As the Federal Bureau of Investigation and Department of Justice continue their investigations into the alleged insurrectionists at the US Capitol on 6 January 2021, evidence from social media will play a significant role in identifying individual rioters and proving probable cause for their arrests.
The Program on Extremism at the George Washington University, which continues to track these ongoing arrests, has identified 143 individuals currently charged at the federal level for their role in the siege at the Capitol as of 24 January 2021. We conducted a preliminary analysis of this database of court records to focus on how prosecutors used evidence from social media to charge those involved in the storming of the Capitol. Overall, 82% of criminal complaints contained some type of evidence from social media, with 52% of the complaints presenting the individual’s own social media posts as evidence against them and an additional 30% presenting others’ social media content to identify and charge the insurrectionists.
The social media evidence in criminal complaints to date was largely garnered from a small number of popular video file-sharing and live streaming platforms. The most-cited social media platform was Facebook; 37 cases relied in part on evidence from Facebook Live videos or posts on personal Facebook accounts. In addition, other frequently-cited platforms include YouTube, Instagram (particularly Instagram stories and Instagram Live), the live-streaming service DLive, and posts on the social networking site Parler.
Federal law enforcement’s focus on these platforms correlates with the bulk of existing charges used to indict the Capitol rioters. Many of the individuals who have thus far been charged with federal offenses are alleged to have unlawfully entered and participated in activities on designated grounds (in violation of 18 U.S.C.§ 1752). Indictments for these charges require that prosecutors prove that the individual in question was inside the Capitol during the siege with the intent to disrupt government proceedings. Therefore, a still image or video footage depicting the charged individual inside the Capitol while the siege took place, alongside some evidence they intended to disrupt Congressional proceedings, can serve as the basis for the indictment.
We broke down the evidence from social media used to indict the rioters into three categories based on the timeline of the events at the Capitol. In certain cases, individual rioters posted information in advance of the siege on 6 January, indicating their intent to storm the Capitol or commit other offenses. For instance, the charging documents for Georgia lawyer William McCall Calhoun document a tip made to the FBI National Threat Operation Center in mid-November 2020 that Calhoun was using Facebook, Twitter, and Parler accounts to incite others to “storm Washington D.C.” and “kill every last communist who stands in Trump’s way.” Days before the siege, he allegedly posted on his Parler account that “being physically present in Washington on January 6 is of key importance…I’ll see you there!”
However, only 13% of criminal complaints thus far contain evidence from rioters’ pre-siege activity on social media. Instead, the overwhelming majority of the evidence from social media presented in the court documents to date was posted online as the siege was taking place. Two sources of social media evidence posted during the riot occur frequently in the criminal complaints. The first source is individual rioters who posted information on their personal social media accounts depicting them participating in the events at the Capitol on 6 January, many of them willingly documenting their own criminal activity with a disturbing nonchalance. As many media sources have noted, this version of self-incrimination was particularly common amongst the rioters, some of whom seemed to forget that documenting their activities for propaganda (and in some cases, self-promotion) purposes would inadvertently assist federal law enforcement in bringing them to justice.
Examples abound of alleged insurrectionists incriminating themselves on social media. On a live stream posted to his Facebook account, former West Virginia House of Delegates member Derrick Evans exclaimed “we’re in! We’re in! Derrick Evans is in!” as he unlawfully entered the Capitol building during the riot. University of Kentucky student Gracyn Courtwright posted several selfies inside the Capitol building during the riot to her Instagram page. By posting this material, several rioters not only incriminated themselves, but many of the other siege participants. Anthime Gionet—a white nationalist more commonly known by his nom du plume “Baked Alaska”—operated a live stream of the storming of the Capitol on DLive that was subsequently used by law enforcement to identify several other individuals who participated in the riot.
Resources like Baked Alaska’s live stream generated another mountain of evidence from social media accounts that the FBI used in criminal complaints. Even if some rioters were able to abstain from social media during the events, others’ extensive video and photo documentation (in combination with tips from the public) were used to identify and indict them. Two days after the siege, Air Force veteran Larry Rendell Brock’s ex-wife called the FBI after she recognised him in pictures from social media depicting the Capitol rioters. This type of public tips, in combination with independent investigations and news media reporting, appeared frequently in the court documents.
The third category of social media evidence encompassed individuals who publicly rehashed—and in some cases openly bragged about—their criminal conduct in the days after the siege took place on the 6th. This includes Joshua Matthew Black, an Alabama resident whose image on the Senate floor next to Brock went viral. The criminal complaint against Black alleges that, on 8 January, he posted two videos on YouTube describing the extent of his actions at the Capitol. In these videos, Black reportedly admitted to entering the Capitol building, claiming “this is our house” and that “I said I need to get in there. I just felt like the spirit of God wanted me to go in the Senate room.” Black further admitted that he carried a knife into the Capitol building, and explained that he suffered a facial injury on his left cheek when he was shot with a projectile.
As the prosecution process continues and investigators gather more evidence and information on the intent and motives of the individuals involved, it is likely that more evidence from before and after the siege will make its way into investigations and superseding indictments. This type of evidence, encompassing not only online but also offline activity, will be critical when prosecutors bring major charges that rely on intent and motive. As an example, documenting social media posts from prior to the siege may be required to prove the conspiracy, insurrection, sedition, and federal murder charges that federal prosecutors are reportedly planning to bring against certain individuals involved in the siege.
This piece offers a preliminary glimpse into how federal investigators and prosecutors are using the social media footprints of the participants in the Capitol siege to aid in charging them with a range of federal offenses. The primary takeaway from the initial rounds of arrests is that online evidence posted during the US Capitol siege has, thus far, formed the backbone of a majority of the federal cases against those involved.
While this dynamic is likely to change, this takeaway has two implications for understanding the motivations and intent of those participating in the siege. First, individual rioters’ tendencies to self-incriminate or incriminate their supposed comrades in arms demonstrate equal parts of poor operational security, naïveté about the federal law enforcement response to the events of the 6th, and more concerningly, extremists’ deeply-held belief that their actions were legitimate.
Second, while the strategic innovation of domestic violent extremist groups will also continue offline, the groups responsible for the siege stand to learn a great deal about operational security online. Those tasked with countering the influence of domestic terrorist groups in the United States will unfortunately not always be able to rely on self-incrimination to identify, detect and prosecute domestic terrorists. Therefore, as cases of rioters involved in the Capitol siege continue to roll in, it is incumbent upon researchers and analysts to closely monitor how domestic terrorist groups are adapting their tactics online to avoid detection and improve operational security.