Posts

What Sedition Looks Like: Lots of Stewart Rhodes, but Key Uncharged Others

When DOJ first unrolled the seditious conspiracy charges against Oath Keeper Stewart Rhodes and others on January 13, I noted that one goal of that indictment was to pressure those with the most important information to flip.

It worked.

Less than fifty days later, Joshua James pled guilty to seditious conspiracy and obstruction as part of a cooperation deal.

James’ statement of offense, as all statements of offense must, lays out the things DOJ would have used to prove not just the crimes charged, but the enhancements, which in James’ case includes the following for both the seditious conspiracy and obstruction charges:

Particularly because he’s the first to plead to the sedition charge, the government lays that out carefully, bookending the description of January 6 with an explanation of James’ intent both to obstruct the vote count and to attack the government.

James agreed to take part in a plan developed by Rhodes to stop the lawful transfer of presidential power by January 20, 2021, by deploying force to prevent, hinder, and delay the execution of the laws of the United States governing the transfer of presidential power. They used encrypted and private communications, equipped themselves with a variety of weapons, donned combat and tactical gear, and were prepared to answer Rhodes’s call to take up arms. James and others amassed firearms on the outskirts of Washington, D.C.—some distributed across hotels and “quick reaction force” (“QRF”) teams—and planned, if called upon, to use them in support of the plan to halt the lawful transfer of presidential power.

[snip]

In advance of and on January 6, 2021, James and others agreed to take part in the plan developed by Rhodes to use any means necessary, up to and including the use of force, to stop the lawful transfer of presidential power.

[snip]

James intended to use force and did, in fact, use force in the Capitol and when engaging in physical altercations with law enforcement, in order to prevent, hinder, and delay the execution of the laws governing the transfer of power. James corruptly obstructed, influenced, and impeded an official proceeding, that is, a proceeding before Congress, specifically, Congress’s certification of the Electoral College vote as set out in the Twelfth Amendment of the Constitution of the United States and 3 U.S.C. §§ 15-18.

In taking such actions, James intended to influence or affect the conduct of the United States government or to retaliate against the United States government. He accomplished this by intimidating and coercing government personnel who were participating in or supporting the Congressional proceeding, including Members of Congress, Congressional staff, and law enforcement officers with the Capitol Police and Metropolitan Police Department.

But much of the rest of the statement implicates others, making them more likely to plead, as well.

Most of the new detail in this statement describes actions of Stewart Rhodes, many of which James would be one of, or the only, witness to. That starts with the detail that, after James came out of the Capitol and then again days later, after Rhodes reviewed video of James’ fight with a cop, Rhodes expressed his approval of James’ actions.

After exiting the Capitol, James gathered with Rhodes and other co-conspirators approximately 100 feet from the Capitol, near the northeast corner of the building. Rhodes told James he was glad James and others had gone inside the Capitol.

[snip]

On January 8, 2021, James met with Rhodes and others at a restaurant in Alabama. There, James showed Rhodes a video of James’s physical altercation with law enforcement officers inside the Capitol on January 6, 2021.

DOJ will use this as evidence that Rhodes ratified the violence that James, at least, engaged in (and is proof that James always knew there was evidence of the confrontation with the cops, even though it took some time after James’ arrest for DOJ to find it).

There are a great many details in the statement about the immediate response after the riot. Almost immediately, it seems, Rhodes came to believe they were being pursued (DOJ is coy about whether he had reason to believe, which may prove interesting later). And so almost immediately, they left town.

At Rhodes’s instruction, James, Vallejo, and others met Rhodes that evening at a restaurant in Vienna, Virginia. Rhodes discussed saving “the Republic” by stopping the transfer of presidential power and began to make plans to oppose the Inauguration on January 20, 2021, including by having people open-carry firearms at state capitols around the country.

While at the restaurant, Rhodes and James came to believe that law enforcement was searching for Rhodes and others after their attack on the Capitol. The group immediately returned to their hotel, collected their belongings, and met at a nearby gas station. There, James saw what he estimated to be thousands of dollars’ worth of firearms, ammunition, and related equipment in Rhodes’s vehicle. Rhodes divvied up various firearms and other gear among James and others who occupied a total of three cars. Rhodes left his mobile phone with one person and departed with another person in that person’s car so that law enforcement could not locate and arrest him. The three cars departed in separate directions.

James returned to Alabama with some of Rhodes’s gear, including firearms and other tactical equipment.

This explains the behavior of some others, such as Graydon Young’s decision to drive back to Florida from his sister’s house in North Carolina rather than flying.

Rhodes continued to provide James orders to obscure his actions.

Rhodes expressed gratitude for James’s actions and told James to alter his physical appearance to conceal his identity.

[snip]

Rhodes gave James a burner phone—a cell phone used for concealing the identity of the user through a false registration and/or temporary use before discarding it for another cell phone. Rhodes instructed James to manufacture a false identity— including a false name and address—for the phone. James subsequently wrote the false name and address, “John Smith, 201 Oak Street, Albie, NE 68001,” along with a phone number and “Signal pin” on a sticky note placed inside the back of the phone’s battery case. Rhodes did not allow James and others to have their mobile phones powered on or nearby any time they discussed the Presidential Election and next steps.

But it wasn’t just Rhodes. One paragraph describes someone James “understood to be an attorney for the Oath Keepers” instructing them all to delete their communications. After this instruction, James in turn told Mark Grods and Brian Ulrich to delete their own communications.

On January 8, 2021, James received a Signal message, in a group chat that included Rhodes, from an individual he understood to be an attorney for the Oath Keepers that stated, “STEWART: YOU ALL NEED TO DELETE ANY OF YOUR COMMENTS REGARDING WHO DID WHAT. You are under zero obligation to leave them up. You/we have not yet gotten a preservation order instructing us to retain those chat comments. So DELETE THEM. I can’t delete them because this is a legacy Signal chat that doesn’t let me delete comments. Only the comment author can delete a comment. So GET BUSY. DELETE your self-incriminating comments or those that can incriminate others. Start now …”

Thereafter, on January 8, 2021, James forwarded to Grods the message from the attorney and instructed him to “make sure that all signal comms about the op has been deleted and burned.” James also messaged Ulrich on Signal and instructed him to delete messages with photographs that included their faces.

It’s unclear who this person is — Kelly SoRelle is one possibility. Whoever it is, DOJ has described this in such a way as to remain ambiguous about the lawyer’s actual role, which is important because, as part of the later investigation, DOJ got another Oath Keeper to disavow SoRelle’s role as an attorney (meaning they wouldn’t have to treat her communications as privileged). In any case, whoever this lawyer is, the person is now implicated in James, Grods, and Ulrich’s efforts to obstruct the investigation, and as such becomes a candidate to be charged as a co-conspirator him or herself.

The other actions implicating Rhodes serve to show that Rhodes and James (as well as Kelly Meggs, though the evidence against him is weaker), started pursuing sedition before January 6 and continued it even after the inauguration.

In advance of and on January 6, 2021, James and others agreed to take part in the plan developed by Rhodes to use any means necessary, up to and including the use of force, to stop the lawful transfer of presidential power.

[snip]

On January 8, 2021, James collected his firearms and Grods’s shotgun, and he traveled to Texas where he met and stayed with Rhodes and others to, in part, serve as Rhodes’s security and be prepared to carry out Rhodes’s next instructions. James remained with Rhodes in Texas until February 2021.

While with Rhodes in Texas, and before the Inauguration on January 20, 2021:

[snip]

b. James accompanied Rhodes on multiple trips where Rhodes purchased thousands of dollars’ worth of firearms and tactical equipment, including scopes, ammunition, magazines, bipods, duffel bags, holsters, and firearm-maintenance equipment.

c. While in a vehicle together, Rhodes gave James an AR-platform firearm and explained that Rhodes would not be taken by law enforcement without a fight. James understood Rhodes to be ordering him to help defend Rhodes against law enforcement with force in the event of an arrest.

[snip]

James departed Texas in February 2021. At Rhodes’s instruction, James took with him multiple firearms, thousands of rounds of ammunition, multiple burner phones, scopes, magazines, night-vision equipment, and other tactical gear. Rhodes told James to be prepared to transport and distribute the equipment to others upon Rhodes’s instruction and to be prepared for violence in the event of a civil war. James stored this equipment in a storage shed in Alabama and awaited Rhodes’s instructions.

In short, the first person DOJ got to flip after the sedition charges was probably the most important witness against Rhodes as the leader of a seditious conspiracy.

But it’s not just Rhodes endangered by James’ cooperation. DOJ has included new details about what happened to James’ and others’ guns (including that they remained at the Hilton Garden Inn in Vienna, rather than in the Ballston Comfort Inn) — the significance of which I laid out here.

James and others amassed firearms on the outskirts of Washington, D.C.—some distributed across hotels

[snip]

On January 4, 2021, James traveled with Ulrich, Grods, and others to the Washington, D.C., metropolitan area. James brought a semi-automatic handgun, and Ulrich, Grods, and others brought firearms, including a rifle, a shotgun, a semi-automatic handgun, and ammunition. James stored their firearms at the Virginia hotel where he, Rhodes, Minuta, and others had rooms.

The statement of offense makes it clear that James has told DOJ about his conversations during the riot with Mike Simmons (but not what they included).

Between 2:00 p.m. and 4:05 p.m., James exchanged multiple phone calls with the operation leader Rhodes had appointed for January 6.

The statement implicates Roberto Minuta directly in James’ violence.

At 3:16 p.m., while inside the Capitol lobby outside the Rotunda, James asked Minuta, “Want to keep pushing in?” Minuta responded, “yup.” James then pushed toward the Rotunda, yelling, “Keep fucking going!”

[snip]

Other members of the mob, including Minuta, began pushing James forward into the Rotunda while James yelled, “Keep going!” James and Minuta breached the Capitol Rotunda, and then James was expelled by at least one officer who aimed chemical spray directly at James. Multiple officers pushed James out from behind.

And in a really interesting passage, the statement describes planning that happened on November 14 and 15 in the DC area and VA.

On November 14 and 15, 2020, James met with Rhodes and others in the Washington, D.C., metropolitan area and at Caldwell’s Virginia farmhouse and learned about the start of their plans to oppose by force the lawful transfer of presidential power.

As WO noted yesterday, there may have been an earlier reference to Thomas Caldwell removed in this draft (in which his first name was used), which might have described some reconnaissance Caldwell did on or before November 9, as described in the indictment. The November 14 planning is important, however, because it suggests broader coordination with “others” at the MAGA March. It may reflect Jon Schaffer’s cooperation; his arrest affidavit is one of the few, among all January 6 defendants, that mentions that march. DOJ now has a witness to that planning.

Perhaps the most interesting detail of the statement describes a plan to report to White House grounds and secure the perimeter.

In the weeks leading up to January 6, 2021, Rhodes instructed James and other coconspirators to be prepared, if called upon, to report to the White House grounds to secure the perimeter and use lethal force if necessary against anyone who tried to remove President Trump from the White House, including the National Guard or other government actors who might be sent to remove President Trump as a result of the Presidential Election.

The “if called upon” language reflects some of what we’ve seen in Rhodes’ (and the Oath Keepers’) ideology generally — that they believed they would become a legal militia once the President called on them. It reflects the contingent nature of the preparedness, something Rhodes has already tried to use to undercut the charges. But it also raises questions about why James and others, after having “provided security” for Roger Stone at the Willard the morning of the riot, hung around the Mayflower Hotel until the Capitol was breached. That is, they may have remained close to the White House that day until Rhodes decided there were more immediate objectives. All of which makes me more interested in whether the Oath Keepers brought weapons into DC that day.

Finally, there are the interesting details that aren’t in this statement, but which surely are key aspects of James’ cooperation. As noted above, the statement describes James’ contacts with Mike Simmons after 2:00PM. But we know those communications started earlier, at least by 10:06AM, when James was with Roger Stone.

Then there’s a comment from the indictment that doesn’t show up in this statement, in which James shares his opinion with “another individual” that Joe Biden’s inauguration would lead to “Civil War 2.0.”

On Inauguration Day, January 20, 2021, JAMES messaged another individual, “After this .. .if nothing happens .. .its war … Civil War 2.0.”

This statement has far more details showing that James was taking steps to prepare for such a civil war. But this detail of reflecting intent doesn’t appear in it.

Which is to say, there’s a lot here for Stewart Rhodes and others to see, to entice them to follow James’ lead in pleading.

But there’s a lot left unsaid to make others worry.

The Disappearing Willard Hotel and the Accused Seditionists’ Other Interlocutors

Just as sedition bears down on Roger Stone, the government has put a curtain over what they know about his role in it. The government has moved on from Stone, it seems, to other interesting Oath Keeper interlocutors.

Way back in May, I noted how judicious DOJ was being with statements from Stewart Rhodes — referred to officially as Person One back in his halcyon pre-sedition charge days — in the charging documents for Oath Keepers. Within a few days that month, DOJ added to its insurrection narrative a December 14, 2020 Rhodes post calling for Trump to invoke the Insurrection Act via James Breheny’s charging documents. The iteration of the Oath Keeper conspiracy released at the same time (the fourth) introduced Rhodes’ November 9 GoToMeeting discussion of the Insurrection Act that continues to appear in the indictments.

For eight months, in other words, DOJ has been engaged in a slow-reveal of its case against Rhodes.

Now, in the sedition indictment bearing Rhodes’ name, we get a whole lot more of what Rhodes was saying:

  • Calls for civil war as soon as a it became clear Biden should win
  • Rhodes’ adoption of a Serbian (!!!) model for his civil war
  • An oblique comment — dated to “around this time” of the Inauguration — about Rhodes messaging others to organize local militias to oppose Biden’s Administration

Most of the new comments aren’t as scintillating as the catalog describing the personal arsenal Rhodes was purchasing, though, and a few of the new Rhodes comments included were public before.

There are three comments about Rhodes’ communications, though, that I find intriguing because they seem to hint at other interlocutors with the accused seditionists that we may not know about yet.

The first doesn’t even involve Rhodes directly. Rather, it relays Roberto Minuta describing to someone else that 1) Minuta had spoken directly with Rhodes the night of December 18 and 2) Minuta was sharing with someone apparently outside the Oath Keepers how Rhodes felt.

28. Also on December 19, 2020, MINUTA messaged another individual, “Oath Keepers president is pretty disheartened. He feels like it’s go time, the time for peaceful protest is over in his eyes. I was talking to him last night.”

This wasn’t in the prior indictment and I don’t recall it appearing in any other filings in the case (Minuta was not detained, so there’s less about him in the public record). Unless this was originally on the Facebook account Minuta allegedly deleted, there doesn’t seem to be any reason DOJ wouldn’t have obtained this message when they exploited Minuta’s phone. If they’ve had it for months, then the simplest explanation for its inclusion is that this indictment is all about Rhodes, and the comment captures Rhodes’ commitment to violence. In addition, this comment exhibits a closeness between Minuta and Rhodes (which we’ve seen in earlier charging documents) that may be useful from an evidentiary standpoint.

But I suspect it serves an additional purpose. Minuta wrote it not long after the December MAGA March in DC. While there, he had been hanging out with Proud Boys, including Dominic Pezzola (who like Minuta is from upstate New York). It comes after Mike Flynn’s call for insurrection. After Trump tweeted out a promise for Wild Protests on December 19, a ton of aspiring insurrectionists, both organized and not, started making plans to come to DC. In short, this was a key time in the lead-up to the operation, and Minuta was surprisingly well-connected (for a tattoo artist!!!) within the movement. So I suspect his interlocutor here is of some interest (and it’s even possible the government obtained the text from that interlocutor, not Minuta).

An exchange that Kelly Meggs had with Rhodes on Christmas 2020 is similar.

34. On December 25, 2020, MEGGS messaged the OKFL Hangout Chat, in reference to the Joint Session, “We need to make those senators very uncomfortable with all of us being a few hundred feet away.” RHODES then wrote, “I think Congress will screw him [President Trump] over. The only chance we/he has is if we scare the shit out of them and convince them it will be torches and pitchforks time is they don’t do the right thing. But I don’t think they will listen.”

As we recently saw in Proud Boy Matthew Greene’s statement of offense, using proximity to pressure members of Congress (and Pence), became well formulated enough that even a low-level Proud Boy would understand it by the day of the insurrection. Here, both Meggs (who is the Florida-based Oath Keeper who boasted of forging an alliance with the Proud Boys) and Rhodes enunciate this goal, but do so twelve days before the actual attack. As with the Minuta comment, my guess is that the his exchange reflects communication with (at a minimum) the Proud Boys about this shared goal of — in Rhodes’ formulation — terrorizing Congress. It certainly makes it clear that the intent of mobbing the Capitol was formulated well in advance of the event.

There’s one more example. For some reason, DOJ provides the exact time (without time zone) that Rhodes wrote, “There is no standard political or legal way out of this” on December 31, 2020.

40. RHODES and his co-conspirators used the Leadership Intel Chat and other Signal group chats to plan for January 6, 2021. On December 31, 2020, at approximately 10:08 p.m., RHODES wrote to the Leadership Intel Chat, “There is no standard political or legal way out of this.”

For the purposes of the indictment, this shows mens rea that the Yale Law grad leading this insurrection recognized what they were going to do next was not legal. But it also seems to reflect a response (thus the timing) to something — one I haven’t been able to guess yet. The comment comes before Texas Congressman Louie Gohmert’s lawsuit against Mike Pence, the last of a long series of ridiculous “legal” efforts, failed spectacularly. But it comes at around the same time that even Sean Hannity was beginning to give up.

For example, on December 31, 2020, you texted Mr. Meadows the following:

“We can’t lose the entire WH counsels office. I do NOT see January 6 happening the way he is being told. After the 6 th. [sic] He should announce will lead the nationwide effort to reform voting integrity. Go to Fl and watch Joe mess up daily. Stay engaged. When he speaks people will listen.”

I’m not saying that Rhodes was in contact with Hannity: But something seems to have happened just before 10:08 PM (in whatever time zone) that elicited this response which is not dissimilar from where Hannity’s brain was at the time. And if it was non-public (as Hannity’s panic was), then it suggests Rhodes may have been responding to a well-connected interlocutor.

So it’s not so much that the sedition indictment quotes Rhodes as saying really interesting things. Rather, it seems to suggest he and others were saying things to some interesting interlocutors.

Even as the government is hinting at other interesting interlocutors of the accused seditionists, as I noted above, DOJ has entirely hidden the prior back-and-forth between the Oath Keepers and the Willard Hotel. This back-and-forth involving people who were guarding Roger Stone at the Willard that morning first started to show in the Third Superseding Indictment. Once Jonathan Walden — the guy now charged by himself — got added, the indictments included this exchange:

At 9:36 a.m., WALDEN texted JAMES, “Willard hotel?” At 9:51 a.m., WALDEN placed a phone call to JAMES, which is recorded as missed. At 9:52 a.m., WALDEN texted JAMES, “I’m here, awaiting instruction.” At 10:37 a.m., JAMES placed a phone call to WALDEN, which lasted 2 seconds.

Then last month, Kenneth Harrelson released Mike Simmons’ [Person Ten] 302s (purportedly in a desperate bid to adopt his lies, but possibly also to let others know what FBI had been investigation in May).

They revealed that Joshua James, who was in charge of the security detail at the Willard, called in several times to Simmons and seems to have cited Stone’s gripe about being treated poorly to Simmons.

This is what I was referring to in this post about the effect of disappearing Mark Grods, the one overt cooperator who was at the Willard that morning, from all last week’s indictments. Several decisions made in the structure of these most recent indictments — spinning Walden off by himself, disappearing Grods, focusing on the activities of two stacks in the sedition indictment (and thereby starting the narrative at a later point in time), remaining coy about the present status of Simmons, and eliminating James and Minuta in the Crowl indictment — had the effect of eliminating the coordination with the Willard from the sedition indictment altogether.

Poof! Where’s Roger?

Trust me. I don’t think DOJ has decided that the Oath Keepers’ presence at the Willard was unimportant. On the contrary. I think they’ve just decided to move onto making other people sweat about their communications with now-charged seditionists appearing in the indictment, while hiding how much more they’ve learned about the Willard in recent weeks.

The Oath Keepers Dilemma: The Government Has Threatened Yet Another Indictment

The remaining 15 Oath Keeper conspiracy defendants have a status hearing today.

A lot has happened since the last status hearing the bulk of them had on June 1, 2021. Most notably, Graydon Young — co-defendant Laura Steele’s brother — pled guilty on June 23, just over a week ago. His cooperation with prosecutors will implicate the entire Stack, especially Joseph Hackett, Jessica Watkins, his sister, as well as the participants on a OK FL DC OP Jan 6 listserv (in addition to Watkins and Hackett, Kelly Meggs, Kenneth Harrelson, Jason Dolan, and William Isaacs).

Then, on Wednesday, Mark Grods pled guilty. His cooperation will implicate fellow Alabaman Joshua James (who got Grods to delete some files), Meggs, Watkins, Robert Minuta, Stewart Rhodes, and others who were on chats Grods was part of, as well as everyone involved in the Golf Cart chase and prior events at the Willard Hotel, adding Jonathan Walden to the mix.

Yesterday (or today, depending on which defendant you ask) was a deadline that Judge Amit Mehta set on June 1 for all motions unrelated to discovery (with the expectation that the late added defendants would probably need more time).

Thomas Caldwell (who can be implicated primarily by the Ohioans, the still unindicted Person Three, Grods, and possibly some other VA militia members not charged in this conspiracy) has been filing motions. He filed a marginally serious motion to dismiss everything on June 15, and filed a frivolous motion to transfer venue yesterday.

Yesterday, the deadline, both Joshua James and Kenneth Harrelson filed some motions. The former filed a motion to dismiss an assault charge and an obstruction charge against himself, as well as for a Bill of Particulars. The latter filed a motion to dismiss the counts of the indictment charged against him. The Meggses had earlier filed a motion for a Bill of Particulars.

But thus far, almost everyone is asking for an extension to file their own motions. Here’s a summary of what’s on the books thus far (Dolan, Hackett, Isaacs, and Walden would have an extension in any case, on account of their late addition):

  1. Thomas Caldwell: Motion to Dismiss, Motion to Change Venue, Motion for Extension
  2. Dominick Crowl: Motion for 60 Day Extension, Motion to Adopt
  3. Jason Dolan: Motion for Extension
  4. Joseph Hackett
  5. Kenneth Harrelson: Motion to Adopt Caldwell and James Motions, Motion for Extension, Motion to Dismiss Charges against Him
  6. William Isaacs
  7. Joshua James: Motion to Adopt, Motion to Dismiss Counts 8 and 13, Motion for Bill of Particulars, Motion for Extension
  8. Connie Meggs: Motion to Join Caldwell’s Motion, Motion for 60 Day Extension
  9. Kelly Meggs: Motion to Adopt Caldwell’s Motion (including a cursory adoption of his obstruction charge)
  10. Roberto Minuta (Minuta’s attorney has had some health limitations so would need an extension anyway): Motion for 30 Day Extension
  11. Benny Parker: Motion for at least 60 Day Extension, Motion to Adopt Harrelson and Caldwell, though not adopting Caldwell’s “partisan surplusage”
  12. Sandi Parker: Motion to Join Caldwell Motion, Motion for Extension
  13. Laura Steele: Motion to be able to go on vacation, Motion to Join Caldwell, Motion for at least 60-Day Extension
  14. Jonathan Walden
  15. Jessica Watkins: Motion to Join Caldwell’s Dismissal, Motion for 60 Day Extension

Between these requests, the government has gotten defendants to waive Speedy Trial for at least 30 more days as they contemplate the legal dilemma they’re facing.

It’s true that most defendants cite the voluminous discovery before them. A few claim they have not yet had an adequate tour of the Capitol. Harrelson’s motion quotes several paragraphs of boilerplate from the government.

But a comment from James’ Motion for Extension is perhaps the most telling. It asserts that defendants have been told there’s still yet another indictment on the way.

Because the government has made clear that an additional indictment (which could include more charges or more defendants) is possible, and because Mr. James is unaware of which, if any, currently charged defendant will be proceeding to trial, it is impossible to assess, prepare, and file motions regarding severance of counts or defendants at this time.

It also suggests that it’s possible none of the currently charged defendants will actually proceed to trial.

Short of adding Stewart Rhodes, there are few places this indictment will go except to make the terrorism or insurrection claims more explicit.

Which may explain why James, one of the remaining key players who would be able to trade a lesser sentence for a cooperation deal, suggests no one may go to trial.

Person Fifteen (AKA Mark Grods), Another Roger Stone Security Staffer, Flips

Sometime in the recent history of Tucker Carlson’s fever dreams, he claimed that the long list of numbered unindicted co-conspirators in the Oath Keepers case were actually paid FBI informants setting up the militia members.

I guess with the news that Person Fifteen, AKA Mark Grods, will plead guilty and enter into a cooperation agreement with prosecutors today, Tucker gets partial credit: the government asked and received permission to keep Grods’ charges sealed so he could testify to the grand jury before pleading guilty today.

Delaying the government’s need to notify other defendants about Mark Grod[’]s related case between the filing of the criminal Information on June 28 and his public plea hearing on June 30, 2021, will ensure the defendant’s safety while he cooperates pursuant to his plea agreement and testifies before the grand jury.

So, it turns out, Grods was informing on his buddies. But not for pay, but in hopes of lenience at sentencing for a conspiracy and an obstruction charge.

Here are all the things — based on comparing the Fourth Superseding Indictment with Grods’ Statement of Offense— to which Grods is a direct witness:

55. At least as early as December 31, 2020, [Jessica] WATKINS, KELLY MEGGS, [Joshua] JAMES, [Roberto] MINUTA, PERSON ONE [Stewart Rhodes], PERSON THREE, PERSON TEN, and others known and unknown joined an invitation-only encrypted Signal group message titled “DC OP: Jan 6 21” (hereinafter the “Leadership Signal Chat”).

[snip]

58. On December 31, 2020, KELLY MEGGS and JAMES attended a 4-participant GoToMeeting titled “SE leaders dc 1/6/21 op call.” KELLY MEGGS was the organizer of the meeting.

[snip]

67. On January 2, 2021, [Grods] messaged JAMES on Signal and asked, “So, I guess I am taking full gear less weapons? Just reading through all the posts. Would rather have it and not need it.” JAMES responded, “Yeah full gear… QRF will have weapons Just leave em home.”

[snip]

95. MINUTA, using his personal email address and his personal home address, reserved three rooms at the Mayflower Hotel in Washington, D.C., under the names of MINUTA, JAMES, and PERSON TWENTY. A debit card associated with [Grods] was used to pay for the room reserved under MINUTA’s name. A credit card associated with JAMES was used to pay for the room reserved under JAMES’s name.

[snip]

128. Between 2:30 and 2:33 p.m., MINUTA, JAMES, WALDEN, and others rode in a pair of golf carts towards the Capitol, at times swerving around law enforcement vehicles, with MINUTA stating: “Patriots are storming the Capitol building; there’s violence against patriots by the D.C. Police; so we’re en route in a grand theft auto golf cart to the Capitol building right now . . . it’s going down, guys; it’s literally going down right now Patriots storming the Capitol building . . . fucking war in the streets right now . . . word is they got in the building . . . let’s go.”

[snip]

129. At 2:33 p.m., MINUTA, JAMES, WALDEN, and others parked the golf carts near the intersection of Third Street and Pennsylvania Avenue, Northwest. They then continued on foot towards the Capitol.

[snip]

165. Shortly after 4:00 p.m., individuals who breached the Capitol, to include YOUNG, STEELE, KELLY MEGGS, CONNIE MEGGS, HARRELSON, MINUTA, JAMES, WALDEN, HACKETT, DOLAN, and ISAACS, among others, gathered together with PERSON ONE and PERSON TEN approximately 100 feet from the Capitol, near the northeast corner of the building.

[snip]

195. On January 8, 2021, JAMES instructed [Grods] to “make sure that all signal comms about the op has been deleted and burned,” and [Grods] confirmed [Grods] did in fact do so.

In addition, Grods entered the Capitol shortly after others allegedly assaulted the cops.

And because he was at the Willard with Roberto Minuta, Joshua James, and Jonathan Walden, he may have been witness to the James side of key conversations involving Person Ten.

And Grods is one of nine Oath Keepers who provided security for Roger Stone, and the second to have entered a cooperation agreement.

OpSec Confusion on the Oath Keeper Conspiracy

I write a lot about the comms the Oath Keepers used to plan insurrection. There was the post about how they figured out, too late, not to plan an insurrection on Facebook; of the five counts of obstruction on the Oath Keeper indictment released Sunday, two pertain to Facebook. Then there was the post where I cataloged how many social media platforms were described in the last iteration of the indictment against them.

  • leadership list on Signal they appear to have obtained from either Watkins and/or Kelly Meggs
  • Open channels on Zello, possibly separate ones for each large event
  • Telephony chats and texts, including during January 6
  • MeWe accounts
  • Way too much blabbing on Facebook, followed by a foolish belief they could delete such content
  • Parler for further blabbing
  • Stripe for payment processing (possibly for dues)
  • GoToMeeting for operational planning

The remaining three obstruction charges pertain to this social media activity, one — for Joshua James — specifically describing his attempt to delete and burn the “[S]ignal comms about the op.”

Add hand-written ProtonMail attachments to the toolchest

It turns out I should have included ProtonMail in that list, because both the addresses to which Laura Steele sent her vetting application to join the Oath Keepers on January 3 were ProtonMail addresses, but the government only laid that out in their unsuccessful bid to keep her detained, in an attempt to use its encryption to ascribe to her that operational security.

On the evening of January 3, 2021, Defendant Steele emailed a membership application and vetting form to the Oath Keepers of Florida.4 She copied Defendant Young on the email, and wrote: “My brother, Graydon Young told me to submit my application this route to expedite the process.” Under the section for “CPT Skill Sets (Community Preparedness Team) Experience or Interests,” she checked “Security.” Under “Skillsets,” she wrote: “I have 13 years of experience in Law Enforcement in North Carolina. I served as a K-9 Officer and a SWAT team member. I currently work Private Armed Security for [company name redacted]. I am licensed PPS through the North Carolina Private Protective Services.”

Within 10 minutes, Defendant Steele sent another email, this one directly to Defendant Kelly Meggs’s email account at Proton Mail, again copying Defendant Young. She again attached her application and vetting form, and wrote: “My brother, Graydon Young told me to send the application to you so I can be verified for the Events this coming Tuesday and Wednesday.”

The following day (January 4), Defendant Steele sent the same materials to yet another Oath Keepers email address at Proton Mail. On her email, she copied co-defendants Kelly Meggs and Graydon Young.

4 The email recipient was actually a Florida Oath Keepers account at “protonmail.com.” Proton Mail is housed overseas (in Switzerland) and offers end-to-end encryption. “Even the company hosting your emails has no way of reading them, so you can rest assured that they can’t be read by third parties either.” Mindaugas Jancis, ProtonMail review: have we found the most secure email provider in 2021?, CyberNews, Mar. 4, 2021, at https://cybernews.com/secure-email-providers/protonmail-review.

But Proton is not going to help if one side of a communication is on Gmail or some other email service on which FBI can serve a subpoena. Which may explain how the government obtained this email from the newly indicted Joseph Hackett in the latest superseding.

41. On December 19, 2020, HACKETT sent an email to YOUNG with a subject line “test.” The body of the email stated: “I believe we only need to do this when important info is at hand like locations, identities, Ops planning.” The email had a photo attached; the photo showed cursive handwriting on a lined notepad that stated: “Secure Comms Test. Good talk tonight guys! Rally Point in Northern Port Charlotte at Grays if transportation is possible. All proton mails. 7 May consider [a rally point] that won’t burn anyone. Comms – work in progress. Messages in cursive to eliminate digital reads. Plans for recruitment and meetings.”

7 Based on the investigation, “proton mails” appears to refer to the company “ProtonMail,” which offers encrypted email services.

I’ve not seen anything that suggests the government has obtained Proton Mails from the Oath Keepers conducted entirely on the platform; that may have to wait until someone involved decides to cooperate. But I’m not sure how writing the most sensitive messages on what sounds like dead tree paper before sending it adds to the security.

DOJ’s selective understanding of encryption

One of the more aggravating pieces of confusion in the new indictment, however, comes not from the alleged conspirators but from the government.

The last item in a list of Manner and Means employed in the conspiracy is the use of “secure and encrypted communications.”

Using secure and encrypted communications applications like Signal3 and Zello4 to develop plans and later communicate during the January 6 operation.

The first overt act describes Stewart Rhodes laying out what I am calling the “Antifa foil” on a GoToMeeting meeting.

At a GoToMeeting5 held on November 9, 2020, PERSON ONE told those attending the meeting, “We’re going to defend the president, the duly elected president, and we call on him to do what needs to be done to save our country. Because if you don’t guys, you’re going to be in a bloody, bloody civil war, and a bloody – you can call it an insurrection or you can call it a war or fight.”

As a result, the following footnotes appear on the bottom of the same page.

3 Signal is an encrypted messaging service.

4 Zello is an application that emulates push-to-talk walkie-talkies over cellular telephone networks. Zello can be used on electronic communication devices, like cellular telephones and two-way radios.

5 GoToMeeting is an online meeting site that allows users to host conference calls and video conferences via the Internet in real time.

Start with Zello: It can be secure. But it wasn’t, as used by the Oath Keepers, the day of the insurrection, because it was an open channel. Indeed, the reason we know about it is because journalist Micah Loewinger was following along in real time. Plus, anything saved onto a phone will be accessible once the phone is compromised, just like Signal will. (From the discovery letters shared with the Oath Keepers — the most recent of which is over a month old — the government appears to have initially relied on WNYC’s published versions of the Zello chats. But this superseding indictment includes time stamps from Watkins’ Zello exchanges, which suggests they’ve obtained a more reliable copy since then.

Signal, DOJ says, is encrypted. I have no problem with that. But they started compromising the Signal chats as soon as they exploited Jessica Watkins’ phone. And the latest indictment seems to rely on the exploitation from another of the more involved participants — it’s where the new details on the Quick Reaction Force come from (here’s my rough capture of the communications we’ve seen referenced to date).

What I find annoying is that, after treating Signal and Zello as super spooky applications, DOJ then treats GoToMeeting like a normal tool, just “an online meeting site that allows users to host conference calls and video conferences via the Internet in real time.”

But it is also end-to-end encrypted and has a number of other security features that are necessary for its use by mainstream businesses and health care providers. That said, it is centralized and probably responds eagerly to legal process, which is the distinction DOJ really intends by this. That is, it’s not encryption that makes the use of these apps a useful marker of a conspiracy, it’s decentralized security, security that the Oath Keepers didn’t use with Zello the day of the insurrection. Plus, for a conspiracy indictment, as opposed to other criminal charges, the use of G2M suggests a bureaucratization that should be more useful to prove the case.

In any case, with this fourth indictment, DOJ added content from G2M that was probably meant to be secure: Stewart Rhodes’ “Antifa foil” comments. An initial production of G2M had been provided to defendants by April 9, with a second attempt on April 23. So it may be that it has taken some time to reconstruct whatever full production they might receive from the various Oath Keeper accounts.

The money is the metadata

That said, it is amusing seeing the conspirators try to add a layer of security to the already secure ProtonMail while they’re laying a trail of travel plans that knots them all up into a network. Here are just some of the fleshed out details from the indictment:

79. On January 4, 2021, HARRELSON and DOLAN departed Florida together in a vehicle rented by DOLAN and traveled to the Washington, D.C., metropolitan area.

[snip]

82. On January 4, 2021, PERSON TEN checked into the Hilton Garden Inn in Vienna, Virginia. The room was reserved and paid for using a credit card in PERSON ONE’s name.

[snip]

85. On January 5, 2021, PERSON ONE and MINUTA separately traveled to the Washington, D.C., metropolitan area and checked into the Hilton Garden Inn in Vienna, Virginia.

[snip]

90. KELLY MEGGS paid for two rooms, each for two people, at the Comfort Inn Ballston from January 5-6, 2021. The rooms were reserved under the name of PERSON THREE.

90. KELLY MEGGS paid for two rooms, each for two people, at the Comfort Inn Ballston from January 5-6, 2021. The rooms were reserved under the name of PERSON THREE.

91. KELLY MEGGS also booked two rooms at the Hilton Garden Inn in Washington, D.C., from January 5-7, 2021. KELLY MEGGS paid for both of the rooms, using two different credit cards.

[snip]

93. HACKETT paid for a room at the Hilton Garden Inn in Washington, D.C., from January 5-7, 2021. The room was booked in the name of PERSON SIXTEEN.

[snip]

95. MINUTA, using his personal email address and his personal home address, reserved three rooms at the Mayflower Hotel in Washington, D.C., under the names of MINUTA, JAMES, and PERSON TWENTY. A debit card associated with PERSON FIFTEEN was used to pay for the room reserved under MINUTA’s name. A credit card associated with JAMES was used to pay for the room reserved under JAMES’s name.

Kelly Meggs, by paying for what appears to be the QRF room and another for Person 3 to tend the weapons, would tie the Floridians staying in the DC Hilton Garden with a group coming from at least three states at the Ballston Comfort Inn (and that’s before you consider the surveillance footage that shows others dropping off weapons). Minuta, by reserving three rooms at the Mayflower, would tie Joshua James, Person Twenty, and Person Fifteen to the group, including Minuta, staying at the Vienna Hilton Garden, which includes Rhodes and Person Ten. And there’s at least one known payment — from some unidentified person to James’ wife — that doesn’t show up here.

Post 9/11, it’s hard to hide hotel travel, especially retroactively, after engaging in a terrorist attack, but it doesn’t help that the Oath Keepers didn’t compartment their network at all. So all the encrypted messaging and meeting apps in the world could not hide that this was a network that spanned (thus far, but I’m holding out hope they’ll roll out the first Mississippi defendants any day!) at least seven states.

Update: I’ve taken out a reference to the Ohioans walking Isaacs back to a hotel in DC. They did separate early but it was not to take him back. Thanks to Benny Bryant for the correction.

How Did the Proud Boys Have Better Lines of Communication about National Guard Reinforcements than the National Guard Did?

At 3:38 on January 6, according to the Proud Boy leaders conspiracy indictment, Charles Donohoe announced on the 60-member operational Telegram channel the Proud Boys used that day that, “we are regrouping.”

Sometime around that time, a bunch of Oath Keepers, having already entered the Capitol, were gathered together on the east side of the Capitol.

According to the most recent Oath Keepers indictment, two minutes after Donohoe announced the Proud Boy plan to regroup, at 3:40, Oath Keeper Joshua James called Person Ten — who was doing much of the coordination for the Oath Keepers that day — and had a 3 minute, 4 second phone call, their second longest call described in the indictment.

Roberto Minuta and Rhodes exchanged two calls just after 4:00 — 42 seconds, then 2 minutes 56 seconds. At 4:10, according to a Thomas Caldwell detention motion, someone on the Oath Keepers’ operational channel said, “Fight the good fight. Stand your ground.”

It seems the militias were preparing for a second, seemingly coordinated, operation of the day: resuming the assault on the Capitol.

Indeed, some of the fighting and attempted breaches at the Capitol did intensify about that time (for example, that’s shortly before, as some cops were trying to help Rosanne Boyland, who had been trampled, they were allegedly assaulted by James Lopatic, Jeffrey Sabol, Peter Stager, and Wade Whitten, with police officer BW being dragged down the steps prone and beaten).

But not the militias, at least not the Proud Boys.

According to the government’s detention memo for Donohoe, he subsequently — they don’t provide the time — sent out a message that the National Guard and DHS agents were incoming.

Donohoe’s intent to create mayhem and disrupt the proceedings at the Capitol continued well after the initial breach into the restricted grounds and up to the west terrace. Indeed, at 3:38 p.m., more than an hour after Pezzola and others had broken into the building, Donohoe indicated that he had left the Capitol grounds, but then announced over Telegram, “We are regrouping with a second force.” That plan appears to have been short-lived, as Donohoe subsequently advised the group that the National Guard and “DHS agents” were “incoming.”

This is fairly remarkable timing, as it came during the most inexplicable period of DOD’s delayed response with the National Guard. At 2:30, just before the second breach by militia-led groups, Acting Defense Secretary Christopher Miller met with (among others) Army Secretary Ryan McCarthy about requests for help from the city and the Capitol Police. At 3, Miller determines the Guard is needed at the Capitol and McCarthy orders them to prepare to move. At 3:04, Miller provides verbal approval for the Guard to support MPD. At 3:19 and 3:26, McCarthy was on the phone with first Chuck Schumer and Nancy Pelosi and then Bowser, assuring them the Guard was on the way. At 3:48, McCarthy leaves to go to MPD headquarters, taking 22 minutes to transit, even as two trained militia groups full of military veterans prepared to make a second assault on the Capitol. At 4:32, after calls back and forth among the militia, Miller provided verbal authorization for the Guard to help the Capitol Police.

Tick tock, tick tock, tick tock.

But then, according to the guy DOD sent to the Senate to not answer questions like this, Robert Salesses, General William Walker, the guy in charge of the Guard, didn’t get that order for another 36 minutes.

Salesses: In fairness to General Walker too, that’s when the Secretary of Defense made the decision, at 4:32. As General Walker has pointed out, cause I’ve seen all the timelines, he was not told that til 5:08.

Roy Blunt: How is that possible, Mr. Salazar [sic], do you think that the decision, in the moment we were in, was made at 4:32 and the person that had to be told wasn’t told for more than a half an hour after the decision.

Salesses: Senator, I think that’s an issue.

Tick tock, tick tock, tick tock.

Somehow, it seems, Proud Boy Charles Donohoe knew that the National Guard was coming to reinforce the Capitol before DC Guard Commander General Walker.

Somehow, it seems, the militias assaulting the Capitol had better lines of communication than the US Department of Defense.

Timeline

2:30PM: Acting Secretary of Defense Christopher Miller and Army Secretary Ryan McCarthy meet to discuss the requests for assistance from the MPD and CPD.

2:40PM: Oath Keepers and Proud Boys breach second front of the Capitol.

3PM: Miller determines the Guard is needed.

3:04PM: Miller authorizes Guard assistance to MPD.

3:19PM: McCarthy on the phone with Democratic leaders. Roberto Minuta enters Capitol.

3:26PM: McCarthy on the phone with Mayor Bowser.

3:38PM: Charles Donohoe announces, “we are regrouping.”

3:40PM: James calls Person Ten, speaks for 3:04.

3:48PM: McCarthy leaves for MPD.

4PM: Meeting with Stewart Rhodes on east side of Capitol.

4:04PM: Minuta calls Rhodes, speaks for 42 seconds.

4:05PM: Rhodes calls Minuta, speaks for 2:56.

4:10PM: McCarthy arrives at MPD. Proud Boy leader channel instructs, “Stand your ground.”

4:32PM: Miller provides the verbal order for the Guard to reinforce the Capitol Police

5:08PM: General Walker gets the order to reinforce the Capitol Police

Unknown time: Donohoe advises that National Guard and “DHS” are incoming.

DOJ Arresting Their Way to Clarity on Joe Biggs’ Two Breaches of the Capitol

The Proud Boys Leadership conspiracy indictment describes that Joe Biggs breached the Capitol twice.

He entered first on the west side through a door opened after Dominic Pezzola broke through an adjacent window with a riot shield.

At 2:14 p.m., BIGGS entered the Capitol building through a door on the northwest side. The door was opened after a Proud Boys member, Dominic Pezzola, charged elsewhere, used a riot shield at 2:13 p.m. to break window allowed rioters to enter the building and force open an adjacent door from the inside. BIGGS and Proud Boys members Gilbert Garcia, William Pepe, and Joshua Pruitt, each of whom are charged elsewhere, entered the same door within two minutes of its opening. At 2:19 p.m., a member of the Boots on the Ground channel posted, “We just stormed the capitol.”

Then, Biggs left the building, walked around it, took a selfie from the east side, then forced his way in the east side and headed from there to the Senate.

BIGGS subsequently exited the Capitol, and BIGGS and several Proud Boys posed for a picture at the top of the steps on the east side of the Capitol.

Thirty minutes after first entering the Capitol on the west side, BIGGS and two other members of the Proud boys, among others, forcibly re-entered the Capitol through the Columbus Doors on the east side of the Capitol, pushing past at least one law enforcement officer and entering the Capitol directly in front of a group of individuals affiliated with the Oath Keepers. [my emphasis]

Understanding Biggs’ actions — including whether they were coordinated with the Oath Keepers who entered at virtually the same time as him (including fellow Floridian Kelly Meggs, who had just “organized an alliance” with the Proud Boys in December) — is crucial to understanding the insurrection as a whole.

That’s particularly true given that Biggs re-entered the Capitol and headed to the Senate, where Mike Pence had only recently been evacuated. That’s also true given how Biggs’ actions coincide so neatly with those of the Oath Keepers.

At the moment Pezzola breaks the Capitol window with a shield, Person Ten contacts Joshua James (from Alabama but seemingly affiliated with the Florida Oath Keepers). At the moment Biggs enters the Capitol, someone on the Oath Keepers’ Signal channel informed the list that “The[y] have taken ground at the capital [sic]. We need to regroup any members who are not on mission.” This is a quicker response than the Proud Boys Boots on the Ground channel itself had to the initial breach.

And that’s what happened. Both the Oath Keepers and the Proud Boys regrouped and opened a new front on the assault on the Capitol.

Rhodes called Kelly Meggs. Person Ten called James. Then Rhodes had overlapping phone calls with Person Ten and Meggs. Around that time, The Stack started making their way to an entry of the Capitol on the other side of the building from where they were. And James and Minuta hopped in some golf carts and rushed to the Capitol (I’m not sure from where). During the period when The Stack, commanded by Kelly Meggs, was making their way to the Capitol and Biggs was walking around rather than through it, Roberto Minuta arrived and started harassing the cops guarding the door through which Biggs and The Stack would shortly enter, perhaps ensuring that the cops remained at their post rather than reinforcing the east side.

I had speculated here that Proud Boys in the initial breach — most notably former Army Captain Gabriel Garcia — were live streaming with the intent of providing tactical information to people located remotely who were performing a command and control function.

If you were following Garcia’s livestreams in real time — even from a remote location — you would have visibility on what was going on inside almost immediately after the first group of the Proud Boys breached the Capitol.

In a later livestream, Garcia narrated what happened in the minutes after the Proud Boys had breached the Capitol.

GARCIA states, “We just went ahead and stormed the Capitol. It’s about to get ugly.” Around him, a large crowd chants, “Our house!”

Then, as a standoff with some cops ensued, Garcia filmed himself describing, tactically, what was happening, and also making suggestions to escalate violence that were heeded by those around him.

At minute 1:34, a man tries to run through the line of USCP officers. The officers respond with force, which prompts GARCIA to shout, “You fucking traitors! You fucking traitors! Fuck you!” As the USCP officers try to maintain positive control of the man that just rushed the police line, GARCIA yells, “grab him!” seemingly instructing the individuals around him to retrieve the man from USCP officers. GARCIA is holding a large American flag, which he drops into the skirmish in an apparent attempt to assist the individuals who are struggling with the USCP officers.

USCP officers maintain control of the line, holding out their arms to keep the crowd from advancing. At least one USCP officer deploys an asp. GARCIA turns the camera on himself and offers tactical observations regarding the standoff. [my emphasis]

Garcia’s livestream was such that you would obtain crowd size estimates from it, as well as specific names of officers on the front line, as well as instructions to “keep ’em coming,” seemingly asking for more bodies for this confrontation.

At minute 3:26, GARCIA, who is still in extremely close proximity to the USCP officer line again yells, “Fucking traitors!” He then joins the crowd chanting “Our house!” At minute 3:38, GARCIA states, “You ain’t stopping a million of us.” He then turns the camera to the crowd behind him and says, “Keep ‘em coming. Keep ‘em coming. Storm this shit.” GARCIA chants with the crowd, “USA!”

Soon after, GARCIA stops chanting and begins speaking off camera with someone near him. At minute 4:28, GARCIA says, “do you want water?” Though unclear, GARCIA seems to be asking the person with whom he is speaking. GARCIA is so close to an officer that, as the camera shifts, the only images captured are those of the officer’s chest and badge. [my emphasis]

Remarkably, Garcia filmed himself successfully ordering the rioters to hold the line — which they do — and then filmed them charging the police.

GARCIA yells, “Back up! Hold the line!” Shortly thereafter, the crowd begins advancing, breaching the USCP officer line. GARCIA says, “Stop pushing.” The last moments captured in the video are of the crowd rushing the USCP officers.

A filing arguing for detention for Ethan Nordean confirms that Proud Boys located offsite were monitoring the livestream and providing instructions.

When the Defendant, his co-Defendants, and the Proud Boys under the Defendant’s command did, in fact, storm the Capitol grounds, messages on Telegram immediately reflected the event. PERSON-2 announced, “Storming the capital building right now!!” and then “Get there.” [Un-indicted co-conspirator-1] immediately followed by posting the message, “Storming the capital building right now!!” four consecutive times.6 These messages reflect that the men involved in the planning understood that the plan included storming the Capitol grounds. This shared understanding of the plan is further reflected in co-Defendant Biggs’ real-time descriptions that “we’ve just taken the Capitol” and “we just stormed the fucking Capitol.”

6 UCC-1 and PERSON-2 are not believed to have been present on the Capitol grounds, but rather indicated that they were monitoring events remotely using livestreams and other methods.*

So at least on the Proud Boys side, there was this kind of command and control.

And the government has been arresting their way to some clarity on this point.

Sometime before March 1, the government got access to both the leadership Telegram channel the Proud Boys used to coordinate the insurrection and the “Boots on the Ground” channel, meaning they’ve got monikers for around 35 active Proud Boy participants in the insurrection who have not yet been arrested. In the weeks since the Biggs and Nordean conspiracy indictment disclosed that the government had these chats, the government has arrested several people with ties to one or another of these men (though without saying whether they identified them from the Boots on the Ground channel or whether they arrested them at this time for investigative reasons).

Two of these men just happen to be two of Joe Biggs’ co-travelers the day of the insurrection, Paul Rae and Arthur Jackman, both also from Florida. The complaints for both are very similar, possibly written by the same FBI agent. Both complaints go through the greatest hits of the Proud Boy actions that day, listing all the conspiracies already charged. While the affidavits include the testimony of acquaintances of both men (in Jackman’s case, obtained after a January 19 interview with Jackman himself, meaning that testimony couldn’t be the lead via which they IDed him), the affidavits also focus on their entries with Joe Biggs, with Rae entering the west Capitol door right next to Biggs.

And Jackman walking up steps with his hand on Biggs’ shoulder.

Each affidavit includes the photo obtained from warrants served on Biggs showing the selfie mentioned in the Leader indictment (bolded above).

In Rae’s affidavit, they’ve redacted out all but his face and Biggs’.

They use the same approach in Jackman’s affidavit, redacting the others (including Rae, who had already been arrested).

If I were one of the two other guys in this picture, I’d be arranging legal representation right now.

The affidavits show both men entering the Capitol on the east side, along with Biggs. As he did on the west side, Rae walked in beside Biggs (you can see Jackman just ahead of Rae in this picture).

And as he did elsewhere in the Capitol, Jackman walked with his hand on Biggs’ shoulder.

Jackman’s affidavit shows him in the Senate (where we know Biggs also went).

The government arrested Rae on March 24. They arrested Jackman on March 30. Again, I’d be pretty nervous if I were one of the other two guys.

Because if the government can show that this second breach by Biggs was coordinated with the Oath Keepers, with The Stack led by the guy who arranged an alliance in December, Kelly Meggs, it will make these five separate conspiracies mighty cozy (in any case, the government is already starting to refer to the multiple Proud Boys conspiracies as one).

There’s at least one other action on which both militias may have coordinated: aborted efforts to launch a second wave after 4PM, something that Rudy Giuliani seems to have had insight into.

But for now, the government seems pretty focused on arresting their way to clarity about why Joe Biggs breached the Capitol, then walked outside and around it, and then breached it again.


* I had suggested in this post that UCC-1 might be Nicholas Ochs. But that’s not possible, because the government knows he was onsite. Moreover, the government is now treating defendants in one of the Proud Boys conspiracy indictments (most notably Dominic Pezzola) as co-conspirators with those charged in other conspiracy indictments (including Nordean), so Ochs would be an indicted co-conspirator. Another — far more intriguing possibility — is that it is James Sullivan (who might have a leadership role in Utah’s Proud Boys), who was in contact with Rudy Giuliani about the insurrection, and who inexplicably hasn’t been arrested. Certainly, Rudy seems to have had the information available on those chats in real time.

The Grand Theft Golf Cart Conspiracy: DOJ Backed Off Charges against Roberto Minuta

Yesterday, DOJ added Roberto Minuta and Joshua James — both of whom provided security to Roger Stone in advance of the insurrection — to the Oath Keepers conspiracy indictment, making a third superseding indictment (S3) against the militia. The showiest part of the indictment describes how Minuta and James rode in golf carts (from where, it doesn’t say, nor does it explain how it knows exactly what Minuta said while on the golf cart escapade) to the Capitol to join in the insurrection.

Between 2:30 and 2:33 p.m., MINUTA, JAMES, and others rode in a pair of golf carts towards the Capitol, at times swerving around law enforcement vehicles, with MINUTA stating: Patriots are storming the Capitol building; there’s violence against patriots by the D.C. Police; so we’re en route in a grand theft auto golf cart to the Capitol building right now … it’s going down, guys; its literally going down right now Patriots storming the Capitol building … fucking war in the streets right now … word is they got in the building … let’s go.

At about 2:33 p.m., MINUTA, JAMES, and the others in their group parked the golf carts near the intersection of Third Street and Pennsylvania Avenue, Northwest. They then continued on foot towards the Capitol.

But the golf cart vignette is not the most interesting detail in the S3 indictment. The additions on the most recent superseding indictment (S2) are interesting for what the government did and did not add with the inclusion of the two Oath Keepers who were not part of The Stack that breached the Capitol, Minuta and James.

The crimes not charged

In spite of Minuta’s self-description, the government did not charge Minuta with Grand Theft Golf Cart. It’s never actually explained where they got the carts, but the Oath Keepers had been using carts as part of their protection detail for people like Roger Stone. If they used golf carts owned or rented by Stop the Steal or some other organizer for the rally, however, it might implicate those owners in the conspiracy if they didn’t report the golf carts as being stolen as part of an effort to breach the Capitol.

But Grand Theft Golf Cart is only the beginning of crimes not charged against the newest additions to the conspiracy.

In the complaint against Minuta, the government had shown probable cause that Minuta obstructed the investigation by deleting his Facebook account on January 13.

Finally, on January 13, 2021, the week after he attacked the Capitol and after much media reporting on law enforcement’s investigation to bring the Capitol rioters to justice, Minuta deleted his Facebook account of over thirteen years.

[snip]

Evidence also demonstrates that one week after he participated in forcibly storming the Capitol, Minuta deleted a Facebook account he had maintained for 13 years to conceal his involvement in these offenses.

[snip]

On January 6, 2021, the FBI opened an investigation into the attack on the Capitol, and a grand jury of the United States District Court for the District of Columbia subsequently opened an investigation. Within the first week of the investigation, a number of subjects were arrested and many more subjects’ photographs were shared over the Internet by both the FBI and regular citizens who took it upon themselves to publicize and seek information about the Capitol attackers.

Records indicate that Roberto Minuta opened a Facebook account associated with phone number XXX-XXX-4147 (known to be associated with Minuta) on November 24, 2007. On January 13, 2021—one week after Minuta and others attacked the Capitol on January 6— Minuta deleted his account.

From the first iteration of this conspiracy indictment, the government had charged others for deleting their Facebook accounts — first Thomas Caldwell, and then Graydon Young. So it would have followed the pattern already set to include a Count 7 against Minuta for his deletion of Facebook.

It’s not in there.

But that’s not the only crime not charged.

The complaint against Minuta focused closely on his taunts against cops in the minutes before The Stack arrived (the government may suspect that Minuta did this to occupy the police while insurrectionists breached the Capitol from the west side, to ensure officers guarding the east side of the building could not go assist those being overrun on the west side).

The indictment adds this further interaction between the cops and Minuta.

At 3:15 p.m., inside the Capitol building, MINUTA and JAMES pushed past U.S. Capitol Police Officers who physically placed their hands on MINUTA and JAMES in an unsuccessful attempt to stop them from progressing toward the Capitol Rotunda.

Other January 6 defendants (not part of this Oath Keeper conspiracy) got charged with obstructing the police during a civil disorder for such physical interactions. Not Minuta and James.

Minuta and James got charged, along with the other members of the conspiracy, with one (but not both) of the trespassing charges used against virtually all the January 6 defendants. But Minuta entered the Capitol with a holster of bear spray (visible on his hip in the picture above). Others who entered the Capitol similarly armed had an enhancement added for carrying a deadly weapon, an enhancement that increases the potential sentence to 10 years. Minuta was not similarly charged (meaning, too, that the Oath Keepers who conspired with him were not charged with abetting his armed entry to the Capitol).

Finally, all the other conspirators, including Thomas Caldwell (who never entered the Capitol and was on the other side of it from where The Stack entered) were charged with abetting the destruction of the Capitol door through which The Stack entered. This is the charge that counts as a crime of violence for detention purposes, and also can merit (and is being treated as meriting, for the Proud Boy conspiracy cases) a terrorism enhancement. But neither Minuta nor James were charged with it, even though the indictment notes they entered the same door that The Stack went through.

At 3:15 p.m., inside the Capitol building, MINUTA and JAMES, together with others known and unknown, forcibly entered the Capitol building through the same east side Rotunda doors through which members of the stack had entered about 25 minutes earlier.

It’s unclear why DOJ wouldn’t treat Minuta and James the same way they treated Caldwell (and Kenneth Harrelson, who went in with The Stack but not part of it). I can think of several possible explanations. But they didn’t, which is notable (particularly in the wake of the DC Circuit decision that led to the release of Zip Tie Guy Eric Munchel and his mother).

In short, if Minuta (and James) were treated the same way other January 6 defendants were, they would be facing significantly more serious charges and significantly more prison time. They’re not.

One other, potentially related detail: The complaint that Minuta was charged with — which was obtained on February 24 but not executed until weeks later, seemingly in conjunction with the Joshua James arrest — is titled, “Affidavit in Support of Complaint Minuta (non conspiracy) 2021 02 23,” almost as if at that point DOJ wasn’t sure whether they were going to treat him separately from the rest of the Oath Keepers or not. They appear to have decided to do so, and along the way, thereby limit his potential criminal exposure.

Who is Person Ten and what role did he play with Stewart Rhodes?

Minuta and James complaints included new details about the role of Oath Keepers heard, Stewart Rhodes, described as Person One in all the Oath Keeper filings. Their addition to the conspiracy effectively added more on Rhodes to the conspiracy indictment.

At least as interestingly, the S3 indictment added a Person Ten. Minuta had been Person Five in the James complaint, it’s not clear who Person Four is, and Persons Six, Seven, Eight, and Nine are not described at all, but — along with Person Ten — are likely some of the people in this picture.

Rhodes paid for Person Ten’s hotel room in the Hilton Garden Inn in DC, but Person Ten arrived the day before Minuta and Rhodes, who also stayed at the Hilton Garden Inn in Vienna.

Curiously, the S3 indictment leaves out some key communications, especially those from a leadership Signal chat that showed up in earlier filings. Between a Caldwell detention motion, a Watkins detention motion, James’ complaint, and the superseding indictment, this partial list of known Oath Keepers communications suggest that Person Ten might be the person coordinating deployments that day. Consider two details from the partial list of the known communications among Oath Keepers below (I’ll update this later, once I catch up on the week of filings).

Highlighted in yellow, Person Ten has a series of calls back and forth with Joshua James, pre-Golf Cart Grand Theft. Right in the middle of it all, someone — not described in this indictment — informs the Signal group as a whole that “the[y] have taken ground” and “we need to regroup any members who are not on mission.” Shortly thereafter, James and Minuta launch the Grand Theft Golf Cart to get to the Capitol, where Minuta taunts the police, preventing them from moving to reinforce the overrun Capitol on the other side, and the members of The Stack leave Trump’s speech prematurely and go to the Capitol. That is, Person Ten calls for reinforcements (Rhodes repeats his Signal text), and then Minuta and James in the golf carts and The Stack converge on the northeast side of the Capitol to breach a new entry point.

Now consider the pink highlight: Unless the government or I have made a mistake in the timing, Person Ten and Kelly Meggs are both on the phone with Stewart Rhodes together. Because of the length of Person Ten’s calls, it overlaps entirely with Rhodes’ call with Meggs (which — again, unless there’s an error of timing — means Rhodes either has two phones or either via conferencing or a hold, had both on the same phone at the same time).

In either case, Person Ten seems to have a key role as a communication pivot between different groups of Oath Keepers.

The communications not included

Finally, consider this: I have not included all known texts in the table above (most obviously missing are Watkins’ Zello texts). But after suggesting strong ties between James and Minuta, the government has included none of their multiple communications, neither on January 6 nor before that, in the superseding indictment. Similarly, the government has left out the Signal chats showing minute to minute deployments as the Oath Keepers launched a second front on the Capitol.

All these communications are tantalizing and hint at a good deal more coordination during the insurrection. And remember: Both Minuta and James were with Roger Stone for part of the day (earlier in the day, I think). But the government is still including just a fraction of the communications it knows about.

Update: Correct that the indictment said Minuta and James rode in the golf carts, didn’t drive and that the Meggses stayed at a different Hilton Garden than Rhodes and Minuta and Person Ten. Thanks to BB.

Update: I want to make clear that the reasons why DOJ backed off charges with Minuta may not all stem from the same reason, nor does this necessarily indicate he is cooperating. For example, in the wake of the DC Circuit decision in Munchel, the chances that DOJ could get pre-trial detention for either Minuta or James, are much lower. So charging them with abetting the damage doesn’t serve an investigative purpose at this time. And it’s possible after they seized Minuta’s phone, they discovered something to indicate he had deleted Facebook in response to Facebook’s decision to shut down Trump on the platform. To be honest, Minuta and James are an odd fit for this conspiracy as currently laid out, which suggests it’s likely to change in the near future.

The State of the Five Now-Intersecting January 6 Militia Conspiracies

Paragraph 64 of a new conspiracy indictment including Proud Boys Ethan Nordean, Joe Biggs, and the newly arrested Proud Boys Zachary Rehl and Charles Donohoe includes a seemingly gratuitous reference to the Oath Keepers. The paragraph describes how Biggs, after having entered the Capitol once already from the northwest side, then moved to the opposite side of the building and forced his way in on the east side. He did so right in front of a group of Oath Keepers.

Thirty minutes after first entering the Capitol on the west side, BIGGS and two other members of the Proud boys, among others, forcibly re-entered the Capitol through the Columbus Doors on the east side of the Capitol, pushing past at least one law enforcement officer and entering the Capitol directly in front of a group of individuals affiliated with the Oath Keepers.

This would have been around 2:44 PM. The Oath Keeper “stack” went in the east side of the Capitol at around 2:40.

That reference, along with the common use of the Zello application, brings two parallel conspiracies laid out over a month ago closer together, arguably intersecting. As of right now, DOJ has charged 25 people in five different conspiracy indictments, four of which share precisely the same goal: to stop, delay, and hinder Congress’s certification of the Electoral College vote, with many similar means and methods. Three conspiracy indictments also share roughly the same goal of obstructing law enforcement. Those indictments are:

Here’s what a simplified version of the five different conspiracies looks like:

This is not the end of it: there are three Oath Keepers not included in that conspiracy, and a random bunch of Proud Boys who might eventually be included, as well as anyone else who coordinated this effort [wink]. But these conspiracy indictments will remain separate only for prosecutorial ease. They are, for all intents and purposes, now-intersecting conspiracies.

Update: Last night, NYT’s visual team released new videos showing that the Oath Keepers Stack was involved in forcing entry into the East entrance of the Capitol. These videos depict what happened moments after Biggs reentered the Capitol, as described above.

Update: To see how the other pieces of any coordinated action fit, I will list the other Oath Keepers and Proud Boys that have played a part in this operation.

Oath Keepers

Stewart Rhodes: The Oath Keeper President. He is not charged, but implicated in the existing Oath Keepers indictment and the Minuta complaint.

Roberto Minuta: Minuta was arrested on March 8. An SDNY Magistrate judge released him on bail (he almost put up silver bars for his security, but ended up coming up with the money itself), ignoring the government request he stay the order. Minuta’s arrest affidavit–which was written 12 days before James’ but executed roughly the same day–focuses primarily on Minuta’s harassment of cops. It doesn’t mention, as James’ affidavit does, Minuta’s role in providing security, including for Roger Stone. Minuta also deleted his Facebook account on January 13, for which he was charged with obstruction.

Joshua James: James was arrested on March 9 and held without bail (in part because of a past arrest associated with claiming to be a military police officer in 2011). His arrest affidavit makes it clear he was a close contact with Minuta as well as Kelly Meggs. The affidavit repeatedly describes James offering security to VIPs we know to include Roger Stone. According to public reporting, James received payment for his “security” services on January 6, which Stone was publicly fundraising for in advance (then denied spending).

Jon Ryan Schaffer: The front man for the heavy metal band Iced Earth and an Oath Keeper lifetime member, Schaffer was arrested for spraying some police with bear spray. But two months after his arrest and detention, he has not been (publicly) indicted and only arrived in DC on March 17. The government has not publicly responded to his motion to dismiss his case on Speedy Trial grounds. All of which suggests there’s something more there that we can’t see.

Person Four: The James affidavit refers to Minuta as “Person Five.” It uses that number, it says, because “Persons Two [Caldwell’s spouse], Three [the NC-based Oath Keeper who might serve as a Quick Reaction Force], and Four are not included in this affidavit, but are already-numbered individuals associated with United States v. Thomas Caldwell, et al, Case No. 21-cr-28 (APM). To maintain consistent nomenclature, the referenced individual here will be defined as ‘Person Five.'” I haven’t been able to find the reference to Person Four (though it might be Watkins’ partner, references to whom are inconsistent).

Three more Stack participants and four others who operated with Minuta and James on January 6: This image, from James’ complaint, identifies three other Stack members (the second, third, and last yellow arrow) and four others who interacted with James and Minuta during the day on January 6.

Proud Boys

Enrique Tarrio: Tarrio is the head of the Proud Boys, but got arrested as he entered DC on January 4 on charges relating to vandalizing a Black church in December, onto which possession charges were added. He is referred to in all the Proud Boy conspiracies, repeatedly in the Leader one (because they scrambled to figure out what to do after his arrest). While it’s unlikely he was on the Telegram channels used to organize the insurrection, he was in touch with members via other, thus far unidentified channels.

Joshua Pruitt: Pruitt was arrested for a curfew violation on the night of the insurrection. He told the FBI he hadn’t engaged in any unlawful activity and was just trying to deescalate the situation. But he was indicted on his own weeks later for obstructing the vote count and interfering with cops, and abetting the destruction of property, along with trespassing. The Nordean conspiracy indictment notes that he went in the West entrance shortly after Dominic Pezzola breached it (suggesting the government may now know he was part of a cell with Pezzola). Pruitt is being prosecuted by the same prosecutor as on most Proud Boy cases, Christopher Berridge, and before the same judge, Timothy Kelly.

Gabriel Garcia: Garcia, a former Army Captain, appears to have originally been identified by the Facebook order showing who livestreamed from the Capitol. It’s possible his livestreams were intended to serve as live reporting for those coordinating outside (he catches the names of cops, the size of the crowd, and instructs, “keep ’em coming.” He incites a big push through a line of cops. Later, he calls for “Nancy” to “come out and play” and calls to “Free Enrique” [Tarrio]. He was charged by complaint on January 16 and by indictment on February 16 with obstruction and resisting cops during civil disorder. The Nordean conspiracy indictment notes he went in the West entrance shortly after Pezzola breached it.

Christopher Worrell: The government originally charged Worrell, a committed Proud Boy who traveled to DC in vans of Proud Boys paid for by someone else and wore comms equipment, with trespass crimes on March 10. Among his criminal background, he pretended to be a cop to intimidate a woman. He lied in his first interview with the FBI, hiding that he sprayed pepper spray on some police who were the last line of defense on the West side of the Capitol. According to a witness who knows him, he also directed other likely Proud Boys. After first being released, he was subsequently detained and is awaiting indictment on what the government suggests are likely to be assault charges.

Robert Gieswein: Ethan Nordean spoke to Giswein shortly before he and Pezzola launched the attack on the Capitol suggesting that Gieswein, who had known ties to the 3% movement, was coordinating with the Proud Boys that day. Over the course of breaking into the Capitol, he allegedly assaulted 3 cops with a bat or pepper spray, and broke a window to break in. He was first charged on January 16, indicted on January 27. His docket shows none of the normal proceedings, such as a protective order, but his magistrate’s docket shows two sealed documents placed there in recent weeks.

Ryan Samsel: There’s no indication I know of that ties Samsel to the Proud Boys. But he marched with them and initiated the assault on the West side of the Capitol with Dominic Pezzola and William Pepe. He was charged with assault and obstruction on January 29 and arrested on February 3. In his case, he allegedly did so by assaulting a cop at the first line of barriers, knocking her out. He and the government are in talks for a guilty plea.

Ryan Bennett: Bennett was IDed off his own Facebook livestreaming, while wearing a Proud Boys hat, of the event, including his direct witness to the shooting of Ashli Bennett, with his voice yelling “Break it down!” in the background. He was arrested on January 26 and charged in a still-sealed March 17 indictment over which James Boasberg will preside.

Bryan Betancur: Betancur was busted by his Maryland Probation Officer, to whom he had lied about distributing Bibles to get permission to go to DC. He wore a Proud Boys shirt to the insurrection and is a known white supremacist who espouses violence. He was charged with misdemeanor trespass charges. His defense attorney is already discussing a guilty plea.

Daniel Goodwyn: Goodwyn’s online identity is closely associated with the Proud Boys. He was identified via an interview he did with Baked Alaska during the insurrection and texts sent to an associate; he was arrested on January 29. He was originally charged with trespass, with obstruction added in his indictment on February 24. Charles Berridge was originally the prosecutor on this case but has been replaced on it.

Christopher Kelly: Kelly revealed on Facebook before he headed to DC that he would be going with, “ex NYPD and some proud boys.” While inside, he bragged that they had “stopped the hearing, they are all headed to the basement.” He was originally charged with trespass and obstruction on January 20; he has yet to be (publicly) indicted yet. He has the same defense attorney, Edward McMahon, as Nicholas Ochs.

Around 40 other people who used the Proud Boys “Boots on the Ground” Telegram channel: As I noted here, the government must have at least monikers for — and likely email and/or device identifiers — for around 40 people who used the organizing channel set up less than a day before the operation. It will be interesting to see if they attempt to track all of them down.

Rolling Updates:

Marc Bru, a Proud Boy with ties to Nordean, was charged on March 9.

Paul Rae, a Proud Boy from Florida who trailed Biggs both times he entered the Capitol.

Arthur Jackman: a Proud Boy from Florida who trailed Biggs both times he entered the Capitol, including into the Senate.

 

GoToInsurrection and Other Astounding Oath Keeper Social Media Habits

DOJ has now charged the following Oath Keeper associates:

Between all the charges, prosecutors have laid out a breathtaking scope of social media use by the militia:

  • A leadership list on Signal they appear to have obtained from either Watkins and/or Kelly Meggs
  • Open channels on Zello, possibly separate ones for each large event
  • Telephony chats and texts, including during January 6
  • MeWe accounts
  • Way too much blabbing on Facebook, followed by a foolish belief they could delete such content
  • Parler for further blabbing
  • Stripe for payment processing (possibly for dues)
  • GoToMeeting for operational planning

Plus, most of the people arrested thus far had their cell phones on, pinging cell towers, while they were in the Capitol (thus far, two of the accused did not enter the Capitol).

It’s the GoToMeeting revelation, in Harrelson’s affidavit, that gets me:

Pursuant to legal process, the government obtained records from Go To Meeting showing that a user named “gator 6” was the organizer for a meeting titled “dc planning call” on January 3, 2021. The user “gator 6” accessed the meeting from a mobile device using the same IP address ending in 158 [as Harrelson used to access Apple servers], and the user listed themselves as living in Titusville, Florida. Between September 30, 2020, and January 3, 2021, the user with the same IP address ending in 158 attended or organized approximately 30 meetings on Go To Meeting affiliated with the Oath Keepers, using the names “gator 6,” “hotel 26,” or kenneth harrelson.”

GoToMeeting is basically spyware for your computer, because it has to access so many features of your computer to work. As a default it collects a great deal of data on participants, and can be set to collect more. It is end-to-end encrypted, but with legal process FBI might be able to get a great deal of information from GTM, if the Oath Keepers kept it.

Between these twelve people, then, DOJ has served legal process on enough databases to create a veritable dossier on the Oath Keepers. While some of these comms (such as the Zello comms) are ephemeral, Facebook and GoToMeeting and Stripe are data vacuums.

With a database like this, the government can be choosy about which Oath Keepers they arrest. Reportedly, DOJ says they may add 6 more people to their collection of Oath Keeper defendants.

Indeed, it’s not really clear why they’ve charged the last three — Minuta, James, and Harrelson — before charging the last several members of the Stack that entered the Capitol together.

Harrelson was not part of the Stack, but the affidavit justifying his arrest shows him — and another guy — in communication as the Stack came up the Capitol steps, with Harrelson interacting with Graydon Young inside the Capitol. But his organizing efforts in Florida would put him in close touch with the Meggses (Kelly leads the Florida chapter) and James (who lives in Alabama but seems to be tied to the Florida chapter), along with Young (who lives in Titusville).

These Florida Oath Keepers were providing “security” for Roger Stone well before the January insurrection, including an event in Florida. (MoJo had a summary of who provided security when yesterday.)

As for Minuta, in addition to serving as Stone’s security on January 5 and 6, he also was abusive to cops before entering the Capitol and on his way out, when he promised the Second Amendment option came next. Like Young, Minuta is also accused of deleting Facebook, probably just as unsuccessfully.

In James’ case, DOJ seems particularly interested in the communications he had with Minuta, called Person Five in the affidavit even though he was already arrested by the time it was approved.

While James stood with the other Oath Keepers, at least one of them (who will be referred to below as “Person Five”)2 aggressively berated and taunted U.S. Capitol police officers responsible for protecting the Capitol and the representatives inside.

[snip]

Records indicate that phone number XXX-XXX-4304 (associated with James) exchanged a number of phone calls throughout November and December 2020 with a person who will be referred to herein as Person Five.

On November 13 and 14, 2020, for example, phone number XXX-XXX-4304 (associated with James) exchanged approximately eight calls with the number associated with Person Five. Your affiant is aware that certain Oath Keepers attended rallies in Washington, D.C., held on November 14, 2020, at which some Oath Keepers, to include Person Five, operated as a personal security detail for one or more speakers at the events.

Later, on or around November 20 and December 11, 2020, records indicate that phone number XXX-XXX-4304 (associated with James) exchanged two phone calls with Person Five. Your affiant is aware that certain Oath Keepers attended rallies in Washington, D.C., held on December 12, 2020, to protest the results of the 2020 election—at which some Oath Keepers, to include Person Five, operated as a personal security detail for speakers at the events.

Finally, records indicate that, on or around January 5, 2021, phone number XXXXXX-4304 (associated with James) exchanged six calls with the number associated with Person Five. That day, James, Person Five, and other individuals wearing apparel with the Oath Keepers name and/or insignia provided security to a speaker at the “Stop the Steal” events planned for that day.

Note that Minuta was hanging out with Proud Boy Dominic Pezzola in that December MAGA event.

James’ affidavit ends with this group photo, identifying Connie Meggs, two still uncharged Stack participants, four uncharged people who tracked with James and Minuta during the insurrection, Kelly Meggs, and another Stack member.

Both the Minuta and James affidavits focus on Oath Keeper head Stewart Rhodes, described as Person One, as does this detailed filing opposing bail for Caldwell.

James stayed in touch with others during the time of active investigation:

Since January 6, 2021, phone number XXX-XXX-4304 (known to be associated with James) has exchanged multiple phone calls and text messages with the number associated with Person Five. The number associated with James has also placed at least one call as recently as February 2021, to a phone number known to be associated with Kelly Meggs, the now-arrested self-described Florida Oath Keeper leader.

Thus far, DOJ isn’t explaining why Minuta, James, and Harrelson were arrested in the weeks after FBI started exploiting the Signal chats that organized Oath Keeper efforts on January 6 and, particular, Kelly Meggs’ communications.

But because the Oath Keepers were such promiscuous users of all kinds of social media tools, the FBI has a remarkable collection of data about the group’s activities since last fall. And they’ve picked these guys to arrest.

Update: In his detention hearing today, the FBI focused on James’ providing security for Stone.

The FBI agent who testified at Thursday’s hearing said several firearms were found during a search warrant executed at James’ home. All of the firearms were legal, and none were confiscated. They included a shotgun, a hunting rifle, a few “AR-15 style rifles,” and two pistols, the agent said.

James was paid $1,500 for security at two events, including a “Stop the Steal” rally on January 6, according from testimony from his wife, Audrey James. Stone and other pro-Trump figures held several events in Washington in addition to the official rally that Trump spoke at shortly before the attack.

Audrey James said she was sent “around $1,500 total” directly from the Oath Keepers over a mobile app. She stated the funds were paid out over a couple of months to assist her and her children during Joshua James’ absence to Texas and Washington, DC, while he was providing security. She said she didn’t know where the money originated from.

This story, by itself, presents real problems with the story Stone told. He raised funds for “security” in advance of the insurrection, but then said he couldn’t find paid security so relied on volunteers.