around January 14, 2021, after receiving an internet tip and viewing similar photographs and video of Young from the civil unrest on January 6, 2021, an FBI agent drafted an arrest warrant for an individual (Subject-1) other than Young, based on a review of Subject-1’s driver’s license photo and the fact that Subject-1 was affiliated with the Oath Keepers. An FBI agent in Kansas City, Missouri, who was familiar with Subject-1, then determined that Subject-1 was not the individual depicted in the photos at the U.S. Capitol on January 6, 2021. The government did not pursue charges against Subject-1. Second, on or around January 15, 2021, a concerned citizen provided the FBI with a tip that the photograph of Young in the Rotunda was a photograph of Subject-2, who was a co-worker of the concerned citizen in Illinois. On January 18, 2021, SA Wren spoke with the concerned citizen, who stated that Subject-2 had quit the job and moved to Colorado, and “seemed like the type” who would have gone to the Capitol. SA Wren reviewed Subject-2’s driver’s license photo and determined that Subject-2 is not the person depicted in the photographs of Young at the U.S. Capitol.

In other words, FBI was prepared to arrest Young by January 18, within a day of the initial Watkins arrest. But they did not. They kept that arrest warrant sealed while they obtained his location records, travel records (including evidence he drove home from North Carolina rather than flying, and had his sister’s car towed back to North Carolina afterwards), and subscriber information for other social media.

At some point (as noted), FBI obtained Young’s Google account. But on February 11, they used that “solely as evidence against Kelly Meggs. At this time, the government is not seeking to use this email against Young,” suggesting they still needed legal process to use it against him.

Don’t launch an insurrection with a still-active Facebook account

Given that the FBI was ready to arrest Graydon Young on January 18, it’s worth looking more closely at the Facebook evidence in this conspiracy.

The FBI learned on January 15 that Young was probably at the insurrection, had been tagged in planning for the event on January 4, and had attempted to delete his Facebook account on January 7 (it went into effect the next day). Young didn’t delete his related Instagram account until January 13.

At some point, the FBI also learned that Caldwell attempted to unsend messages on January 8, the same day Young shut down his Facebook account.

Nevertheless, Facebook still had Young’s data, including a post from January 6 boasting, “We stormed and got inside.”

The government also obtained highly damning Facebook content from much earlier, including a message he posted to a group, the “War of Northern Aggression,” on November 7. In it, he clearly acknowledges Joe Biden’s victory.

Will this group consider migration to MeWe and Parler? I think censorship is going to get worse with Biden win.

On November 9, he asked again to move from Facebook to MeWe and Parler.

On November 30, he pushed MeWe and Parler again.

I already have MeWe and Parler … waiting for this drama to end before I delete my FB account.

Hey Graydon?!?! The drama for you is just beginning.

Meanwhile, Caldwell didn’t succeed in deleting all his evidence either. As early as January 17, in Crowl’s affidavit, they had a message (it’s unclear whether it’s public or private)

Here is the direct number for Comfort Inn Ballston/Arlington 1-571-397-3955 I strongly recommend you guys get one or two rooms for a night or two. Arrive 5th, depart 7th will work. She says there are five of you including a husband and wife new recruits. This time of year especially you will need to be indoors to set up, etc. Really, press this home, just get somebody to put it on a credit card. Even if you tell the hotel its double occupancy, you can STILL get a couple of people on the floor with bedrolls and the hotel won’t know shit. Paul said he might be able to take one or two in his room as well. I spoke to the hotel last night (actually 2 a.m. this morning) and they still had rooms. This is a good location and would allow us to hunt at night if we wanted to. I don’t know if Stewie has even gotten out his call to arms but it’s a little friggin late. This is one we are doing on our own. We will link up with the north carolina [sic] crew.

The later affidavits include Caldwell Facebook messages sent in November predicting violence.

I am very worried about the future of our country. Once lawyers get involved all of us normal people get screwed. I believe we will have to get violent to stop this, especially the antifa maggots who are sure to come out en masse even if we get the Prez for 4 more years.

On January 6, Caldwell continued to use Facebook, receiving a message informing him,

All members are in the tunnels under capital seal them in. Turn on gas.

And,

Tom all legislators are down in the Tunnels 3floors down

Between Young and Caldwell, Facebook evidence shows that this operation clearly targeted legislators even after they knew Joe Biden had been elected. It turns out that neither of them successfully deleted this Facebook content before the drama really got started.

The delayed reveal

As noted, it took some time for the affidavit for the southern Oath Keepers to be unsealed. In the interim period, the FBI would have been able to investigate the Oath Keeper whose name was on the hotel room Young paid for, and all the other people on the bus on which Young and his sister were pictured. The FBI surely has reviewed any role the War of Norther Aggression Facebook group had in the insurrection. The accounts for which the FBI just had subscriber information on February 11 are probably now being fully exploited (including the WeMe accounts on which they may have been more open about their plotting).

There are still members of The Stack at large, the others on the bus, the group from Mississippi those who provided “security” for Trump’s closest associates. We don’t know where the next Oath Keepers to be arrested are. We do know where the FBI was, 17 days ago.

Timeline of Oath Keeper conspiracy

January 4: Young travels from Englewood, FL to Thomasville, NC. Young tagged in planning messaging for the attack.

January 5: Young travels from Thomasville to Springfield, VA, then heads to DC for the evening.

January 6: Young travels into DC, then back to Thomasville that night. Watkins posts to Parler and Caldwell posts to Facebook. Young posts, “we stormed and got inside” on Facebook.

January 7: Young deleted Facebook content going back to March 2019 (per Facebook record it goes into effect on January 8).

January 8: Caldwell unsends Facebook messages continuing evidence. Young returns to Englewood. Young writes an email saying that his “team leader” during the insurrection was “OK Gator 1” with Kelly Meggs’ phone number.

January 9: Watkins texts Bennie Parker telling him not to worry about the FBI investigating them.

January 11: Young has a vehicle registered to Steele’s address towed from a location near his home to Steele’s home in NC. Young deletes his Instagram account.

January 13: Watkins interview in Ohio Capital Journal. Guardian story on Watkins’ use of Zello. Young closes Instagram account.

January 14: Donovan Crowl story in New Yorker. Watkins and Crowl travel to Caldwell’s property in VA; he gives them OpSec tips for the drive. Bennie Parker texts Watkins asking if she put Sandi “out there” in the Capitol. FBI chases a false positive for Young on an Oath Keeper who lives in Kansas City, MO.

January 15: A tipster who has known Young for 35 years identified Young in an image published by NBC, informs the FBI that on January 4, other people had tagged Young in a discussion about traveling to DC. The tipster further revealed that on January 7, Young deleted his Facebook content going back to March 2019, then deleted the whole thing. FBI chases a false positive for Young to someone in CO.

January 16: Arrest warrant for Watkins.

January 17: Search of Watkins’ house discovers gear and other military items. Interview of her partner reveals she has left to stay with a friend, Commander Tom, and provides a phone registered to him at his VA property as the way to reach Watkins. Arrest warrant for Crowl. Search of a location where Crowl stays finds his tactical vest. Arrest warrant for Caldwell. Both Watkins and Crowl turn themselves in to the Urbana Police, where the FBI takes them into custody.

January 18: First arrest warrant for Graydon Young.

January 19: Caldwell, Crowl arrested by FBI, and Watkins arrested. Amended criminal complaint makes conspiracy charges against Watkins, Crowl, and Caldwell more formal. Search of Caldwell’s property finds Death List targeting election official from a different, a Gadsden flag signed by Crowl and Watkins, and a sales invoice for a weapon designed to look like a phone.

Janaury 21: Stewart Rhodes declares Biden’s “not a constitutional government.” Kelly Meggs closes his Facebook account.

January 27: Indictment for Watkins, Crowl, and Caldwell.

January 29: NYT does video analysis showing the movements of the Oath Keepers from the Ellipse to the Capitol.

February 11: Counterterrorism prosecutors Justin Sher and Alexandra Hughes join team. Motions for pre-trial detention for both Watkins and Caldwell. Sealed complaint filed against Kelly and Connie Meggs, Graydon Young, and Laura Steele.

February 12: Government moves for protective order against the original conspirators; Caldwell objects. Sealed complaint filed against Bennie and Sandi Parker.

February 16: Graydon Young arrested.

February 17: The Meggs and Laura Steele arrested.

February 18: The Parkers arrested.

February 23: Thomas Caldwell appeals detention.

February 26: Amit Mehta grants government motion to detain Jessica Watkins.

Update: I clarified that the email quoted at the top is from Stewart Rhodes, not Graydon Young.