Posts

January 6: A Change of Pace

Although GWU’s tracker, which is still the best way to keep track of all the January 6 defendants (though this visual story from WaPo using their data is nifty) added four new January 6 defendants yesterday, the pace of new defendants has slowed considerably. While there are still some detention fights, several of those disputes (Proud Boys Ethan Nordean and Joe Biggs, and disorganized conspirators Nate DeGrave and Ronnie Sandlin, as well as Neo-Nazi sympathizer Timothy Hale-Cusanelli — have moved to the DC Circuit.

We’re likely to have more bail revocation fights. The other day, for example, Landon Copeland — who made news for his meltdown during a magistrate judge’s hearing last week — was arrested for some still unidentified bail violation. The government has also moved to revoke Patrick Montgomery’s bail because he — a professional hunting guide — shot a mountain lion that he — a felon — cannot legally possess.

But there are a couple of developments this week that point to what’s going on with this investigation.

Delayed phone exploitation

In a hearing in the case against mother and son defendants Deborah and Salvador Sandoval, Deborah’s attorneys were anxious to move to trial based off an apparent misunderstanding that the evidence on her sole computer device, her smart phone, would show she barely entered the Capitol. Meanwhile, the government revealed that because Salvador chose not to share passwords to his multiple devices, those are taking a lot longer to exploit. As I’ve already noted, Ethan Nordean is the only Proud Boys leadership co-conspirator whose phone DOJ was able to exploit without cracking the password first (the FBI got the password from Nordean’s wife). Exploiting all these phones is going to take a lot of time.

In another case, there appear to be privileged communications on Eric Torrens’ phone, which will delay the exploitation of that for up to four weeks as a filter team reviews the content.

In other words, even before you consider any delay created by FBI’s need to respond to Signal’s Moxie Marlinspike’s exposure of vulnerabilities in Cellebrite’s code, it will take some time to process the vast volume of evidence the government has obtained since January 6.

The network analysis

The arrest of Brittiany Dillon gives a sense of another cause of delay.

Bryan Betancur was one of the first wave of January 6 defendants to be arrested, on January 17, after his parole officer alerted the FBI that he had lied about handing out Bibles to get permission to travel from Baltimore to DC that day. The government got a warrant for his phone on January 20. Once they got into his phone, they discovered text messages between Betancur and Dillon in which Dillon described falling in the door of the Capitol during the riot. The government found video of her — falling down as she entered — on surveillance videos by January 23. The government obtained phone and Google warrants to confirm that Dillon had been inside the Capitol the day of the riot. For some reason, the FBI only got around to interviewing Dillon’s father, ostensibly about Betancur, on April 21; the agent got Dillon’s father to confirm Dillon’s ID while they were talking.

This is similar to what happened with Patrick Montgomery, who like Betancur was arrested on January 17. Only after FBI exploited his phone and found some key pictures did they arrest a buddy he was with that day, Brady Knowlton, while pursuing two others.

These arrests of friends of early arrestees may reflect an FBI agent trying to get arrest numbers, but in a number of cases, they seem to reflect larger investigative strategies based on things investigators have found in the profiles of the original defendant. By my count there are about 18 cases of network arrests aside from the militia conspiracies, and about half of those look like they may be more interesting than friends getting scooped up together. I would expect to see more of this going forward.

Delayed arrests

The two month delay between the time DOJ identified active duty Marine, Major Christopher Warnagiris, as the person who played a key role in keeping the East door of the Capitol open after it was first breached on January 6 and when they arrested him on Wednesday is far more interesting.

As the arrest affidavit explains, FBI isolated Warnagiris as a suspect based on his conduct as shown in video, and then published a Be On the Lookout picture to figure out who he was. On March 16, a former co-worker IDed him, and on March 17, the FBI interviewed one of his current co-workers, who positively IDed Warnagiris.

And that’s it–that’s where the narrative in the affidavit, which was signed on Wednesday, ends. They get a BOLO-based tip on March 16, and get military witnesses to confirm his ID on March 17. And that’s all they’re telling us about who he is and what other evidence they have against him.

I’m sure that’s not all that has transpired since FBI discovered an active duty Major played a key role in keeping the East Capitol breach open.

All the while, someone who by dint of being an active duty service member has clearance, has (as far as we know) been going into Quantico every day for the almost two months since they IDed him. That’s … an interesting investigative decision.

Compare that narrative to the one told in the arrest affidavit of Timothy Hale-Cusanelli, the Army reservist and Nazi-sympathizer who worked as a contractor at Naval Weapons Station Earle in New Jersey. On January 12, an informant told the FBI that Hale-Cusanelli was at the riot, on January 14, the informant recorded a conversation in which Hale-Cusanelli admitted to pushing and shoving along with the rest of the mob. Hale-Cusanelli has been jailed since the very next day, January 15 (he is appealing his detention to the DC Circuit). Hale-Cusanelli has not been charged with assault and he is not known to have played such a key role in compromising the Capitol from a second side.

Now, for many defendants, I can see taking your time after the initial rush of arrests. After all, if they were going to delete their Facebook, that would have happened (and did happen, with a goodly number of defendants) by January 9. But Warnagiris seems like a more urgent risk.

And, remarkably, DOJ apparently did not ask for any special conditions on Warnagiris. He has no location monitoring, no restrictions on possessing a gun, no specificity to his travel around DC (most defendants have stay-away orders, but for people like Warnagiris who are local to DC, they’re sometimes restricted to their District). They did not ask him to surrender his passport. Now, perhaps something is also going on with him in the military. But the whole thing — on top of the inevitable shock of having an active duty officer arrested — raises more questions than other cases.

All of which is to say that, with a defendant who genuinely poses unique security risks, the government is now taking their time to flesh out their investigation.

I’ve said from the start that this investigation has been lightning quick. That’s still, absolutely, true. But there’s going to be a lot more happening behind closed doors in the weeks ahead.

Is a Disorganized Militia January 6 Conspiracy in the Offing?

I’m working on a very long post about everyone known to have occupied the Senate on January 6. As part of it, I’m trying to lay out how a bunch of seemingly unconnected people who were present in the Senate network together many of the disparate groups that took part in the insurrection.

For a variety of reasons, I want to look at one node of that network — Josiah Colt, Ronnie Sandlin, and Nate DeGrave — that may soon become a non-militia conspiracy that parallels the militia ones, but is based on a more disparate ideology.

This network first attracted attention when its Idaho member, Josiah Colt was photographed hanging from the balcony level of the Senate, as well as another one showing him sitting in the presiding officer’s chair.

His January 9 arrest affidavit says little about how the FBI IDed him, beyond an interview he gave to CBS, and it charged him just with trespassing; he was arrested on January 12. His February 3 indictment added obstruction and abetting, but never described him as part of a network that worked together to halt the vote count.

Nor did Ronnie Sandlin’s arrest affidavit, approved on January 20 but not executed until January 28. It made just a small mention of his presence in the Senate gallery, showing a picture but not the surveillance footage of his efforts to keep the doors to it open. But mostly it made him sound (and was treated by much of the press) like someone who entered the Capitol and on a lark smoked a joint in there.

Two days after Colt was indicted, Sandlin was indicted, by himself, for assault and obstruction in addition to trespassing. And while the indictment provided the initials of the officers Sandlin allegedly assaulted, it didn’t really describe the significance of those assaults.

The hints that Colt, Las Vegas-based Nate DeGrave, and Ronnie Sandlin (who’s life was in transit before he ended up in DC jail) were all working together began to show in DeGrave’s arrest affidavit which (we now know) was obtained after the FBI, in search of Sandlin, discovered he was at DeGrave’s house in Vegas.

On January 28, 2021, cell-site data for Sandlin’s phone received pursuant to a search warrant led investigators in the FBI Las Vegas division to locate and visually identify Sandlin’s vehicle parked outside the Las Vegas apartment complex where DeGrave was confirmed to reside. That same day, Sandlin was spotted leaving the apartment and taken into custody by the FBI. Based on the defendant’s actions on January 6, 2021, a complaint and arrest warrant for DeGrave were issued on January 28, 2021, and DeGrave was arrested at his residence.

There are a lot of details in DeGrave’s arrest affidavit in there about their joint planning to travel to DC, as well as their boasts that violence might be necessary.

Even still, nothing in that affidavit explains the significance of the confrontation captured in this picture (and not yet described as involving serious contact); DeGrave is allegedly the guy with his fists raised.

And even though DeGrave was indicted the same day and on roughly the same charges as Sandlin, they weren’t yet joined in the same conspiracy.

A February 9 search warrant affidavit for Colt’s Facebook account that has only recently been unsealed reveals that the government was obtaining his Facebook content, in part, to learn more about the joint efforts of the three of them.

Here, Sandlin mentions boogaloo; elsewhere, he mentioned 3%. A bond filing described him as a QAnon follower and at other times he mentions the Rubicon. There’s no clear ideology here as opposed to the mishmash Trump supporters ingested online.

In response to the search warrant, Facebook returned posts and conversations in which the defendant discussed “stop[ping] the steal” and displayed an adherence to the QAnon conspiracy theory movement. See CBS News, What Is the QAnon Conspiracy Theory? (Nov. 24, 2020), https://www.cbsnews.com/news/what-is-the-qanon-conspiracy-theory/. On December 10, 2020, he posted an image decrying the use of masks and facility closures to combat the COVID-19 pandemic, accompanied by the hashtag “#WWG1WGA”—where we go one we go all—a QAnon refrain. See id. In response to some commenters’ criticism of this post, Sandlin wrote what would become his own rallying cry leading up to the riot on January 6: “tyranny always masquerades itself as safety and security. Freedom is paid for with blood, there is a reason why America was founded on the principles of give me liberty or give me death.” The government understands that Sandlin carried around a coin with the letter “Q” on it, apparently to demonstrate his proud affiliation with the QAnon movement.

We also now know that the FBI obtained this warrant, in part, in an attempt to reconstruct the Facebook content that Sandlin and DeGrave allegedly deleted.

A bond filing in DeGrave’s case was where I first started asking why these men weren’t being treated as a conspiracy in the same way the militias were. It described chats with in-depth planning for their trip.

Beginning on December 31, 2020, DeGrave, Sandlin, and Colt began a private group chat on Facebook to plan for the 6th. They discussed “shipping guns” to Sandlin’s residence in TN, where they would all meet before driving to D.C. Colt said he would try to fly with his “G43,” which the government understands to refer to a Glock .43 pistol. They filled up their Amazon shopping carts with weapons and paramilitary gear to take to the Capitol. For example, the defendant stated he was “looking at a 100w laser the thing that can instantly burn paper.” Sandlin responded: “Good god you want to burn these communists retinas?” The defendant replied: “I dont but would rather do that then have to shoot someone” and “would be totally possible though.” To minimize his prior statements, the defendant added, “all purely self defence might I add. but will be ready.” Sandlin stated he was bringing his “little pocket gun” and a knife. Later that evening, the defendant asked for Sandlin’s address and then wrote that he had “about 300 worth of stuff coming to you.” Sandlin appears to have reviewed the defendant’s list of Amazon purchases and then wrote: “Nate is really ready for battle hahaha.” Sandlin and Colt later posted pictures of their recent purchases, including a glock holster, gas masks, and a helmet. On January 3, 2021, the defendant posted a picture of various items of clothing with skulls on them, a helmet, and a face mask on Facebook, with the following caption: “Gearing up. Only a fraction of what I have. #fbappropriate #dc #jan6 #drdeath.” He also posted that he was “flying in with friends on the 6th. We’re ready to do what is necessary to save the country.”

The bond filing describes how the three of them armed themselves for their trip to DC on January 6.

DeGrave, Colt, and Sandlin ultimately brought the following weapons and other items with them in a rental car from Tennessee to the D.C. metropolitan area: one Glock 43 pistol, one pocket gun, two magazines of ammunition, bear mace, gas masks, a handheld taser/stun gun, military-style vests/body armor, two helmets, an expandable baton, walkie talkies, and several knives. Colt brought a gun to a rally in Washington, D.C. on January 5. While in the Capitol on January 6, Sandlin and Colt were armed with knives, and Colt had bear mace in his backpack. The defendant carried a walkie talkie, as did Colt.

Thus far, none of them have been charged with weapons possession nor even had their trespassing charges enhanced because they carried knives (though I bet whatever proof the government obtained that Colt brought a gun into DC and bear spray into the Capitol is being used to coerce Colt to flip in the same way it was with Jon Schaffer; note, too, there was a woman involved with them who thus far remains uncharged and unnamed who might be witness to these preparations).

Most importantly, the DeGrave filing described the significance of the two assaults he and Sandlin are accused of. The first served to create the opportunity to open what sounds like the East door of the Capitol (through which Joe Biggs and the Oath Keepers entered).

Surveillance footage from the entrance to the Capitol rotunda depicts a mob outside attempting to gain entry through a door. The door’s glass windows are damaged. Individuals already inside can be seen moving benches blocking the door to try to let the mob in, at which point three U.S. Capitol Police (“USCP”) officers move in to stand guard in front of the door. The defendant, Sandlin, and Colt are then seen entering the area, along with approximately twenty to thirty other individuals. The USCP officers are without backup.

Sandlin approaches the officers and appears to be yelling and pointing at them. Sandlin continues to yell, and DeGrave moves to his side. Immediately thereafter, the crowd, including DeGrave and Sandlin, begins pushing the officers and slowly forces the door behind the officers open, allowing the mob outside to begin streaming in. Rather than shy away, DeGrave continues to engage and records the ongoing attack on the officers. Sandlin can be seen attempting to rip the helmet off of one of the USCP officers, an apparent attempt to expose him and render him vulnerable as the mob surrounds him.

The second created the opportunity to get into the Senate.

DeGrave and Sandlin continue to engage with the crowd near the entrance, with at least one officer still trapped in the midst, until Colt taps the defendant on the shoulder and leads the two away and up nearby stairs. Around this time, Colt shouted something to the effect of “we have to get to the Senate” and “there’s no turning back now, boys, we’re here.”

They eventually made their way to the Senate. Additional surveillance video footage from the Capitol Senate Gallery provides a view of a hallway and several sets of doors, which lead to the upper balcony of the Senate Chamber, where shortly before the Senate and the Vice President had been convened for the Electoral College vote count certification. The beginning of the video clip shows several unidentified subjects in the hallway. A USCP officer (hereinafter “USCP1”) can be seen entering one of these sets of doors and is shortly joined by two other USCP officers (“USCP2” and “USCP3”). As part of their official duties, USCP1, USCP2, and USCP3 were clearing individuals out of rooms and securing the doors.

Approximately 27 seconds into the video clip, Sandlin enters the view of the security camera. Shortly thereafter, USCP2 and USCP3 move toward the second set of doors to start to usher people out, while USCP1 finishes locking the first set of doors. Sandlin can be seen walking next to USCP1 as he approaches the second set of doors, and while USCP2 is attempting to close the second set of doors. Sandlin cuts in front of USCP1 and attempts to wrestle the door away from USCP2. DeGrave then joins Sandlin in a shoving match with the USCP officers in an attempt to keep the door open. Following this assault on USCP officers, DeGrave bragged that he punched an officer “three or four times.” As the three USCP officers make their way away from the crowd, DeGrave, Sandlin, and several others are observed on the video footage acting in an aggressive manner towards the officers. DeGrave puts up his fists as if to begin boxing one of the retreating USCP officers. As the USCP officer steps away, DeGrave can be seen banging his chest.

Shortly thereafter, the defendant, Sandlin, and Colt entered the now open doors and reached the upper balcony of the Senate Chamber, which members and staff of Congress and the Vice President had already evacuated. Colt handed the GoPro, which he had been carrying and using to record the riot, to DeGrave, as he prepared to jump down to the floor of the Senate Chamber. After Colt jumped down, DeGrave was one of several individuals yelling at Colt to take documents and laptops.

In other words, these three guys, with closer ties to QAnon than to the military, played a key role in a pincer effect that created a second or third front inside the Capitol and succeeded in occupying the Senate floor.

As I said, when I read the DeGrave filing, I began to wonder why these guys aren’t being treated with the same seriousness as the militia groups, as a well-armed conspiracy.

The government was considering such a step earlier this month. In a bond filing in Ronnie Sandlin’s case, the government claimed (back on April 5) they anticipated superseding Sandlin (and, the implication is, DeGrave and Colt’s) indictments soon.

With respect to why the defendant was not charged in the same indictment as Mr. DeGrave, the other individual who traveled to D.C. with the defendant and was present with him inside the Capitol: Mr. Colt, the third individual who traveled with them, was indicted on February 3, 2021—the same day the defendant and Mr. DeGrave had their initial appearances in Las Vegas. The indictment timeline for these individuals thus varied. The government was and is still investigating them for conspiracy and anticipates superseding in this matter in the near future.

These men allegedly put in extensive planning to prepare for their assault on the Capitol. They explicitly planned for violence, and DeGrave and Sandlin are both accused of violence. The government further alleges (but has not yet charged) Sandlin and DeGrave with attempting to obstruct the investigation afterwards. For months, the government has seemingly focused on the Proud Boys and Oath Keepers to the detriment of a focus on the more organic networks formed online or in in-person protests. That may be about to change.

I expect there will be further stories told about the Senate incursion, as I alluded to here. And I expect those stories will show how all these networks worked together to pull off a tremendous success on January 6.