Posts

Thomas Caldwell’s “Storming the Castle” Ploy Succeeds

Judge Amit Mehta just released Thomas Caldwell to home confinement in the Oath Keeper conspiracy case.

Caldwell’s attorney, David Fischer, made some easily rebuttable arguments about Caldwell’s honesty, which I’ll return to. Fischer also tried to convince Judge Mehta that Caldwell was operating out of a sincere belief that he was defending against Antifa, not arming against the US government; I’ll return to that too (Judge Mehta had no patience for that ploy). While Mehta did come away believing Caldwell had been more cooperative than prosecutors had suggested, that’s not why he released Caldwell.

It’s important background, that in Fischer’s motion to reconsider Caldwell’s detention dismissed several references Caldwell made to “storming” the Capitol as an allusion to the fictional narrative of The Princess Bride.

Some of the lines that the Government cites in its papers are straight from Hollywood. The best example is “storming the castle” and “I’m such an instigator.” These are classic lines from the 1980s classic movie The Princess Bride.

Fischer suggested Caldwell’s own use of the same word everyone else used to describe assaulting the Capitol was just fiction.

The claim is important because the key reason that Caldwell got bailed is because of a feint that Fischer made in his motion for reconsideration. He argued that there is no evidence that Caldwell planned in advance to storm the Capitol.

On January 6th, at the urging of former President Donald J. Trump, hundreds of thousands of disgruntled, patriotic Americans came to Washington to protest what they viewed as an unfair election. Caldwell joined this protest to exercise his First Amendment right, a right he defended for 20 years in military service. Caldwell absolutely denies that he ever planned with members of the Oath Keepers, or any other person or group, to storm the Capitol. Caldwell absolutely denies that he obstructed justice. 3 The word of a 20-year military veteran with no prior criminal record is evidence, and it is strong evidence, of his innocence.

[snip]

In short, despite having an army of federal agents working around the clock intensively investigating for almost three months, the Government has not provided the Court with a confession, witness statement, or physical evidence backing up their claim that any person or group had a premeditated plan to storm the Capitol. Caldwell asks rhetorically: Doesn’t the Court find it odd that the Government hasn’t outlined the specifics of the premeditated plan? What time was the “invasion” scheduled to begin? Who would lead the attack? What was the goal once the planners entered the Capitol?

[snip]

The Government’s fanciful suggestion that right-wing tactical commandos were waiting in the wings to storm the Capitol is one for the ages.

In response to Judge Mehta’s questions about this claim, AUSA Kathryn Rakoczy conceded that the alleged co-conspirators didn’t have hard and fast plans as to what would happen before the event. This was a plan made of “possibilities,” which included the possibility (the facetious excuse offered by Caldwell) that other groups would resort to violence if Vice President Pence threw out the vote and the Oath Keepers would have to respond with force, or that President Trump would invoke the Insurrection Act and the Oath Keepers would come in to institute martial law. As Rakoczy described, they were “watching and waiting to see what leadership did” to achieve the goal of preventing the vote count, which goal the “government submits was unlawful and corrupt.”

They were waiting to see what leadership did. When leadership did what they referred to as “nothing,” they did take matters into their own hands. They were waiting and watching to see what was happening.

So when asked to respond to Caldwell’s misrepresentation that he was charged with conspiring to storm the Capitol, Rakoczy responded that it wasn’t certain they would storm the Capitol; the group was prepared to act, they just weren’t sure how — given the uncertainties of the day — they would act.

Based on that response and his conclusion that Caldwell actually had never entered the Capitol, Judge Mehta ruled that Caldwell was differently situated than the other defendants insofar as the evidence that he participated in the conspiracy (to storm the Capitol, Fischer said) was weaker given that he never did enter the Capitol.

Only later, after Judge Mehta had announced his decision, did Rakoczy point out the problem with this argument: Caldwell is not charged with conspiring to storm the Capitol. As she noted, the language Fischer kept quoting about storming the Capitol came from a background paragraph of the superseding indictment:

23. As described more fully herein, CALDWELL, CROWL, WATKINS, SANDRA PARKER, BENNIE PARKER, YOUNG, STEELE, KELLY MEGGS, and CONNIE MEGGS, planned with each other, and with others known and unknown, to forcibly enter the Capitol on January 6, 2021, and to stop, delay, and hinder the Congressional proceeding occurring that day.

The actual conspiracy as charged was to impede the certification of the Electoral College vote.

24. [… the defendants] did knowingly combine, conspire, confederate, and agree with each other and others known and unknown, to commit an offense against the United States, namely, to corruptly obstruct, influence, and impede an official proceeding, that is, Congress’s certification of the Electoral College vote, and to attempt to do so, in violation of Title 18, United States Code, Section 1512(c)(2).

Purpose of the Conspiracy

25. The purpose of the conspiracy was to stop, delay, and hinder Congress’s certification of the Electoral College vote.

This is a problem I saw going in (though I doubted that Fischer would be able to confuse Mehta as well as he did).

But the results of this hearing, particularly given Rakoczy’s answers, reveal something about the way this conspiracy is charged (and the ones most of the Proud Boy are charged).

They assume the any action conspirators took would be effectuated on Congress, that that was the only eventuality conspirators were planning for.

The conspiracy is all built off an obstruction charge which itself, while valid, is fairly inapt. It likens the counting of the vote to a trial, which legally holds, but doesn’t get at the scope of what co-conspirators (and Trump) were trying to accomplish. The focus — Caldwell’s, as well as those who actually did storm the Capitol — was all on Congress, because that was the next event in question (just as the previous December mob had been focused on the electoral certifications in the states). But the goal was not (just) to stop the certification of the vote count on Congress. The ultimate goal was to ensure that Trump would remain President, via whatever means. And as Rakoczy acknowledged, one possibility that co-conspirators Kelly Meggs and Jessica Watkins believed might happen was that Trump would declare martial law, and the Oath Keepers would become the glorious army to save their fantastic dreams. That would have had the effect of preventing the certification of the electoral vote, but it would have (if successful) been a more direct route to the actual goal of the conspiracy: to keep Trump in power and prevent the lawfully elected President from taking over.

That’s why Fischer’s ploy worked: because all the planning wasn’t primarily about the Capitol. It was primarily about Trump.

This charge is built like it is, I’ve always been convinced, because no one has yet made the commitment to charge seditious conspiracy (ideally in parallel with this conspiracy). The real goal, after all, was to overthrow the democratic system, and impeding the vote count was just one means to achieve that conspiracy. The conspiring that started even before the election was about overthrowing democracy, not just January 6.

This may not be a fatal weakness for these conspiracy charges. Now that prosecutors have seen Fischer work this feint so well, they’ll be better prepared for it from others.

But one reason it worked is because the real goal of the conspiracy — the one that Caldwell’s lawyer all but conceded to today — was to do whatever it took to prevent the lawfully elected President from taking power.

An Inventory of the January 6 Investigation on Merrick Garland’s First Day

Overnight on the day that Merrick Garland got his first briefing on the January 6 investigation, DOJ asked for a 60-day extension of time in the Oath Keepers’s conspiracy case. As part of the motion, they cite what has been done on the investigation so far. That inventory includes:

  • Over 900 search warrants, executed in almost all fifty states and the District of Columbia
  • More than 15,000 hours of surveillance and body-worn camera footage from multiple law enforcement agencies
  • Approximately 1,600 electronic devices
  • The results of hundreds of searches of electronic communication providers
  • Over 210,000 tips, of which a substantial portion include video, photo and social media
  • Over 80,000 reports and 93,000 attachments related to law enforcement interviews of suspects and witnesses and other investigative steps
  • Involvement of 14 law enforcement agencies, including:
    • U.S. Capitol Police
    • DC Metropolitan Police Department
    • FBI
    • DHS
    • Bureau of Alcohol, Tobacco, Firearms and Explosives
    • US Secret Service
    • US Park Police
    • Virginia State Police
    • Arlington County Police Department
    • Prince William County Police Department
    • Maryland State Police
    • Montgomery County Police Department
    • Prince George’s County Police Department

As the filing lays out, the government and the DC Public Defender’s office are trying to set up a system making available the general set of evidence to all defendants, while providing more specific evidence directly to the defendant. Some of that has started in this case.

The government has already provided defense counsel with preliminary discovery, including: arrest paperwork; recordings of custodial interviews, where available; paperwork and photographs relating to premises search warrants; data extracted from several of the defendants’ cellular telephones and social media accounts; some defendants’ hotel records; and some photographs and video recordings, from publicly available sources, of the defendants participating in the alleged offenses.

But most of the defendants in this case have already opposed a continuance, including Donovan Crowl, Kelly and Connie Meggs, Graydon Young, and Thomas Caldwell.

Not only must they be aware that others will get added to the conspiracy, broadening the scope of their potential criminal exposure under the conspiracy. But the government also clearly envisions the potential of more charges (possibly including seditious conspiracy).

Some of the conspiratorial activity being investigated, such as the activity under investigation in this matter, involves a large number of participants. The spectrum of crimes charged and under investigation in connection with the Capitol Attack includes (but is not limited to) trespass, engaging in disruptive or violent conduct in the Capitol or on Capitol grounds, destruction of government property, theft of government property, assaults on federal and local police officers, firearms offenses, civil disorder, obstruction of an official proceeding, possession and use of destructive devices, and conspiracy. [my emphasis]

Given Amit Mehta’s inclinations in any case, he might grant the continuance but put several of the defendants on home detention. We’ll know more about his inclinations at a hearing at 3.

GoToInsurrection and Other Astounding Oath Keeper Social Media Habits

DOJ has now charged the following Oath Keeper associates:

Between all the charges, prosecutors have laid out a breathtaking scope of social media use by the militia:

  • A leadership list on Signal they appear to have obtained from either Watkins and/or Kelly Meggs
  • Open channels on Zello, possibly separate ones for each large event
  • Telephony chats and texts, including during January 6
  • MeWe accounts
  • Way too much blabbing on Facebook, followed by a foolish belief they could delete such content
  • Parler for further blabbing
  • Stripe for payment processing (possibly for dues)
  • GoToMeeting for operational planning

Plus, most of the people arrested thus far had their cell phones on, pinging cell towers, while they were in the Capitol (thus far, two of the accused did not enter the Capitol).

It’s the GoToMeeting revelation, in Harrelson’s affidavit, that gets me:

Pursuant to legal process, the government obtained records from Go To Meeting showing that a user named “gator 6” was the organizer for a meeting titled “dc planning call” on January 3, 2021. The user “gator 6” accessed the meeting from a mobile device using the same IP address ending in 158 [as Harrelson used to access Apple servers], and the user listed themselves as living in Titusville, Florida. Between September 30, 2020, and January 3, 2021, the user with the same IP address ending in 158 attended or organized approximately 30 meetings on Go To Meeting affiliated with the Oath Keepers, using the names “gator 6,” “hotel 26,” or kenneth harrelson.”

GoToMeeting is basically spyware for your computer, because it has to access so many features of your computer to work. As a default it collects a great deal of data on participants, and can be set to collect more. It is end-to-end encrypted, but with legal process FBI might be able to get a great deal of information from GTM, if the Oath Keepers kept it.

Between these twelve people, then, DOJ has served legal process on enough databases to create a veritable dossier on the Oath Keepers. While some of these comms (such as the Zello comms) are ephemeral, Facebook and GoToMeeting and Stripe are data vacuums.

With a database like this, the government can be choosy about which Oath Keepers they arrest. Reportedly, DOJ says they may add 6 more people to their collection of Oath Keeper defendants.

Indeed, it’s not really clear why they’ve charged the last three — Minuta, James, and Harrelson — before charging the last several members of the Stack that entered the Capitol together.

Harrelson was not part of the Stack, but the affidavit justifying his arrest shows him — and another guy — in communication as the Stack came up the Capitol steps, with Harrelson interacting with Graydon Young inside the Capitol. But his organizing efforts in Florida would put him in close touch with the Meggses (Kelly leads the Florida chapter) and James (who lives in Alabama but seems to be tied to the Florida chapter), along with Young (who lives in Titusville).

These Florida Oath Keepers were providing “security” for Roger Stone well before the January insurrection, including an event in Florida. (MoJo had a summary of who provided security when yesterday.)

As for Minuta, in addition to serving as Stone’s security on January 5 and 6, he also was abusive to cops before entering the Capitol and on his way out, when he promised the Second Amendment option came next. Like Young, Minuta is also accused of deleting Facebook, probably just as unsuccessfully.

In James’ case, DOJ seems particularly interested in the communications he had with Minuta, called Person Five in the affidavit even though he was already arrested by the time it was approved.

While James stood with the other Oath Keepers, at least one of them (who will be referred to below as “Person Five”)2 aggressively berated and taunted U.S. Capitol police officers responsible for protecting the Capitol and the representatives inside.

[snip]

Records indicate that phone number XXX-XXX-4304 (associated with James) exchanged a number of phone calls throughout November and December 2020 with a person who will be referred to herein as Person Five.

On November 13 and 14, 2020, for example, phone number XXX-XXX-4304 (associated with James) exchanged approximately eight calls with the number associated with Person Five. Your affiant is aware that certain Oath Keepers attended rallies in Washington, D.C., held on November 14, 2020, at which some Oath Keepers, to include Person Five, operated as a personal security detail for one or more speakers at the events.

Later, on or around November 20 and December 11, 2020, records indicate that phone number XXX-XXX-4304 (associated with James) exchanged two phone calls with Person Five. Your affiant is aware that certain Oath Keepers attended rallies in Washington, D.C., held on December 12, 2020, to protest the results of the 2020 election—at which some Oath Keepers, to include Person Five, operated as a personal security detail for speakers at the events.

Finally, records indicate that, on or around January 5, 2021, phone number XXXXXX-4304 (associated with James) exchanged six calls with the number associated with Person Five. That day, James, Person Five, and other individuals wearing apparel with the Oath Keepers name and/or insignia provided security to a speaker at the “Stop the Steal” events planned for that day.

Note that Minuta was hanging out with Proud Boy Dominic Pezzola in that December MAGA event.

James’ affidavit ends with this group photo, identifying Connie Meggs, two still uncharged Stack participants, four uncharged people who tracked with James and Minuta during the insurrection, Kelly Meggs, and another Stack member.

Both the Minuta and James affidavits focus on Oath Keeper head Stewart Rhodes, described as Person One, as does this detailed filing opposing bail for Caldwell.

James stayed in touch with others during the time of active investigation:

Since January 6, 2021, phone number XXX-XXX-4304 (known to be associated with James) has exchanged multiple phone calls and text messages with the number associated with Person Five. The number associated with James has also placed at least one call as recently as February 2021, to a phone number known to be associated with Kelly Meggs, the now-arrested self-described Florida Oath Keeper leader.

Thus far, DOJ isn’t explaining why Minuta, James, and Harrelson were arrested in the weeks after FBI started exploiting the Signal chats that organized Oath Keeper efforts on January 6 and, particular, Kelly Meggs’ communications.

But because the Oath Keepers were such promiscuous users of all kinds of social media tools, the FBI has a remarkable collection of data about the group’s activities since last fall. And they’ve picked these guys to arrest.

Update: In his detention hearing today, the FBI focused on James’ providing security for Stone.

The FBI agent who testified at Thursday’s hearing said several firearms were found during a search warrant executed at James’ home. All of the firearms were legal, and none were confiscated. They included a shotgun, a hunting rifle, a few “AR-15 style rifles,” and two pistols, the agent said.

James was paid $1,500 for security at two events, including a “Stop the Steal” rally on January 6, according from testimony from his wife, Audrey James. Stone and other pro-Trump figures held several events in Washington in addition to the official rally that Trump spoke at shortly before the attack.

Audrey James said she was sent “around $1,500 total” directly from the Oath Keepers over a mobile app. She stated the funds were paid out over a couple of months to assist her and her children during Joshua James’ absence to Texas and Washington, DC, while he was providing security. She said she didn’t know where the money originated from.

This story, by itself, presents real problems with the story Stone told. He raised funds for “security” in advance of the insurrection, but then said he couldn’t find paid security so relied on volunteers.

The Passport and the Antifa Hunt: The Militia Counter-Stories Emerge

In both the case against Proud Boy Leader Ethan Nordean and accused Oath Keeper Thomas Caldwell, the defendants are arguing that the government has made errors about their activities.

With regards to the former, Nordean’s wife submitted a sworn declaration stating, among other things, that the passport the government has pointed to as evidence that Nordean might flee was not — as the government claimed — on the dresser by the bed, but instead inside a jewelry box on the dresser. She also claimed that Nordean received a Baofeng radio on January 7, the day after the insurrection, and that to her knowledge, he “did not possess” one before that date.

The government responded with a picture showing that, at a time they claim precedes the search, a picture they took to show the weapons they had secured shows the passports were on the dresser.

Additionally, she claimed that Nordean’s cell phone “was without power” on the day of the insurrection, which is irrelevant to why he stashed it in the drawer or whether it would have useful evidence.

Ms. Nordean responded with her own picture showing that, in a picture taken on December 8, 2020, the jewelry box was closed.

This would be a matter of he-said she-said, FBI agents against the wife of a suspect, except for one thing. In her original affidavit, Ms. Nordean tries to rebut the government’s focus on the Baofeng (the government claims the Baofeng he got on January 7 is a different one than the one he used the day of the riot, but in any case the one they seized was set to the channel used by the Proud Boys during the riot), she noted that “it is [her] understanding that his mobile phone was without power throughout January 6, 2021,” a detail the defense relied on to suggest, first of all, that the government was purposefully withholding that detail, and that that — and not the evidence of the Proud Boys discussing obtaining the radios and using a specific channel — is why the government had focused on the Baofeng.

But it does the opposite. A bunch of the Proud Boys brought live cell phones to their insurrection on January 6. William Chrestman appears to have tried avoiding using cell coverage, but got geolocated using his Google account. For Nordean to spend an entire day his phone powered off suggests an operational security that many of his buddies didn’t have. It certainly suggests he might have the wherewithal to search for a passport he might make use of, suggesting it’s possible that he, not the FBI, took the passports out of the jewelry box (though they would have been out there for a day because, per Ms. Nordean, Ethan wasn’t home the night before the raid.

Meanwhile, Thomas Caldwell says the government has similarly misunderstood everything about his involvement in an insurrection. There’s a claim he makes that I find quite compelling: that Jessica Watkins and Donovan Crowl hid out at his home — and tried to lose a tail on the way there — to hide from the press, not the FBI.

Contrary to the Court’s understanding, Caldwell informed FBI agents that Watkins and Crowl contacted him—not vice-versa–and requested to come to his farm to get away from the media, not law enforcement.22 That is, subsequent to a New Yorker article that identified Watkins and Crowl as being involved in entering the Capitol, their small town Ohio residences were surrounded by scores of media. 23

22 Undersigned counsel reviewed over a thousand social media messages in discovery. Multiple messages from Watkins and Crowl express a desire to run away from the media throng that descended on their small Ohio hometown. Not one message evinces an intent to avoid authorities, who had not yet charged the two with a crime. In fact, Watkins’ mother, who is not a suspect in this case, fled Ohio and hid from the media in Florida. Also, discovery confirms that Watkins and Crowl reached out to Caldwell, not vice-versa.

23 Similarly, the Government’s claim that Caldwell advised Watkins and Crowl to “avoid law enforcement” by making sure that they were not followed to his farm is misplaced. Caldwell’s concern was that the pair weren’t followed by the media to his farm. Caldwell did not want a hundred reporters camped outside his farm.

But in the rest of the filing, Caldwell spins a fairy tale while at the same time he admitted he spends a lot of time spinning fairy tales.

To put his personality in more context, Caldwell is an amateur screen writer. Specifically, Caldwell has written screenplays with military style plots.17 Undersigned counsel has read a couple of these screenplays, which are heavy on hyperbolic military language. To give the Court a sample of his writings, in one screenplay Caldwell depicts a “dog fight” between rival aircraft, with one pilot radioing out “Buzzard One, this is Slingshot, I got two bogies on my six; say again, two bogies on my six; May-day, May-day.” What the Government misunderstands is that Caldwell’s language and personality center around his military career and his addiction to Hollywood.18

Ultimately, the fairy tale Caldwell spins in this filing is that he didn’t conspire to interfere with the vote count, but instead was just aiming to hunt Antifa.

He explained his contacts with the Oath Keepers, who he viewed as a self-styled group of patriots who sought to protect Trump supporters from Antifa and who provided security at Trump events. The concerning social media posts Caldwell made, he explained, all referred to fear that Antifa would attack Trump supporters on January 6th . 21

21 This fear was well-founded. In fact, contrary to the Government’s suggestion that Antifa is a virtuous group with a few bad apples, this organization is a domestic terrorist organization that has taken over cities like Portland and Seattle, burned buildings and churches, killed and injured police officers, defaced and destroyed public monuments, and violently injured hundreds of Trump supporters across the country. In fact, just a month before the Capitol was breached, Antifa attacked elderly Trump supporters at a December rally in Washington.

As part of this fairy tale Caldwell argues that the government has the timeline of the Zello chats included in the evidence against him, and therefore mistook a plan to guard people like Roger Stone for a plan involving the Capitol.

The Court placed great weight on this evidence, as it purported to show a specific, contemporaneous plan to breach the Capitol. In court papers, the Government described the Zello communications as follows:

“At the approximate 5 minute mark, the voice believed to be [codefendant] Watkins reports, “We have a good group. We have about 30-40 of us. We are sticking together and sticking to the plan.”

“At the approximate 7 minute 44 mark, an unknown male states, “You are executing citizen’s arrest. Arrest this assembly, we have probable cause for acts of treason, election fraud.”

The voice believed to be WATKINS responds, “We are in the mezzanine. We are in the main dome right now. We are rocking it . . .[.]” ECF 1-1, ¶27 (ZMF-21-119) (second criminal complaint) (emphasis added).9

The latest indictment includes the same chronological representation, only without time-stamps. The Government’s inference is clear: The Oath Keepers had a plan to invade the Captiol and arrest elected officials, discussed this “invasion plan” at the “5 minute mark,” and were inside the Capitol a few minutes later executing the plan (at the 7:44 mark). Unfortunately, the Court has been misinformed by the Government. Upon receipt of discovery, undersigned counsel discovered that the Government’s Zello evidence actually consists of a National Public Radio (NPR) report, which aired random snippets of Zello communications. The above timestamps the Government referenced are time-stamps in the NPR report, not from Zello. In other words, the referenced Zello communications did not take place 2 minutes and 44 seconds apart in real time.

Ironically, after listening to these Zello communications, the Government’s smoking-gun proof of premeditation fizzles. Specifically, it is clear that the communication regarding “sticking to the plan” happened several hours before the Capitol breach, and probably in the very early morning, as there is no crowd noise in the background. 10 By contrast, the second Zello communication (from inside the Capitol) had substantial background noise.

10 Published reports suggest that as many as 500,000 demonstrators showed up to the rally. The fact that the audio reveals no crowd noise suggests that this particular Zello communication happened before hundreds of thousands of rally-goers entered the streets of Washington.

I’ll return to the temporal claim later. But there are several things that mark this story as a fairy tale. First, he’s complaining that the male voice has no background noise whereas Watkins’ does have background noise. Caldwell is comparing messages from different people in different places.

Moreover, while he nods to the NPR original of this (which he doesn’t cite, but I assume is this WNYC interview), he doesn’t acknowledge two sets of texts that the government has yet to rely on (but surely will), which make it clear the plan was prospective and tied to the Capitol. First, from two blocks away, Watkins reports that everyone is marching on the Capitol.

MILITIA What kind of numbers do we have going into the capital? Any estimates? What percentage of the crowd is going to the capital?

WATKINS One hundred percent. Everybody’s marching on the capital. All million of us. It’s insane. We’re about two blocks away from it now and police are doing nothing. They’re not even trying to stop us at this point. [END CLIP]

And then, a block away, Watkins informs her interlocutor that she’s going to go silent because “Imma be a little busy.”

WATKINS Yeah, we’re one block away from the Capitol now. I’m probably going to go silent when I get there because Imma be a little busy.

INFORMANT Hey, my girlfriend is at the Capitol right now and she said that cops are coming in from the right of the building. [END CLIP]

Even assuming the rest of the excerpts are a jumble (and I expect we’ll get clarity on this point shortly), it’s clear that Watkins’ objective is the Capitol, not guarding Roger Stone.

But there’s one more part of the texts that make that clear: the channel name. “Stop the Steal J6” The Oath Keepers didn’t arrange radio communications to keep Roger Stone safe. They arranged radio communications to stay in touch as they jointly assaulted the Capitol.

But there’s a bigger tell in this filing of fairy tales, the filing that argues Caldwell’s communications can’t be taken literally because he lives in a fantasy world, presents a claim that he believed Antifa presented a serious threat, and then claims that Caldwell’s denials must be believed because, “The word of a 20-year military veteran with no prior criminal record is evidence, and it is strong evidence, of his innocence.” Caldwell tells a fairy tale about the crimes of which he is accused.

Caldwell absolutely denies that he ever planned with members of the Oath Keepers, or any other person or group, to storm the Capitol. Caldwell absolutely denies that he obstructed justice. 3

The issue as to whether Caldwell violated 18 U.S.C. § 1752(a)(1) (Entering and Remaining in a Restricted Building or Grounds) is still being researched by undersigned counsel. Obviously, however, this charge is the least of the Court’s concerns in weighing the factors under the Bail Reform Act.

Caldwell is personally accused of two counts of obstruction. The first, 18 U.S.C. § 1512(c)(1), accuses him (like Graydon Young) of attempting to delete damning Facebook content, an accusation this filing rebuts.  But he is singularly and as part of the conspiracy also accused of violating 18 U.S.C. §§ 1512(c)(2), 2. The object of the conspiracy is not, as Caldwell would suggest, to storm the Capitol. It was, instead, to stop the electoral vote count.

The purpose of the conspiracy was to stop, delay, and hinder Congress’s certification of the Electoral College vote.

This is an accusation his entire fairy tale story doesn’t deny, nor does his narrative about his own actions that day (or the planning leading up to it) rebut the claim.

As I’ve said, at least one part of Caldwell’s story may well be true: that Watkins and Crowl were hiding out from the press, not (yet) the FBI. But none of Caldwell’s re-imagining of the record even attempts to rebut that he and his terrorist buddies were attempting to interfere with the counting of the vote as laid out in the Constitution.

Then again, Judge Mehta may not be his desired audience. Instead, his claim this was all about Antifa may be an attempt to feed GOP efforts to deny they encouraged a terrorist attack on the Capitol.

Update: Took out a reference to Nordean’s phone in his daughter’s drawer. That was William Chrestman, not Nordean. I thought I had removed it.

Update: Beryl Howell granted Nordean home detention yesterday, judging that the government (which backed off some of its earlier claims about Nordean’s role) had not proven that Nordean had directed the breach of the Capitol.

Oath Keepers Learn the Hard Way: Don’t Plan an Insurrection on Facebook

“For every Oath Keeper you see, there are at least two you don’t see.” – email from Oath Keeper head Stewart Rhodes forwarded from Oath Keeper Graydon Young to his sister, Laura Steele, on January 4, 2021

I want to look at filings from the Oath Keepers investigation to show how FBI is juggling to move quickly enough to prevent obvious subjects from obstructing the investigation without tipping off others to the substance of the investigation. The filings confirm that the FBI will get sealed arrest warrants against subjects who are obviously obstructing the investigation, but may not use them right away, so as to obtain more evidence against them and their immediate co-conspirators. The filings also show how hard it is to delete evidence in an age of social media while conspiring with dozens of other co-conspirators.

The investigation from Watkins to Caldwell to the Parkers, Youngs, and Biggs

There’s a story about the Oath Keepers investigation that arises from the nature of the first publicly charged defendants. According to that story, the founder of an Ohio militia affiliated with the Oath Keepers, Jessica Watkins, boasted on Parler about “forcing entry into the Capitol” on the day of the attack. Videos of the Oath Keeper Stack showed up in videos posted within a day of the attack. Then, on January 13, the Ohio Capital Journal posted an interview with Watkins where she described it “the most beautiful thing” until she started hearing glass smashing — which she blamed on an Antifa false flag attack (a subsequent filing suggests Watkins wanted the Oath Keepers to get good press from the attack, threatening to sue some male journalist if he portrayed the Oath Keepers negatively).

That’s the evidence the FBI showed to obtain an arrest warrant on Watkins on January 16.

Meanwhile, as the investigation was closing in on Watkins, her recruit Donovan Crowl did an interview with the New Yorker for a story loaded with more images of coordinated movement from the Oath Keepers. Crowl offered similarly contradictory excuses for his action as Watkins.

On January 17, the FBI tried to conduct an interview with Watkins, only to be told by her partner, Montana Siniff, that she left Ohio on January 14 to stay with her friend and fellow Oath Keeper, “Commander Tom.”

At some point, the FBI obtained information from Facebook — they don’t explain when or on whom it was served, which I’ll return to. The return showed that Caldwell coordinated hotel reservations at the Comfort Inn/Ballston, not just with Watkins, but also others from North Carolina, as well as speaking with Crowl. This content may not have been obtained via Caldwell yet, because Caldwell’s private messages don’t show up in filings until January 19 (alternately they may have delayed that reveal until Caldwell was arrested).

But the FBI used that public Facebook information to obtain a warrant for Crowl on January 17. Watkins and Crowl turned themselves into Urbana, OH police that day, where the FBI took them into custody.

On January 13, the Guardian did a story on Watkins’ use of Zello.

“We are in the main dome right now,” said a female militia member, speaking on Zello, her voice competing with the cacophony of a clash with Capitol police. “We are rocking it. They’re throwing grenades, they’re frickin’ shooting people with paintballs, but we’re in here.”

“God bless and godspeed. Keep going,” said a male voice from a quiet environment.

“Jess, do your shit,” said another. “This is what we fucking lived up for. Everything we fucking trained for.”

The frenzied exchange took place at 2.44pm in a public Zello channel called “STOP THE STEAL J6”, where Trump supporters at home and in Washington DC discussed the riot as it unfolded. Dynamic group conversations like this exemplify why Zello, a smartphone and PC app, has become popular among militias, which have long fetishized military-like communication on analog radio.

On January 19, the government obtained an amended conspiracy complaint against Watkins, Crowl, and Caldwell. It included the following new information:

  • Quotations from the Zello messaging
  • Facebook messaging from Caldwell pictured standing outside the riot calling everyone in Congress a traitor
  • Facebook messages showing planning between Watkins, Crowl, and Caldwell between December 24 and January 8
  • Instructions for making plastic explosives found at Watkins’ house

Of particular interest, the complaint included the first hint that the Oath Keepers had intelligence — shared using Facebook — about the movements of Members of Congress.

On January 6, 2021, while at the Capitol, CALDWELL received the following Facebook message: “All members are in the tunnels under capital seal them in . Turn on gas”. When CALDWELL posted a Facebook message that read, “Inside,” he received the following messages, among others: “Tom take that bitch over”; “Tom all legislators are down in the Tunnels 3floors down”; “Do like we had to do when I was in the core start tearing oit florrs go from top to bottom”; and “Go through back house chamber doors facing N left down hallway down steps.”

Having arrested the two Oath Keepers blabbing to the press and the guy they hid out with, there’s not much more overt sign of the investigation until February 11, when the government submitted filings supporting pre-trial detention for both Watkins and Caldwell.

Arrest affidavits submitted on February 11 and February 12 (but sealed until after February 16) also refer to Watkins’ cell phone returns, including address book information describing Bennie Parker as a recruit, texts between Watkins and Parker coordinating plans for the insurrection and reassuring him the FBI would not prosecute them after the insurrection, and a picture of his wife Sandi Parker. Watkins’ cell phone returns also show a contact for Kelly Meggs in Florida, which she associated in her address book with the Oath Keepers.

Those initially sealed arrest affidavits also rely on surveillance footage and financial records from the Comfort Inn where all the Ohioans  stayed. It shows the Ohioans together in the lobby. It reveals that Kelly Meggs paid for a room that night registered under another suspected Oath Keeper’s name (according to credit card records showing a $302 charge, Meggs apparently stayed at the Hilton Garden Inn the night of January 7). [Update: The indictment clarifies that Meggs paid for two rooms at the Comfort Inn and booked two at the Hilton, of which he paid for one. h/t bb]

The initial affidavit against Kelly and Connie Meggs and Graydon Young and Laura Steele also includes a picture taken — by some unidentified person — from the van from North Carolina.

The same affidavit includes testimony from a witness who interacted with the Oath Keepers on January 6 and was on a text message chain including Young and Steele, who was introduced to them as Gray and Laura and learned they had taken the Metro into DC. It relies on surveillance video from the Metro. It includes returns from Steele and Young’s Google accounts, including Steele’s application to join the Oath Keepers.

It includes location data showing Graydon Young’s phone traveling from Englewood, FL to Thomasville, NC to Springfield, VA, to DC, then back to Thomasville and ultimately, on January 8, back to Englewood. It includes his round trip flight records from Tampa to Greensboro, consistent with the movement of his phone. The affidavit also uses location data to place Steele and the Meggses in a “geographic area that includes the interior of the United States Capitol building.”

It includes subscriber records for Steele, Young, and Kelly Megg’s MeWe accounts, as well as subscriber records for Facebook accounts for everyone. Of particular note, the affidavit used to arrest Young and the others shows advanced legal process for Young, but mostly subscriber information for the others. They also use Young’s Google data to establish probable cause against the Meggs but do not, yet, use it against Young.

It’s likely in the five days between the affidavit and the arrest, more warrants were served for materials on the others.

There wasn’t much added in a February 25 memo supporting Watkins’ pretrial detention — except that aforementioned Watkins text with Stewart Rhodes complaining about media reports making the Oath Keepers look bad (which, because of the timing of the coverage, likely happened almost a week after the insurrection, or later).

If he has anything negative to say about us OATHKEEPERS, I’ll let you know so we can sue harder. Class action style. Oathkeepers are the shit. They rescued cops, WE saved lives and did all the right things. At the end of the day, this guy better not try us. A lawsuit could even put cash in OK coffers. He doesn’t know who he is playing with. I won’t tolerate a defamation of character, mine or the Patriots we served with in DC. Hooah?!

But in a hearing held February 26, prosecutors told Judge Amit Mehta something in an ex parte hearing to support their argument that there really was a Quick Reaction Force outside of DC on the day of the insurrection ready to bring weapons into the Oath Keepers already in DC, which is one of the reasons he denied Watkins’ motion for release.

The earlier investigation into Graydon Young

It took a while for DOJ to unseal all the filings from the other co-conspirators, particularly the long affidavit for the four southerners. But a docket unsealed last week tells another side of that story. On January 15, a tipster identified Graydon Young, one of the Floridians added to the Caldwell and Watkins conspiracy. Based off that tip, the FBI prepared and got authorization for an arrest warrant by January 18. But they didn’t use it, perhaps because FBI was chasing down two false positives based off pictures of Young, as described in the later affidavit (the first of which may have been based off facial recognition).

First, on or around January 14, 2021, after receiving an internet tip and viewing similar photographs and video of Young from the civil unrest on January 6, 2021, an FBI agent drafted an arrest warrant for an individual (Subject-1) other than Young, based on a review of Subject-1’s driver’s license photo and the fact that Subject-1 was affiliated with the Oath Keepers. An FBI agent in Kansas City, Missouri, who was familiar with Subject-1, then determined that Subject-1 was not the individual depicted in the photos at the U.S. Capitol on January 6, 2021. The government did not pursue charges against Subject-1. Second, on or around January 15, 2021, a concerned citizen provided the FBI with a tip that the photograph of Young in the Rotunda was a photograph of Subject-2, who was a co-worker of the concerned citizen in Illinois. On January 18, 2021, SA Wren spoke with the concerned citizen, who stated that Subject-2 had quit the job and moved to Colorado, and “seemed like the type” who would have gone to the Capitol. SA Wren reviewed Subject-2’s driver’s license photo and determined that Subject-2 is not the person depicted in the photographs of Young at the U.S. Capitol.

In other words, FBI was prepared to arrest Young by January 18, within a day of the initial Watkins arrest. But they did not. They kept that arrest warrant sealed while they obtained his location records, travel records (including evidence he drove home from North Carolina rather than flying, and had his sister’s car towed back to North Carolina afterwards), and subscriber information for other social media.

At some point (as noted), FBI obtained Young’s Google account. But on February 11, they used that “solely as evidence against Kelly Meggs. At this time, the government is not seeking to use this email against Young,” suggesting they still needed legal process to use it against him.

Don’t launch an insurrection with a still-active Facebook account

Given that the FBI was ready to arrest Graydon Young on January 18, it’s worth looking more closely at the Facebook evidence in this conspiracy.

The FBI learned on January 15 that Young was probably at the insurrection, had been tagged in planning for the event on January 4, and had attempted to delete his Facebook account on January 7 (it went into effect the next day). Young didn’t delete his related Instagram account until January 13.

At some point, the FBI also learned that Caldwell attempted to unsend messages on January 8, the same day Young shut down his Facebook account.

Nevertheless, Facebook still had Young’s data, including a post from January 6 boasting, “We stormed and got inside.”

The government also obtained highly damning Facebook content from much earlier, including a message he posted to a group, the “War of Northern Aggression,” on November 7. In it, he clearly acknowledges Joe Biden’s victory.

Will this group consider migration to MeWe and Parler? I think censorship is going to get worse with Biden win.

On November 9, he asked again to move from Facebook to MeWe and Parler.

On November 30, he pushed MeWe and Parler again.

I already have MeWe and Parler … waiting for this drama to end before I delete my FB account.

Hey Graydon?!?! The drama for you is just beginning.

Meanwhile, Caldwell didn’t succeed in deleting all his evidence either. As early as January 17, in Crowl’s affidavit, they had a message (it’s unclear whether it’s public or private)

Here is the direct number for Comfort Inn Ballston/Arlington 1-571-397-3955 I strongly recommend you guys get one or two rooms for a night or two. Arrive 5th, depart 7th will work. She says there are five of you including a husband and wife new recruits. This time of year especially you will need to be indoors to set up, etc. Really, press this home, just get somebody to put it on a credit card. Even if you tell the hotel its double occupancy, you can STILL get a couple of people on the floor with bedrolls and the hotel won’t know shit. Paul said he might be able to take one or two in his room as well. I spoke to the hotel last night (actually 2 a.m. this morning) and they still had rooms. This is a good location and would allow us to hunt at night if we wanted to. I don’t know if Stewie has even gotten out his call to arms but it’s a little friggin late. This is one we are doing on our own. We will link up with the north carolina [sic] crew.

The later affidavits include Caldwell Facebook messages sent in November predicting violence.

I am very worried about the future of our country. Once lawyers get involved all of us normal people get screwed. I believe we will have to get violent to stop this, especially the antifa maggots who are sure to come out en masse even if we get the Prez for 4 more years.

On January 6, Caldwell continued to use Facebook, receiving a message informing him,

All members are in the tunnels under capital seal them in. Turn on gas.

And,

Tom all legislators are down in the Tunnels 3floors down

Between Young and Caldwell, Facebook evidence shows that this operation clearly targeted legislators even after they knew Joe Biden had been elected. It turns out that neither of them successfully deleted this Facebook content before the drama really got started.

The delayed reveal

As noted, it took some time for the affidavit for the southern Oath Keepers to be unsealed. In the interim period, the FBI would have been able to investigate the Oath Keeper whose name was on the hotel room Young paid for, and all the other people on the bus on which Young and his sister were pictured. The FBI surely has reviewed any role the War of Norther Aggression Facebook group had in the insurrection. The accounts for which the FBI just had subscriber information on February 11 are probably now being fully exploited (including the WeMe accounts on which they may have been more open about their plotting).

There are still members of The Stack at large, the others on the bus, the group from Mississippi those who provided “security” for Trump’s closest associates. We don’t know where the next Oath Keepers to be arrested are. We do know where the FBI was, 17 days ago.

Timeline of Oath Keeper conspiracy

January 4: Young travels from Englewood, FL to Thomasville, NC. Young tagged in planning messaging for the attack.

January 5: Young travels from Thomasville to Springfield, VA, then heads to DC for the evening.

January 6: Young travels into DC, then back to Thomasville that night. Watkins posts to Parler and Caldwell posts to Facebook. Young posts, “we stormed and got inside” on Facebook.

January 7: Young deleted Facebook content going back to March 2019 (per Facebook record it goes into effect on January 8).

January 8: Caldwell unsends Facebook messages continuing evidence. Young returns to Englewood. Young writes an email saying that his “team leader” during the insurrection was “OK Gator 1” with Kelly Meggs’ phone number.

January 9: Watkins texts Bennie Parker telling him not to worry about the FBI investigating them.

January 11: Young has a vehicle registered to Steele’s address towed from a location near his home to Steele’s home in NC. Young deletes his Instagram account.

January 13: Watkins interview in Ohio Capital Journal. Guardian story on Watkins’ use of Zello. Young closes Instagram account.

January 14: Donovan Crowl story in New Yorker. Watkins and Crowl travel to Caldwell’s property in VA; he gives them OpSec tips for the drive. Bennie Parker texts Watkins asking if she put Sandi “out there” in the Capitol. FBI chases a false positive for Young on an Oath Keeper who lives in Kansas City, MO.

January 15: A tipster who has known Young for 35 years identified Young in an image published by NBC, informs the FBI that on January 4, other people had tagged Young in a discussion about traveling to DC. The tipster further revealed that on January 7, Young deleted his Facebook content going back to March 2019, then deleted the whole thing. FBI chases a false positive for Young to someone in CO.

January 16: Arrest warrant for Watkins.

January 17: Search of Watkins’ house discovers gear and other military items. Interview of her partner reveals she has left to stay with a friend, Commander Tom, and provides a phone registered to him at his VA property as the way to reach Watkins. Arrest warrant for Crowl. Search of a location where Crowl stays finds his tactical vest. Arrest warrant for Caldwell. Both Watkins and Crowl turn themselves in to the Urbana Police, where the FBI takes them into custody.

January 18: First arrest warrant for Graydon Young.

January 19: Caldwell, Crowl arrested by FBI, and Watkins arrested. Amended criminal complaint makes conspiracy charges against Watkins, Crowl, and Caldwell more formal. Search of Caldwell’s property finds Death List targeting election official from a different, a Gadsden flag signed by Crowl and Watkins, and a sales invoice for a weapon designed to look like a phone.

Janaury 21: Stewart Rhodes declares Biden’s “not a constitutional government.” Kelly Meggs closes his Facebook account.

January 27: Indictment for Watkins, Crowl, and Caldwell.

January 29: NYT does video analysis showing the movements of the Oath Keepers from the Ellipse to the Capitol.

February 11: Counterterrorism prosecutors Justin Sher and Alexandra Hughes join team. Motions for pre-trial detention for both Watkins and Caldwell. Sealed complaint filed against Kelly and Connie Meggs, Graydon Young, and Laura Steele.

February 12: Government moves for protective order against the original conspirators; Caldwell objects. Sealed complaint filed against Bennie and Sandi Parker.

February 16: Graydon Young arrested.

February 17: The Meggs and Laura Steele arrested.

February 18: The Parkers arrested.

February 23: Thomas Caldwell appeals detention.

February 26: Amit Mehta grants government motion to detain Jessica Watkins.

Update: I clarified that the email quoted at the top is from Stewart Rhodes, not Graydon Young.

Jessica Watkins Defends Herself by Claiming the Armed Militia Parade Was Part of the Plan

In a bid to spring her client from jail pre-trial, Jessica Watkins’ attorney Michelle Peterson accuses the government, twice, of wielding rhetorical flourishes to portray Watkins’ actions in the worst light.

The government’s rhetorical flourishes aside, there is insufficient evidence to demonstrate that Ms. Watkins would be either a risk of flight or a danger to her community if she were released on stringent conditions.

[snip]

The government’s motion for detention is filled with rhetorical flourishes design to inflame the passions of its readers without supporting evidence, e.g., “Watkins single-minded devotion to obstruct though violence” p.1, “this was a moment to relish in the swirling violence in the air” p. 2, and references throughout to her attire as “camouflage.”

It’s true that the government motion for detention portrays Watkins’ actions as a grave threat.

The profoundly brazen nature of Watkins’s participation in the January 6, 2021 assault on the Capitol was uniquely dangerous and continues to impact security in the District and beyond. Watkins joined a violent mob that overwhelmed law enforcement and destroyed government property, re-creating in modern times events not seen in this nation since the War of 1812. In this backdrop, Watkins and her co-conspirators formed a subset of the most extreme insurgents that plotted then tried to execute a sophisticated plan to forcibly stop the results of a Presidential Election from taking effect. And she did this in coordination and in concert with a virulently antigovernment militia members.

But Peterson accuses the government of rhetorical excess while excusing Watkins’ own actions and inflamed self-description of them by suggesting that Watkins was simply helpless in the face of Trump’s lies.

His supporters said he would invoke the Insurrection Act to use the military to ensure his continued presidency despite the election results, which they viewed as fraudulently reported in large measure because of the rhetoric of the President, his congressional supporters, and the right-wing media.

[snip]

However, these statements if made, were made in November, shortly after the election in the wake of the then President’s heated rhetoric about the election being stolen.

[snip]

While some of the rhetoric she allegedly engaged in is troubling, she fell prey to the false and inflammatory claims of the former president, his supporters, and the right wing media.

Unless and until Trump’s own crimes get added to these conspiracy indictments, these detention memos will continue to dispute what to call the terrorist event that happened on January 6. Until that time, the government will be relying on legal maneuvers, like charging the Oath Keepers with abetting the physical damage to the Capitol — because the doors through which they breached the building suffered significant damage — as a way to get the presumption of detention tied to a domestic terrorism charge. And defense attorneys will continue to argue that entering the Capitol in military formation after two months of preparation for action in response to the election outcome does not amount to a crime of violence.

I don’t believe we need a domestic terror statute. But we need language to describe domestic terrorism. Because we don’t have agreed on language for this thing, an event that forced the Vice President, the Speaker of the House, and the Vice President-Elect to flee from threats of imminent assassination, these disputes will continue to struggle to fit these actions into our existing categories.

Still, even in Peterson’s description of the problem, there are problems with this story. Watkins’ brief admits that she engaged in apocalyptic rhetoric, but suggests that all happened in November, long before and dissociated from the apocalyptic event.

The government includes statements Ms. Watkins is alleged to have made about the election and the need to fight, kill, or die for rights and statements about being prepared to fight hand to hand. However, these statements if made, were made in November, shortly after the election in the wake of the then President’s heated rhetoric about the election being stolen. They are not even alleged to have been made about the January 6 events. The statements were not directed towards law enforcement and are as easily interpreted as being prepared to encounter violent counterprotesters as they had on earlier occasions. And importantly, according to the government, Ms. Watkins made it clear that she would do nothing that was not specifically requested by the President. However misguided, this shows an intent to abide by the law, not violate it. [my emphasis]

Peterson describes the events of January 6, by contrast, as the natural response of veterans anticipating that the then-President might invoke the Insurrection Act, as his disgraced former National Security Advisor Mike Flynn and others demanded.

His supporters said he would invoke the Insurrection Act to use the military to ensure his continued presidency despite the election results, which they viewed as fraudulently reported in large measure because of the rhetoric of the President, his congressional supporters, and the right-wing media. The report of the potential invocation of the Insurrection Act took root in the online community of Trump supporters and led many local militias to believe they would have a role if this were to happen. Ms. Watkins was one of those people. In November, she believed that the President of the United States was calling upon her and her small militia group to support the President and the Constitution and she was ready to serve her Country in that manner. However misguided, her intentions were not in any way related to an intention to overthrow the government, but to support what she believed to be the lawful government.

The problem is, these claims are totally refuted by the timeline.

Flynn was probably the earliest prominent advocate for martial law. That was on December 1, after the November comments in question. Watkins, meanwhile, was looking for a sign even before that, on November 9.

Her concern about taking action without his backing was evident in a November 9, 2020, text in which she stated, “I am concerned this is an elaborate trap. Unless the POTUS himself activates us, it’s not legit. The POTUS has the right to activate units too. If Trump asks me to come, I will. Otherwise, I can’t trust it.”

That’s before the earliest Trump incitement cited by the defense, a November 21 rally in GA.

See id., Donald J. Trump (@realDonaldTrump), Twitter (Nov. 21, 2020 3:34 PM) (Watch: Hundreds of Activists Gather for ‘Stop the Steal‘ Rally in Georgia https://t.co/vUG1bqG9yg via Breitbart News Big Rallies all over the Country.

The earliest moment when Watkins spoke specifically in terms of the Insurrection Act was December 29, long after some of her most inflammatory comments.

In a text exchange with Co-defendant Donovan Crowl on December 29, 2020, she informed, “[w]e plan on going to DC on the 6th” because “Trump wants all able bodied Patriots to come,” and how, “[i]f Trump activates the Insurrection Act, I’d hate to miss it.”

Yet as early as October 26, Watkins was already timing militia training to inauguration.

Watkins emphasized this point to another recruit on October 26, 2020, noting, “the election is imminent. We do have Basic Training/FRX coming up in January though … others who join before then without experience will be REQUIRED to attend for the full week. Donovan already has his Drill Sergeant mode going haha. The rest of us will be training with them to get us all field-ready before inauguration.”

That shows a continuity between Watkins’ pre-election statements and post election plans.

On November 9,2020, WATKINS, the self-described “C.O. [Commanding Officerl of the Ohio State Regular Militia,” sent text messages to a number of individuals who had expressed interest in joining the Ohio State Regular Militia. In these messages, WATKINS mentioned, among other things, that the militia had a weekJong “Basic Training class coming up in the beginning of January,” and WATKINS told one recruit, “l need you fighting fit by innaugeration.”

And some of her most inflammatory language came in mid-November, such as when, on November 17, she spoke of killing and dying for “our” rights.

I can’t predict. I don’t underestimate the resolve of the Deep State. Biden may still yet be our President. If he is, our way of life as we know it is over. Our Republic would be over. Then it is our duty as Americans to fight, kill and die for our rights.

and:

[I]f Biden get the steal, none of us have a chance in my mind. We already have our neck in the noose. They just haven’t kicked the chair yet.

Or, her comments on November 19 about going “underground if this coup works.”

Indeed, on November 19, 2021, Watkins went so far as to text a contact that, “If anything, we need to go underground if this coup works,” as well as for the need “to be cautious as hell going forward” since “[i]f they still this election, we are all targets after Jan 20th.”

Again, this precedes the first instance of incitement from Trump cited by Watkins’ attorney, on November 21.

Moreover, Peterson’s claim that when Watkins spoke of the beauty of the insurrection to a reporter, she was just referring to the National Anthem, is totally refuted by the actual record.

Their evidence is that 40 minutes after the Capitol had been breached, she went to the Capitol and entered the building. By that time, the door had already been opened. The government acknowledges that “the crowd aggressively and repeatedly pulled on and assaulted” the doors of the building to get inside, causing damage. Ms. Watkins is charged with aiding and abetting this offense, but there is no evidence that this was something she had a criminal intent to do. She would have to have shared in the intent to destroy property, when in fact, she attempted to stop people from destroying property. She talked of the beauty of the peaceful protest, but acknowledged that it was only beautiful until she started hearing glass break. When she spoke of the beauty, she was referring not to the violence, but to the chants of USA and the singing of the National Anthem.

In the actual interview, Watkins specifically spoke of “standing our ground” against the cops because “they attacked us.”

“To me, it was the most beautiful thing I ever saw until we started hearing glass smash. That’s when we knew things had gotten really bad.” Watkins also states, “We never smashed anything, stole anything, burned anything, and truthfully we were very respectful with Capitol Hill PD until they attacked us. Then we stood our ground and drew the line.”

Her claim that “they attacked us,” may reflect her co-conspirator Thomas Caldwell’s false claim that the cops were “teargassing peaceful protestors.”

On January 6,2021, at approximately 2:06 p.m., CALDWELL sent WATKINS a text message stating: “Where are you? Pence has punked out. We are screwed. Teargassing peaceful protesters at capital steps. Getting rowdy here… I am here at the dry fountain to the left ofthe Capitol[.]”

That is, it’s not just Donald Trump who riled her up. So did her buddies in the militia (as she riled up fellow members).

Moreover, Watkins’ lawyer makes much of the fact that Watkins’ formation did not enter the Capitol until 40 minutes after it was breached. But that was long after she operated on a belief that the cops had targeted “protestors,” and it reflected actions planned a week in advance.

Perhaps the most intriguing comments in Watkins’ filing — and the most unintentionally damning — are the description of Watkins serving as “escort” or “security” for pro-Trump politicians.

Ms. Watkins has no prior history of violence and has tremendous respect for law enforcement and the Constitution of the United States. Indeed, although misguided, she believed she was supporting the Constitution and her government by providing security services at the rally organized by Mr. Trump and the republican lawmakers who supported his goals.

[snip]

On January 5 and 6, Ms. Watkins was present not as an insurrectionist, but to provide security to the speakers at the rally, to provide escort for the legislators and others to march to the Capitol as directed by the then President, and to safely escort protestors away from the Capitol to their vehicles and cars at the conclusion of the protest. She was given a VIP pass to the rally. She met with Secret Service agents. She was within 50 feet of the stage during the rally to provide security for the speakers. At the time the Capitol was breached, she was still at the sight of the initial rally where she had provided security. The government concedes that her arrival at the Capitol was a full 40 minutes after the Capitol had been breached. [my emphasis]

I believe this is the first description of the Oath Keepers’ role as “security” as these events in any of the legal filings in the case. But it doesn’t seem to help any of the co-conspirators.

Jessica Watkins was invited to an extremist revival event and given a VIP badge. She did so in the guise of providing security. But she admits she was almost 50 feet away from the stage, in no way the right location to be providing security (moreover, I think this claim is somewhat inconsistent with that the reported analyses shows, because members that would become the Stack left early, perhaps in response to Caldwell’s text).

Her brief further describes that she and her kitted-out militia were to provide “escort” to marchers to the Capitol, and she appears to know the intent was to march to the Capitol. One way or another, that still means her stated purpose — the reason she was wearing a VIP pass provided by official organizers (including Ali Alexander and Alex Jones) — was to ensure that those marching on the Capitol were accompanied by a militia that had plans to take up arms if things went badly.

I’m really grateful to Watkins’ attorney for providing the FBI reason to go ask the Secret Service and event organizers about this plan for an armed escort to the Capitol. This may accelerate the process of incorporating at least Roger Stone and Jones into these conspiracy indictments.

But it simply doesn’t help the cause of claiming that the Oath Keepers weren’t part of an organized conspiracy to interrupt the legal vote count. Does that mean that Jessica Watkins should be detained because people incited by the Proud Boys demolished the Capitol door? No. Does it mean she poses a threat because the organization she help[ed] lead started planning even before the election to have people trained to take action? Yes.

In November, Watkins wanted to make sure that Trump himself wanted her militia to take action. Her lawyer claims that Watkins was awaiting the invocation of the Insurrection Act. But even without that invocation, according to this filing, she envisioned serving as the military guard for a march of people from the White House to the Capitol seeking to overturn the election results.

And thanks to this defense filing, prosecutors can start talking about this earlier part of the conspiracy now.

Update: Peterson has submitted a clarification that has made the comments about the Secret Service even more damning. She didn’t meet the Secret Service. She spoke with them as she was coming through security for the VIP pen, from which she fancies she was “providing security.” And they told her to leave her tactical gear outside the pen.

Jessica Watkins, through counsel, respectfully submits this clarification to her motion for release pending the outcome of her case. Counsel apologizes for being less than clear on a couple of points raised in the original motion – something that unfortunately became obvious by media inquiries. Counsel in no way meant to imply that Ms. Watkins met with the Secret Service. A better verb would have been “encountered.” Ms. Watkins spoke with Secret Service members early in the day when she was coming through the check in point for the VIP area. The point counsel was attempting to make was that she encountered law enforcement, including Secret Service officer on her way to providing security for the rally. She was given directives about things she could and could not do, including directions to leave all tactical gear outside of the VIP area, and she abided by all of those directives. Ms. Watkins does not suggest that she has any direct knowledge that her role as security was sanctioned by anyone other than people involved in organizing the rally. She certainly did not mean to suggest that she was hired by the U.S. Secret Service to perform security. Counsel again apologizes for any confusion created by the inartful language used in the motion.

Effectively, then, hours before she entered the Capitol, which was full of protected people, including the Speaker of the House, President Pro Tempore, Vice President-Elect, and the Vice President that Donald Trump had just targeted, Watkins was told not to bring her tactical gear close to another set of protected people. And once she left the VIP pen where she was “providing security,” she put that tactical gear back on.

That only serves to emphasize the degree to which she was targeting Congress.

Mike Lee Provides Key Evidence Implicating Trump in the Existing Criminal Conspiracy

Because Donald Trump’s Personal Injury lawyer, Michael Van der Veen, made a specious argument about the First Amendment to successfully give 43 Republicans cover to vote to acquit the Former President in his impeachment trial, the discussion about Trump’s potential criminal exposure for January 6 (which according to CNN he is concerned about) has largely focused on incitement charges.

That’s true even though the trial led Mike Lee to offer up evidence implicating Trump in the same conspiracy charges already charged against 10 defendants: conspiring to delay Congress’ official proceeding to certify the electoral college vote. As I have noted, DOJ has started mapping out conspiracy charges against both the Oath Keepers and the Proud Boys:

While there are differences in the scope of the conspiracy and overt acts involved, all three charging documents charge defendants with conspiring “to stop, delay, and hinder Congress’ certification of the Electoral College vote,” effectively conspiring to commit 18 USC 1512, tampering with the official procedure of certifying the electoral college vote, an official procedure laid out in the Constitution.

And in spite of their votes to acquit the Former President last night, both Tommy Tuberville and Mike Lee provided evidence that the FBI might use to investigate Trump in that conspiracy. As I noted days after the attack, during the attack, Trump twice attempted to reach out to Tuberville to ask him to delay the count. The second time, Rudy Giuliani even left a message specifically asking for a delay as such, precisely the object of the already charged conspiracy charges.

I know they’re reconvening at 8 tonight, but it … the only strategy we can follow is to object to numerous states and raise issues so that we get ourselves into tomorrow—ideally until the end of tomorrow.

I know McConnell is doing everything he can to rush it, which is kind of a kick in the head because it’s one thing to oppose us, it’s another thing not to give us a fair opportunity to contest it. And he wants to try to get it down to only three states that we contest. But there are 10 states that we contest, not three. So if you could object to every state and, along with a congressman, get a hearing for every state, I know we would delay you a lot, but it would give us the opportunity to get the legislators who are very, very close to pulling their vote, particularly after what McConnell did today. [snip]

Over the last few days, both Tuberville and Lee offered up more details on the earlier call. Tuberville confirmed the content of the call, including that he told the President that his Vice President had been evacuated.

Sen. Tommy Tuberville revealed late Wednesday that he spoke to Donald Trump on Jan. 6, just as a violent mob closed in on the the Senate, and informed the then-president directly that Vice President Mike Pence had just been evacuated from the chamber.

“I said ‘Mr. President, they just took the vice president out, I’ve got to go,’” Tuberville (R-Ala.) told POLITICO on Capitol Hill on Wednesday night, saying he cut the phone call short amid the chaos.

And Lee — who twice demanded that references to this call be removed from the Congressional record — ultimately provided phone records showing that even after Pence had been publicly rushed to safety, Trump was still working on delaying the vote rather than addressing the danger. Trump tweeted about Pence at 2:24, specifically complaining that Pence hadn’t given states a chance to “correct” facts, effectively a complaint that Pence had not disrupted the orderly counting of the vote.

Mike Pence didn’t have the courage to do what should have been done to protect our Country and our Constitution, giving States a chance to certify a corrected set of facts, not the fraudulent or inaccurate ones which they were asked to previously certify. USA demands the truth!

And then, two minutes later, Trump attempted to call Tuberville and, after Lee turned over his phone to the former coach, spoke to him for four minutes. It matters that Tuberville told Trump about the evacuations, though it is highly unlikely he had not been informed both informally and formally at that point. But it matters just as much that even after the insurrectionists had breached the building, Trump took two overt acts to attempt to delay the vote.

A Trump defense might argue — as his Personal Injury Lawyer did this week — that he was just trying to count the votes, but Trump had already made an unconstitutional request of Mike Pence, something Trump’s team provided no defense for. And that’s before you consider the evidence that Rudy, at least, was in direct contact with James Sullivan, who is affiliated with the group, the Proud Boys, that has already been accused of conspiring to breach the Capitol (indeed, another conspiracy case, against Proud Boys Dominic Pezzola and William Pepe, charges that they conspired to interfere with cops trying to keep protestors out of the Capitol, and the Chrestman indictment also includes that as a separate conspiracy).

I’m not saying this will definitely happen. The bar to charging a Former President remains high.

But DOJ has already charged ten people for doing what Trump was also demonstrably doing that day. And, partly because of Mike Lee’s desperate effort to avoid having the record of him implicating Trump in the congressional record, Lee ended up making the timeline of the events public without the FBI having to breach speech and debate concerns to obtain it. By doing so, Lee made it easier for the FBI to make a case against Trump if they ever attempt to do so.

Mike Lee may have helped prevent Trump from being barred from running for President again. But Mike Lee also made it easier to prosecute Trump for those very same acts.

Update: NYT just posted a story showing that six of the Oath Keepers Roger Stone was palling around with leading up to the attack entered the Capitol on January 6.

Accused Insurrectionist Thomas Caldwell Claims to Have Top Secret Clearance

Yesterday, Thomas Caldwell — the man accused of being part of an Oath Keeper conspiracy on January 6 — submitted a motion fighting detention. In it, he claims all the accusations against him are false, there’s no evidence that he breached the Capitol (presumably based on certainty that his wife, who was allegedly with him, won’t testify to that fact), and that his bad back prevents him from doing things like walking into the Capitol.

The Oath Keepers have a reputation of ordering underlings to do their dirty work, and that may be what Caldwell is claiming here.

It is noteworthy that despite reports of over 100,000 photo and video recordings of the incidents on January 6, 2021, the Government has not identified and photo or video that shows Caldwell in the U.S. Capitol Building, on the grounds, after overcoming any barrier or other evidence of restriction, in the vicinity of any damaged property, or in any chamber of Congress. Further, the Government has not identified any time, place, or specific content of any alleged agreement that Caldwell alleged participated in that would meet the definition of a conspiracy.

But the more interesting move is — in an effort to suggest his military background means he wouldn’t engage in a conspiracy with a militia that focuses on recruiting former military — Caldwell’s claims to retain (still!) clearance.

After retiring from the Navy, he worked as a section chief for the Federal Bureau of Investigation from 2009-2010 as a GS-12. He also formed and operated a consulting firm performing work, often classified, for U.S. government customers including the U.S. Drug Enforcement Agency, the Department of Housing and Urban Development, the U.S. Coast Guard, and the U.S. Army Personnel Command.

What classified work and military experience does HUD require?

In another case where an insurrectionist had Top Secret clearance, DOJ pointed to that as reason why the person should be detained.

In any case, what is clear is that Caldwell believes Congress is full of traitors because they followed the Constitution, and he advocated similarly storming Capitols around the country.

Even with his bad back.

The Insurrection Affidavits Don’t Show Where the Insurrection Was Organized

The normally very rigorous Thomas Brewster has a piece purporting to fact-check Sheryl Sandberg’s claim, made days after the January 6 insurrection, that the insurrection wasn’t organized on Facebook.

“I think these events were largely organized on platforms that don’t have our abilities to stop hate and don’t have our standards and don’t have our transparency,” said Sheryl Sandberg, Facebook chief operating officer, shortly after the Capitol Hill riots on January 6.

The piece has led both bad faith and good faith actors to grasp on the story to claim that Facebook is responsible for the violence.

Brewster purports to measure that by seeing how many mentions appear in the charging documents for the 223 people included on GWU’s list of arrestees.

But a few paragraphs later, Brewster admits he’s not measuring on what platform the riot was organized, but instead which was most popular among rioters.

Whilst the data doesn’t show definitively what app was the most popular amongst rioters, it does strongly indicate Facebook was rioters’ the preferred platform.

Even that is not proven (though it may well prove to be true), but obviously which platform is most used among rioters to boast about the riot is a very different question than on which platform (if any) the insurrection was organized.

Here’s why:

  • At least half the existing affidavits are a measure of which riot attendees were most likely to be outed and how
  • Expect parallel construction
  • There are a lot of dangerous rioters who’ve not yet been charged
  • The currently accused in no way represent all the known people who might be considered organizers of the riot or the larger operation
  • The existing affidavits are no measure of what platforms actual organizers used to organize

At least half the existing affidavits are a measure of which riot attendees were most likely to be outed and how

The police made just a handful of arrests on January 6, with the biggest component being curfew violators who did not even provably enter the Capitol (and so those non-federal cases should not be included in the analysis of rioters, as Brewster did).

In the four and a half weeks since the riot, the cops have engaged in a kind of triage, arresting those whom they could easily identify and then, over time, prioritizing those who — from video evidence of the insurrection — appeared to have committed more dangerous crimes. That means in the days after the insurrection, arrests largely focused on the people who appeared the most outlandishly stupid in videos, those whose own social networks of family, work acquaintances, and high school friends disapproved of their participation in the riot and so called the FBI with a tip, or those who identified themselves in media interviews (which often led to family, work acquaintances, and high school friends to then alert the FBI).

To understand the affidavits, it’s important to realize that any person who entered the Capitol without a legitimate purpose on January 6 (that includes a number of people who videoed the event but had no media credentials) were committing two crimes, both tied to it being the Capitol. So all the FBI would need to charge someone is to prove that they entered the building.

About half the current arrestees were charged with just these trespassing crimes, yet many of these people were among the first arrested. These people are in no way the organizers of the riot, and many of them are just Trump supporters who were caught up in the crowd. Some even credibly described trying to de-escalate the situation (including one such guy who got arrested because he had the misfortunate to show up in videos of the guy who stole Pelosi’s lectern).

The measure of how these people were arrested is quite often a measure of the fact that they shared their memories of the day or were caught by others who did. And to the extent that this happened on Facebook, it likely happened because Facebook is the platform where people have their broadest social networks, making it more likely that a lot of people who don’t sympathize with the riot would have witnessed social media content talking about it. Facebook is where ardent Trump supporters still share networks with people who vehemently oppose him.

In other words, in this initial arrest push, the people who bragged on Facebook were among the most likely to be arrested precisely because the network includes a broader range of viewpoints. It’s a measure of reach — and the political diversity of that reach — and not a measure of the centrality of the platform to the planning or violence.

Expect parallel construction

As noted, in the weeks since the insurrection, some agents at the FBI have obviously shifted to a reverse approach: rather than arresting those against whom tips came in from aggrieved ex-wives and people who were owed money, the FBI started to identify which rioters were the most dangerous and prioritize figuring out who they were.

One type of more dangerous rioter would be those with institutional ties that lead the FBI to believe there might be something more going on. But these are just arrest affidavits, which the FBI is acutely aware will be publicly scrutinized. As every single one of them say, they don’t reflect the totality that an Agent might know about the person. And in those cases, we should expect the FBI to parallel construct what they know about people and how they came to know it.

Social media is a wonderful way to do that.

And it does seem that the FBI relied on social media to establish probable cause for such people. Take the Lebanese-born woman who started engaging in the 3% community in November, which the FBI cites to Facebook. Or consider how the FBI pretends they did not know who Nick DeCarlo was until he showed up in Nick Ochs’ Twitter feed. Both rely on social media (in the latter case, one piece of evidence is something researchers found on Telegram and posted on Twitter, and so should be chalked up in the “uses Telegram” column).

But measuring how the FBI parallel constructed other knowledge is not a measure of what social media platforms people primarily use.

There are a lot of potentially dangerous rioters who’ve not yet been charged

As noted, one way the FBI shifted focus after the initial arrests of people identified by their disapproving family members was by identifying people involved in assaults — first of officers (designated by AFO), and then the media (designated by AOM) — and trying to identify them, in part through the use of Wanted posters (BOLO).

To date, the FBI has released 223 BOLOs, of which 40 precede the shift of focus to those involved in assault (and so include people who caught attention for another reason, such as the use of a Confederate or Nazi imagery). The FBI has arrested around 35 people identified in BOLOs, thus leaving around 190 people that the FBI has identified to be of particular interest based off video images, that they have not yet arrested.

For what it’s worth, I suspect that the FBI has identified a goodly number of these people, and may even have sealed complaints against some of them but is holding off on an arrest to gather more evidence. That is, they can arrest them now, but would prefer not to until they shore up their case. In a number of cases where people were identified off of BOLOs, the people turned themselves into the FBI but denied any physical contact was anything but a love tap (here’s one example, but there are others), potentially making it harder to prosecute for the violence.

If and when these people are identified, they may well prove to have used Facebook. But thus far, this group of people has shown better operational security and (unsurprisingly) a greater likelihood to flee or to destroy evidence.

But whatever their Facebook use, when counting the numbers of the 800 people who committed a trespass crime on January 6 by entering the Capitol, of which 200 have been arrested, it’s worth noting that almost another 200 — some of the greatest concern — have not been provably identified by bragging Facebook posts yet.

The currently accused in no way represent all the known people who might be considered organizers of the riot or the larger operation

Thus far, the government has filed the bare outlines of conspiracy charges against both the Oath Keepers (who spoke of a plan they had trained for) and the Proud Boys (who moved in obviously coordinated fashion communicating via radio on January 6). But those conspiracy charges currently include just three and two people, respectively (with a sub-conspiracy charged against two more Proud Boys).

According to claims quoted in charging documents, there were anywhere from 30 to 65 Oath Keepers involved in the riot (including a busload from North Carolina). There are at least three other key Proud Boys that have not been arrested for the riot (Enrique Tarrio, of course, was arrested days earlier for a different racist attack), and about half of those that have were charged with just the trespassing crimes.

In general, these people are not currently identified in BOLO posters.

In other words, this is a set of people — perhaps another 40 on top of the 190 outstanding BOLO figures — that the FBI likely considers key suspects.

And that’s just the organizers of the riot. That doesn’t include James Sullivan, who appears to have been in communication — via text — with Rudy Giuliani.  It doesn’t include people like Ali Alexander and Rudy and possibly Roger Stone who would tie the riot to the larger effort to delay the vote (which is the object of both the Oath Keeper and Proud Boys conspiracy). We know from Stone’s prosecution, at least, that he was de-platformed long ago and learned to use encrypted apps by August 2016.

In any case, before you can make claims about what platforms were used to organize the insurrection, you first need to identify the universe of people believed to have organized it. Right now, perhaps as few as 20 of the 200 people who’ve been arrested should be considered leaders of it, and there are probably at least another 40 who might be considered organizers of the riot itself who have not been arrested yet.

The existing affidavits are no measure of what platforms actual organizers used to organize

To be sure, both of the groups identified in conspiracies (and Three Percenters) made use of Facebook. As Brewster cited, accused Oath Keeper conspirator Thomas Caldwell posted updates to Facebook during the siege, and the co-conspirators did use Facebook to communicate both publicly and privately before the event. Among those referencing the Proud Boys in affidavits, Andrew Ryan Bennett uploaded video to Facebook,  Gabriel Garcia uploaded video to Facebook, and Daniel Goodwin used Instagram and Twitter. As noted above, Nick Ochs had a campaign Twitter account.

But some of the more substantive public communications from both groups, including important communications from before the riot, was posted on Parler. And both groups used other means — Zello for the Oath Keepers and radios for the Proud Boys — to communicate operationally during the day.

With the Proud Boys, in particular, Facebook and Twitter have long tried to exclude them from the platform, both because their speech violated platform guidelines but also because after expulsion the group tried to bypass that expulsion.

Importantly, aside from some quotations from Jessica Watkins’ Zello account and those Facebook messages, the FBI hasn’t shown what it has of operational communications between these groups, and it’s unlikely to do so, either, until trial. The FBI is not going to share how much it knows (if anything) about the operational contacts of these groups until it has to. Which makes any conclusions drawn from what it is willing to show of questionable validity.

Don’t get me wrong: I’m happy to argue that Sheryl Sandberg is one of a number of Facebook executives who should be ousted. I agree that Facebook has fostered right wing violence, not least with the settings of its algorithms (which is the opposite of what Glenn Greenwald wants the Facebook problem to be). Because it has such wide breadth, it is a platform where people not already radicalized might get swept up in disinformation.

But I know of little valid evidence yet about Facebook’s role in organizing the insurrection, nor is there likely to be conclusive evidence for some time yet.

Update: Changed language to describe Tarrio’s alleged vandalism of a traditionally black church to make it clear he is not accused of assaulting another person.