Telegram Channel @nettrain

NOWHERE TO HIDE:
OPEN SOURCE INTELLIGENCE
GATHERING

How the FBI, Media, and Public Identified

the January 6, 2021, U.S. Capitol Rioters

Daniel Farber Huang

1
Telegram Channel @nettrain
NOWHERE TO HIDE: OPEN SOURCE INTELLIGENCE GATHERING
How the FBI, Media, and Public Identified the January 6, 2021, U.S. Capitol
Rioters

©2021 Daniel Farber Huang

All Rights Reserved.

The information in this book is published on an “As Is” basis, without warranty.
The author has taken great care in preparation of this book, but assumes no
responsibility for errors or omissions. No liability is assumed for incidental or
consequential damages in connection with or arising out of the use of the
information or programs contained herein.

Rather than use a trademark symbol with every occurrence of a trademarked

name, logo, or image, this book uses such names, logos, or images in an
editorial fashion and to the benefit of the trademark owner, with no intention of
infringement of the trademark.

No part of this book shall be reproduced or transmitted in any form or by any

means, electronic, mechanical, magnetic, and photographic, including
photocopying, recording, or by any information storage and retrieval system,
without prior written permission of the publisher.

Published by Princeton Studios

2
Telegram Channel @nettrain
 Table of Contents
Topic Page

Introduction
Section I ‒ Assault on the United States Capitol
Chapter 1 - Who, What, When, Where, How, Why?
Chapter 2 ‒ January 6, 2021
Chapter 3 - A Note on Definitions and Approach
Chapter 4 ‒ Broadcasting the “revolution”
Chapter 5 ‒ FBI Calls on the Public for Help
Chapter 6 - FBI Capabilities and Resources
Chapter 7 – The Hunt for the Capitol Pipe Bomber
Chapter 8 ‒ The Media’s Hunt for Suspects
Chapter 9 ‒ Social Media Crackdown
Chapter 10 ‒ Public Crowdsourcing
Section II – Identifying the Capitol Rioters
Chapter 11 ‒ Knock Knock
Section III – Tactics, Techniques and Procedures
Chapter 12 – Best practices for OSINT Investigators
Chapter 13 ‒ Deepfakes and Cheapfakes
Chapter 14 ‒ Facial recognition
Chapter 15 ‒ Image Research
Chapter 16 ‒ Exercises in Photo Observation
Chapter 17 ‒ Reverse Engineering Social Media
Chapter 18 – Investigating Social Media Accounts
Chapter 19 ‒ Fringe Social Media
Chapter 20 ‒ Real World Data
Chapter 21 ‒ Archiving Data

3
Telegram Channel @nettrain
Appendix
A Primer on Key Terms and Definitions
Capitol Breach Cases
About the Author
Bibliography
Index

4
Telegram Channel @nettrain
 5
Telegram Channel @nettrain
 Introduction

“You see, but you do not observe. The distinction is clear,”

Sherlock Holmes once said to Dr. John Watson. “For example, you have
frequently seen the steps which lead up from the hall to this room.”
“Frequently,” Watson replied.
“How often?”
“Well, some hundreds of times.”
“Then how many are there?” Holmes asked.
“How many? I don’t know.”
“Quite so! You have not observed. And yet you have seen. That
is just my point. Now, I know that there are seventeen steps, because I
have both seen and observed.”

Although Holmes would likely be a professor most students

would avoid, he had a point.

In the year 2021, we are deluged in data and information

bombarding our senses – both overtly and covertly – to the point where
most of us are numb to it. Not only are we drowning in data being
targeted at us, our personal data – literally terabytes of information on
each of us – is being collected by every device ranging from the phones
in our pockets and purses to the Amazon Alexa playing music in our
kitchens to our cars getting an oil change.
Collecting information on or about an incident, entity, or
person(s) through existing, available sources (both online and in the real
world) is considered “open source intelligence gathering.” Open source
information is publicly accessible (although not always easily accessible
or readily available), as compared to closed or confidential information.
The challenge is knowing how to find it, how to document it, and how to
make sense of it all to form a story, history, or plausible scenario for
whatever it is you are researching.

6
Telegram Channel @nettrain
 When reading about open source research, the word
“breadcrumbs” comes up a lot. Because what researchers often find are
pieces, threads, or hints of something larger and more telling. Gathering
the breadcrumbs of an investigation requires technical know-how (but
fortunately much of the technical part is pre-packaged in easy to use,
existing services and apps, many of which are discussed in this book)
and also common sense to retrace the logical (or sometimes illogical)
path a subject might have taken. The art of trying to understand a
subject’s unpredictable human nature may lead you to reconstruct the
breadcrumbs into a cracker or a croissant. Any or both of those results
might be half correct.
Fortunately, by developing a consistent approach to your
information gathering tools, tactics, and procedures, the likelihood that
you’re pointing yourself in the generally correct direction toward the
answers you seek is increased meaningfully.
I wrote “Nowhere to Hide: Open Source Intelligence Gathering”
to shine some light into the vast, urgent investigative effort that has been
taking place since the January 6, 2021 riots at the U.S. Capitol. The goal
is to provide brief context into what led up to the riots, what happened on
the fateful day, and then provide extensive case studies into how those
involved with the riot were identified by law enforcement, the media,
and the general public. Finally, I provide an extensive guide to open
source intelligence gathering (sometimes referred to as “OSINT”) tools
and resources (and how to use them), which can be a useful guidebook
for continuing the current Capitol investigations and can also be applied
to other investigations in the future.
My cyber experience is built from multiple areas. Firstly, for
several years I have worked closely with numerous federal, state, and
local law enforcement agencies across the U.S. on providing solutions to
their mobile technology requirements. I have focused on providing
hardware and software solutions to federal field agents, investigators, the
police, and other authorities to support them in performing their duties. I
am a strategic consultant helping a wide range of companies in different
industries reduce risks at all levels of their organizations.
Secondly, my work as a journalist, documentary photographer
and independent humanitarian advocate has required me to evaluate my
personal cyber security from a different angle. I have traveled to nearly
40 countries, often to document and photograph humanitarian crises or
politically-sensitive situations. I have worked in locations where there

7
Telegram Channel @nettrain
have been covert or visible threats against foreigners or, more
specifically, journalists from oppressive governments, military, local
authorities, organized crime, and even disorganized street criminals.
Sometimes I organize teams for projects, so in addition to my personal
safety, I may be responsible for the on-the-ground safety of other
individuals. I need to ensure my teams have the necessary gear
(computers, phones, cameras, and other equipment) to accomplish our
reporting. I need to ensure the sensitive information we are collecting
(photos, videos, interview notes, and evidence) are securely stored as
quickly as possible to prevent potential seizure, theft, or even accidental
data corruption. I need to consider if crossing international borders may
present additional risks to our team, such as the possibility of having our
mobile phones inspected or confiscated. Authorities have the ability to
copy a cellphone’s contents – photos, contacts, messages, call and
browsing histories, account logins, everything – without the owner’s
consent. Our cyber security planning and execution are extensive, every
single time.
And thirdly, I earned my Master’s degree in Journalism and
Certificate in International Security from Harvard University. During my
studies I gained perspective and insight into the ways governments, non-
state actors, corporations, and even lone individuals are using cyber
warfare and intelligence gathering not only against each other but also
against unsuspecting civilians. When I earned my MBA at The Wharton
School, I was trained in efficiency, so throughout this book I will get
right to the point.

Daniel Farber Huang

March 13, 2021

8
Telegram Channel @nettrain
 9
Telegram Channel @nettrain
 10
Telegram Channel @nettrain
 Section I ‒ Assault on the United States
Capitol

Section Table of Contents

Topic Page
Chapter 1 - Who, What, When, Where, How, Why?
Chapter 2 ‒ January 6, 2021
The Buildup
The events of Wednesday, January 6, 2021 at the Capitol
Who was at the Capitol?
Military Networks
Organized Clusters
Inspired Believers
Minute-by-Minute Timeline of Significant Events
Chapter 3 - A Note on Definitions and Approach
Act of Terrorism
Riot
Protest
Right to Peaceably Assemble and Protest
Innocent Until Proven Guilty
Chapter 4 ‒ Broadcasting the “revolution”
Making the Riot a Pay-Per-View Event
Chapter 5 ‒ FBI Calls on the Public for Help
That’s Capitol with an O
Wednesday, January 6, 2021
Thursday, January 7, 2021
Friday, January 8, 2021
Be on the Lookout
Tuesday, January 12, 2021
Friday, January 15, 2021
Chapter 6 - FBI Capabilities and Resources
Biometric Modalities

11
Telegram Channel @nettrain
 Facial Recognition
Voice Recognition
Iris Scan
Retina Recognition
Fingerprint
Palm Print
DNA
Emerging Biometrics
The FBI Biometric Center of Excellence
Operational Technology Division
Criminal Justice Information Services Division
Laboratory Division
Chapter 7 – The Hunt for the Capitol Pipe Bomber
The FBI’s Request for Public Assistance
FBI-Released Information
Images of the Suspect
Bomb-Making Materials
Backpack Used to Transport the Bombs
Suspect’s Distinctive Footwear
Surveillance Videos
Stride Observations
Surveillance Video Observations
Cumulative Video Observations
Location Observations
Video #1 – South Capitol Street SE.
Video #2 – DNC Headquarters
Video #3 – RNC Headquarters Alley
Video #4 – Capitol Hill Club
Mapping Observations
Chapter 8 ‒ The Media’s Hunt for Suspects
ProPublica’s Parler Collection
Chapter 9 ‒ Social Media Crackdown
“I am shocked, shocked…”
Facebook
Twitter
Banning or Suspending Trump’s Accounts
Chapter 10 ‒ Public Crowdsourcing
@HomeGrownTerrorists
Sedition Hunters

12
Telegram Channel @nettrain
The Faces of the Riot

13
Telegram Channel @nettrain
 Chapter 1 - Who, What, When, Where,
How, Why?

Let me start by saying in the United States an individual is

presumed innocent until proven guilty in a court of law.
In this book, I focus discussion on individuals whom the Federal
Bureau of Investigation (“FBI”) has filed formal charges against.
Whether an individual being charged might be considered a domestic
terrorist, rioter, peaceful protestor, some other type of actor, or none of
the above is for the legal system to determine.
This book provides context around the events of January 6,
2021, at the U.S. Capitol Building in Washington, D.C., which left five
people – one police officer and four protestors – dead by the end of the
day. The focus of this book is to provide insight into the wide range of
investigative tools and open source intelligence gathering techniques
available to law enforcement, the media, and the general public used to
identify individuals involved the riots at the Capitol.
Effective open source investigation (sometimes referred to as
“OSINT”) requires a combination of technical knowledge to find the
Who, What, When, Where, and How threads of data and information as
well as taking into account our unpredictable human nature that
sometimes leads us to do the things we do (the Why). That’s a wordy
way of saying effective OSINT investigations require both science and
art.
This parallel approach is illustrated in the numerous case studies
in Section 2 where I draw heavily upon the charging documents filed by
prosecutors. The charging documents typically include:
1. a statement of facts, or affidavit, written by law enforcement
personnel regarding the specific facts of each case, including
the methods used to confirm the identity of the defendant being
charged;
2. a criminal complaint stating which laws are believed to have
been broken; and

14
Telegram Channel @nettrain
 3. an indictment document in which a grand jury has determined
specific laws have been violated.
In this book I often refer to the documented statement of facts
and affidavits (both of which serve the same function in the charging
papers) simply as “affidavits” as it is more concise. The affidavits were
primarily written by FBI Special Agents stating what they believe were
the facts of each case, but on occasion an affidavit was written by other
law enforcement officers including Capitol Police Special Agents. The
cases discussed herein were typically submitted in the United States
District Court for the District of Columbia.
Many of the original affidavits (available for review on the
Department of Justice’s website[1]) read like detective stories as
investigators describe the anonymous tips received, breadcrumbs of data
found online, threads of information to be explored, analysis of
thousands of photographs and hundreds of hours of video footage, all the
while having to question whether a tip was a false lead to begin with
(which, not surprisingly, happened more than once).
In the case studies, I’ve compressed much of the information to
focus primarily on the investigative techniques while providing color and
context to a subject’s alleged state of mind. The photographs, video
screenshots, and other images in the case studies are drawn extensively
from the federal affidavits publicly filed by prosecutors.
Individuals discussed in this book may sometimes be referred to
as rioters or perhaps protestors. Although the term “domestic terrorist”
has been mentioned widely since January 6, 2021, I have intentionally
not used that label when discussing specific individuals in this book
since court verdicts (and possible appeals) have not been determined at
this point in time.
In describing the events that took place, I use the plural phrase
“Capitol riots” rather than singular “Capitol riot.” There were many
occurrences of chaos, mayhem, and violence inside and around the
Capitol Building on January 6, 2021, with different levels of intensity.
Different individuals, similarly, engaged at different levels of intensity –
some were intent on causing pain and damage, others were not. Rather
than lump all the moments together into a homogenous mass, I wanted to
recognize that moments may have had variation.
The second half of the book provides practical insight into open
source investigative tools and techniques. It is intentionally designed to

15
Telegram Channel @nettrain
be highly visual including screenshots of the websites, apps, and
processes being discussed. I believe by knowing what to expect visually
in advance can help users learn faster and, importantly, get to working
faster. My intention is to eliminate much of the intimidating opacity that
OSINT tactics, techniques, and procedures may inherently possess.
Depending on the tool or process discussed, the “Tactics,
Techniques, and Procedures” section may or may not delve into the
specific steps of a resource being discussed. If the step-by-step
instructions for a specific tool are not provided in this book, it is because
that information is readily available and easily understood when you’re
in the program or app. Also, new versions of a tool released after this
book’s publication may alter the interface, making a step-by-step guide
outdated. Furthermore, readers need to be aware that individual tools or
resources included herein may go offline or otherwise cease to function
for any number of reasons.
In certain instances, I have also provided information on
different tools that perform the same or similar functions to allow for
redundancy and cross-checking your research as no one tool may
uncover all the information or data you are seeking. Different tools and
apps may also have varying levels of performance depending on the
browser you are using (e.g., Chrome, Edge, Firefox, Safari), so it is
sometimes necessary to use multiple browsers during an investigation.
My goal with the technical aspects of this book is to provide
users with a broad understanding and framework of the vast range of
tools and resources that can be added to a digital investigative toolbox.
One important takeaway for readers of this book to remember is that the
digital tools will inevitably change over time, but the tactics and
strategies you can apply to conduct solid, robust open source
investigations remain the same.

16
Telegram Channel @nettrain
 Chapter 2 ‒ January 6, 2021

The Buildup
The 2020 presidential race between incumbent Donald Trump
and former Vice President Joseph Biden in many ways represented
American politics at its worst. Spin, propaganda, misinformation and
blatant lies were often broadcast or tweeted to the American public by
Trump, building up to the “Big Lie,” where Trump claimed he rightfully
won the election but it was being stolen from him and handed to Biden.
The general election was held on Election Day on Tuesday,
November 3, 2020. Due to the COVID-19 pandemic, mail-in voting
became an important avenue for the public to cast their votes rather than
going in-person to voting sites. By the end of Election Day, no clear
winner had been announced by any major news outlet.
It wasn’t until four days later, on Saturday, November 7, 2020
that the Associated Press announced it was naming Joe Biden as the 46th
President of the U.S. of America, having received 306 Electoral College
votes, whereas Trump received 232 Electoral College Votes. A candidate
needs more than 270 votes to win the Presidency.[2] Biden received
81,283,098 votes, or 51.3 percent, of the votes cast, while Trump won
74,222,958 votes, or 46.8 percent, of votes cast.[3]
The U.S. Senate was scheduled to ratify the Electoral College
voting shortly after the new year, on Wednesday, January 6, 2021 at the
Capitol Building, as it had done for the last 84 years since 1937.[4]
Between the time Biden was declared the winner in early
November up through January 6, Trump continued to promote the Big
Lie that he had won the popular vote, that he was still rightfully
president, and he was being robbed of his role. Trump’s new slogan was
“Stop the Steal”. In Michigan some of his supporters protested outside
voting count locations screaming “STOP THE COUNT!” while his
Arizona protesters demanded “COUNT THE VOTES!”[5]
Eventually, Trump’s supporters merged their demands and the
common shout became “STOP THE STEAL,” which was an easier

17
Telegram Channel @nettrain
tagline to rally followers behind to spread misinformation and often
outright lies about the 2020 Presidential election.
The Election Infrastructure Government Coordinating Council
(“GCC”) was established in 2017 under the Department of Homeland
Security to support and coordinate critical infrastructure security and
resilience efforts related to federal, state and local elections. The Election
Infrastructure GCC also “made clear domestically and internationally
that election infrastructure enjoys all the benefits and protections of
critical infrastructure that the U.S. government has to offer.”[6]
On November 12, 2020, the five members of the Election
Infrastructure GCC Executive Committee and the five members of the
Election Infrastructure Sector Coordinating Council released a formal
statement:
“The November 3rd election was the most secure in American
history. Right now, across the country, election officials are reviewing
and double checking the entire election process prior to finalizing the
result.
“When states have close elections, many will recount ballots. All
of the states with close results in the 2020 presidential race have paper
records of each vote, allowing the ability to go back and count each
ballot if necessary. This is an added benefit for security and resilience.
This process allows for the identification and correction of any mistakes
or errors. There is no evidence that any voting system deleted or lost
votes, changed votes, or was in any way compromised. [Emphasis in
bold was written in the original issued statement.]
“Other security measures like pre-election testing, state
certification of voting equipment, and the U.S. Election Assistance
Commission’s certification of voting equipment help to build additional
confidence in the voting systems used in 2020.
“While we know there are many unfounded claims and
opportunities for misinformation about the process of our elections, we
can assure you we have the utmost confidence in the security and
integrity of our elections, and you should too. When you have questions,
turn to elections officials as trusted voices as they administer
elections.”[7]
Nevertheless, Trump persisted.
In the months, weeks, and days, building up to the January 6,
2021 attack on the Capitol, Trump and his allies actively, daily promoted

18
Telegram Channel @nettrain
the “Big Lie.”
Steve Israel, a former New York State Representative and
current director of the Institute of Politics and Global Affairs at Cornell
University, in a December 2, 2020 opinion article for The Hill described
it as follows:
“Trump has inflicted us with some little lies each day, adding up
to about 20,000 of them, according to The Washington Post. They
include ‘total exoneration’ by the special counsel, Hurricane Dorian
bearing down on Alabama, and Barack Obama separating children. Such
little lies have run the gamut from silly, like how the noise from
windmills causes cancer, to serious, like his birther claims about Obama.
They have been delivered to us in relentless waves of disinformation and
calumnies.
“But Trump and his minions had never created one big lie that is
sustained, amplified and repeated over and over until it is hard not to
believe it. The big lie gathers all the little ones. It all adds up to one
understandable and unifying theory. Now he has one big lie reduced to
an easily digested but entirely bogus claim that he actually won the
election.”[8]
On the day of pro-Trump rallies in Washington, D.C. on
December 12, 2020, Trump tweeted “I WON THE ELECTION IN A
LANDSLIDE, but remember, I only think in terms of legal votes, not all
of the fake voters and fraud that miraculously floated in from
everywhere! What a disgrace!”
That same day he tweeted again, “WE HAVE JUST BEGUN TO
FIGHT!!!”
One week and 109 tweets later[9] Trump tweeted his praise for a
report by his adviser Peter Navarro alleging election fraud: “A great
report by Peter. Statistically impossible to have lost the 2020 Election.
Big protest in D.C. on January 6th. Be there, will be wild!”
On December 26, 2021, Trump tweeted: “The ‘Justice’
Department and the FBI have done nothing about the 2020 Presidential
Election Voter Fraud, the biggest SCAM in our nation’s history, despite
overwhelming evidence. They should be ashamed. History will
remember. Never give up. See everyone in D.C. on January 6th.”
New Year’s Day 2021, Trump tweeted, “The BIG Protest Rally
in Washington, D.C., will take place at 11.00 A.M. on January 6th.
Locational details to follow. StopTheSteal!”

19
Telegram Channel @nettrain
 At a rally in Georgia the day before the Senate runoffs, Trump
repeated his grievances about his own election. He spoke about a
continued fight, both for himself and the Senate. “If the liberal
Democrats take the Senate and the White House — and they’re not
taking this White House — we’re going to fight like hell, I’ll tell you
right now,” Trump said. “We’re going to take it back,” Trump said.[10]
On the morning of Tuesday, January 5, 2021 at 9:50 a.m.,
Trump’s first tweet of the day said, “Pleased to announce that
@KLoeffler & @sendavidperdue have just joined our great
#StopTheSteal group of Senators. They will fight the ridiculous Electoral
College Certification of Biden. How do you certify numbers that have
now proven to be wrong and, in many cases, fraudulent!”
And then 76 minutes later at 11:06 a.m., tweeted the lie that
“The Vice President has the power to reject fraudulently chosen
electors.”
At 5:05 p.m., “Washington is being inundated with people who
don’t want to see an election victory stolen by emboldened Radical Left
Democrats. Our Country has had enough, they won’t take it anymore!
We hear you (and love you) from the Oval Office. MAKE AMERICA
GREAT AGAIN!”
Later that day, sometime between 7:30 p.m. and 8:30 p.m., an
unidentified suspect placed pipe bombs at both the Democratic National
Committee Headquarters building and the Republican National
Committee Headquarters building.
Trump’s last tweet of Tuesday, January 5, 2021, at 10:28 p.m.,
continued the Big Lie with, “Looks like they are setting up a big “voter
dump” against the Republican candidates. Waiting to see how many
votes they need?”

10:28 p.m. EST on January 5, 2021 (3:28 a.m. UTC on January 6, 2021)

20
Telegram Channel @nettrain
The events of Wednesday, January 6, 2021 at the
Capitol
The following description of the events of January 6th is drawn
heavily from federal affidavits and statements of fact submitted by the
FBI in its formal complaints against Capitol rioters.
On January 6, 2021, a joint session of the U.S. Congress
convened at the Capitol Building, located at First Street Southeast,
Washington, District of Columbia. During the joint session, elected
members of the U.S. House of Representatives and Senate met in the
U.S. Capitol to certify the vote count of the Electoral College for the
Presidential Election that took place on November 3, 2020.
The Washington D.C. Metropolitan Police Department (“MPD”)
has jurisdiction over city streets and property whereas the U.S. Capitol
Police (“USCP”) has jurisdiction over the federal Capitol building and
grounds. The U.S. Capitol is secured 24 hours a day by security barriers
and the USCP occupy various posts throughout the grounds. Restrictions
around the U.S. Capitol include permanent and temporary security
barriers and posts manned by USCP. USCP officers wear uniforms with
clearly marked police patches, insignia, badges, and other law
enforcement equipment. Only authorized people with appropriate
identification are allowed access inside the U.S. Capitol. On January 6,
2021, the exterior plaza of the U.S. Capitol was closed to members of the
public.
The January 6, 2021 joint session began at approximately 1:00
p.m. Shortly thereafter, by approximately 1:30 p.m., the House and
Senate adjourned to separate chambers to resolve a particular objection.
Vice President Michael Pence was present and presiding, first in the joint
session, and then in the Senate chamber.
As the proceedings continued in both the House and the Senate,
and with Pence present and presiding over the Senate, a large crowd
gathered outside the U.S. Capitol. Temporary and permanent barricades
were in place around the exterior of the U.S. Capitol Building and USCP
were present, attempting to keep the crowd away from the Capitol
Building and the proceedings underway inside. As the certification
proceedings were underway, the exterior doors and windows of the
Capitol were locked or otherwise secured.
At approximately 2:00 p.m., certain individuals in the crowd
forced their way through, up, and over the barricades, and past officers

21
Telegram Channel @nettrain
of the USCP. The crowd advanced to the exterior façade of the building.
The crowd was not lawfully authorized to enter or remain in the building
and, prior to entering the building, no members of the crowd submitted
to security screenings or weapons checks by the USCP or other
authorized security officials.
A short time later, at approximately 2:20 p.m., members of the
U.S. House of Representatives and U.S. Senate, including the President
of the Senate, Vice President Pence, were instructed to - and did -
evacuate the chambers. All proceedings of the U.S. Congress, including
the joint session, were effectively suspended.
After the Capitol was breached, USCP requested assistance from
the Washington, D.C. Metropolitan Police Department (“MPD”) and
other law enforcement agencies in the area to protect the Capitol, keep
more people from entering the Capitol, and expel the crowd that was
inside the Capitol. Multiple MPD officers and other law enforcement
officers came to assist.
In light of the dangerous circumstances, including the danger
posed by individuals who had entered the U.S. Capitol without any
security screening or weapons check, Congressional proceedings could
not resume until the building had been confirmed secured, which would
only occur after every unauthorized occupant had left the U.S. Capitol.
The building had been declared secure hours later, and the congressional
election proceedings resumed at approximately 8:00 p.m.
During national news coverage of the protests and riots, video
footage, which appeared to be captured on mobile devices of people
present on the scene, depicted evidence of violations of local and federal
law, including scores of individuals inside the U.S. Capitol Building
without authority to be there.[11]
In an effort to identify individuals who had entered the Capitol
unlawfully on January 6, 2021, the FBI, MPD, and USCP sought the
public’s assistance in identifying individuals who unlawfully entered the
restricted grounds and building of the Capitol. As a result, thousands of
tips were received in the week following the January 6 incident.[12]

22
Telegram Channel @nettrain
 At the time of this book’s writing, 257 individuals have been
charged in federal court for their involvement in the Capitol riots.
According to research by George Washington University’s Program on
Extremism, the rioters represent a heterogeneous group, with individuals
as young as 18 and as old as 70 charged. They came to the Capitol from
40 states, and 91% traveled from outside the Washington, D.C.
metropolitan area. 33 individuals have known military backgrounds.
Some face as many as 17 counts on their indictment, and charges range
from trespassing and illegal entry on designated grounds to conspiracy
against the U.S. government.

Who was at the Capitol?

George Washington University categorized individuals into three
distinct groups: militant networks, organized clusters, and inspired
believers.

Military Networks
“The first category — militant networks — represents the apex
of organizational planning by domestic violent extremist groups for and
on January 6th. Militant networks at the Capitol were characterized by
hierarchical organization and chains of command. Leaders of established
domestic violent extremist groups issued orders or directives to members

23
Telegram Channel @nettrain
of their groups, encouraging them to travel to Washington in advance of
the siege. Individual group members answered the call, contacting one
another to coordinate logistics, methods, and plans of action in the weeks
before January 6th. Unlike individuals in the other categories, not only
did these militant networks plan to attend protests on the 6th, but they are
also alleged to have planned in advance to breach the Capitol and, in
many cases, conduct violence inside the walls of the building.”

Organized Clusters
“The second category — organized clusters — are composed of
small, close-knit groups of individuals who allegedly participated in the
siege together, usually comprising family members, friends, and
acquaintances. Inspired by ideological fervor, organized clusters lacked
top-down direction from a domestic violent extremist organization but
jointly coordinated their travel to D.C. in groups of likeminded believers.
Many in organized clusters did not arrive in Washington with the same
level of advanced planning to breach the Capitol or conduct violence as
established militant networks”.

Inspired Believers
“Finally, the remainder of the alleged siege participants can be
categorized as inspired believers. These individuals, according to
available evidence, were neither participants in an established violent
extremist group nor connected to any of the other individuals who are
alleged to have stormed the Capitol. They arranged their own travel,
accommodations, and other logistics to join the crowds in Washington
from areas throughout the United States. Inspired by a range of extremist
narratives, conspiracy theories, and personal motivations, individual
believers made up a significant portion of the crowd at the Capitol.”[13]

24
Telegram Channel @nettrain
Minute-by-Minute Timeline of Significant Events
The following minute-by-minute timeline of events from
January 6, 2021 was compiled from multiple news sources, including C-
Span, FactCheck, Boston Globe, CNN, Al Jazeera, and the BBC.[14],[15],
[16] ,[17] ,[18] ,[19]

Time Status
12:08 Just part midnight, Trump posted his first tweet of
a.m. Wednesday, January 6, 2021 at 12:08 a.m.
Twitter attached a notice on Trump’s post stating,
“This claim about election fraud is disputed.”

12:08 a.m. EST (5:08 a.m. UTC), January 6, 2021

9:00 a.m. By morning, Trump was increasing his claims of
vote fraud numbers, tweeting, “They just
happened to find 50,000 ballots late last night. The
USA is embarrassed by fools. Our Election
Process is worse than that of third world
countries!”

10:50 At the "Save America" rally at the Ellipse, a park

a.m. near the White House, Trump’s personal lawyer
and exceptionally vocal promotor of the Big Lie,
Rudolph Giuliani, tells the gathering crowd:
"Over the next 10 days, we get to see the machines
that are crooked, the ballots that are fraudulent,
and if we’re wrong, we will be made fools of. But
if we’re right, a lot of them will go to jail. Let’s
have trial by combat. I’m willing to stake my
reputation, the President is willing to stake his
reputation, on the fact that we’re going to find
criminality there."
10:58 Members of the Proud Boy movement, a right-

25
Telegram Channel @nettrain
 a.m. wing militia, are seen heading toward the Capitol.
Speaking to BBC Newsnight's US correspondent
David Grossman, one member of the group says:
"We're taking our country back." One [person in]
the group has a radio. "It was clear he was
communicating - getting messages, sending
messages to somebody," the BBC correspondent
said.
12:00 Trump begins his speech at the “Save America”
p.m. rally. Approximately 15 minutes into his talk, he
starts urging the audience to converge on the
Capitol. "I know that everyone here will soon be
marching over to the Capitol building to
peacefully and patriotically make your voices
heard," he said.
12:00 During his speech, Trump uses the word
p.m. "peacefully" one time. He uses the word "fight" 21
onward times.
Trump also says, “Now, it is up to Congress to
confront this egregious assault on our democracy.
And after this, we’re going to walk down, and I’ll
be there with you, we’re going to walk down,
we’re going to walk down. Anyone you want, but I
think right here, we’re going to walk down to the
Capitol, and we’re going to cheer on our brave
senators and congressmen and women, and we’re
probably not going to be cheering so much for
some of them.
“Because you’ll never take back our country with
weakness. You have to show strength and you
have to be strong. We have come to demand that
Congress do the right thing and only count the
electors who have been lawfully slated, lawfully
slated.”
12:40 The first protesters arrive at the Capitol, where
p.m. Congress is meeting in joint session to certify Joe
Biden's election.
12:53 As the president continues speaking, a crowd

26
Telegram Channel @nettrain
 p.m. outside the Capitol is swelling. They begin
marching toward the police barrier and get past
officers. The police, outnumbered, try to contain
them.
1:00 p.m. Trump begins to wrap up his speech. He tells
rallygoers the presidential election was "stolen" by
Democrats and the "fake news media," and says
that he's going to walk with the crowd to the
Capitol "to try and give our Republicans, the weak
ones … the kind of pride and boldness that they
need to take back our country."
Around At the Capitol, a Capitol Police officer calls for
1:10 p.m. backup. "They're throwing metal poles at us," he
says. "Multiple law-enforcement injuries," he adds
in a panicked voice. Capitol Police send an
evacuation warning.
At the Save America rally at the Ellipse, Trump
nears the end of his speech and urges the crowd,
“And we fight. We fight like hell. And if you don’t
fight like hell, you’re not going to have a country
anymore. Our exciting adventures and boldest
endeavors have not yet begun. My fellow
Americans, for our movement, for our children,
and for our beloved country.
“And I say this despite all that’s happened. The
best is yet to come.
“So we’re going to, we’re going to walk down
Pennsylvania Avenue. I love Pennsylvania
Avenue. And we’re going to the Capitol, and we’re
going to try and give.
“The Democrats are hopeless, they never vote for
anything. Not even one vote. But we’re going to
try and give our Republicans, the weak ones
because the strong ones don’t need any of our
help. We’re going to try and give them the kind of
pride and boldness that they need to take back our
country. So let’s walk down Pennsylvania Avenue.

27
Telegram Channel @nettrain
 Thousands of people were in attendance at the
rally, and many walked over to the U.S. Capitol to
protest the electoral vote procedures as directed by
Trump.
Trump does not accompany the rally attendees to
the Capitol.
1:19 p.m. Trump arrives back at the White House
1:26 p.m. Capitol Police order evacuation of Capitol
complex.
1:45 p.m. Protesters surge past Capitol police protecting the
west steps, the side facing the White House.
1:45 p.m. An officer declares there is a riot at the Capitol.
"We're going to give riot warnings," he says.
"We're going to try to get compliance but this is
now effectively a riot."
1:45 p.m. Meanwhile Vice President Mike Pence continues
to preside over the session. The Senate and House
convene separately to debate objections by
Arizona to the Electoral College views.
2:13 p.m. Protesters break through the Capitol building
windows. They push inside and pass through the
broken glass. They then kick open the doors to let
others in. Some wear hoods and helmets.
The Secret Service quickly and suddenly evacuate
Pence from the Senate floor. An immediate recess
of the Senate is called.
2:14 p.m. Officer Eugene Goodman runs to respond to the
initial breach. He warns Senator Mitt Romney that
the mob is approaching. Romney turns and runs
through a Capitol hallway to safety. The mob, a
floor below them, has already begun to search for
the Senate chamber. Officer Goodman makes his
way down to the first floor where he encounters
the mob. Officer Goodman lures the armed rioters
away from the upper chamber. Many of these
individuals have been calling for Vice President
Pence to be hanged.

28
Telegram Channel @nettrain
 By that point, the rioters are "within 100 feet" of
Pence and a foot away from one of the doors to the
chamber. Many senators are still inside. The
Senate adjourns and a live microphone picks up an
aide telling Sen. James Lankford (R-OK) that
there were protesters in the building.
Speaker of the House Nancy Pelosi is rushed from
the house floor. She is evacuated entirely from the
Capitol complex to a secure off-site location. Her
staff barricade themselves into a conference room,
hiding under a table. Staff members of the House
leader speak softly, frantically, to each other. Just
outside, rioters are spreading out across the
building, searching for Pelosi herself. The rioters
chant: "Where are you Nancy?" In an audio clip,
one staff member is heard whispering: "They're
pounding on doors trying to find her." One man
breaks open the outer door to the office where the
staff are hiding, but not the inner door. Another
tries as well, but eventually moves on.
2:15 p.m. Capitol police send alert to congressional staff that
no entry or exit is allowed at Capitol buildings
amid an "external security threat."
2:19 p.m. The House and Senate begin evacuation.
2:24 p.m. Rioters start to spread through the buildings.
Others break in from outside through various
doors around the building. They open the east side
door of the rotunda to let more people in, flooding
through the doors and overwhelming the officers.
"Folks have entered the rotunda and are coming
this way," lawmakers are told. The House floor
debate is suspended to update members. House
members are told to reach for tear gas masks and
be prepared to use them. The House is called back
into session in the hope of continuing the count.
But minutes later the House is abruptly recessed.
Members are told to get down under their chairs if
necessary.

29
Telegram Channel @nettrain
 The mob outside the chamber grows larger and
they get within feet of the house door.
Democratic Congressman Eric Swalwell sends a
text to his wife: "I love you and the babies. Please
hug them for me".
Meanwhile, from the White House Trump tweets,
“Mike Pence didn’t have the courage to do what
should have been done to protect our Country and
our Constitution, giving States a chance to certify
a corrected set of facts, not the fraudulent or
inaccurate ones which they were asked to
previously certify. USA demands the truth!”

2:24 p.m. EST (7:24 p.m. UCT), January 6, 2021

2:41 p.m. People still inside the gallery of the chamber are
trapped. They tell each other to take off their
congressional pins. In the meantime, a number of
rioters reach the inside of the Senate gallery.
House Rules Committee Chairman James
McGovern is spotted by the mob as he leaves the
House floor.
Ashli Babbitt, a rioter, is seen turning the corner
toward the House lobby doors as members are
leaving.
"Is this the Senate?" one demands to know.
"Where are they?" another asks, apparently
referring to the evacuated senators. Video footage
shows some rioters rifling through papers and
materials left behind by lawmakers. "There's got to
be something we can use against these scumbags,"
one says.

30
Telegram Channel @nettrain
 In a hallway outside the House chamber, a group
attempts to force its way through a set of locked
doors. The glass window panes on the doors are
shattered. A rioter uses a baton to smash through
as the crowd around him chants "break it down,
break it down".
Footage shows the hands of an officer on the other
side, holding a gun and pointing it toward the mob.
We hear a shot and see Babbitt fall to the ground.
3:13 p.m. Footage shows a sprawling mob, a sea of people
on the Capitol grounds. A Confederate flag waves
in the foreground.
Trump tweets asking for people to "remain
peaceful".
4:00 p.m. President-elect Biden calls the men and women
who invaded the Capitol a "mob" of "extremists."
Biden calls on Trump to immediately deliver a
speech to "demand an end to this siege" at the U.S.
Capitol.
4:17 p.m. Trump releases a video on social media in which
he states, in part, "We had an election that was
stolen from us. It was a landslide election and
everyone knows it, especially the other side, but
you have to go home now. We have to have peace.
We have to have law and order. … We love you.
You're very special. You've seen what happens.
You see the way others are treated that are so bad
and so evil. I know how you feel. But go home and
go home in peace."
Twitter places a disclaimer on Trump’s video
stating, “This claim of election fraud is disputed,
and this Tweet can’t be replied to, Retweeted, or
liked due to a risk of violence.”

31
Telegram Channel @nettrain
 4:17 p.m. EST (9:17 p.m. UTC), January 6, 2021

40 p.m. The first National Guard personnel arrive at the

Capitol. By then, most of the violence had ended.
5:50 p.m. After the violent mob of Trump supporters occupy
the building for four hours, they are expelled.
6:00 p.m. A citywide curfew goes into effect.
6:01 p.m. Trump tweets, "These are the things and events
that happen when a sacred landslide election
victory is so unceremoniously & viciously stripped
away from great patriots who have been badly &
unfairly treated for so long. Go home with love &
in peace. Remember this day forever!" Trump
appears to excuse the actions of the mob. Twitter
quickly removes the tweet.
6:14 p.m. Capitol Police, Metropolitan Police and the D.C.
National Guard "successfully establish perimeter
on the west side of the U.S. Capitol," the Pentagon
timeline states.
7:02 p.m. Twitter suspends Trump's account for the next 12
hours. "As a result of the unprecedented and
ongoing violent situation in Washington, D.C., we
have required the removal of three
@realDonaldTrump Tweets that were posted
earlier today for repeated and severe violations of
our Civic Integrity policy," Twitter announced.
8:00 p.m. USCP declares Capitol building secure.

32
Telegram Channel @nettrain
 8:06 p.m. Vice President Mike Pence reopens the Senate.
"The Capitol is secured and the people's work
continues," Pence says. "To those who wreaked
havoc in our Capitol today, you did not win.
Violence never wins. Freedom wins, and this is
still the people's house." Pelosi brings the House
back into session less than an hour later.
By the end of the day, 5 people have been killed
Thursday, Early the next morning, Pence officially affirmed
January the election results and that Joseph R. Biden won
7, 2021, the Presidency of the United States.
3:40 a.m.

In the immediate aftermath of January 6, 2021, five people were

killed in the assault on the U.S. Capitol – one police officer and four
protestors.
Capitol Police Officer Brian Sicknick, 42 years old, died the
following day after he was overpowered and beaten by rioters from the
violent mob at the Capitol.
Ashli Babbitt, 35, was shot by Capitol Police while forcing her
way through a broken window toward the Speaker’s Lobby inside the
Capitol.
Roseanne Boyland, 34, appears to have been killed in a crush of
fellow rioters during their attempt to fight through a police line.
Kevin D. Greeson, 55, suffered a heart attack while with a
throng of fellow Trump supporters at the Capitol.
Benjamin Philips, 50, according to fellow protestors, died of a
stroke while at the Capitol.[20]

33
Telegram Channel @nettrain
 34
Telegram Channel @nettrain
 Chapter 3 - A Note on Definitions and
Approach

Definitions matter. To ensure discussions, debates, arguments,

and – most importantly – laws and justice are applied equally and
equitably for all people, clarifying what exactly someone, something, or
some action is or is not is crucial both for the immediate situation at hand
as well as for consistency in the future.
To provide consistent framework around the events of January 6,
2021, the distinction between an act of terrorism, a riot, and a protest is
clarified below. A deeper discussion of key terms and definitions,
including the FBI’s and Department of Homeland Security’s definitions
of “domestic terrorism” is provided in the Appendix in “A Primer on
Key Terms and Definitions”.

Act of Terrorism
An act of terrorism is the use of force or violence and/or the threat
thereof, by any person or group(s) of persons, whether acting
alone or on behalf of or in connection with any organization(s) or
government(s), committed for political, religious, ideological or
similar purposes including the intention to influence any
government and/or to put the public, or any section of the public,
in fear.[21]

Riot
A riot is defined as:
1. technically a turbulent and violent disturbance of peace by
three or more people acting together, or
2. an assemblage of people who are out of control, causing injury
or endangering the physical safety of others and/or themselves,
causing or threatening damage to property and often violating
various laws both individually and as a group. The common
thread is that the people in a riot have the power through

35
Telegram Channel @nettrain
 violence to break the public peace and safety, requiring police
action. Often a riot is declared after the crowd has been
informed by police officers that the people constitute an
"unlawful assembly" and are ordered to "disperse" immediately
(historically in England called "reading the riot act"). If the
crowd does not disperse, its members become subject to arrest
for the crime of rioting, disturbing the peace, resisting arrest or
other separate crimes ranging from assault to unlawful
possession of firearms.[22]
Protest
A protest is defined as a way to complain in some public way
about any act already done or about to be done, such as adoption
of a regulation by a county board, sending troops overseas, or use
of the death penalty.[23]

Right to Peaceably Assemble and Protest

The 1st Amendment of the U.S. Constitution states:
“Congress shall make no law respecting an establishment of
religion, or prohibiting the free exercise thereof, or abridging the
freedom of speech, or of the press, or the right of the people peaceably to
assemble, and to petition the Government for a redress of grievances.”[24]
According to a November 2020, FBI memo titled, “Domestic
Terrorism: Definitions, Terminology, and Methodology” (which is
discussed in the Appendix under “A Primer on Key Terms and
Definitions”) the FBI states:
“Under FBI policy and federal law, no investigative activity may
be based solely on 1st Amendment activity. The FBI does not
investigate, collect, or maintain information on US persons solely
for the purpose of monitoring activities protected by the 1st
Amendment. All personnel should exercise sound judgment and
discretion in evaluating the totality of circumstances surrounding
any of these indicators in order to determine whether a law
enforcement or intelligence response or activity is warranted.”[25]
Innocent Until Proven Guilty
The 6th Amendment of the Constitution guarantees an individual
the right to a fair, speedy, and public trial. The 6th Amendment also
enables an individual to have legal assistance, regardless of the charge,

36
Telegram Channel @nettrain
and the right to confront adverse witnesses and notice of accusations.
These rights are given to all men or women under trial for any sort of
wrongdoing. Importantly, it established the mantra “an individual is
innocent until proven guilty” that is present in the United States legal
system.[26]

37
Telegram Channel @nettrain
 38
Telegram Channel @nettrain
 Chapter 4 ‒ Broadcasting the “revolution”

The breaking news attack on the Capitol was broadcast both live
and repeatedly on major news networks on television, streaming services
and online. Countless photos and videos were captured by journalists and
observers documenting the events from all angles. Furthermore,
thousands of rally attendees, marchers, protestors, and domestic terrorists
shared their own photos, videos, selfies, and messages during the weeks,
days and hours building up to the rally, during the attack, and afterwards.
A March 2021 report by George Washington University’s
Program on Extremism reviewed the first 257 individuals charged in
federal court. The charging papers for 83 percent of those cases
contained some form of evidence from social media linking them to the
Capitol.
More specifically, of the 257 initial defendants charged:
120 people (47 percent) are alleged to have posted evidence
on their personal social media accounts;
76 people (30 percent) have been possibly incriminated by
evidence on the social media accounts of their friends and
others in their social networks; and
18 people (7 percent) are alleged to have both posted on
their personal accounts and possibly incriminated by their
friends and others.
According to George Washington, analysis of available records
suggests that the social media evidence against the Capitol Hill
extremists came in three forms:
15 percent publicly indicated their intent prior to storming
the Capitol;
68 percent documented their alleged crimes in real-time at
the Capitol; and
25 percent commented on social media about the events that
took place in the days and weeks that followed
Some individuals’ records included evidence from a
combination of two or all three of these time periods.”[27]

39
Telegram Channel @nettrain
 40
Telegram Channel @nettrain
 41
Telegram Channel @nettrain
 42
Telegram Channel @nettrain
 43
Telegram Channel @nettrain
 44
Telegram Channel @nettrain
 45
Telegram Channel @nettrain
 46
Telegram Channel @nettrain
Making the Riot a Pay-Per-View Event
According to the Southern Poverty Law Center, which monitors
and reports on white supremacy, at least five DLive accounts
livestreamed the protest, including accounts called “Baked Alaska,”
“Gloomtube,” “Loulz,” Murder the Media,” and “Woozuh.”[28]
DLive is a video-streaming platform that uses a cryptocurrency-
based donation format, which allows a channel’s followers and
supporters to make anonymous donations. The company describes itself
as “the largest live streaming platform on the blockchain.”[29] DLive
takes 25% from every donation, keeping 20% for itself and redistributing
the remaining 5% to other DLive users in a system called "staking."
“Baked Alaska” is the username for white nationalist Tim
Gionet. According to a Jan. 8, 2021 New York Times article, “Gionet
made over $2,000 while live-streaming the attack. Through DLive, his
fans then sent him messages telling him where to go to avoid capture by
the police. They also tipped him with “lemons,” a DLive currency that
can be converted into real money, through which Mr. Gionet made more
than $2,000 on Wednesday.”[30]

White nationalist Tim Gionet, who goes by the name Baked Alaska,
livestreamed on DLive during the Capitol Riots.

47
Telegram Channel @nettrain
 Alternative social networking sites such as Rumble, Gab, Parler,
and DLive had grown in users and gained momentum among the far-
right community since the November 2020 election. The growth of these
platforms was further boosted after mainstream platforms including
Twitter, Facebook, Snapchat, Instagram, and Twitch restricted Trump’s
accounts for inciting the Capitol riots, as well as others restricting other
right-wing personalities on their platforms.[31]
The day after the Capitol riots, DLive stated, “…we have
suspended 3 accounts, forced offline 5 channels, banned 2 accounts from
live streaming and permanently removed over 100 past broadcasts from
our platform. The DLive team actively are taking actions regarding
streamers who are found to be part of or participants in the incident at the
Capitol Building in Washington, D.C. on January 6th including but not
limited to account suspension, removal of past broadcasts, freezing their
earnings and abilities to cash out. The donation and paid subscriptions
will be refunded to the accounts from which they originated.”[32]
The BakedAlaska channel (which had about 16,340 followers)
was one of those suspended.

According to a February 8, 2021, Forbes magazine article, in a

review of the charging documents issued by law enforcement for 223
individuals involved in the Capitol riots, 73 of those cases reference
Facebook, 24 reference YouTube, 20 reference Instagram, and eight
reference Parler.[33]

48
Telegram Channel @nettrain
 Chapter 5 ‒ FBI Calls on the Public for Help

That’s Capitol with an O

Wednesday, January 6, 2021

Capitol Police estimate that more than 10,000 Trump supporters
went onto the Capitol grounds, about 800 of whom entered the building.
[34]

Thursday, January 7, 2021

The day following the riots, FBI Director Christopher Wray
issued the following statement:
“The violence and destruction of property at the U.S. Capitol
building yesterday showed a blatant and appalling disregard for our
institutions of government and the orderly administration of the
democratic process. As we’ve said consistently, we do not tolerate
violent agitators and extremists who use the guise of 1st Amendment-
protected activity to incite violence and wreak havoc. Such behavior
betrays the values of our democracy. Make no mistake: With our
partners, we will hold accountable those who participated in yesterday’s
siege of the Capitol.
“Let me assure the American people the FBI has deployed our
full investigative resources and is working closely with our federal, state,
and local partners to aggressively pursue those involved in criminal
activity during the events of January 6. Our agents and analysts have
been hard at work through the night gathering evidence, sharing
intelligence, and working with federal prosecutors to bring charges.
Members of the public can help by providing tips, information, and
videos of illegal activity at fbi.gov/USCapitol. We are determined to find
those responsible and ensure justice is served.”[35]
Friday, January 8, 2021
On January 8th, FBI Washington Field Office Assistant Director
in Charge Steven M. D’Antuono stated on a press call:

49
Telegram Channel @nettrain
 “In the midst of the crisis, the FBI deployed hundreds of people,
to include special agents, bomb technicians, Evidence Response Teams,
tactical and specialty teams, and intelligence analysts, to name just a few.
Immediately following Wednesday’s events, the full force of WFO [the
FBI Washington Field Office] and all 56 field offices have been
dedicated to investigating the events that transpired on the 6th.
We are combing through tips we have received from the public
and will move forward any appropriate investigative activity that will
bring those responsible to justice. We have been in constant
communication with our, state, federal, and local partners across the
country to thoroughly and quickly identify, investigate, and locate those
who wreaked havoc and caused damaged to the Capitol—a symbol of
our democracy and freedom….
“We will continue to investigate all allegations of criminal
activity and work with our partners at DOJ [Department of Justice] and
the D.C. USAO [United States Attorney’s Office for the District of
Columbia] to bring charges and prosecute those responsible for the
horrific activity that happened here in our nation’s capital.
“Just because you’ve left the D.C. region, you can still expect a
knock on the door if we find out that you were part of criminal activity
inside the Capitol. Bottom line—the FBI is not sparing any resources in
this investigation.”[36]

Be on the Lookout
Shortly following the riots, the FBI published numerous
“Seeking Information” posters, often called “Be on the Lookout” or
“BOLO” posters with photographs of individuals recorded participating
in the Capitol unrest. On the FBI’s website, unidentified suspects’ photos
were tagged simply with a number such as “Photograph #10.” If multiple
photos of a suspect were released, the FBI labeled the images as, for
example, “Photograph #14 A,” “Photograph #14 B,” and so on.
Individuals who assaulted federal law enforcement personnel
were denoted with “AFO” for “Assault on a Federal Officer,” such as
“Photograph #171 – AFO.”
Individuals who targeted members of the media for assault,
threats, destruction of property, and other unlawful conduct were tagged
“AOM” for “Assault on Media,” such as “Photograph #227 – AOM.”

50
Telegram Channel @nettrain
 The BOLO posters stated, “The FBI is seeking the public’s
assistance in identifying individuals who made unlawful entry into the
U.S. Capitol building and committed various other alleged criminal
violations, such as destruction of property, assaulting law enforcement
personnel, targeting members of the media for assault, and other
unlawful conduct, on January 6, 2021, in Washington, D.C.
“We have deployed our full investigative resources and are
working closely with our federal, state, and local partners to aggressively
pursue those involved in these criminal activities.
“If you have witnessed unlawful violent action—or have any
information about the cases below—we urge you to contact us.
“You can call 1-800-CALL-FBI (1-800-225-5324) to verbally
report tips and/or information related to this investigation, or submit a tip
online at tips.fbi.gov.”[37]

Several of the Be on the Lookout / Seeking Information posters

are below, which illustrate, in part, the massive scale of the investigation
taking place to identify domestic terrorists and rioters who stormed the
U.S. Capitol on January 6, 2021.

51
Telegram Channel @nettrain
 52
Telegram Channel @nettrain
 53
Telegram Channel @nettrain
 54
Telegram Channel @nettrain
 55
Telegram Channel @nettrain
 56
Telegram Channel @nettrain
 57
Telegram Channel @nettrain
 58
Telegram Channel @nettrain
 59
Telegram Channel @nettrain
 60
Telegram Channel @nettrain
 61
Telegram Channel @nettrain
Tuesday, January 12, 2021
On January 12, 2021, FBI Assistant Director in Charge
D’Antuono provided an updated statement to the press:
“…Since our call for tips, videos, and pictures, we have received
more than 100,000 pieces of digital media—which is absolutely fantastic
—and are scouring every one for investigative and intelligence leads. We
continue to ask for more. If you have information, contact 1-800-CALL-
FBI or submit photos and videos to fbi.gov/USCapitol—that’s Capitol
with an O.
“In the weeks leading up to the January 6 rally, the FBI worked
internally with every FBI field office to ensure they were looking for any
intelligence they may have developed about potential violence during the
rally on January 6. We developed some intelligence that a number of
individuals were planning to travel to the D.C. area with intentions to
cause violence.
“We immediately shared that information and action was taken,
as demonstrated by the arrest of [Proud Boys leader] Enrique Tarrio by
the Metropolitan Police Department the night before the rally. Other
individuals were identified in other parts of the country and their travel
subsequently disrupted.
“The FBI receives enormous amounts of information and
intelligence, and our job is to determine the credibility and viability of it,
under the laws and policies that govern FBI investigations. We have to
separate the aspirational from the intentional and determine which of the
individuals saying despicable things on the internet are just practicing
keyboard bravado or they actually have the intent to do harm. If the
latter, we work diligently to identify them and prevent them from doing
so.
“As offensive as a statement can be, the FBI cannot open an
investigation without a threat of violence or alleged criminal activity.
However, when that language does turn to a call for violence or criminal
activity, the FBI is able to undertake investigative action.
“Part and parcel of our investigation into violent actors is the
fact we continue to gather intelligence that will aid in our ability to
disrupt possible future violent activity.”[38]

Friday, January 15, 2021

62
Telegram Channel @nettrain
 On a January 15, 2021 press call, D’Antuono said, “To date,
we’ve identified more than 270 suspects involved in criminal activity in
and around the Capitol. The FBI has arrested more than 40 subjects, and
—with the help of our partners around the country—more than 100
individuals have been taken into custody. We are methodically following
all the leads to identify those responsible and hold them accountable.
“The American people have played a critical role in assisting us
with these efforts. In the past week alone, we’ve received nearly 140,000
photos and videos from the public.
“To those of you who took part in the violence, here’s something
you should know: Every FBI field office in the country is looking for
you. As a matter of fact, even your friends and family are tipping us off.
So you might want to consider turning yourself in instead of wondering
when we’re going to come knocking on your door—because we will.
“Your tips are helping us investigate people on a variety of
federal charges. Today, I want to focus on a particularly egregious charge
—assault on a law enforcement officer….
“Yesterday, we arrested the first subjects on these charges. One
is Peter Stager of Arkansas, who was captured on video using an
American flag—the symbol of our democracy—to repeatedly strike a
D.C. Metropolitan Police officer after he was dragged down the Capitol
steps and forced into a prone position by a large group of rioters.
“Also arrested yesterday is Robert Sanford, a retired
Pennsylvania firefighter, who is alleged to have struck three U.S. Capitol
Police officers with a fire extinguisher.
“These are just two examples of the brutal assaults on law
enforcement last week. We are working with the Metropolitan Police
Department and U.S. Capitol Police to identify and investigate all of
these and other violent attacks on those who were doing their duty to
protect the very symbol of our democracy, the U.S. Capitol.[39]
[Case studies of the open source investigation methods used to
identify both Stager and Sanford are discussed in Chapter 11 – Knock
Knock.]
D’Antuono continued to state, “You’ve all seen the Wanted
posters we’ve been plastering everywhere, from digital billboards on
America’s highways to bus shelters in D.C. to your social media feed.
But I wanted to tell you what you haven’t seen. Behind the walls of
every FBI field office throughout the country are scores of dedicated

63
Telegram Channel @nettrain
agents, analysts, and other specialized personnel, who are working with
our law enforcement partners. They are chasing down leads, reviewing
evidence, and combing through digital media to identify, charge, and
arrest anyone who was behind the siege we all saw on the sixth.
“Now, one question being asked is: Who are we looking for?
Not only are we focused on finding those who breached the Capitol,
damaged the building, or stole government property but we are also
looking to find those who violently assaulted the law enforcement
officers who were trying to protect the Capitol and prevent the disruption
of our democratic process.
“As part of this investigation, we are also continuing to try to
identify and arrest the person (or persons) responsible for placing pipe
bombs outside the offices of the Democratic and Republican National
Committees. Together with ATF, we are offering a $75,000 reward for
information leading to the identification, arrest, and prosecution of the
perpetrator or perpetrators….
[On March 9, 2021, with the pipe bomb suspect still
unidentified, the FBI increased the reward to $100,000. The search for
the pipe bomb suspect is discussed further in Chapter 7 – The Hunt for
the Capitol Pipe Bomber]
“Spurred by the public outrage and disgust at what occurred on
January 6, we have seen an outpouring of tips and information from
citizens around the country that has been nothing short of remarkable.
We received more than 200,000 digital media tips from the public. Some
of you have recognized that this was such an egregious incident that you
have turned in your own friends and family members. We know that
those decisions are often painful—but you picked up the phone because
it was the right thing to do….
“With your assistance, we have identified more than 400
suspects in the breach of the Capitol and assault on law enforcement
officers. Of those, the FBI has arrested approximately 135 to date, with
many more being identified and charged every day….
“What happened at the Capitol on January 6 has not occurred in
over 200 years. We owe it to the American people to find out how and
why it did.”[40]

64
Telegram Channel @nettrain
Chapter 6 - FBI Capabilities and Resources

Biometric Modalities
Commonly implemented or studied biometric categories (also
known as “modalities”) include fingerprint, face, iris, voice, handwriting
recognition, and hand geometry. Many other modalities are in various
stages of development and assessment. There is not one biometric
modality that is best for all implementations, and many factors must be
taken into account when implementing a biometric device, including
location, security risks, task (identification or verification), expected
number of users, user circumstances, and existing data, among others. It
is also important to note that biometric modalities are in varying stages
of maturity.
The following is a brief overview of the different types of
biometric analysis that can be used to identify an individual.

Facial Recognition
Early facial recognition algorithms used simple geometric
models, but the recognition process has now matured into a science of
sophisticated mathematical representations and matching processes.
There are two predominant approaches to the facial recognition problem:
geometric (feature based) and photometric (view based).

Voice Recognition
Speaker, or voice, recognition is a biometric modality that uses
an individual’s voice for recognition purposes. It is a different
technology than “speech recognition,” which recognizes words as they
are articulated, which is not a biometric. The speaker recognition process
relies on features influenced by both the physical structure of an
individual’s vocal tract and the individual’s behavioral characteristics.
The physiological component of voice recognition is related to the
physical shape of an individual’s vocal tract, which consists of an airway
and the soft tissue cavities from which vocal sounds originate.

65
Telegram Channel @nettrain
Iris Scan
Iris recognition analyzes the random pattern of the iris to
recognize an individual. The iris is a muscle within the eye that regulates
the size of the pupil, controlling the amount of light that enters the eye. It
is the colored portion of the eye, and the coloring is based on the amount
of melatonin pigment within the muscle. Although the coloration and
structure of the iris are genetically linked, the pattern details are not. The
iris develops during prenatal growth through a process of tight forming
and folding of the tissue membrane. Prior to birth, degeneration occurs,
resulting in the pupil opening and the iris forming random, unique
patterns. Although genetically identical, an individual’s irises are unique
and structurally distinct, which allows for them to be used for
recognition purposes.

Retina Recognition
While iris recognition uses the iris muscle to perform
verification, retinal recognition uses the unique pattern of blood vessels
on an individual’s retina at the back of the eye.

Fingerprint
Fingerprint identification is one of the most well-known and
publicized biometrics. Because of their uniqueness and consistency over
time, fingerprints have been used for identification for more than a
century. Fingerprint identification is popular because of the inherent ease
in acquisition, the numerous sources (10 fingers) available for collection,
and their established use and collections by law enforcement and
immigration. A fingerprint usually appears as a series of dark lines that
represent the high, peaking portion of the friction ridge skin, while the
valleys between these ridges appears as white space and are the low,
shallow portion of the friction ridge skin.

Palm Print
Palm print recognition uses many of the same matching
characteristics that have allowed fingerprint recognition to be one of the
most well-known and best publicized biometrics. Both palm and finger
biometrics are represented by the information presented in a friction
ridge impression. This information combines ridge flow, ridge

66
Telegram Channel @nettrain
characteristics, and ridge structure of the raised portion of the epidermis.
The data represented by these friction ridge impressions allows a
determination that corresponding areas of friction ridge impressions
either originated from the same source or could not have been made by
the same source.

DNA
Genes make up 5 percent of the human genome. The other 95
percent are non-coding sequences, which used to be called “junk DNA.”
In non-coding regions there are identical repeat sequences of DNA,
which can be repeated anywhere from one to 30 times in a row. These
regions are called variable number tandem repeats (“VNTRs”). The
number of tandem repeats at specific places, called loci, on
chromosomes varies between individuals. For any given VNTR loci in
an individual’s DNA, there will be a certain number of repeats. The
higher the number of loci that are analyzed, the smaller the probability of
finding two unrelated individuals with the same DNA profile. DNA
profiling determines the number of VNTR repeats at a number of
distinctive loci and uses it to create an individual’s DNA profile. The
main steps to create a DNA profile are: isolate the DNA from a sample
such as blood, saliva, hair, semen, or tissue, cut the DNA up into shorter
fragments containing known VNTR areas, sort the DNA fragments by
size, and compare the DNA fragments in different samples. The benefit
of using DNA as a biometric identifier is the level of accuracy offered:
the chance of two individuals sharing the same DNA profile is less than
one in 100 billion with 26 different bands studied.

Emerging Biometrics
The potential of newly emerging biometric technology allows
federal government agencies to increase their identity management
capabilities. The FBI is developing and enhancing other potential new
biometric technologies including footprint and hand geometry as well as
gait recognition.

67
Telegram Channel @nettrain
 68
Telegram Channel @nettrain
 69
Telegram Channel @nettrain
According to charging documents that have been filed against defendants, investigators
cross-referenced
driver’s license photos to confirm the identity of numerous suspects involved in the
Capitol riots.

70
Telegram Channel @nettrain
The FBI Biometric Center of Excellence
The FBI’s Biometric Center of Excellence (“BCOE”) is the
central program for advancing biometric capabilities for integration into
operations. Based in Clarksburg, West Virginia, the BCOE’s mission is
to foster collaboration, improve information sharing, and advance the
adoption of optimal biometric and identity management solutions within
and across the law enforcement and national security communities.
Specific BCOE activities in the area of biometrics and emerging
technologies include: sponsoring targeted applied research and
prototyping activities, facilitating the test and evaluation of emerging
technologies and systems, and helping develop standards.[41]
The BCOE is a collaborative initiative of three different FBI
divisions:
1. Operational Technology Division;
2. Criminal Justice Information Services Division; and
3. Laboratory Division.
A description of each division and their key capabilities related
to biometric identification is provided below.

Operational Technology Division

The Operational Technology Division (“OTD”), based in
Quantico, Virginia, develops and deploys technology-based solutions to
enable the FBI’s intelligence, national security, and law enforcement
operations. OTD is staffed with agents, engineers, electronic technicians,
forensic examiners, and analysts who support investigations and national
security operations with advanced electronic surveillance, digital
forensics, technical surveillance, tactical operations, and
communications capabilities.
Facial Recognition. OTD provides guidance and lead
information to support criminal and national security investigations and
courtroom testimony to domestic and international investigations. The
FBI performs video and image analysis of faces in its accredited digital
forensic laboratory, one of only a few in the world, for intelligence and
criminal investigative purposes and leads the way in pursuit of
automated facial biometric capabilities.

71
Telegram Channel @nettrain
 Voice Recognition. This program works to recognize
individuals by their voices to provide investigative guidance to FBI field
offices, as well as other local, state, federal, and international law
enforcement agencies. Realizing the potential of voice recognition, the
FBI has funded applied research and development projects for more than
a decade to achieve its long-term goal of automating voice biometric
capabilities.[42]

Criminal Justice Information Services Division

(Photo source: FBI)

The FBI’s Criminal Justice Information Services Division

(“CJIS”) provides advanced tools and services to law enforcement,
national security and intelligence community partners, and the general
public. Located on a 986-acre campus in Clarksburg, West Virginia, the
heart of the complex is the 500,000-square foot main office building
nearly the length of three football fields, with a 600-seat cafeteria and a
100,000-square-foot computer center.
Next Generation Identification (“NGI”). According to the
FBI, the Next Generation Identification system is the world's largest and
most efficient electronic repository of biometric and criminal history
information. The NGI system improved the efficiency and accuracy of
biometric services to address evolving local, state, tribal, federal,
national, and international criminal justice requirements. Enhanced
capabilities include a national background check service; fingerprint
verification services; more complete and accurate identity records; and
enhancements to the biometric identification repository. NGI’s
capabilities include Advanced Fingerprint Identification Technology,
Latent and Palm Prints records, an Interstate Photo System of over 30

72
Telegram Channel @nettrain
million criminal mug shot photos and other identifying information, and
the NGI Iris Service to identify individuals via their iris image.[43]

73
Telegram Channel @nettrain
Laboratory Division

(Photo source: FBI)

The FBI Laboratory is today one of the largest and most

comprehensive crime labs in the world. Operating out of a state-of-the-
art facility in Quantico, Virginia, the Lab’s scientific experts and special
agents travel the world on assignment, using science and technology to
support law enforcement, intelligence, military, and forensic science
partners.
Combined DNA Index System (“CODIS”). CODIS blends
forensic science and computer technology into a tool for linking violent
crimes, enabling federal, state, and local forensic laboratories to
exchange and compare DNA profiles electronically, linking serial violent
crimes to each other and to known offenders. The National Missing
Persons DNA Database also helps identify missing and unidentified
individuals. CODIS generates investigative leads in cases where
biological evidence is recovered from the crime scene. Matches made
among profiles in the Forensic Index can link crime scenes together,
possibly identifying serial offenders. Based upon a match, police from
multiple jurisdictions can coordinate their respective investigations and
share the leads they developed independently. Matches made between
the Forensic and Offender Indexes provide investigators with the identity
of suspected perpetrators.[44]

74
Telegram Channel @nettrain
 75
Telegram Channel @nettrain
 Chapter 7 – The Hunt for the Capitol Pipe
Bomber

The FBI’s Request for Public Assistance

76
Telegram Channel @nettrain
 Immediately after the Capitol riots, the FBI issued the above
BOLO poster seeking information on the individual suspected of placing
pipe bombs in the Capitol.
By March 9, 2021, however, more than two months after the
Capitol riots, the identity of the pipe bomb suspect (the “Suspect”) was
still unknown. That day, the FBI released additional information, photos,
and surveillance video of the Suspect.
According to the FBI, between 7:30 p.m. and 8:30 p.m. Eastern
Standard Time (EST) on January 5, 2021 (the day before the Capitol
riots), an unknown individual placed two pipe bombs in the Capitol Hill
neighborhood of Washington, D.C.
1. One pipe bomb was placed next to a park bench near the
Democratic National Committee (“DNC”) Headquarters,
located at 430 South Capitol Street Southeast, #3; and
2. The second bomb was placed in an alley behind the
Republican National Committee (“RNC”) Headquarters,
located at 310 First Street Southeast.
The unknown individual wore a face mask, a grey hooded
sweatshirt, and black and light grey Nike Air Max Speed Turf shoes with
a yellow logo. The individual carried a backpack in their hand.
Components of the devices include 1x8-inch threaded
galvanized pipes, a kitchen timer, and homemade black powder.
The FBI stated, “Identifying the person responsible for placing
these pipe bombs is a priority for the FBI’s Washington Field Office and
our partners at the Bureau of Alcohol, Tobacco, Firearms and
Explosives; U.S. Capitol Police; and D.C. Metropolitan Police
Department,” the FBI stated with the March 9, 2021 update.”[45]
FBI Assistant Director in Charge D’Antuono was quoted in the
press announcement stating, “We still believe there is someone out there
who has information they may not have realized was significant until
now. We know it can be a difficult decision to report information about
family or friends — but this is about protecting human life. These pipe
bombs were viable devices that could have been detonated, resulting in
serious injury or death. We need the public’s help to identify the
individual responsible for placing these pipe bombs to ensure they will
not harm themselves or anyone else.”

77
Telegram Channel @nettrain
 The FBI had previously released photos of the individual,
including the individual’s shoes, the devices, and the kitchen timers used,
in hopes that someone would recognize something familiar about them.
The FBI asked the public to watch the additional videos of the Suspect.
D’Antuono further elaborated, “You may recognize their gait,
body language, or mannerisms. We are asking the public to come
forward with any information that could assist us, including any odd or
out-of-character behavior you noticed in a family member, friend, or
coworker, leading up to or after January 5. Regarding the evening of
January 5, we are asking for information about an individual who you
may have observed matching this description in the vicinity of North
Carolina Avenue SE and Folger Park between 6:30 p.m. and 9:00 p.m.
This person may have entered a vehicle or taken an item from a vehicle
and placed it into the backpack.”[46]
Along with the release of new information, D’Antuono issued a
video message prompting the public to recall any potential suspects. He
stated:
“We are asking for you to come forward and speak to us about
any odd or out-of-character behaviors. You may have observed someone
exhibiting these behaviors leading up to January 5th, their actions during
the night of January 5th, or their behavior changes after January 5th.
“Leading up to January 5th, you may have observed behaviors
that indicate someone was involved. This could include making travel
plans to Capitol Hill or researching the locations of the DNC and RNC.
They may have shown an increased fixation on the current political
climate.
“Specific to the devices, you may have noticed this person
purchased 1x8-inch threaded galvanized pipe. This person may have had
unexplained possession of multiple kitchen timers. They may have an
interest in explosives, making black powder, or researched these topics.
“This person may have talked about their aspirations to place the
pipe bombs.
“You may have noticed that they were distracted from their
normal activities, work, their relationships, or holiday activities.
“Since January 5th, you may have noticed changes in someone
you know. This may include recently discarding or having stopped
wearing the Nike Air Max Speed Turf shoes.

78
Telegram Channel @nettrain
 “It could be bragging about what they did while on Capitol Hill,
following this story very closely, or exhibiting an unusual emotional
response to the reporting of this story. This may range from excitement
to frustration with the outcome and press coverage. They may have
increased anxiety about being identified. Any emotion you feel is
inappropriate is worth reporting.
“We know it can be a difficult decision to report information
about family, friends, or coworkers – but this is about protecting human
life. We need your help to identify the individual responsible for placing
these pipe bombs to ensure that they will not harm themselves or anyone
else.
“We still believe there is someone out there who has information
that they may not have realized was significant until now. We’re asking
you to come forward to share that information with us.”[47]

FBI-Released Information
The FBI released the images on the following pages to the
public.

79
Telegram Channel @nettrain
Images of the Suspect
Several images from video footage of the Suspect walking in the
Capitol Hill area.

80
Telegram Channel @nettrain
 81
Telegram Channel @nettrain
Bomb-Making Materials
A photo of one of the pipe bombs placed in the Capitol Hill area
of Washington, D.C., along with a photo of the kitchen timer used in the
device.

82
Telegram Channel @nettrain
Backpack Used to Transport the Bombs
Images of the Suspect’s backpack.

83
Telegram Channel @nettrain
 84
Telegram Channel @nettrain
Suspect’s Distinctive Footwear
Images of the Suspect’s black and light gray Nike Air Max
Speed Turf shoes with a yellow logo compared to product photos of the
sneakers.

85
Telegram Channel @nettrain
 .

86
Telegram Channel @nettrain
Surveillance Videos
In the FBI-released video on March 9, 2021, video footage from
four different surveillance cameras were provided. The videos were
compiled into a single 2 minute and 22 second video and shared on the
FBI website as well as YouTube.[48]

87
Telegram Channel @nettrain
 In Video #1, the Suspect is seen at 7:40 p.m., walking south on
South Capitol Street, NE toward the direction of the Democratic
National Committee Headquarters.

In Video #2, 12 minutes later, according to the FBI timestamp,

the Suspect is seen at the DNC Headquarters, walking north toward and
then sitting on a park bench (and then stretching their arms). The FBI
stated the DNC pipe bomb was placed next to a park bench. The subject
then heads possibly north or northeast.

In Video #3, at 8:14 p.m., the Suspect is recorded walking west

through the alley between the Republican National Committee

88
Telegram Channel @nettrain
Headquarters and the Capitol Hill Club next door. The subject walked
through the alley with their right shoulder appearing raised.

In Video #4, at 8:14:21 p.m., according to FBI timestamps, the

Suspect can be seen walking north (and stretching their arms) in front of
the Capitol Hill Club, which is next door to the RNC Headquarters.

89
Telegram Channel @nettrain
Stride Observations

The FBI asked the

public to observe the Suspect’s stride, body movements.[49]
On social media, there was some public speculation the Suspect
might be a woman based on her stride.

By taking screen captures of the South Capitol Street video and

then using Adobe Photoshop, I layered the images to illustrate the
Suspect’s stride and body movements, and compiled the following
sequence.

90
Telegram Channel @nettrain
 91
Telegram Channel @nettrain
Surveillance Video Observations
Below is a timeline of information I observed in the videos and
questions raised or additional possible leads to explore, assuming the
FBI’s timestamp information is accurate.
Time Location Observations
7:40 South Subject recorded walking south.
p.m. Capitol At the end of the video, Suspect places
Video Street, SEbackpack on ground, looks up for several
#1 seconds, adjusts eyeglasses with both
hands, and loiters in that spot for a few
moments. A man walking a dog walks
past Suspect on the sidewalk, passing just
inches away.
Questions raised:
Why did the Suspect place their backpack
on the ground?
What was the Suspect looking up at after
placing their backpack on the ground?
Presumably the FBI has explored locating
the dog walker as a possible witness. Did
the man walking the dog live nearby?
Was he taking his dog for a regular
evening walk? What would a reasonable
search radius be to find a local man who
walks a dog of that size?
7:52 DNC Subject recorded walking north.
p.m. Headquarters Looking at Google Maps, the distance
Video Corner of S. between the location in Video #1 and
#2 Canal Street Video #2 is approximately only 300 feet,
and S. however, the Suspect is recorded on
Capitol Video #2 at 7:52 p.m., which is 12
Street minutes after being recorded on Video
#1.
In Video #1, the Suspect is walking south
toward DNC Headquarters. In Video #2,
the Suspect is coming from the south,
headed north. At some point the Suspect

92
Telegram Channel @nettrain
 must have gone past the location of the
surveillance camera in Video #2 and then
turned around headed north.
When the subject sits on the park bench,
they appear to pause to stretch each arm,
as if they had been under strain. The
subject appears to raise and stretch their
right elbow and arm higher than they
stretched out their left arm, however, the
low resolution of the video makes that
observation inconclusive.
Question raised:
What was the Suspect doing for 12
minutes in the vicinity of the DNC
Headquarters?
8:14 Alley behind Subject recorded walking west.
p.m. RNC The FBI stated a pipe bomb was placed in
Video Headquarters the alley behind the Republican National
#3 Convention Headquarters. Video #3
shows the Suspect exiting the alley.
Video #3 records the Suspect at 8:14
p.m., 22 minutes after Video #2 recorded
the Suspect. According to the walking
directions in Google Maps, it takes
approximately 10 minutes to walk
between those two locations.
The area lighting in the alley allows for a
clearer image of the Suspect, who walks
holding their backpack in their right
hand. The Suspect walks with a
noticeably raised right shoulder, which
appears to overcompensate in their stride.
Questions raised:
What did the Suspect do during the 22
minutes between locations?
Did the Suspect know there was an alley
accessible behind the RNC Headquarters?
Did the Suspect plan in advance on

93
Telegram Channel @nettrain
 placing the pipe bomb in the alley or was
that decided spontaneously? Did the
subject surveil the location in advance to
find the alley location? Is there earlier
surveillance video that may have
recorded the Suspect?
8:14 Capitol Hill Subject recorded walking north.
p.m. Club In Video #4, the Suspect walks past the
Video 300 First front doors of the Capitol Hill Club,
#4 Street SE which is around the building corner of the
alley in Video #3.
After walking past the building’s front
awning, the Suspect can be observed
stretching both arms out at the same time.
The Suspect reaches their left arm back
and then up above their head, in a circular
stretching motion. They are still holding
the backpack in their right hand and
lifting their arm back and up, but only
raising their arm to approximately
shoulder height. As the Suspect exits the
frame, they begin what appears to be a
second stretch of both arms.
Cumulative Video Observations
In all four videos the Suspect appears to be struggling with their
backpack or their upper body.
1. In Video #1, the Suspect places their backpack on the
ground for a few moments;
2. In Video #2, the Suspect appears to pause to stretch both
arms;
3. In Video #3, the subject appears to walk with a noticeably
raised right shoulder, walking with a hunch; and
4. In Video #4, the subject appears to be stretching their arms
backwards in a pronounced manner, twice.

By organizing available breadcrumbs in a logical manner, a

picture of the Suspect’s actions can begin to be compiled. Disparate and

94
Telegram Channel @nettrain
tangential threads of information may lead to additional threads or leads
that can be explored.
It is important to bear in mind that some breadcrumbs or clues
may potentially be valuable, but others may be incorrect or unrelated to
the investigation at hand. Approaching open source investigation without
pre-set biases is important.

95
Telegram Channel @nettrain
Location Observations
Online mapping tools such as Google Maps can help provide
additional information, context and perspective to investigations.
Conducting open source research on the four locations where the Suspect
was recorded may reveal more details. (Obviously, the FBI knows
exactly where these videos came from, but for the purposes of
investigation techniques we will seek to identify where it was recorded.)

Video #1 – South Capitol Street SE.

The Suspect is walking in front of what appear to be residential
brownstones, which are common in Washington residential
neighborhoods.

Looking at a satellite photo of the area near the DNC

Headquarters reveals that many of the surrounding blocks have office
buildings. The block north of the DNC Headquarters shows narrow
rooftops (noted with an arrow) typically associated with brownstone
residences. That is a reasonable place to start looking to locate where the
video might have been captured.

96
Telegram Channel @nettrain
 Navigating that location in Google Street View mode reveals a
row of brownstones, and we see a light-colored building façade with
curved, black door and window trim next to a red brick building similar
to the buildings in Video #1. This is a possible location match but
warrants further inspection.

Zooming in closer to the building provides additional details,

which appear to match those in Video 1. The birdbath (noted with the
arrow) in both images along with the other matching details provide
solid confirmation of a location match.

97
Telegram Channel @nettrain
 The video appears to have been recorded from an elevated
location across the street from the brownstones, as we can see both a car
and the blacktop of the street in the image. Rotating the direction in
Street View Maps reveals an open air parking lot across the street.

Comparing the angle of view in Video #1 to the raised structures

across the street, it is possible that a surveillance camera was mounted on
the light post noted with the arrow. The light post in this image does not
appear to have an overt surveillance camera mounted on it. If this is, in
fact, where the video camera was placed, there are a few possible
explanations as to why a camera is not visible here. The camera may be
covert, hidden from view. Alternatively, according to the date
information provided by Google Street View, the most recent image was
taken in June 2019, approximately 19 months before the video was
recorded. It is possible a camera was installed after June 2019.

98
Telegram Channel @nettrain
Video #2 – DNC Headquarters
In addition to the two park benches, which are positioned
perpendicular to each other, we notice several bushes on both sides in
planting areas. Further out we can see large round shapes, approximately
2 feet tall, which appear to be security barriers to protect the building
from vehicles. Vehicle barriers in different designs are fairly common
throughout Washington, D.C. We also can see painted lines for
crosswalks on the street. The street corner itself is obscured by tree
branches so details are more difficult to discern.

By viewing the location from different angles, we are able to

identify the park benches (noted with an arrow), the vehicle barriers, and
we see the street corner is curved rather than square. The curve of the
street corner makes it somewhat ambiguous which direction the Suspect
walked toward the RNC Headquarters, it may be either north or east.

99
Telegram Channel @nettrain
Video #3 – RNC Headquarters Alley
The FBI stated the Suspect placed a pipe bomb in the alley
behind the Republican National Convention Headquarters.

Google Maps Satellite View shows an opening between the RNC

Headquarters and the Capitol Hill Club building.

100
Telegram Channel @nettrain
 If closer inspection was necessary, zooming in on Google Street
View provides a closer look at a portion of that alley. Notably, the
staircase with the dark handrail can be seen from the street (noted with
an arrow). Also, the contour of the alley shows liquid running down the
center, similar to that shown in Video #3, even though the images were
captured at different points in time.

101
Telegram Channel @nettrain
Video #4 – Capitol Hill Club
The façade of the Capitol Hill Club and additional details may
be viewed upon further inspection using a variety of mapping tools.

Google Street View provides a clear view of the location. The

awning shown in Video #4 is noted with an arrow below.

102
Telegram Channel @nettrain
Mapping Observations

The FBI released the below map showing the location of where
the pipe bombs were placed, at the DNC and RNC headquarters.

Taking the threads of information we accumulated above, we

can piece together possible scenarios of what occurred, which may also
lead to additional questions to explore. Here is a possible path (which
may be one of many possibilities) the Suspect may have taken to travel
from South Capitol Street to the DNC Headquarters to the RNC
Headquarters and then past the Capitol Hill Club.

103
Telegram Channel @nettrain
 104
Telegram Channel @nettrain
 Chapter 8 ‒ The Media’s Hunt for Suspects

The world media reported extensively on the live events at the

Capitol riots as well as the aftermath. Not surprising, efforts to report on
the right-wing militias, organized extremist groups, and individuals were
both vast and deep.
The news outlet USA TODAY, for example, put out a call for
help the day after the Capitol riots asking for leads and stories from the
public on rioters shown in a series of photos.

“If you were there or if you know someone who was there,
please help us,” the article implored. “We are using this information to
piece together stories about how the event unfolded, who the participants
were and what their motivations were. Some people claim those who
entered the federal building were not Trump supporters but members of
left-leaning groups like Antifa. We seek to determine the truth on these
claims.
“Posted below are a small sample of publicly available photos. If
you are in one of these photographs or know someone in these
photographs – or if you have links to other photos you would like to
share – please use the form below. We won't publish anything about you
unless you give us permission. You'll be helping us to report this
important story.”[50]
The news outlet included a link to a Google form where tipsters
could provide information.

105
Telegram Channel @nettrain
 106
Telegram Channel @nettrain
ProPublica’s Parler Collection
https://projects.propublica.org/parler-capitol-videos/
The non-profit newsroom ProPublica archived more than 500
videos from January 6, 2021 that were posted on Parler prior to Parler’s
site being taken down by Amazon, its hosting provider. ProPublica said
its collection of videos is “one of the most comprehensive records of a
dark event in American history through the eyes of those who took part.”
Importantly, ProPublica organized the videos chronologically,
and identified the location where each video was taken: around
Washington, DC; near the Capitol; or inside the Capitol Building. The
interactive database is an easy-to-use resource that provides framework
around the day’s events from hundreds of perspectives.[51]
According to ProPublica, the videos from Parler “range in
intensity, from frenetic, violent snippets of people clashing with police
near the inaugural platform and rioters demanding to be led to the House
chamber where the joint session of Congress was being held, to more
prosaic clips of crowd members milling around, far from the action. A
number of the videos capture threats to harm lawmakers, and a handful
catch the kinds of behavior — smashing windows, assaulting police —
that has led to criminal charges against dozens of people.”[52]

107
Telegram Channel @nettrain
 108
Telegram Channel @nettrain
 109
Telegram Channel @nettrain
 Chapter 9 ‒ Social Media Crackdown

“I am shocked, shocked…”
In the 1942 movie classic, Casablanca, the famous “shocked,
shocked” quote was born. It is the pinnacle of hypocrisy, expertly
delivered by Claude Raines, playing the role of Gendarme Captain Louis
Renault. Renault is a double-dealing, suave on the outside, ruthless on
the inside authority figure. He is a frequent guest at Rick’s Café
Américain, where Renault enjoys the gambling tables as much as he
enjoys never paying for his drinks. In this particular scene, the Nazis
whom Renault is afraid to upset command him to find a reason to shut
down Rick’s Café Américain, Renault stands up tall inside the saloon,
blows his emergency whistle loudly to demand the guests’ attention, and
declares:
Captain Renault: "I am shocked, shocked to
find that gambling is going on in here."
Emil, the casino croupier, approaches Renault
with a stack of money: "Your winnings, sir."
Captain Renault: "Oh, thank you very much."

Yeah, social media platforms did the same thing on January 6,

2021, in which 5 people died when the U.S. Capitol was assaulted.

According to a January 6, 2021, Buzzfeed article, “The

supporters of President Donald Trump who rioted in the US Capitol
building on Wednesday had been openly planning for weeks on both
mainstream social media and the pro-Trump internet. On forums like
TheDonald, a niche website formed after Reddit banned the subreddit of
the same name, they promised violence against lawmakers, police, and
journalists if Congress did not reject the results of the 2020 election.
“In one interaction four days before the Capitol riots, a person
on TheDonald asked, ‘What if Congress ignores the evidence?’

110
Telegram Channel @nettrain
 “’Storm the Capitol,’ said one reply, which received more than
500 upvotes.
“’You’re fucking right we do.’
“On pro-Trump social media website Parler, chat app Telegram,
and other corners of the far-right internet, people discussed the Save
America rally that took place earlier in the day on January 6th at which
Trump spoke as the catalyst for a violent insurrection. They have been
using those forums to plan an uprising in plain sight, one that they
executed Wednesday afternoon, forcing Congress to flee its chambers as
it met to certify the results of the election.
“Extremists have for weeks repeatedly expressed their intentions
to attend the January 6 protests, and unabashedly voiced their desire for
chaos and violence online,” said Jared Holt, a visiting research fellow
with [the Atlantic Council’s Digital Forensics Research Lab]. “What
we've witnessed is the manifestation of that violent online rhetoric into
real-life danger.”[53]
The Anti-Defamation League’s Center on Extremism uncovered
a range of posts reacting to the Capitol riots and spreading conspiracies
and memes. These have appeared on platforms favored by extremists,
including MeWe, Parler (before it was shut down), militia forums,
Twitter, and, most overwhelmingly, on Telegram.[54]

111
Telegram Channel @nettrain
 To identify threat actors who participated in the violence,
Australian security company OSINT Combine analyzed trending
hashtags and symbols captured in images and videos posted to Twitter
and Parler. The following hashtags were found trending on January 6,
2021 between 12:00 a.m. and 8:00 p.m. EST.
#washingtonriots
#campauschwitz
#Totenkopf
[totenkopf is a Nazi skull and crossbones symbol]
#boogaloobois
[Boogaloos are a far-right extremist group]
#6MWE
[refers to an anti-Semitic slogan]
#lockhimupnow
#stopthesteal
#antifa
[a decentralized anti-fascist movement]
#maga
[refers to Trump’s slogan “Make America Great Again”]
#civilwar2021
#burndowndc
#january6th
#patriots
#patriotsparty / #freedomfighters
#FBI
#Pence
#wakeupamerica
#capitolterrorists[55]

112
Telegram Channel @nettrain
 Quickly following the events of January 6th, several online
platforms began limiting search term access on their sites to prevent
searches for #StopTheSteal, #CapitolPatriots, and other terms from
showing posted images or videos of the Capitol riots.

Even Peloton, a manufacturer of internet-connected stationary

bicycles and treadmills that encourages users to participate in their online
community while exercising on their machines, had to prevent users
from creating a #StopTheSteal tag from within its app, according to a
January 11, 2021 article in TheVerge. The company said the hashtag did
not meet their community guidelines when a user goes to create it.

113
Telegram Channel @nettrain
According to the article, Peloton’s community guidelines specifically
ban “hate, offensive, and obscene speech” as well as “bullying,
harassment, and other offensive behavior.” Tags on Peloton function as
community identifiers. When people join a tag, it appears under their
name on the company’s leaderboard during workouts, and they can
socialize with other members of that tag. Anyone can create a tag, and
new tags are popping up in response to the #StopTheSteal ban. New
groups like #StopTheSteall, #StopTheSteel, #StopTheCensorship, and
#StopTheFraud were appearing on their app.[56]

114
Telegram Channel @nettrain
Facebook
Back in June 22, 2020, the Anti-Defamation League (“ADL”)
released a blog post titled, “Hate, Conspiracy Theories and Advertising
on Facebook,” stating “Facebook has been claiming that it is effectively
addressing hate on its platforms. ADL and others, however, have
continued to expose egregious examples of online hate, misinformation
and extremism across the company’s products, particularly on Facebook
and Instagram. Whether or not these posts technically violate Facebook’s
complicated guidelines around hate speech, as a result of the platform’s
casual placement of ads, paid advertisements run a risk of being placed
next to divisive (and sometimes blatantly hateful) content. Indeed, even a
cursory investigation conducted by ADL’s analysts immediately surfaced
examples of prominent brands’ advertising displayed on newsfeeds next
to hateful and conspiratorial content.”[57]
A few days later, on June 25, 2020, ADL CEO and National
Director Jonathan A. Greenblatt issued “An Open Letter to the
Companies that Advertise on Facebook,” saying, “…when it comes to
dealing with rampant hate and harassment, the platform [Facebook]
continues to come up short. What are they doing with $70 billion in
revenue and $17 billion in profit? Their hate speech, incitement, and
misinformation policies are inequitable. Their harassment victim services
are inadequate. Their advertising placement’s proximity to hateful
content is haphazard. And their ‘civil rights’ audit transparency reports
aren’t helpful to the civil rights community….
“Facebook regularly recommends extremist groups on its
platform to users. In fact, according to its own internal research in 2016
on German political groups on the platform, the company found that 64
percent of all extremist groups’ [new members] are due to their own
recommendation tools. While they have made improvements since then,
our researchers still experienced recruitment recommendations to hateful
groups just last week….
“During the ongoing COVID-19 pandemic, Facebook chose to
decrease the number of human content moderators who monitor hateful
content on the platform. Those human moderators who remain have not
been focused on hate, but we know the company could afford to do both
- it just isn’t convenient, and it would impact the bottom line - but with
proper resourcing, this is a completely solvable problem.

115
Telegram Channel @nettrain
 “Facebook has repeatedly refused to remove political
advertisements that contain blatant lies.
“The platform has also been slow to respond to calls to take
down conspiratorial content like QAnon and content that links to fringe
websites. In fact, Mark Zuckerberg explained the company’s decision to
not remove Holocaust denial content, stating ‘I don’t believe that our
platform should take that down because I think there are things that
different people get wrong.’”[58]
On August 3, 2020, the ADL again spoke out publicly about
Facebook. “Despite [Facebook’s] public announcements of efforts to
curb hateful speech and misinformation across its platform, Facebook
still hosts many spaces in which this content propagates and thrives.
While some of these problematic activities occur in small groups, a
number of problematic Facebook groups have grown to a significant
membership size, yet are still allowed to exist by Facebook.
“This is not by accident. Groups are largely self-moderated
spaces overseen by specific users with administrative or moderator
rights. Facebook states that groups can be banned for repeatedly
reposting items that have been flagged as false news, but the system can
be circumvented. While posts that break Facebook’s guidelines can be
flagged to the platform by members in the group, some moderators
actively warn their members not to report problematic content to
Facebook. For example, the rules for the group ‘#RedneckIII%’, a nearly
2,000-member group associated with the Three Percent militia
movement, say ‘NO REPORTING If you dont like a post keep scrolling.
Simple as that. Reporting to facebook is an automatic boot. You can
contact an admin and we will check out your claim.’
“In many other instances, racist, homophobic, and other hateful
posts are not deemed offensive enough by Facebook’s standards to
warrant intervention. Facebook has a history of overlooking this kind of
behavior, arguing that some hateful content does not go against their
Community Standards.
“QAnon is a conspiracy theory rooted in the claim that world
governments are controlled by an underground political group of
pedophiles…. For example, the 29,000-member group “Official Q /
QAnon Public Group” regularly features problematic posts, such as [a
specific] post making a “joke” about cars running into protesters, which
has happened.”[59]

116
Telegram Channel @nettrain
Then January 6th happened.

117
Telegram Channel @nettrain
 Facebook announcement, via Twitter, January 6, 2021

At 7:00 p.m. Washington, D.C. time, on January 6, 2021, after

the Capitol Building had been stormed by rioters, Facebook issued a
public statement:
“Let us speak for the leadership team in saying what so many of
us are feeling. We are appalled by the violence at the Capitol today. We
are treating these events as an emergency. Our Elections Operations
Center has already been active in anticipation of the Georgia elections
and the vote by Congress to certify the election, and we are monitoring
activity on our platform in real time. For those of you who are
wondering, here are the actions we’re taking:
“First, we have been searching for and removing the following
content:
Praise and support of the storming of the US Capitol
Calls to bring weapons to locations across the US — not
just in Washington but anywhere in the US — including
protests
Incitement or encouragement of the events at the Capitol,
including videos and photos from the protestors. At this
point they represent promotion of criminal activity which
violates our policies.
Calls for protests — even peaceful ones — if they violate
the curfew in D.C.
Attempts to restage violence tomorrow or in the coming
days
“As a part of this, we removed from Facebook and Instagram the
recent video of President Trump speaking about the protests and his
subsequent post about the election results. We made the decision that on

118
Telegram Channel @nettrain
balance these posts contribute to, rather than diminish, the risk of
ongoing violence.
“Next, we’re updating our label on posts across our platforms
that attempt to delegitimize the election results. The new text reads: “Joe
Biden has been elected President with results that were certified by all 50
states. The US has laws, procedures, and established institutions to
ensure the peaceful transfer of power after an election.
“In recent days and weeks, we have also taken enforcement
action consistent with our policy banning militarized social movements
like the Oathkeepers [sic] and the violence-inducing conspiracy theory
QAnon. We’ve also continued to enforce our ban on hate groups
including the Proud Boys and many others. We’ve already removed over
600 militarized social movements from our platform.
“We’ve had emergency measures in place since before the US
elections like not recommending civic groups for people to join. We’re
keeping them in place. Today we’re implementing several additional
ones as well, including:
Increasing the requirement of Group admins to review and
approve posts before they can go up
Automatically disabling comments on posts in Groups that start to
have a high rate of hate speech or content that incites violence, and
Using AI to demote content that likely violates our policies
“We’re continuing to monitor the situation and will take
additional measures if necessary to keep people safe.”[60]

Facebook announcement via Twitter, January 6, 2021

According to a February 11, 2021 article on

BloombergQuint.com, in the days following the attack, [Facebook’s]
Chief Operating Officer Sheryl Sandberg said the riots were planned
mostly on other social media platforms. But reporters quickly found

119
Telegram Channel @nettrain
evidence that Facebook and Instagram, which the company also owns,
were mainstream tools for coordinating and spreading the word about the
events.[61]

120
Telegram Channel @nettrain
Twitter

Twitter announcement, January 8, 2021

Building up to January 6th, Twitter had previously placed

disclaimers of inaccurate information or removed earlier tweets by
Trump for containing misinformation. On Friday, January 8, 2021,
Twitter was the first social media platform to permanently suspend
Trump’s accounts. The company stated several reasons for their decision:
“After close review of recent Tweets from the
@realDonaldTrump account and the context around them — specifically
how they are being received and interpreted on and off Twitter — we
have permanently suspended the account due to the risk of further
incitement of violence.
“In the context of horrific events this week, we made it clear on
Wednesday that additional violations of the Twitter Rules would
potentially result in this very course of action. Our public interest
framework exists to enable the public to hear from elected officials and
world leaders directly. It is built on a principle that the people have a
right to hold power to account in the open.
“However, we made it clear going back years that these accounts
are not above our rules entirely and cannot use Twitter to incite violence,
among other things. We will continue to be transparent around our
policies and their enforcement.
“The below is a comprehensive analysis of our policy
enforcement approach in this case.
“Overview
“On January 8, 2021, President Donald J. Trump Tweeted:
“’The 75,000,000 great American Patriots who voted for me,
AMERICA FIRST, and MAKE AMERICA GREAT AGAIN, will have a

121
Telegram Channel @nettrain
GIANT VOICE long into the future. They will not be disrespected or
treated unfairly in any way, shape or form!!!’

9:46 a.m. EST (2:46 p.m. UTC), January 8, 2021

“Shortly thereafter, the President Tweeted:

“’To all of those who have asked, I will not be going to the
Inauguration on January 20th.’

10:44 a.m. EST (3:44 p.m. UTC), January 8, 2021

“Due to the ongoing tensions in the United States, and an uptick

in the global conversation in regards to the people who violently stormed
the Capitol on January 6, 2021, these two Tweets must be read in the
context of broader events in the country and the ways in which the
President’s statements can be mobilized by different audiences, including
to incite violence, as well as in the context of the pattern of behavior
from this account in recent weeks. After assessing the language in these
Tweets against our Glorification of Violence policy, we have determined
that these Tweets are in violation of the Glorification of Violence Policy
and the user @realDonaldTrump should be immediately permanently
suspended from the service.
“Assessment
“We assessed the two Tweets referenced above under our
Glorification of Violence policy, which aims to prevent the glorification
of violence that could inspire others to replicate violent acts and
determined that they were highly likely to encourage and inspire people
to replicate the criminal acts that took place at the U.S. Capitol on
January 6, 2021.

122
Telegram Channel @nettrain
 “This determination is based on a number of factors, including:
“President Trump’s statement that he will not be attending the
Inauguration is being received by a number of his supporters as further
confirmation that the election was not legitimate and is seen as him
disavowing his previous claim made via two Tweets by his Deputy Chief
of Staff, Dan Scavino, that there would be an “orderly transition” on
January 20th.

“The second Tweet [in which Trump states he will not be

attending the inauguration] may also serve as encouragement to those
potentially considering violent acts that the Inauguration would be a
‘safe’ target, as he will not be attending.
“The use of the words ‘American Patriots’ to describe some of
his supporters is also being interpreted as support for those committing
violent acts at the US Capitol.
“The mention of his supporters having a ‘GIANT VOICE long
into the future’ and that ‘They will not be disrespected or treated unfairly
in any way, shape or form!!!’ is being interpreted as further indication
that President Trump does not plan to facilitate an ‘orderly transition’
and instead that he plans to continue to support, empower, and shield
those who believe he won the election.
“Plans for future armed protests have already begun proliferating
on and off-Twitter, including a proposed secondary attack on the US
Capitol and state capitol buildings on January 17, 2021.

123
Telegram Channel @nettrain
 “As such, our
determination is that the two Tweets above are likely to inspire others to
replicate the violent acts that took place on January 6, 2021, and that
there are multiple indicators that they are being received and understood
as encouragement to do so.[62]

124
Telegram Channel @nettrain
Banning or Suspending Trump’s Accounts
By January 10th, four days after the riots, several mainstream
platforms banned or suspended Trump’s accounts as well as those of
many of his enablers and underlings.[63]

125
Telegram Channel @nettrain
 126
Telegram Channel @nettrain
 Chapter 10 ‒ Public Crowdsourcing

Almost immediately following the Capitol riots, some members

of the public began collecting and organizing photos of the rioters’ faces
in efforts to crowdsource identification efforts. Some examples include
HomeGrownTerrorists, Sedition Hunters, and Faces of the Riot

@HomeGrownTerrorists

127
Telegram Channel @nettrain
 An
Instagram account called HomeGrownTerrorists quickly gained attention
on social media after providing photos of rioters’ faces. The account had
amassed 373,000 followers by mid-March, 2021.
In a January 11, 2021, Vice.com article titled, “The Instagram
Account Naming and Shaming Pro-Trump Rioters in D.C.,” the founder
of HomeGrownTerrorists — who had asked to withhold their name in
the interest of protecting their safety — was interviewed by journalist
Drew Schwartz about why they started the effort, the methods they were

128
Telegram Channel @nettrain
using to confirm rioter's identities, and the person toll maintaining this
account was taking on them. Excerpts of that interview are below.

129
Telegram Channel @nettrain
“Why did you decide to start @HomegrownTerrorists?
“On Monday, when the news was going around about this march
on the same day as the certification, I messaged one of my
colleagues saying, ‘Wow, you know what's gonna happen, right?’
And it happened. I was just so upset, and I wanted to help
[uncover] the identities of all of these people who weren't wearing
masks and blatantly breaking the law and trying to bring down our
government. I didn't think it would work; I didn't expect this to go
so viral, and to blow up into this huge, crazy thing.

“How do you go about identifying the rioters whose photos

and names you post on the account?
“A lot of them were coming through in the DMs [direct
messages]. From there, I would go online and search them to see if
I could find any information on them, [or] images to match them. I
have software—it's called "Let's Enhance"—where you can take a
really pixelated image and blow it up, like, 16 times. It uses
artificial intelligence and neural networks to blow it up without
losing detail. [Let’s Enhance is discussed in detail in Chapter 15 –
Facial Recognition.]

“How did you go about confirming their identities, and

making sure you were certain the names you were attaching to
these faces were correct?
“There were names that came through where I have multiple
photos, the name of the person, and I can see that they were there
on their social media—in their stories, or that they posted videos
or photos actually in [the Capitol]. Or they're photographed, and
they have all these profiles from all sorts of angles. [I'm] pulling
all that together and laying it over in Photoshop and seeing like,
does this all match up?

“Why do you think that it's important to identify these people,

and to make sure that the public knows who they are and what
their names are?
“I mean, it was essentially a terrorist attack. Think about the
Boston Bombing, or 9/11, or the shooting in Las Vegas. Everyone
knew the names of these people. This was just on such a massive
scale that it's not possible to keep track of all of those people. And

130
Telegram Channel @nettrain
so getting those names out there and making sure that they are
held to account for the crimes that they committed [is important].

“Have you been getting harassed by Trump supporters?

“Yeah. Those actually started first, before anything else. It was,
like, non-stop comments on every photo. We would post a photo
like, ‘Do you know who this person is?’ And they were
commenting things like, ‘Breonna Taylor’; ‘George Floyd’; ‘Anne
Frank.’ And you could tell that they were probably bots, accounts
with zero followers. After that, there were a lot of really terrible
DMs that came through, which were really rattling.

“What were they like?

“Like, ‘I'm going to kill you.’ A lot of that. That's unsettling.
Sleeping last night was not great.

“Why did you delete your first account,

@homegrownterrorists?
“I wasn't sure if my IP address or location could be somehow
traced from the metadata on the images. I don't know if that's a
thing; I just got really paranoid. And I really wanted to just, like,
go to sleep. I just got really, really anxious, and I put it on private,
and then locked it down and archived everything.

“Have you told any of your close friends that you're doing
this?
“No.

“Does anyone know that you're doing this?

“No.

“That has to be a difficult secret to keep.

“It's not fun.

“It seems like running this account is, in a lot of ways, pretty
terrible. It's stressful. You're on your own. You're afraid for
your safety. What's keeping you from shutting it down and
walking away?
“I feel obligated to the country just to get this behind us, to do
something to help facilitate that. But it is so icky. I've had a

131
Telegram Channel @nettrain
migraine for two days now just from staring at this and thinking
about it so much. Ultimately, I don't want to do this for months on
end.”[64]

132
Telegram Channel @nettrain
Sedition Hunters
https://seditionhunters.org/

According to their website, Sedition Hunters is a global

community of open-source intelligence investigators working together to
assist the U.S. FBI and Washington D.C. Capitol Police in finding people
who allegedly committed crimes in the January 6 Capitol riots. The site
asks the public to help by sharing its posts, images, and videos on social
media and with friends and family. By sharing content, users help
amplify even further because social media algorithms are more likely to
boost Sedition Hunter’s posts in their algorithms. Tipsters are instructed
to contact the FBI directly either via the agency’s online portal or by
phone.
In a January 17, 2021, Los Angeles Times article titled, “On
social media, amateur digital sleuths try to help track violent Capitol
rioters,” the site’s founder, who declined to give their name for fear of
retaliation, said that they advise others not to post names online.
“Online witch hunts can be bad or dangerous, and could lead me
to shutting down the site earlier if we can’t do this in a way where we are
not accidentally doxxing people,” the 30-year-old founder said. “I don’t
see social media as the platform where justice is delivered.”[65]

133
Telegram Channel @nettrain
 134
Telegram Channel @nettrain
The Faces of the Riot
https://facesoftheriot.com/

In a January 28, 2021 article in Wired.com, journalist Andy

Greenberg reported on the website Faces of the Riot’s use of open source
machine learning and facial recognition software to detect, extract, and
deduplicate [that is, remove duplicates of] every face from the 827
videos available from Parler that were taken during the Capitol riots
inside and outside of the Capitol Building.
When Faces of the Riot first appeared online it contained a vast
grid of more than 6,000 images of faces, each one tagged only with a
string of characters associated with the Parler video in which it appeared.
The creator of Faces of the Riot, who says he's a college student in the
"greater D.C. area,” said his goal was to allow anyone to easily sort
through the faces pulled from those videos to identify someone they may
know or recognize who took part in the mob, or even to reference the
collected faces against FBI wanted posters and send a tip to law
enforcement if they spot someone.

135
Telegram Channel @nettrain
 According to the Wired article, “Aside from the clear privacy
concerns it raises, Faces of the Riot's indiscriminate posting of faces
doesn't distinguish between lawbreakers—who trampled barriers, broke
into the Capitol building, and trespassed in legislative chambers—and
people who merely attended the protests outside.”
An upgrade to the site added hyperlinks from faces to the video
source, so that visitors could click on any face and see what the person
was filmed doing on Parler. The site’s creator said that added feature will
help contextualize every face's inclusion on the site and differentiate
between bystanders, peaceful protesters, and violent insurrectionists. He
conceded that he and a co-creator are still working to scrub "non-rioter"
faces, including those of police and press who were present.
According to the article, “Despite its disclaimers and limitations,
Faces of the Riot represents the serious privacy dangers of pervasive
facial recognition technology, says Evan Greer, the campaign director for
digital civil liberties nonprofit Fight for the Future. ‘Whether it's used by
an individual or by the government, this technology has profound
implications for human rights and freedom of expression,’ says Greer,
whose organization has fought for a legislative ban on facial recognition
technologies. ‘I think it would be an enormous mistake if we come out of
this moment by glorifying or lionizing a technology that, broadly
speaking, disproportionately harms communities of color, low-income
communities, immigrant communities, Muslim communities, activists ...
the very same people that the faces on this website stormed the Capitol
for the purpose of silencing and disenfranchising.’
“The site's developer counters that Faces of the Riot leans not on
facial recognition but facial detection. While he did use the open source
machine learning tool Tensor Flow and the facial recognition software
Dlib to analyze the Parler videos, he says he used that software only to
detect and "cluster" faces from the 11 hours of video of the Capitol riot;
Dlib allowed him to deduplicate the 200,000 images of faces extracted
from video frames to around 6,000 unique faces. (He concedes that there
are nonetheless some duplicates and images of faces on protest signs
included too. Even the number "45" [Trump was the 45th President] on
some signs was in some cases identified as a human face.)”[66]

136
Telegram Channel @nettrain
 137
Telegram Channel @nettrain
 138
Telegram Channel @nettrain
Section II – Identifying the Capitol Rioters

Section Table of Contents

Topic Page
Chapter 11 ‒ Knock Knock
Zachary Alam
#HelmetBoy Door Smasher
Eduardo Nicholas Alvear Gonzalez (a.k.a. Nicolas
Alvear)
This could have been an email
Richard “Bigo” Barnett
Speaker Nancy Pelosi Letter Stealer
Larry Rendall Brock
“Zip Tie Guy #1” turned in by his ex-wife
Jacob Anthony Chansley (a.k.a. Jacob Angeli)
Also known as #VikingMan or the “QAnon
Shaman”
Nolan Cooke
Identified by his personal grooming
Daniel Egtvedt
Arrested after unrelated, anti-vaccination
domestic disturbance
Derrick Evans
“DERRICK EVANS IS IN THE CAPITOL!”
Philip Sean Grillo
Look, Mom. I’m on TV!
Andrew Hatley
Deny, deny, deny
Adam Johnson
#PodiumThief
Edward Jacob Lang
THIS IS ME
Kevin James Lyons
Made a map, claimed it was all a dream
Anthony R. Marrioto (a.k.a. Tony Mariotto)

139
Telegram Channel @nettrain
 Have you seen this man?
Patrick Edward McCaughey III
BOLO #62-AFO
William D. Merry, Jr.
Speaker Nancy Pelosi sign stealer
Richard Michetti
Called his ex-girlfriend a “moron” then she
turned him in
Matthew Ryan Miller
Fire Extinguisher-spraying, cape and cowboy hat-
wearing rioter
Aaron Mostofsky
#CaveMan, son of a Brooklyn judge
Clayton Ray Mullins
#Slickback police assaulter
Eric Gavelek Munchel and Lisa Eisenhart
“Zip Tie Guy #2” and his Mom
Joseph Lino Padilla (a.k.a. Jose Padilla)
SCUBA masked rioter
Rachel Marie Powell
#PinkHatLady, #BullhornLady
Christine Marie Priola
Tracked by public WiFi
Robert Maurice Reeder
Quick hit identification by facial recognition
software
Nicholas Rodean
Wore his employee ID tag to the Capitol riots
Jennifer Leigh Ryan (a.k.a. Jenna Ryan)
“Y’all know who to hire for your realtor. Jenna
Ryan for your realtor.”
Jeffrey P. Sabol
Police assaulter
Robert Sanford
Chester, PA Fire Department fire extinguisher
hurler
Peter Francis Stager
Flag wielding police beater
Katherine Staveley Schwab (a.k.a. Katie)
Weeee

140
Telegram Channel @nettrain
Marissa A. Suarez and Patricia Todisco
License plate readers tracked their travel to
Washington, D.C.
Dustin Byron Thompson and Robert Anthony Lyon
Got caught waiting for an Uber with a stolen
Senate coat rack
William Vogel
Large Red Hat
Riley June Williams
Speaker Nancy Pelosi Laptop Thief

141
Telegram Channel @nettrain
 Chapter 11 ‒ Knock Knock

According to George Washington University’s Program on

Extremism, which reviewed information on 257 people charged for their
participation in the Capitol riots, 91 percent of the rioters traveled to
Washington, D.C. from 40 states and within the District of Columbia. 86
percent were men, and 14 percent were women. Law enforcement
arrested individuals as young as 18 and as old as 70. The average age of
individuals arrested was 40 years old.[67]
The goal of these case studies is to provide insight into the tools,
tactics, and procedures the FBI, media, and general public employed to
identify individuals suspected to be involved in the Capitol riots.
Certain actors in Washington, D.C. on January 6, 2021 were
already well-known to law enforcement agencies, and likely had been for
some time. White nationalists, far right groups, alt-right groups, and
other extremist groups and individuals including the Boogaloos, Oath
Keepers, Proud Boys, QAnon, Three Percenters, and numerous others
entities participated in the riots. Because the identities of their individual
members were already known to law enforcement, for the purposes of
this book, OSINT techniques and strategies were typically not
distinctive. They were already identified.
Many of the following case studies involve individuals whose
identities were discovered and then confirmed from a variety of sources.
From an OSINT standpoint, these cases were selected because they each
provided investigative points of interest.
Except where noted in the paragraphs or images with alternative
source information, information compiled for these case studies comes
primarily from the U.S. Attorney’s Office Department of Justice’s
official documents filed with the courts. Every case is being prosecuted
by the U.S. Attorney’s Office for the District of Columbia. Following
arrest, or surrender, a defendant must appear before a district court
magistrate or judge where the arrest takes place, in accordance with the
Federal Rules of Criminal Procedure.
The listing of charges filed for each defendant comes from the
Department of Justice’s website as of the time of this book’s publication.

142
Telegram Channel @nettrain
[68]
It is possible that additional charges may be added, or charges may be
removed, for a defendant as their case progresses.
I’ve compressed much of the information to focus primarily on
the investigative techniques while providing color and context to a
subject’s alleged state of mind. The photographs, video screenshots, and
other images in the case studies are drawn extensively from the federal
affidavits filed by prosecutors. The methodology, procedures, and
techniques used in the investigations are discussed. However, certain
specific identifying information included in the official documents -
including a defendant’s home address, city of residence, and telephone
numbers - have been redacted or omitted from these case summaries.
To ensure clarity and appropriate identification of the different
individuals discussed in each case, the original affidavits were written to
be clear in its evidentiary presentation, which oftentimes required the
official narratives to be overly-detailed and specific. As that level of
specificity is valuable in documenting OSINT investigations, the case
studies will often reflect a similar level of detail and description.
Furthermore, the investigative language often uses phrases such as “is
believed to be” rather than rigid, definitive statements as it is important
to bear in mind that images or events may sometimes be misinterpreted,
misunderstood, or misconstrued. Being open-minded and flexible when
gathering and reviewing evidence is important to prevent bias,
preconceived notions, or foredrawn conclusions from influencing an
objective investigation.
Several affidavits contain verbal statements made by rioters
either recorded on video or during interviews which contain mature
language. As appropriate for the purposes of providing context into a
defendant’s alleged state of mind, many of those statements are included
in the case studies.
Messages posted by defendants are also included where
appropriate. Typically, those messages are copied verbatim, including
grammatical errors, obscenities, or slang words, if any.
Unless otherwise stated, for the safety of victims and witnesses,
victims and confidential sources of information are referred to using non-
binary pronouns (they/their/theirs) and conversations about victims and
confidential sources of information have been altered as necessary to
reflect non-binary pronouns.

143
Telegram Channel @nettrain
 All times noted are Washington, D.C. local time, Eastern
Standard Time.
OSINT tools, techniques, and procedures that are particularly
interesting in each case are noted in the margins.
Several of the individuals were labeled by the public on social
media with hashtags, such as #Caveman or #Slickback, or labels, such as
“Zip Tie Guy #2.” To provide color on the zeitgeist immediately
following the Capitol riots, those descriptions have been included where
applicable.

144
Telegram Channel @nettrain
 145
Telegram Channel @nettrain
Zachary Alam
#HelmetBoy Door Smasher

To investigate the riots at the U.S. Capitol, investigators

reviewed several open source videos and video footage provided by the
U.S. Capitol Police (“USCP”). Video showed a male wearing a dark
colored jacket, a black and tan fur-lined hat, and a black shirt with
yellow and red label on the front (the “Subject Male”) entering through
the Senate Wing entrance window entrance to the Capitol Building.

146
Telegram Channel @nettrain
Picture reproduced in charging documents.

147
Telegram Channel @nettrain
 Police video shows the Subject Male inside the Main Door Hall
at approximately 2:40 p.m.where he and other violators forced their way
past USCP officers and personnel. The logo on the shirt reflects the label
“Pirelli” with a “Nike” label on the right-side and an Inter-Milan Soccer
Team logo on the left side of it.

Pictures reproduced in charging documents.

His demeanor appeared agitated as he walked down the hallway

toward the East stairs. Then he walked toward a USCP security official
wearing a suit and an unidentified female. According to the federal
affidavit, the Subject Male “immediately bypassed the female and got
close to the U.S. Capitol Police official’s face.”

148
Telegram Channel @nettrain
 Open source videos
show a large, aggressive crowd, including the Subject Male, trying to

breach a barricaded door to the Speaker’s Lobby, a

hallway that connects to the House of Representatives chambers. The
words “Speaker’s Lobby” are visible at the top of the doors. Chairs,
visible through the door’s glass panels, were used to barricade the door
from the inside of the Speaker’s Lobby. The door was guarded by three
Capitol Police officers in front.

Videos depicting this entrance to the

Speaker’s Lobby captured the shooting of a woman identified as Ashli
Babbitt. A closer vantage point of the Subject Male showed his black
and tan fur-lined hat had a “Canada Goose” label and he also wore a red
baseball hat underneath the fur-lined hat. He had dark rimmed glasses

149
Telegram Channel @nettrain
and a black mask positioned down on his chin. The Subject Male was
observed repeatedly punching the glass panels of the doors immediately
behind the officers, causing the glass to splinter. While throwing two of
the punches, the Subject Male pushed his body up against one of the
Capitol Police officers guarding the door. He is seen in video footage
shouting “Fuck the blue” multiple times in the faces of the police officers
Seconds after the officers stepped away from the doorway, the
Subject Male began kicking the glass panels of the Speaker’s Lobby
door. He took a black-colored helmet from an individual with a yellow
“Don’t tread on me” flag, took off his fur-lined hat and red baseball hat,
and violently struck the middle glass panel repeatedly with the helmet,
further shattering the window. Chants could be heard of “Break it
down!” and “Let’s fucking go!”
Babbitt was shot while attempting to climb through one of the
shattered windows. After the shot, the Subject Male backed away toward
the stairwell and put the helmet on.

Picture reproduced in charging documents.

150
Telegram Channel @nettrain
 151
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

On January 12, 2021, an FBI poster was posted to various social

media platforms seeking public assistance in identifying the Subject
Male. On January 13, 2021, the Subject Male was also included on an
FBI “BOLO” (Be On The Lookout) poster, which captured his image as
“BOLO #79.”
On social media the Subject Male was sometimes identified with
the hashtag #HelmetBoy

On January 14, 2021, an anonymous tip to

the FBI National Threat Operation Center (“NTOC”) identified BOLO
#79 as the tipster’s “family member,” Zachary Alam, providing Alam’s
age, phone number, email address, and other identifying information.

FBI agents later retrieved a driver's license

photo of Zachary Jordan Alam and determined the individual depicted in
the driver’s license matched the appearance of the Subject. FBI agents

152
Telegram Channel @nettrain
viewed Alam’s Youtube channel and Facebook profile based on the
name provided by the tip and determined that the photos in the account
matched the Subject Male.

On January 19, 2021, an individual

(“Witness #1”) submitted a tip, including their contact information, to
the FBI NTOC identifying BOLO #79 as their relative, Zachary Alam,
providing Alam’s age, approximate location, and a phone number Alam
recently used to call Witness #1.
On January 24, 2021, the FBI interviewed Witness #1, who
stated that Witness #1 had submitted the anonymous tip on January 14,
2021, before following up with the tip on January 19. Witness #1
positively identified Alam as the male depicted in BOLO #79. Witness
#1 was shown several photographs from video footage of the Capitol
events and identified Alam.

One of the photographs depicted a tattoo

“2020” on Alam’s inner left arm. Witness #1 reviewed the photograph
with the partial “2020” and advised agents that Alam has such a tattoo
that states in full, “$250k in 2020.” Witness #1 circled the area and
provided their initials as confirmation that the Subject Male was Alam.
Witness #1 recognized the black Pirelli shirt bearing the red and yellow
logo as ALAM’s shirt.
Witness #1 stated that a few days after the events at the U.S.
Capitol, another relative sent Witness #1 an open source video depicting
the breaking of the glass windows of the doorway to the Speaker’s
Lobby. Witness #1 stated that Witness #1 and the relative reviewed the
video approximately 20 times and confirmed that the male hitting the
glass with the helmet was their relative Alam
Witness #1 advised that Alam subsequently called Witness #1
from the phone number that Witness #1 provided in the January 19, 2021
tip. Alam and Witness #1 are in routine contact, but this was the first
time Alam used the number to communicate with Witness #1; Alam has
used a different phone number for years. Alam declined to provide his

153
Telegram Channel @nettrain
exact location. Alam told Witness #1 that he was sorry for what he had
done at the U.S. Capitol but he was not going to turn himself into
authorities because he did not want to go to jail again.
Witness #1 also advised that Alam has, since the events at the
Capitol, asked relatives if Alam may stay at their residences, and has
stated that the FBI is looking for him.

CHARGES FILED:
1. Assault on a federal officer with a dangerous or deadly weapon;
2. Destruction of government property over $1,000;
3. Obstruction of an official proceeding;
4. Unlawful entry in a restricted building or grounds; and
5. Violent entry and disorderly conduct

154
Telegram Channel @nettrain
Eduardo Nicholas Alvear Gonzalez (a.k.a. Nicolas Alvear)
This could have been an email

Pictures reproduced in charging documents.

On January 20, 2021, a witness (“Witness

#1”) contacted the FBI and identified Eduardo Nicolas Alvear Gonzalez
as an individual who had stormed the Capitol on January 6, 2021.
Witness #1 knew Gonzalez as a family member and identified him in
two publicly available YouTube videos showing him standing inside the
Capitol Rotunda on January 6, smoking what appears to be marijuana.

In both videos, the individual Witness #1

identified as Gonzalez is wearing an olive-colored sun hat; olive-colored
long-sleeve shirt; a light green backpack; a black fanny pack; red, white,
and blue American flag pants; and long brown hair with a full, dark-
colored beard.

155
Telegram Channel @nettrain
 In the first
YouTube video, entitled “Man smoking a doobie weed at capitol dome
Donald Trump supporters,” the individual identified as Alvear Gonzalez
blows smoke out of his mouth, while another individual in the video asks
“what strain of weed is that?” A screenshot of that video is below.

In the second YouTube video, entitled

“The Capitol Rotunda Doobie Smoker explains

why he did it,” someone asks Alvear Gonzalez why he is smoking weed
in the Capitol, and he responds in part, “freedom.” A screenshot of that
video is here.

156
Telegram Channel @nettrain
 Witness #1 informed law enforcement that Gonzalez previously
resided in California, and was most recently renting an AirBnB in or

near Washington, D.C.

A law enforcement search of California Department of Motor
Vehicles data revealed an Alvear Gonzalez Eduardo Nicolas of

California, and the associated photograph appeared

to be the same person in the YouTube videos.
Records also reveal that Gonzalez has been renting a residence
through AirBnB in Virginia for a term of 30 days beginning on January

1, 2021.
Travel records revealed that Gonzalez was scheduled to fly from
Ronald Reagan Washington National Airport to Los Angeles

International Airport on Monday, February 1,

2021.
In light of the matching physical appearances, residential
information, and rental details, law enforcement believed the individual
Witness #1 identified in the Capitol Rotunda on January 6 is Alvear
Gonzalez.
A subsequent search of YouTube revealed a photograph posted
by a user account identified as “The Good Lion Experience” that

included a profile picture of a male lion in gold

with a black background and the words “Good Lion.” Witness #1
informed the FBI that Gonzalez often goes by the nickname “Lion

157
Telegram Channel @nettrain
Nick.” The posted photograph shows Alvear Gonzalez dressed in an
olive-colored sun hat; olive-colored long-sleeve shirt; a light green
backpack; a black fanny pack; red, white, and blue American flag pants;
and long brown hair and a full, dark-colored beard. Given the same
physical appearance and clothing across all of the viewed YouTube
content, law enforcement concluded the individual in this photograph
was Gonzalez. In the video, Gonzalez is standing in the Capitol Rotunda
and smoking what appears to be a lit, self-rolled cigarette. A screenshot
of this post is here.

Other witnesses have provided Snapchat videos to the FBI’s National

Threat Operations Center.

On January 11, 2021, for example, a

different witness submitted a recording of a Snapchat “story” that
another Snapchat user had created and posted. That Snapchat user can be
seen in his story marching through the Capitol Rotunda on January 6,
2021. At one point in the video, that user is sitting near a painting in the
Capitol Rotunda and pans the camera around to show the Capitol
Rotunda and other rioters, including an individual believed to be
Gonzalez based on his distinct clothing, presence in the Capitol Rotunda,
and the fact that he is smoking what appears to be marijuana.

158
Telegram Channel @nettrain
 Another individual in the
video asks, “How many joints we have? [sic]” and can be seen counting
the people around him smoking, including Alvear Gonzalez. At one
point in the video, Alvear Gonzalez is exchanging small items that
appear to be marijuana cigarettes with another, older individual wearing
a dark-colored beanie, dark-colored long-sleeve top, and dark- colored
pants. A screenshot of the Snapchat video is here.
Additional witnesses provided the FBI with a Zoom video that
Alvear Gonzalez filmed and broadcasted over the internet on January 7,
2021. In the more than one hour-long video, Alvear Gonzalez shares his
Apple laptop screen and narrates multiple photos and videos of himself
and others inside the Capitol on January 6, 2021. At times, he shows
what appear to be over 50 photographs and videos saved in a folder
entitled, "Captiol [sic] Storming."
In the upper right of the screen is a smaller panel showing the
narrator in real time who identifies as "Nick Alvear," matching
Gonzalez's names of Nicholas and Alvear and physically appears to be
the same individual.

159
Telegram Channel @nettrain
 At about 26 minutes and 50 seconds into the video, Gonzalez
shows part of his recording that shows his face as he drinks a beverage
after breaking into the Capitol Rotunda. A screenshot of that moment is
below, with an oval around the name he uses throughout the video.

Picture reproduced in charging documents.

At about 27 minutes and 20 seconds into the video, Gonzalez

shows a portion of his recording where he continues to march through
the Capitol, and he sarcastically says, "Yeah, this is the most protected
building," and laughs. He then narrates that he and other rioters were
looking for "doors to break in" as they walked around the Capitol.
At about 28 minutes and 5 seconds into the video, Gonzalez
plays a clip from his recording where he pans the camera to himself in
the Capitol Rotunda and yells, “Time to smoke weed in here!"
At about 33 minutes and 55 seconds into the video, Gonzalez
says to those live viewing his recording, "If you're just joining, this is
footage from my camera. This is me there, I'm speaking from first-hand
experience."
Afterward, Gonzalez narrates that at this point he asked someone
to film him smoking in the Capitol, and the video shows Gonzalez hand

160
Telegram Channel @nettrain
the camera to another rioter who records Gonzalez lighting a pipe and
smoking. A screenshot of the video is below, with an oval around his
name.

Picture reproduced in charging documents.

At about 39 minutes and 20 seconds into

the video, Gonzalez restates to his live viewers, "I'm showing everyone
how I barged into the Capitol yesterday.” Soon afterward, he notes there
are "200 plus" people in an open chat room of individuals that appear to
be watching Gonzalez's live stream video.
Finally, at about 48 minutes and 10 seconds into the video,
Gonzalez explains that he has “gnarlier footage on Twitter.” He proceeds
to show his viewers a Twitter profile with an account username of “Good
Lion Films” that also has a profile picture of a gold male lion on a black
background with the words “Good Lion.” This profile picture and name
appears to match the “Good Lion Experience” YouTube account
described above.
CHARGES FILED:
1. Entering and remaining in a restricted building or grounds;
2. Disorderly and disruptive conduct in a restricted building or
grounds;
3. Disorderly conduct in a Capitol building; and

161
Telegram Channel @nettrain
4. Parading, demonstrating, or picketing in a Capitol building.

162
Telegram Channel @nettrain
Richard “Bigo” Barnett
Speaker Nancy Pelosi Letter Stealer

Picture reproduced in charging documents.

A rioter entered the restricted office area of House

Speaker Nancy Pelosi and took photographs with his feet propped up on
furniture. Those photos were circulated on numerous online media
platforms which identified the individual as Richard Barnett of Arkansas.

Capitol Police searched law enforcement

databases including Department of Motor Vehicle records and obtained a
photograph and biographical information for Barnett, confirming that the
individual in the news photographs did in fact appear to be Barnett.
The photo of Barnett seated inside Pelosi’s office shows an
American flag lying on an adjacent credenza. Barnett is wearing a hat,
plaid jacket, blue jeans, and brown boots. Another photo depicts Barnett

163
Telegram Channel @nettrain
seated holding an envelope in his left hand addressed to The Honorable
Billy Long, 2453 Rayburn House Office Building, Washington, D.C.
20515 and a digital signature of Nancy Pelosi.
In another photo, an individual whose face is blocked by a flag
but appears to be Barnett based on his clothing is seated at a different
desk with his feet propped up holding an American flag and a cell phone.
Another unidentified individual in a brown jacket is sitting next to him
on a couch.

164
Telegram Channel @nettrain
Pictures reproduced in charging documents.

165
Telegram Channel @nettrain
 Video surveillance from a camera
positioned outside of the Speaker’s main office door captured individuals
entering and exiting the office. At approximately 2:30 p.m., several
unidentified individuals appear to try the door to the office, however the
door is locked. At approximately 2:33 p.m., an unidentified individual
forces open the door to the office. At 2:50 p.m., Barnett is captured on
surveillance video carrying an American flag and a cellular phone while
entering the doors which lead to the Speaker’s conference room. As he is
entering it, he is following behind the unidentified individual in the
brown jacket. At 2:56 p.m., Barnett is recorded leaving the main office
doors of the Speaker’s office space with only a phone in his hand.

On the same date, Barnett spoke to media

outlets in a video recording. In the recording, Barnett is wearing the
same hat and plaid jacket as worn inside of the Speaker’s office except
that Barnett appears to have removed his shirt.
Barnett is asked by a person off camera how he obtained an
envelope he is holding, which was addressed to The Honorable Billy
Long. Barnett states “I did not steal it. I bled on it because they were
macing me and I couldn’t fucking see so I figured I am in her office. I
got blood on her office. I put a quarter on her desk even though she ain’t
fucking worth it. And I left her a note on her desk that says, ‘Nancy,
Bigo was here, you bitch.’”
In another photo taken outside on Capitol grounds, Barnett is
depicted holding the envelope he purported to have taken from Speaker
Pelosi’s office. Based on the writing on the envelope, the envelope
appears to be the same envelope Barnett was photographed holding
inside of the office building.

166
Telegram Channel @nettrain
 Picture reproduced in charging documents.

On January 8, 2021, Barnett waived his

Miranda rights and participated in a custodial interview with law
enforcement. During the interview, Barnett admitted driving from
Arkansas to Washington, D.C. to participate in the “Stop the Steal”
Rally.
During the course of the protests, Barnett stated he was pushed
inside of the Capitol by a large crowd. Barnett returned the above
pictured envelope to law enforcement during the interview. Law
enforcement had previously learned from Speaker Pelosi’s staff that the
envelope was empty at the time it was taken from Pelosi’s office.
On January 8, 2021, law enforcement conducted a search at
Barnett’s residence pursuant to a search warrant issued by a Chief U.S.
Magistrate Judge in the Western District of Arkansas. During the
execution of that warrant, law enforcement observed the empty
packaging for a ZAP Hike n’ Strike Hiking Staff High Voltage Stun

167
Telegram Channel @nettrain
Device inside the home. This packaging is shown in the below
photograph.

Picture reproduced in charging documents.

On January 11, 2021, the FBI received a tip that Barnett carried
a stun gun in the Capitol. Upon reviewing the photos again, the FBI
determined that the ZAP brand is visible on the stun gun tucked into
Barnett’s pants. Based on the branding noted on the weapon, and its
appearance, the weapon appeared to be a ZAP Hike N Strike 950,000
Volt Stun Gun Walking Stick.[69]

168
Telegram Channel @nettrain
 Picture reproduced in charging documents.

According to a January 24, 2021 article in the Arkansas

Democrat Gazette newspaper, unsealed search warrant documents
indicated that when authorities searched Barnett’s house on January 8,
Barnett “commented that the agents may not find much at his house
because he had people packing it up the night before."
Photos from the Capitol showed images of Barnett using a
smartphone. Authorities were searching for the black cellphone Barnett
had with him when he entered Pelosi's office. The FBI believed Barnett's
cellphone was used during the commission of a crime and may have
evidence of that crime on it but were unable to locate it.
During a January 15, 2021 detention hearing in federal court in
Fayetteville, an FBI Special Agent said Barnett told the agents, "If y'all
go out there and do a search warrant, you can see all my shit. You ain't

169
Telegram Channel @nettrain
going to find nothing out there.... I assure you I'm a smart man. There's
not anything there."

"He turned off location services on his

phone, he paid only in cash, and he covered his face,” an Assistant U.S.
Attorney said during the hearing. “He then hurried home and set about
removing any items of evidentiary value, including his phone. Make no
mistake, by then he knew law enforcement was coming for him."

Based on a receipt from Bass Pro Shop in

Rogers, Arkansas, Barnett purchased a stun gun, pepper spray and
walkie-talkie radios in late December, agents testified during the
detention hearing.
Other items inventoried at Barnett's home included three tablet
computers, a Walmart receipt, a Nighthawk Custom hat (Nighthawk
Custom is a gun manufacturer based in Berryville, AK) and an
Anchorage Expedition jacket.[70]

During the second impeachment trial for Trump, video of

Barnett with the stolen letter, and a photo of the note he wrote and left in
Pelosi’s office were presented during the proceedings on February 10,
2021. Screenshots are below.[71]

170
Telegram Channel @nettrain
CHARGES FILED
1. Obstruction of an official proceeding;
2. Aiding and abetting;
3. Entering and remaining in a restricted building or grounds with a
deadly or dangerous weapon;

171
Telegram Channel @nettrain
4. Disorderly and disruptive conduct in a restricted building or
grounds with a deadly or dangerous weapon;
5. Entering and remaining in certain rooms in the Capitol Building;
6. Disorderly conduct in a Capitol building;
7. Parading, demonstrating, or picketing in a capitol building; and
8. Theft of government property.

172
Telegram Channel @nettrain
Larry Rendall Brock
“Zip Tie Guy #1” turned in by his ex-wife

A screen capture from Twitter from the day after the riots, January 7, 2021[72]

Video and images of a man (the “Subject Male”) dressed in

military combat gear, with plastic restraints hanging from his belt,
apparently directing other rioters in a coordinated and tactical manner on
the Senate Chamber floor on January 6, 2021 were circulated widely.
The FBI issued a Be on the Lookout alert including the Subject Male.

Picture reproduced in charging documents.

The U.S. Capitol Police also published alerts for “Persons of

Interest in Unrest-Related Offenses,” which included the Subject Male’s
image.

173
Telegram Channel @nettrain
 On January 8, 2021, the Subject Male’s ex-wife (“Witness #1”)
called the FBI National Threat Operation Center to report that she
recognized her ex-husband, Larry Rendall Brock, in a picture taken
inside the Capitol, and that the two had been married for 18 years. She
also stated that she recognized Brock wearing a military-style helmet,
khaki pants, gray and black fatigues over a military vest, and a patch
from his military service.

According to the federal affidavit, Witness

#1 stated, "I just know that when I saw this was happening I was afraid
he would be there. I think you already know he was there. It is such a
good picture of him and I recognize his patch."

On January 8, 2021,
another witness (“Witness #2”) contacted the FBI to report that they
recognized Brock and wrote, "It looks like him and he has pilot wings on
his chest in this picture. He was an A-10 pilot. Worked at L3, and he still
has contacts that work with L3 that knew he was flying to Washington,
D.C."

174
Telegram Channel @nettrain
 Law enforcement agents retrieved a
driver's license photo of Brock, and confirmed that Brock's driver's
license photo bore a resemblance to the man in the picture.
On January 6, 2021, a video titled, "Inside the U.S. Capitol as
Trump supporters storm building - ITV News eyewitness report" was
posted on YouTube. A man bearing a resemblance to Brock can be seen
walking out of the Speaker of the U.S. House of Representatives Nancy
Pelosi's office.
An open source search of social media depictions from January
6, 2021, uncovered additional footage of Brock inside the U.S. Capitol.
The below picture shows Brock outside the office of House Speaker
Nancy Pelosi.

Picture reproduced in charging documents.

On January 9, 2021, Ronan Farrow of The

New Yorker magazine published an article titled, "An Air Force Combat

175
Telegram Channel @nettrain
Veteran Breached The Senate"[73]. In the article, Farrow stated that two
of Brock' s family members identified him as the man wearing a
military-style helmet, body armor, and holding flex-cuffs in the widely
circulated pictures.
An image of Brock on the Senate Chamber floor was included as
evidence during Day 2 of Trump’s second impeachment trial.

Image presented during Trump’s second impeachment trial, February 10, 2021.

According to a January 14, 2021 article in the Dallas Morning

News, the company where Brock had been employed at the time of the
riots, L3Harris Technologies, is a defense contractor. His duties included
60-day stints overseas. He was still working for the company as of 2019,
according to court records. At the time the article was published, January
14, 2021, an L3Harris spokesman said all he could confirm was that
Brock no longer worked for the firm.

176
Telegram Channel @nettrain
Courtroom sketch artist Dan Crowell made this image of Brock during
Brock’s detention hearing at the Eldon B Mahon Courthouse on
Thursday, Jan. 14, 2020.[74]

CHARGES FILED:
1. Knowingly entering or remaining in any restricted building
or grounds without lawful authority; and
2. Violent entry and disorderly conduct on Capitol grounds.

177
Telegram Channel @nettrain
Jacob Anthony Chansley (a.k.a. Jacob Angeli)
Also known as #VikingMan or the “QAnon Shaman”

Media coverage of these events showed one of the rioters who

entered the Capitol Building dressed in horns, a bearskin headdress, red,
white and blue face paint, shirtless, and tan pants. This individual carried
a spear, approximately 6 feet in length, with an American flag tied just
below the blade. Twitter photos show this individual in the halls of
Congress and standing on the dais inside the Senate chamber.

178
Telegram Channel @nettrain
 Picture reproduced in charging documents.

Several media outlets subsequently identified this individual,

who was sometimes tagged as #VikingMan as Jacob Anthony Chansley,
a.k.a. Jake Angeli. He also was dubbed the “QAnon Shaman” for his
vocal conspiracy beliefs and personal behaviors.

Chansley was also been identified by law

enforcement through open source data bases, including his Arizona
Department of Motor Vehicles driver’s license photo.
The federal affidavit was filed with the below photos of
Chansley inside the Capitol Building and the Senate Chamber.

179
Telegram Channel @nettrain
Pictures reproduced in charging documents.

180
Telegram Channel @nettrain
 The U.S. Capitol Police published alerts for “Persons of Interest
in Unrest-Related Offenses,” which included the Subject Male’s image.

181
Telegram Channel @nettrain
 The photographs of Chansley in the
Capitol display unique attire and extensive tattoos covering his arms and
the left side of his torso. The FBI viewed pictures from Angeli’s
Facebook account posted on December 13, 2020, in which Chansley
bears the same distinctive attire and tattoos.

Chansley has a YouTube channel under

the name Jacob Chansley, on which a video from 2019 shows Chansley
with sleeve tattoos on the lower half of his arms consistent with the
sleeve tattoos Chansley displays in photographs taken in the Capitol.
Chansley was also identified wearing his outfit at previous
protests, and was featured in a November 6, 2020 article by Cronkite
News about Trump protests outside the election counting center in
Maricopa County, Phoenix.[75]

182
Telegram Channel @nettrain
 On January 7, 2021, Chansley called in to the Washington Field
Office of the FBI to voluntarily speak with law enforcement. Chansley
confirmed that he was the male in the face paint and headdress in the
Vice President’s chair in the Senate. Chansley stated that he came as a
part of a group effort, with other “patriots” from Arizona, at the request
of the President that all “patriots” come to D.C. on January 6, 2021.
CHARGES FILED:
1. Civil disorder;
2. Obstruction of an official proceeding;
3. Entering and remaining in a restricted building;
4. Disorderly and disruptive conduct in a restricted building;

183
Telegram Channel @nettrain
5. Violent entry and disorderly conduct in a Capitol building;
and
6. Parading, demonstrating, or picketing in a Capitol building.

184
Telegram Channel @nettrain
Nolan Cooke
Identified by his personal grooming

Picture reproduced in charging documents.

Beginning on or about January 7, 2021, investigative agencies

began receiving tips from the public related to the civil unrest and breach
of the Capitol. The FBI received at least three tips identifying Nolan
Cooke as having been involved in the breach of the Capitol.
An unknown individual (“Tipster #1”) reported the following
information (errors from original message are retained):

“On January 6, 2020 I opened my

snapchat around the end of the day to catch up and I noticed a guy I once
knew participated in the riots around the capital on January 6th. The

185
Telegram Channel @nettrain
guys name in Nolan Cooke, he is 22 and from… Texas. Nolan was in the
front lines of the riots and helped lead the charge of rioters breaking
through the police gates. On his Snapchat story, Nolan posted video of
him at the capital steps banging on the large brown doors with the end of
the American flag he was carrying. There is also video of him shoving

through a police encounter. He filmed the entire

footage of the charges on a GoPro he had hanging from his neck. He
then proceeded to post the picture attached to his Snapchat story. Nolan
is about 56 with long brown curly hair down to his shoulder. He was
wearing a Make America Great Again hat and was carrying a large
American Flag through the entire protest. He is of medium skin tone. I
do believe he had part of breaking in to the U.S. Capitol, but I did not
save any of his Snapchat stories to my phone. I looked the picture
attached below and found it in a U.S. media source after I saw it on
Nolans story. He did not say in his story if this was him,

but the similarities are uncanny.”

A contact name and number were provided for Tipster #1.
However, when the FBI attempted to contact this individual for more
information, the individual stated that they had not reported anything to
the FBI.

A second tipster (“Tipster #2”), whose

identity was known by the FBI, was interviewed and stated they were
familiar with an individual named Nolan Bernard Cooke who went to a
specific high school in Texas and used to work at Walmart.
Cooke posted on his Snapchat account videos of himself inside
of the Capitol on January 6, 2021. Cooke said on Snapchat that he was
wearing a GoPro inside the Capitol.

186
Telegram Channel @nettrain
 Cooke posted a video from a news source,
which Tipster #2 believed was CNN, that showed Cooke inside the
Capitol, and Cooke stated, “I made the news.”

Cooke posted on his Snapchat account on

the drive back from Washington, D.C. to Texas, stating that he was
staying in a hotel somewhere in Tennessee.

Cooke had since deleted all the Snapchat

videos and photos referenced above. Tipster #2 provided a Snapchat
username, email account, and phone number for Cooke. The FBI was
able to confirm that the phone number belonged to Cooke and that the
phone number is affiliated with his Snapchat account.

187
Telegram Channel @nettrain
 Tipster #2 believed the
individual pictured here and which was also known as photograph #9 on
the FBI's website was Cooke. However, the FBI has confirmed that the
person in that photograph was not Cooke.

On or about January 19, 2021, the FBI received a third

anonymous tip about Cooke’s activities at the Capitol. That person
(“Tipster #3”) stated, in pertinent part:

“Reporting on [Cooke’s presumed

girlfriend (“Person A”)] and Nolan Cooke a couple from… Texas. They
were both at the capitol that day and from the video Person A posted to
Instagram they at the very least made their way up the steps. Nolan has a
friend [“Person B”] whose [relative] works with my friend. The
[relative] said Nolan was wearing a go-pro the whole day recording
everything that happened and that he sent the video to [Person B].”

188
Telegram Channel @nettrain
 The FBI conducted
open source research of Cooke’s social media. An approximately 28-
second video that was uploaded on January 13, 2021, at around 2:00
p.m., to a TikTok account under the username of @nolan.Cooke98. The
video appears to show a crowd of individuals shoving their way through
a group of police officers (likely U.S. Capitol Police) in front of what
appears to be the east side of the Capitol. The video appears to have been
taken from a “GoPro”-style camera.
Law enforcement agents retrieved a driver’s license photograph
of Cooke, a resident of Texas, and confirmed Cooke bears a resemblance
to the pictures.

The law enforcement officer submitting

the federal affidavit (the “affiant”) observed in the TikTok video the
sleeve of what appears to be a denim jacket or shirt in the footage. The
affiant noted that they observed two photos of Cooke that were posted on
the “nolan_Cooke3” Instagram account on January 6, 2020. In both
photos, Cooke appears to be wearing a denim shirt or jacket.

Four screenshots from the TikTok video

are below showing the long brown hair and denim shirt or jacket,
followed by the two Instagram pictures of Cooke wearing a denim shirt
or jacket. In the fourth screenshot from the TikTok video depicted below,
it appears that the individual wearing the GoPro-style camera and with
denim sleeves is grabbing the arm of a police officer and interfering with
a law enforcement officer.
While reviewing the video, the affiant observed long brown hair
dangle in front of the camera lens similar to the long brown hair depicted
in Cooke’s driver’s license photo and images of himself on the Instagram
account “nolan_Cooke3.”

189
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

190
Telegram Channel @nettrain
 According to open source information, the
first photograph of Cooke (with a female believed to be Cooke’s
girlfriend) included a caption that noted, “I wouldn’t want anyone other
than you with me to take on the revolution.” The second photo had the
caption, “What a fucking day.”

191
Telegram Channel @nettrain
 On January 20, 2021, a U.S. Magistrate Judge for the Eastern
District of Texas authorized a search of Cooke’s premises and vehicle.
On January 21, 2021, law enforcement agents executed the search
warrant. Cooke agreed to be interviewed voluntarily; he was not under
arrest at this time and was not given Miranda warnings.

During the interview, Cooke made the

following statements and admissions:
a. A few days before January 6, 2021, Cooke saw a posting on
Twitter from Trump about the rally in Washington, D.C.,
scheduled for January 6, 2021.
b. On or about January 5, 2021, Cooke drove to Washington, D.C.,
with his girlfriend and a relative. On arrival to the city, Cooke’s
relative dropped Cooke and his girlfriend off at the Capitol
Building.
c. Cooke brought one or more firearms with him on the trip, but he
left those weapons in the relative’s vehicle and did not bring
them onto the Capitol Grounds.
d. Cooke came to the Capitol because he wanted to be heard.
e. Cooke was at the front of the crowd pushing against the officers
who were enforcing the restricted access to the Capitol Building
and Grounds.
f. Cooke pushed past police officers to get to one of the doors of
the Capitol Building. He used a flag pole to bang on a window.
g. Cooke denied entering the Capitol Building at any time.
h. Cooke confirmed that he filmed the video containing the four
still photographs included above and that his hair and arm are
depicted in those photographs.

CHARGES FILED:
1. Acts during civil disorder;
2. Entering or remaining on restricted buildings or grounds and
disorderly or disruptive conduct in or near restricted building or
grounds; and

192
Telegram Channel @nettrain
3. Unlawful activities on Capitol grounds.

193
Telegram Channel @nettrain
Daniel Egtvedt
Arrested after unrelated, anti-vaccination domestic disturbance

Picture reproduced in charging documents.

According to the FBI statement of facts for this case, at

approximately 2:47 p.m., an individual subsequently identified as Daniel
Egtvedt was first observed on the Capitol Grounds. He was standing at
the threshold of an exterior door to the Capitol Building, appearing to
nuzzle or rub his face and nose on the back of the man in front of him,
apparently attempting to wipe off some type of chemical irritant that was
sprayed on him.

The video, which was obtained from the

social networking application Parler, and published by ProPublica,
shows Egtvedt among a group attempting to gain entry to the Capitol
Building by pushing their way through a line of Capitol Police officers.
Other rioters nearby are heard saying, “Here we go, here’s the next
rush… there’s a push inside, with resistance,” as the rioters continue to
push further inside.

194
Telegram Channel @nettrain
 At approximately 3:08 p.m., Egtvedt was
observed on additional Parler video footage from inside the building.
Egtvedt was seen walking through the hallway as the male in the dark
top, directly beneath the arrow below.

Picture reproduced in charging documents.

At one point, Egtvedt appeared to be

leaving the building but then tried to reenter. A police officer (identified
as “Officer M.D.” in the affidavit) recalled seeing several other officers
attempting to stop Egtvedt and keep him from going back in the direction
of the Rotunda. One of those officers, U.S. Capitol Police Officer M.M.,
recalled Egtvedt rushed at her while screaming at her on three occasions
to shoot him.

Egtvedt grabbed Officer M.M. with both

of his hands and gained control of her left arm. Egtvedt would not let go,
so Officer M.M. swung her arm in a downward motion to break
Egtvedt's grip on her. Officer M.D. described Egtvedt as "generally non-
compliant, screaming, and incoherent" and "screaming at the top of his

195
Telegram Channel @nettrain
lungs." Officer M.D. tried to grab Egtvedt below the waist but could not,
due to Egtvedt's large size. He then attempted to push Egtvedt back in
the direction of the south exit door and "held on for dear life" due to
Egtvedt's size.

As more officers came to assist in moving

Egtvedt toward the exit, Egtvedt fell backwards and Officer M.D. was
dragged down with him. Officer M.D. injured his shoulder in the fall and
had to seek medical treatment.
Egtvedt was on the ground in the Hall of Columns for several
minutes before plain clothes law enforcement officers came over to
advise that other individuals were being removed from the Capitol and
they would need to exit, and Egtvedt was blocking the hallway those
officers planned to use to removed them from the building. As officers
attempted to pick Egtvedt up, he became non-compliant and “then fought
again.” According to Officer M.M., Egtvedt said he wasn’t going to
leave and splayed out his arms and legs while lying on his back in an
effort to inhibit law enforcement from lifting him up.
As part of the security apparatus at the Capitol, the Capitol
Police maintain numerous fixed-post security cameras in the buildings
and on the grounds. Egtvedt was captured on several cameras inside the
building

Hall of Columns Camera

Egtvedt is seen walking down the center of the aisle.

196
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

In the lower left corner of the image, an FBI Special Agent

dressed in tactical gear is directing Egtvedt toward the exit.

Egtvedt shook his head and proceeded to reenter the building,

where he was stopped by Officer M.M. who was wearing her USCP

197
Telegram Channel @nettrain
bicycle uniform. Egtvedt disregarded Officer M.M.’s commands, swatted
at her outstretched arm, and as mentioned above, grabbed at her left arm
and held on with both of his hands. After Officer M.M. was able to break
free, Egtvedt continued to proceed forward in the direction of other
officers. Egtvedt was then approached by Officer A.D., whom he
appeared to shove backward.

Pictures reproduced in charging documents.

As more officers came to assist, Egtvedt further resisted and

violently flailed his arms at officers as they attempted to subdue him.
Finally, with approximately five officers attempting to hold him back,

198
Telegram Channel @nettrain
Egtvedt attempted to charge at Officer M.M. At this point, as shown in
the image below, MPD Officer M.D. can be seen attempting to grab
Egtvedt by his waist to stop him from advancing.

While officers attempted to push Egtvedt away from Officer

M.M., Egtvedt and Officer M.D. fell against a column and onto the
ground as a result, causing injuries to Officer M.D.’s right shoulder.
Egtvedt appeared to grab at his neck after he hit the column.

199
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

Body-Worn Camera
A review of Officer M.D.’s body-worn camera showed
additional footage of Egtvedt physically resisting officers’ attempts to
keep him from traveling further down the Hall of Columns. At one point,
as officers moved forward to interdict, Egtvedt was heard shouting, “You
shoot me; shoot me” at the officers present.

200
Telegram Channel @nettrain
 201
Telegram Channel @nettrain
Vestibule Camera
Several minutes later, Officer A.D. and Officer C.R. assisted
Egtvedt to his feet and tried to walk him through the south side vestibule
and out through the south side door.

Picture reproduced in charging documents.

Egtvedt then fell to the ground as he was being walked out. After
several more minutes, other officers attempted to pick Egtvedt up and
further remove him from the Capitol Building. Egtvedt again attempted
to gain entry, and further fought with law enforcement.

202
Telegram Channel @nettrain
 Officer M.M. viewed the video footage from the vestibule
camera and identified herself as the officer in the USCP bike officer
uniform in the pictures above; however, she acknowledged that she could
not recall details of her second encounter with Egtvedt at the vestibule
door.
There are several additional instances where he is captured on
video or interviewed throughout his time on the Capitol Grounds on
January 6, 2021.

DLive Livestream Interview

He provided an interview to Tim Gionet a.k.a. “Baked Alaska,”
who was livestreaming video, posted to DLive. During the interview,
Egtvedt told the cameraman, “Everyone that’s outside, tell them to get in
here now.” Egtvedt further stated that they “shot me in the eyes twice,”
and said “everybody, if you’re seeing this, come down here now. We’re
not backing away; this is our house.” Egtvedt ends the interview by
screaming that members of Congress should “grow a spine or fucking
resign!” into the camera.

203
Telegram Channel @nettrain
 204
Telegram Channel @nettrain
Picture reproduced in charging documents.

205
Telegram Channel @nettrain
 Egtvedt was observed on several other occasions around the
exterior of the U.S. Capitol Building. Law enforcement included a
picture of Egtvedt from that DLive interview in an FBI “Be on the
Lookout” poster as “BOLO 76.” The “BOLO 76” photo was widely
disseminated to the public by the FBI Public Affairs Office on January
14, 2021.

On January 20, 2021, Witness #1

contacted the FBI National Threat Operations Center identifying “BOLO
76” as Daniel Egtvedt, and provided a telephone number (“Phone
Number 1”) and an address for Egtvedt. The next day, the FBI
telephonically interviewed Witness #1, who wished to remain
anonymous. Nonetheless, Witness #1 provided their own name and
explained that they “had known Egtvedt for over 10 years, and that
Egtvedt had been in Witness #1’s home in the past.”

Following the interview, the FBI

discovered Egtvedt’s Facebook, Pinterest, Twitter, and LinkedIn
accounts. Several of the photos posted by Egtvedt tagged a named
individual, which public record searches confirmed to be Egtvedt’s close
relative. Searches of Maryland property records show that the identified
close relative owned the property at that address.
Each of the social media accounts was public and contained
either a profile photo or photo of Egtvedt posted to the account. Below
are two photos obtained from Facebook and Twitter, respectively:

206
Telegram Channel @nettrain
 Facebook and Twitter photos reproduced in charging
documents.

The FBI compared photos and videos of Egtvedt and “BOLO

76,” and concluded the photographs and video all depict the same
person.
Furthermore, the multi-colored dress shirt worn in a photo
posted to Egtvedt’s Facebook on October 29, 2020 is consistent in color
and pattern with the shirt worn by Egtvedt during his interview that was
livestreamed at the Capitol Building, shown below

207
Telegram Channel @nettrain
 Shirt worn at Capitol matches Facebook. Pictures reproduced in charging documents.

Public record checks of Phone Number 1 indicate that number

was disconnected. However, public record checks revealed that another
phone number (“Phone Number 2”) was registered to “Egtvedt, Daniel”
at his home address.

AT&T Wireless records also show that a

device assigned to Phone Number 2 was present at the U.S. Capitol on
January 6, 2021. Specifically, the Phone Number 2 device first appears
inside the Capitol Building at 2:37 p.m., and appears to remain inside the
U.S. Capitol until 3:31 p.m.

208
Telegram Channel @nettrain
 Maryland driver’s license records show
that Egtvedt (white male, 6’2”, 320 pounds) was issued a Maryland
driver’s license in 2020, and listed him as residing at the same home
address. The records provide a specific date of birth, which is consistent
with the apparent age of Egtvedt in the social media videos and images
from January 6, 2021, and include a photograph that is very similar in
appearance to those video and images.[76]
A criminal complaint was filed under seal on February 9, 2021
(prosecutors in most cases have kept these cases sealed until they’ve
made an arrest).
On February 13, 2021, Maryland State Police officers were
summoned by one of Egtvedt’s relatives (“Witness #2”) because Egtvedt
was trying to stop an older relative of theirs from leaving home

to get a COVID-19 vaccine. Witness #2 called the

police, fearing Egtvedt would use “physical interference,” according to
court papers. During the encounter, Egtvedt allegedly told the officers
that he wouldn’t let his relative leave because Egtvedt believed COVID
vaccines would “eventually kill off a lot of people as a population
control method from the government.”

209
Telegram Channel @nettrain
 Egtvedt was not arrested on the spot as his
involvement in the January 6, 2021 Capitol riots was not known by the
officers, but when officers ran his name in their databases they
discovered Egtvedt was wanted in connection with the January 6 riots for
assaulting multiple police officers, obstructing Congress, and illegally
entering the Capitol. Later that day, more than a month after the Capitol
riots, he was arrested by state police and placed in federal custody.[77]
At the time of his arrest, Egtvedt had attempted to alter his
appearance by growing a goatee, as shown in the arrest photo.

CHARGES FILED:
1. Assault on a federal officer or person assisting a federal
officer;
2. Obstruction of law enforcement during civil disorder;
3. Obstruction of Justice/Congress;
4. Unlawful entry, disorderly conduct, and physical violence
into, in, or on a restricted building or grounds; and
5. Disorderly conduct and physical violence on Capitol
grounds.

210
Telegram Channel @nettrain
Derrick Evans
“DERRICK EVANS IS IN THE CAPITOL!”

Screen capture from Derrick Evans’ Facebook Live video, January 6, 2021.

On January 6, 2021, a recently elected member of the West

Virginia House of Delegates, Derrick Evans, streamed a Facebook Live
video showing himself joining and encouraging a crowd unlawfully
entering the Capitol.

The FBI identified Evans as the person

operating the livestream not only from context, but also by comparing
the voice of the individual operating the livestream to Evans' voice in
one of his political campaign videos. Evans' voice in the campaign video
is consistent with the voice of the individual operating the livestream.

211
Telegram Channel @nettrain
 Evans also identified himself by first and
last name during the recorded video capturing the offense. Evans deleted
the video from his Facebook page, but a Reddit user posted a copy of
Evans' livestream.

At the beginning of the video, Evans is

with a large crowd gathered outside a large, closed set of double doors of
the Capitol. The doors appear to be at least 12 feet tall, with an
ornamental metal design and a large window placed approximately 7 feet
high in each door. Almost immediately, Evans makes a comment to the
effect that he has pepper spray in his right eye. Approximately 4 seconds
into the video, a Facebook user adds a comment bubble onto the
livestream saying, "be some dummies to go inside so they all get locked
in & arrested".
Over the next few minutes, Evans can be heard shouting
statements including:

“There we go! Open the door!” then

begins to chant, “Our house! Our house!”
“We’re at the door now. There’s cops on the inside stopping us
now.”
"The door is cracked" as individuals in the front of the crowd
appear to pry open the doors and begin entering.
"We're going in!" and "They're in, they're in, they're in... "
"Move! Move! Move!"
Approximately 3 minutes and 50 seconds into the video, Evans
crosses the threshold of the doorway and enters the U.S. Capitol.

212
Telegram Channel @nettrain
 Approximately 3 minutes and 56 seconds
into the video, Evans shouts, "We're in, we're in! Derrick Evans is in the
Capitol!"
For the remainder of the video, Evans walks through the Capitol.
Approximately 4 minutes and 11 seconds into the video, Evans
approaches a U.S. Capitol Police officer and appears to fist-bump him
while stating, "We still respect you, all right?"
Approximately 4 minutes and 52 seconds into the video, Evans
shouts, "No destruction of anything! No vandalizing property, no
vandalizing!
Approximately 5 minutes and 15 second into the video, right
before it ends, Evans states, "I don't know where we're going. I'm
following the crowd."

The FBI viewed public posts on Evans'

Facebook page, some of which they state they believe “are potentially
relevant to Evans' motive and intent,” and were included in the affidavit.

213
Telegram Channel @nettrain
 On December 28, 2020, Evans posted the
below meme and added the comment, "Anyone else going to D.C. on Jan
6th?"

214
Telegram Channel @nettrain
 On December 30, 2020, Evans posted this meme and captioned
the post, "One week from today! Who's going?"

On December
31, 2020, Evans posted another meme and the text, "A STORM IS
COMING... AND THERE IS NOTHING THE LEFT CAN DO TO
STOP IT!"

215
Telegram Channel @nettrain
 On January 5, 2021, at 6:59 p.m., Evans
posted a photo of Washington, D.C. with the caption, "We have two
charter buses leaving the local area in 3 hours. I can't wait for tomorrow.
#StopTheSteal."
At 10:06 p.m., Evans posted a photo that appeared to show
individuals seated inside a charter bus with the caption, "Two bus loads
of Patriots from WV, KY, and Ohio are loaded up and heading to D.C.
#StopTheSteal."
At 1:21 a.m. on January 6, 2021, Evans posted a screenshot of a
tweet by President Trump with the caption, "This is why we are going to
D.C. #StopTheSteal."
In another video, Evans states, "They're making an
announcement right now saying if Pence betrays us you better get your
mind right because we're storming that building." He then laughs and
says, "I'm just the messenger, so don' t be hating on me. I'm just telling
you what I'm hearing right now on the ground." As described above,
however, the subsequent video of Evans entering the Capitol is no longer
posted to his Facebook account.

Evans then posted

an "official statement" to his Facebook page: “I want to thank everyone
for their prayers today. I am on the bus headed back home to WV. As
many of you know, for the last few years, I have traveled across the
country to film many different events. Today, I had the opportunity to
film another event in D.C. I want to assure you all that I did not have any
negative interactions with law enforcement nor did I participate in any
destruction that may have occurred. I was simply there as an independent
member of the media to film history.”
In its affidavit, the FBI pointed out that Evans classified himself
as a "political candidate" on his Facebook page and did not appear to

216
Telegram Channel @nettrain
identify himself as a member of the media.

The day after the riots, on January 7,

Evans’ attorney issued a letter stating, “Derrick Evans should not be
condemned as a member of the group of violent and destructive
protestors elsewhere at the Capitol that day. He had no involvement with
them and never witnessed their behavior…. Therefore, Delegate Derrick
Evans will not be resigning his public office. He stands firmly behind the
right of every American to be considered innocent until proven guilty.
He committed no criminal act that day….”[78]
Two days later, on January 9, 2021, Evans resigned from the
West Virginia Legislature in a one-sentence letter, effective immediately.
[79]

217
Telegram Channel @nettrain
CHARGES FILED:
1. Knowingly entering or remaining in any restricted building or
grounds without lawful authority; and
2. Violent entry and disorderly conduct on Capitol grounds.

218
Telegram Channel @nettrain
Philip Sean Grillo
Look, Mom. I’m on TV!

Pictures reproduced in charging documents.

Two individuals contacted the FBI tip line and stated that they
observed CNN footage of Philip Grillo inside the Capitol on January 6,
2021.4

On January 14, 2021, the FBI received an

anonymous tip from an individual (“Witness #1”) who stated that they
saw Philip Grillo “storm” into the Capitol on CNN footage. Witness #1
stated that they knew Grillo from growing up with him in New York and
said, “I saw him twice in CNN in two separate incidents”.

219
Telegram Channel @nettrain
On January 18, 2021, another tipster (“Witness #2”) contacted the FBI
and identified Grillo from CNN footage. Witness #2 included a video
and an image taken from their cell phone of the CNN footage where they
identified Grillo. Screenshots of the image and video Witness #2
provided are below, with Grillo circled in the first image.

Pictures reproduced in charging documents.

An FBI agent met with Witness #2 and showed them

surveillance footage from inside the U.S. Capitol. Witness #2 identified
Grillo in the closed-circuit television (“CCTV”) footage and stated they
have known Grillo for decades, growing up with him and going to the
same schools. Witness #2 stated they did not require any aids, such as
unique clothing, to identify Grillo, and stated they know his face.
Witness #2 also reported that Grillo was a member of the Knights of
Columbus. The CCTV image from which Witness #2 identified Grillo is
below.

220
Telegram Channel @nettrain
 In footage recorded from inside the Capitol, an individual
matching Grillo’s description and clothing can be seen in video from the
Senate Wing Door climbing into the Capitol through a broken window at
about 2:20 p.m. Grillo can be seen holding a megaphone in his hand after
entering the building. Screenshots showing Grillo’s entrance and him
holding the megaphone are below, with circles indicating Grillo and the
megaphone.

221
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

About 15 minutes after entering through the broken window,

Grillo was captured in a different surveillance camera that faces the
Capitol Rotunda interior. Grillo is seen with a crowd attempting to exit
the Rotunda and gain entry to a separate room that contained doors
leading outside, where more protestors were gathered. The crowd’s
movement is blocked by three Capitol Police officers. Eventually the
crowd, including Grillo, moves past the officers and toward the
Rotunda’s exterior entryway doors. Grillo was among the first few
individuals to get past the officers. Screenshots from the video footage
are below, with Grillo circled. At this point, Grillo no longer appears to
be holding a megaphone.

222
Telegram Channel @nettrain
 223
Telegram Channel @nettrain
 Another surveillance video pointed toward the Rotunda exterior
doors picked up the crowd after it bypassed the previously-mentioned
Capitol Police officers. Grillo and the large group of individuals
approach the exterior entryway doors, which were barricaded with
benches. Protestors outside were clearly visible through the door’s
windows. Grillo and the large crowd gathered at the closed doors while
the same three Capitol Police officers repositioned themselves and again
barred the crowd’s movement, this time preventing them from opening
the exterior doors. Grillo was able to move about the crowd, eventually
moving from the back to the front and directly in front of the officers.
The crowd ultimately pushed against the officers and against the doors,
forcing them open. At the time the doors were pushed open, Grillo was
standing toward the middle of the crowd and not making direct contact
with the officers. Two screenshots from the Rotunda exterior doors
footage are below, with Grillo indicated.

Pictures reproduced in charging documents.

224
Telegram Channel @nettrain
Once the doors were opened, allowing more protestors inside the
building, Grillo briefly went through the doors only to re-enter the
Capitol moments later and remain inside the Capitol. Grillo can also
clearly be seen recording himself on his cell phone, a screenshot of
which is here, with circles to indicate Grillo and his cell phone.
In the same surveillance footage, Grillo can be seen wearing a
Knights of Columbus, St. Anne’s Council #2429, New York embroidered
jacket. The FBI conducted an open-records check of Grillo and
confirmed Grillo to be a member of the Knights of Columbus chapter
matching the jacket’s description. Additionally, as stated above, Witness
#2 reported to the FBI agent that Grillo was a member of the Knights of
Columbus. A screenshot from this footage is here.

225
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

In the below screenshot of video footage found on YouTube,

which was taken outside the Capitol and near an entryway, the back of
Grillo’s jacket can be more clearly seen. Grillo was with a crowd that is
shouting, “Fight for Trump.” This crowd was engaged in a physical
confrontation with uniformed officers at the entryway. Again, Grillo was
near the front of the crowd. The crowd, including Grillo, was eventually
driven back from the door when officers employed a chemical irritant.

226
Telegram Channel @nettrain
 From New York State vehicle registration
records, the FBI identified Grillo as the registered owner of a 2019
Chevrolet Traverse with New York State License Plates.

A License Plate reader in New York City

captured that specific License Plate number departing New York City at
approximately 9:30 p.m. on January 5, 2021, and returning on January 6,
2021 at approximately 11:20 p.m. A Secret Service camera located in
Washington, D.C. scanned that specific New York License Plate at
approximately 2:10 a.m. on January 6, 2021.

Grillo’s U.S. Passport Application from

March 7, 2017 includes a photograph of Grillo, which appears to be the
same person as the individual contained in the January 6, 2021 video
footage from inside the U.S. Capitol as described above.

According to records obtained through a

search warrant that was served on Verizon, on January 6, 2021, in and
around the time of the Capitol riots, a specific cellphone number was
identified as having used a cell site that includes the interior of the
Capitol Building.

Grillo’s mother, on her U.S. passport

application, listed that same phone number in the point of contact section

227
Telegram Channel @nettrain
as belonging to Grillo. That number is registered in Grillo’s mother’s
name, as are other phone numbers on the same Verizon account.
On November 11, 2020, Grillo posted a brief video from the
Facebook page of “Donald J. Trump” to his own page. Trump’s post was
captioned with “WE WILL WIN!” and a brief video saying to believe in
the impossible.

CHARGES FILED:
1. Unlawful entry on restricted buildings or grounds;
2. Violent entry and disorderly conduct on Capitol grounds; and
3. Obstruction of Justice/Congress.

228
Telegram Channel @nettrain
Andrew Hatley
Deny, deny, deny

Pictures reproduced in charging documents.

229
Telegram Channel @nettrain
 On January 6, 2021, at
approximately 4:18 p.m., a tip was received from a witness (“Witness
#1”), who identified one of the subjects who had entered the Capitol. A
Special Agent of the FBI contacted Witness #1, who identified Andrew
Hatley as having entered the U.S. Capitol Building. Witness #1 stated
Hatley had driven from his residence in South Carolina on January 5,
2020, in a red Ford Mustang, early 2000s model, to attend the protests.
Witness #1 had known Hatley for several years and provided the below
picture which Hatley had taken of himself and an unknown male subject
in front of a statue in the Capitol Building.
Witness #1 had obtained the picture from another witness
(“Witness #2”), who advised that they had obtained the photograph from
Hatley himself.

230
Telegram Channel @nettrain
 Witness #2 later identified the man on the
right side of that picture as being Andrew Hatley.
The FBI conducted a search of statues located in the Capitol
Building and located the statue of John Caldwell Calhoun, located in the
Crypt of the building, which is the same statue in the background of
Hatley’s photograph. An image of the statue is below.

Pictures reproduced in charging documents.

An Investigative Analyst with the FBI conducted an open source

search and located Hatley’s profile on Facebook. The profile name was
identified as “Andrew Duo Hatley”. A post on Hatley’s account stated,
“It has come to my attention that there was someone who looks
like me at the Capitol. I’d like to set the record straight. I don’t
have that kind of motivation for lost causes. I just don’t care
enough anymore, certainly not enough for all that.”
The first comment after the post came from a subject identified
as “SB Lamont” who stated “Welcome back”. This exchange, and
pictures of Hatley from his Facebook profile, are below.

231
Telegram Channel @nettrain
 A Special Agent for the FBI compared
pictures of Hatley in his Facebook profile pictures to the picture sent by
Witness #1 and noted that the hat Hatley is seen wearing in both pictures
appears to be the same.

On January 9, 2021, the FBI received

confirmation from Capitol Police that the subject wearing the hat in the
picture in front of the John Calhoun statute, reproduced above, was
observed on Capitol Police surveillance video inside of the Crypt at the
U.S. Capitol.

232
Telegram Channel @nettrain
 Witness #1 stated that Hatley shared his
geolocation with Witness #2 via the application “Life360” during
Hatley’s entire time in Washington, D.C. and had told Witness #2 he was
going to attend the protests against the certification of the election.
Life360 is a cellular phone application that allows individuals to track
the location of a cellular telephone if the individual has installed the
company’s app on their phone. Individuals can create an account with
Life360 that allows the user to share information, such as the location of
the user’s cellular telephone, with another user that has downloaded the
application.

Witness #1 identified Hatley’s cellular

telephone number for the FBI.
The FBI contacted legal counsel for Life360 and requested
confirmation that the phone number provided by Witness #1 was of
record with Life360. Life360’s legal counsel confirmed the number
provided to them had an active Life360 account.

A search warrant for the account was

obtained in the U.S. District Court for the District of Columbia. On
January 12, 2021, Life360 sent the FBI data from the account in response
to the warrant. An FBI Special Agent plotted some of the data into an
electronic map of Washington, D.C., which confirmed that Hatley’s
cellular telephone was at the U.S. Capitol Building during the riots on
January 6, 2021.
On January 11, 2021, Special Agents of the FBI interviewed
Witness #2. Witness #2 had a close relationship with Hatley. Witness #2
provided agents with three photographs that Hatley sent them, including

233
Telegram Channel @nettrain
the photograph of the individual with the black hat in front of the
Calhoun statue, reproduced above. Witness #2 identified Hatley as the
man on the right of the picture. Witness #2 also identified Hatley as the
man on the left of the below photograph wearing a green respirator mask
inside the U.S. Capitol.

Picture reproduced in charging documents.

On January 12, 2021, the FBI contacted Hatley at the telephone

number that was provided by Witness #1. That number is the same
number associated with the Life360 account. Hatley confirmed that it
was his only phone number.
When Hatley was asked about the events at the U.S. Capitol,
Hatley advised he was not sure how much he should say without legal
counsel because he could be in a great deal of trouble.

CHARGES FILED:

234
Telegram Channel @nettrain
1. Knowingly entering or remaining in any restricted building or
grounds without lawful authority;
2. Knowingly, with intent to impede government business or
official functions, engaging in disorderly conduct on capitol
grounds;
3. Engaging in disorderly or disruptive conduct on Capitol
buildings or grounds; and
4. Parading, demonstrating, or picketing in the Capitol buildings.

235
Telegram Channel @nettrain
Adam Johnson
#PodiumThief

Picture reproduced in charging documents.

A search of open sources revealed an

image credited to Getty Images, a visual media company, showing a
Subject Male (“Person #1”) appearing to carry the lectern with a large
seal reading “Seal Of The Speaker U.S. House Of Representatives
1789”. Person #1 can be seen with what appeared to be red facial hair,
wearing a gray jacket, blue knit cap with white lettering, and a backpack.

236
Telegram Channel @nettrain
 On or about January 6, 2021, an individual
(“Witness #1”) called the FBI to report that the individual in the
photograph was named Adam Johnson, and they shared a mutual friend.

On or about January 7, 2021, law

enforcement received information from U.S. Capitol authorities that the
Speaker of the House’s lectern was missing. According to the House of
Representatives’ curator, the Speaker’s lectern has a market value of
more than $1,000.

FBI research into government databases

revealed that an individual named Adam Johnson was associated with
residences in two cities in Florida, including one near the location
provided by Witness #1.

237
Telegram Channel @nettrain
 A January 7, 2021 article
published by Florida’s Sarasota Herald-Tribune contained a Facebook
post by a person with the username “Adam Johnson.” The man in the
photo was posing by a sign reading “Closed to all tours.” The caption on
the post, seemingly in response to the sign, says “No.”[80]

U.S. Capitol Police subsequently

identified the location of Johnson as inside the Capitol Building, likely
on the second floor in the hallway near the Old Senate Chamber. Capitol
Police also indicated that the “Closed to all tours” sign was consistent
with signs normally used in the U.S. Capitol building.

238
Telegram Channel @nettrain
 On social media, some users incorrectly
believed Johnson’s name was “Via Getty” as photos were often credited
as “Via Getty.”

A search of the Florida’s Department of

Motor Vehicles returned Johnson’s driver’s license photo, which
investigators reasonably believe to be Johnson.

CHARGES FILED:
1. Knowingly entering or remaining in any restricted building or
grounds without lawful authority;
2. Theft of government property; and
3. Violent entry and disorderly conduct on Capitol grounds.

239
Telegram Channel @nettrain
Edward Jacob Lang
THIS IS ME

Pictures reproduced in charging documents.

240
Telegram Channel @nettrain
 Beginning on or about January 7,
2021, investigative agencies began receiving tips from the public.
Multiple people identified Edward Jacob Lang as being involved in the
Capitol riots. The tips included photographs of Lang on the grounds of
the Capitol on January 6, 2021. At least one photograph from Lang’s
Instagram appears to have been posted at some point during or after the
attack on the Capitol, and depicts Lang wearing a black jacket with
numerous silver zippers and a ribbed pattern on the shoulders, standing
on the steps of the Capitol Building. Lang captioned the photograph
“1776 has commenced.”

On January 9, 2021, the FBI interviewed

Witness #1, a friend since childhood, who provided Lang’s Facebook
account and photos and video of Lang actively participating in the
Capitol attack. Witness #1 also provided a potential birth month and day

241
Telegram Channel @nettrain
for Lang and believed Lang was born in either 1995 or 1996. Law
enforcement agents retrieved a New York driver’s license photograph of
Lang and Witness #1 confirmed the person in the photograph was Lang.
Witness #1 also provided this photo and video from Lang’s
Facebook showing him and a large crowd at the lower west terrace door
of the Capitol on January 6, 2021.

Pictures reproduced in charging documents.

Lang posted on Instagram, which tagged the location as “Capitol

Hill” and showed Lang smiling and wearing a blue and white floral-
patterned shirt, which matches the shirt in the still shot from the video
referenced above. The photograph, shown below, appeared to be taken
on the Capitol grounds and the images in the background are consistent
with known images of the Capitol breach. The caption read, in part,
“Pepper spray really does wonders for your complexion #1776.”

242
Telegram Channel @nettrain
 Additional photographs

243
Telegram Channel @nettrain
provided by Witness #1 from Lang’s Facebook page included more
references to Lang’s participation in the attack on the Capitol.
On or about January 8, 2021, Lang posted a video on Instagram,
which appeared to be a compilation of multiple videos with the caption
“GIVE ME LIBERTY OR GIVE ME DEATH.” The video depicted the
following two moments:
The video initially showed Lang in a crowd saying “I ain’t done
yet.” Lang wore a black leather jacket with a blue floral-patterned shirt
underneath, consistent with the other images.

Pictures reproduced in charging documents.

244
Telegram Channel @nettrain
 As the video progressed, another video included in the
compilation showed an individual consistent with Lang with a green gas
mask on and the same black jacket and blue floral-patterned shirt
underneath. Lang appeared to film himself directly in front of law
enforcement personnel and to be pointing at them.

Pictures reproduced in charging documents.

245
Telegram Channel @nettrain
Screenshots of the stories Lang posted on Instagram were captured and
provided to the FBI by witnesses. One of the screenshots, shown here,
depicted an entrance to the Capitol guarded by law enforcement officers,
who were violently attacked by rioters attempting to gain entry into the
Capitol. The story had the words “THIS IS ME” and an icon pointing to
the front of the crowd.

Pictures reproduced in charging documents.

Several open source videos and

photographs show Lang violently engaging with law enforcement
officers as they attempted to keep rioters out of the Capitol.

246
Telegram Channel @nettrain
 A video on Twitter (that the screenshot depicted
below came from) shows an individual raising a riot shield over his head
as the crowd cheers and then violently slam the shield down on the
ground repeatedly near the officers. That individual is in a black jacket,
Metropolitan Police Department helmet, and gas mask consistent with
Lang in the photos above and is directly below the “This is me” sign
added to the video.

247
Telegram Channel @nettrain
 According to the federal affidavit,
photographs posted to Reuters’ online picture database show what
appears to be Lang carrying the protective shield and engaging with law
enforcement.
Photographs on Pacific Press Agency similarly show an
individual consistent with Lang near the arch as those around him strike
at the officers with poles, along with later close-up images of his face.
An open source search of social media uncovered several videos
and photographs of Lang with a dark and red colored baseball bat.
According to the federal affidavit, video posted to Facebook showed
Lang as he “swung, thrusted, and/or jabbed the bat at law enforcement
officers multiple times. In doing so, Lang struck at least the shields the
officers held in front of them. As the video progresses, others in the
crowd assist in the attack, with some throwing items and one individual
spraying the officers with a fire extinguisher.” In the below screenshot,
Lang is circled and an arrow points to the baseball bat raised in the air.

248
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

In a video posted by a Twitter account holder, Lang had a

conversation with an unidentified female ("UF"), which was streamed on
Instagram. The following is an excerpt of the conversation posted online:
UF: "So what do you think happens next?"
Lang: "Guns... That's it. One word. The 1st Amendment didn't
work, we pull out the Second. We're all civilized people and we love
going to work and praying to God on Sundays and having nice family
barbeques... and that was every single person there. No one wants to take
this and and die for our rights, but dying for our rights is the only option
that any person with a logical brain sees right now. This is it.”
On January 14, 2021, Lang posted a story to Instagram. Among
other things, he stated: “I want to use this time to say thank you for all
the people that have been reaching out, calling me a patriot.… Been
really amazing to have this impact on the community, going to keep on
fighting for you guys, we got some big things planned. We are not going
to let them take our Constitutional Liberties. Our God-given rights are
safe within the hearts of the patriots. So we won’t give up. You guys

249
Telegram Channel @nettrain
should not give up. Contact me if you want to be a part of the patriot
movement.”

CHARGES FILED:
1. Civil disorder;
2. Assaulting, resisting, or impeding certain officers;
3. Assaulting, resisting, or impeding certain officers using
a dangerous weapon;
4. Obstruction of an official proceeding;
5. Aiding and abetting;
6. Disorderly and disruptive conduct in a restricted
building or grounds with a deadly or dangerous weapon;
7. Disorderly conduct in a Capitol building; and
8. Act of physical violence in the Capitol grounds or
buildings.

250
Telegram Channel @nettrain
Kevin James Lyons
Made a map, claimed it was all a dream

Image reproduced in charging documents.

Following the Capitol riots, law

enforcement reviewed an Instagram account under the account name

251
Telegram Channel @nettrain
@chi_hvac, which appeared, and was later confirmed to belong to Kevin
James Lyons. The main profile page of this account lists the name "
Kevin Lyons." Posted on this account, among other things, was the
above photo which appeared to be a screenshot of a map tracing a route
from Lyons' home in the vicinity of Chicago, Illinois, as marked on the
map and confirmed in law enforcement databases, to the Washington,
D.C. area.
Beside the posting was a post that read "I refuse to tell my
children that I sat back and did nothing. I am heading to D.C. to STOP
THE STEAL!"
The same Instagram account posted the below photo
(reproduced in charging documents) depicting a sign that read "Speaker
of the House Nancy Pelosi" and with the comment under it "WHOS
HOUSE?!?!? OUR HOUSE!!" The image appears to capture the area
outside of Pelosi' s office within the Capitol.

On January 8, 2021, Lyons was

interviewed by FBI agents in Chicago at his residence in Illinois. During
the interview, detailed in the federal affidavit, Lyons provided this
information:
a. Lyons acknowledged that he was in Washington, D.C. on
Jan 6, 2021, 2021, but was evasive about whether he
entered the Capitol Building.
b. Lyons stated that he "100% guaranteed, without
incriminating himself” that he saw nothing being
damaged.

c. He further stated that “in a dream

he had, he saw a lot of banging on doors, paper being
throwing about, and a mob of people.” According to
Lyons, “in the dream, people really didn't have much
choice of where they were going because of the mob.”

252
Telegram Channel @nettrain
 d. Lyons advised that if he were
inside, he was inside for approximately 45 minutes.

e. Lyons was
shown the photo referenced above that read "Speaker of
the House Nancy Pelosi" at which time Lyons stated,
"Wow you are pretty good that was up for only an hour."
Law enforcement understood Lyons' statement to be
expressing surprise that law enforcement officers had
found and observed this photograph on his Instagram
account because it had only been posted on his account
for one hour before it was removed. Lyons then stated
that he can't guarantee that he posted it.
f. Lyons confirmed that @chi_hvac was his Instagram
account and @hydra_shoc was his Twitter account.
When subsequently asked whether he still had the picture
discussed above on his phone' s camera roll, Lyons said yes and showed
the agents his phone. The photo on Lyons' phone appeared to be the
same photo above that was previously posted and observed on Lyons'
Instagram account. Lyons also displayed a nearly identical second
picture of the wooden plaque and a video.

The video was of a group of people

walking through what appeared to be the Capitol Building. When asked
whether he would be willing to give the FBI agents a copy of the video,
Lyons said the file would be too big, and offered to upload his videos to
YouTube and email the links to the agents.

253
Telegram Channel @nettrain
 On January
9, 2020, an FBI Special Agent received an email from an email address
that included Lyons's first and last names. The email stated, "Hello Nice
FBI Lady, Here are the links to the videos. Looks like Podium Guy is in
one of them, less the podium. Let me know if you need anything else.

254
Telegram Channel @nettrain
Kevin Lyons." [“Podium Guy” likely referred to Adam Johnson, a rioter
discussed previously in this chapter.]

One link showed a video of people

walking in what appeared to be a hallway of the Capitol Building. The
Special Agent recognized the voice of Lyons speaking throughout the
video. Another link opened to a video of a group of people walking in
the Rotunda of the Capitol Building.
During the January 8, 2021 in-person interview with Lyons at his
home, Lyons also admitted to traveling from Chicago to Washington,
D.C. to attend President Trump's rally. Lyons described himself as a
tourist at the events and said that he had live streamed his experiences.

According to Lyons, on January 6, 2021,

he took an Uber to the Washington Monument where the rally was held.
He attempted to wear his level 3 Kevlar vest, but was unable to fit it over
his sweatshirt.
Lyons indicated that the rally was the only event he planned on
attending that day. Lyons stated that while he was at the rally, he walked
along Pennsylvania Avenue and heard "flash bangs" and saw

people walking toward him with red faces. The

crowd of people continued to push toward the Capitol Building. Lyons
claimed that there was very little he could do to escape the crowd
because he weighed 140 pounds. Lyons indicated that as he neared the
Capitol Building, he saw people tearing up scaffolding and people
climbing up the Capitol Building walls. Lyons stated that he walked up
the stairs of the Capitol Building and entered it through its rear doors. He
claimed that he did not enter through a window.

255
Telegram Channel @nettrain
 Lyons stated that once he was inside the Capitol Building, he
walked to the Rotunda where he took a moment to look at the statues and
get his bearings. Lyons indicated that he then walked up an interior
staircase to the second floor, but that he did not go into the House of
Representative' s Chamber because he did not know where it was
located.

Lyons stated that he stayed primarily in

the hallways, but did enter the "big boss" office. Lyons was asked if this
was a reference to Representative Nancy Pelosi and he stated yes. Prior
to entering Pelosi's office, Lyons indicated that he took a picture of the
plaque located outside of Representative Pelosi' s office and uploaded the
image to his Instagram account.
Lyons explained that Pelosi's office was a "good size" office and
there were approximately 20 to 30 people in it. He saw a broken mirror,
but stated it was broken before he entered the office.
Lyons claimed that while he was in Pelosi's office, a Capitol
Police Officer entered with his "40mm" pistol drawn. Lyons indicated he
immediately raised his arms above his head. Lyons stated that the officer
told him to get out and Lyons immediately left the office.

As he made his way to the first floor,

Lyons indicated that the second floor was filled with tear gas and that he
passed by several officers with AR-15 rifles. After exiting the Capitol
Building, Lyons stated that he went directly to his vehicle and left
Washington, D.C.

CHARGES FILED:
1. Entering and remaining in a restricted building;
2. Entering and Remaining in Certain Rooms in the Capitol
Building; and
3. Disorderly conduct in a Capitol building.

256
Telegram Channel @nettrain
Anthony R. Marrioto (a.k.a. Tony Mariotto)
Have you seen this man?

Picture reproduced in charging documents.

257
Telegram Channel @nettrain
 On January 6, 2021, a concerned citizen
(“Citizen 1”) submitted an online tip to the FBI National Threat
Operations Center alleging that Anthony R. Mariotto was inside the
Capitol during the riots.

On January 10, 2021, law enforcement

interviewed Citizen 1 by phone, who said they knew Mariotto personally
for over one year and that they were friends with or followed Mariotto
on social media, specifically Facebook. Citizen 1 reported that they had
seen photos of Mariotto in the Capitol Building posted to Mariotto’s
Facebook page.

Citizen 1 also stated that Mariotto recently

deleted his Facebook account, but that Citizen 1 had taken screenshots of
the photographs and saved them before the account was deleted,
including a screenshot of one of the photographs.

258
Telegram Channel @nettrain
Mariotto is clearly depicted in the screenshot Citizen 1 provided. The
screenshot depicts Mariotto in the Senate Chamber with the following
caption “I’m in [sic] And there are just a few [sic] This is our house”.
The photograph appears to be a selfie, which indicates Mariotto took the
photograph himself, most likely with a cellphone. The photo depicts the
Senate floor in the background from a raised perspective, indicating that
Mariotto was present in the Senate gallery.

Based on Mariotto’s Florida driver’s

license photograph, law enforcement positively identified the individual
in the screenshot as Anthony R. Mariotto, a.k.a. “Tony”, with an address
in Florida.

The FBI verified through law enforcement

database checks that Anthony R. Mariotto has a registered address in
Florida.

259
Telegram Channel @nettrain
 On January 14, 2021, a Special Agent
interviewed Citizen 1 over the phone. Citizen 1 stated they also observed
at least four videos of Mariotto inside the Capitol on January 6, 2021 that
were posted to Mariotto’s Facebook page prior to it being deleted.
Citizen 1 also stated they observed video of Mariotto’s wife in
Washington, D.C., on January 6, 2021, on Mariotto’s Facebook page
prior to it being deleted.
On January 16, 2020, a Special Agent with the FBI located
Mariotto in Georgia and interviewed Mariotto over the phone. At the

start of the conversation, the Special Agent

confirmed that he was in fact speaking with Mariotto when Mariotto
identified himself as “Tony.” During the call, Mariotto also
acknowledged that the FBI had his correct Florida address. Mariotto

admitted that he was present inside the Capitol

during the riots that took place on January 6, 2021.
Mariotto stated he was in Washington, D.C. with his wife and
listened to Trump’s speech, after which he gathered with the crowd
outside the Capitol. Mariotto claimed he thought he “was being part of
history,” and told the Special Agent that he walked through the Capitol
chanting “USA.” Mariotto conceded he knew he was not allowed to be
in the Capitol, and stated he would accept full responsibility for his
actions.

Mariotto was instructed to immediately

return to Florida, and was advised that criminal charges against him were

260
Telegram Channel @nettrain
likely forthcoming.

On January 19, 2021, Mariotto voluntarily

met with an FBI Special Agent and provided the agent with his phone.
Pursuant to a search warrant, the FBI processed Mariotto’s phone.
Within the phone is the selfie photograph Citizen 1 observed on
Facebook, as well as other videos that were recorded inside the Capitol
Building during the events of January 6, 2021. After processing the
phone, the Special Agent returned the cell phone to Mariotto.

CHARGES FILED:
1. Entering and remaining in a Restricted Building or Grounds;
2. Disorderly and disruptive conduct in a restricted building or
grounds;
3. Entering and remaining in the Gallery of Congress;
4. Disorderly conduct in a Capitol building; and
5. Parading, demonstrating, or picketing in a Capitol building.

261
Telegram Channel @nettrain
Patrick Edward McCaughey III
BOLO #62-AFO

Pictures reproduced in charging documents.

On January 6, 2021, Metropolitan Police Department (“MPD”)

Officer Daniel Hodges was working his evening shift in his official
capacity, while wearing his official MPD uniform. During that shift,
Officer Hodges was directed to report to the Capitol to assist the U.S.
Capitol Police (“USCP”) in maintaining security of the Capitol Building.

262
Telegram Channel @nettrain
 Shortly before 3:00 p.m., Officer Hodges and many other MPD
and USCP officers gathered in the interior tunnel of the Capitol Building,
which leads out to an archway by the lower west terrace door.
According to the federal affidavit, video posted to YouTube
(“YouTube Video #1”) shows a large crowd of rioters pushing forward
into the tunnel to breach the line of police. Rioters used police riot
shields and police riot batons to combat uniformed law enforcement
officers. Unidentified rioters can also be overheard planning and
implementing a rotation of rioters to have the “fresh” rioters up front to
combat law enforcement, with various unidentified individuals yelling
“we need fresh patriots in the front” and “we need fresh people.”
Unidentified rioters are heard instructing the front line of rioters to make
a “shield wall” to prevent law enforcement from controlling rioters with
oleoresin capsicum spray (“O.C. spray”).
In the front line of rioters, a Subject Male (“Subject Male”) with
shoulder length light brown hair, slightly tinted eye glasses, and wearing
a brown in color hooded sweatshirt can be seen using a clear police riot
shield to physically push against the left side of Officer Hodges’ body.
Officer Hodges was pinned between the clear police riot shield being

263
Telegram Channel @nettrain
held by the Subject Male and the lower west terrace door. Officer
Hodges appeared to be loudly crying out in pain. As Officer Hodges was
being pinned to the door by the Subject Male, a separate rioter was
violently ripping off Officer Hodges’ gas mask exposing Officer
Hodges’ bloodied mouth. As the Subject Male was using the riot shield
to push against Officer Hodges, numerous other rioters behind and
around the Subject Male appeared to add to the weight against Officer
Hodges.

Pictures reproduced in charging documents.

On January 15, 2021, the Metropolitan Police Department

posted on Twitter asking for the public’s assistance in identifying the
individual that pinned Officer Hodges to the lower west terrace door on
January 6, 2021. The Twitter post included photos from video
screenshots of the assault of Officer Hodges.

264
Telegram Channel @nettrain
 On January 15, 2021, Witness #1
contacted the FBI National Threat Operations Center in reference to FBI
“BOLO 62-AFO”. “BOLO” is short for “Be on the Lookout” and the
designation “AFO” refers to “Assault on a Federal Officer.” Witness #1
identified Patrick Edward McCaughey III and provided his date of birth.
Witness #1 also indicated that Patrick McCaughey “has transitional
lenses and long hair which matches the image 62-AFO.”
On January 16, 2021, the FBI interviewed Witness #1 by phone,
who reported having known McCaughey since they were children.
Witness #1 last saw McCaughey in person approximately one year ago,
but heard from mutual friends that McCaughey attended the events at the
Capitol on January 6, 2021.

265
Telegram Channel @nettrain
 Witness #1 provided the FBI with a copy
of four pictures and a short video sent by McCaughey to mutual friends.
The pictures and video all appear to have been taken on a cellular phone
at the Capitol on January 6, 2021.
One of the pictures is a selfie-style picture that appears to have
been taken of McCaughey on the scaffolding of the west front of the
U.S. Capitol.
The FBI conducted a comparison of McCaughey’s selfie photo
and the photographs in FBI “BOLO 62-AFO,” and concluded the
photographs all depict the same person. The tan in color plywood
observed in the background of the selfie photo, the screen capture of the
video, and one of the other pictures provided are consistent with the
images being captured on the scaffolding on the west front of the U.S.
Capitol.

266
Telegram Channel @nettrain
 The FBI later reviewed U.S. Capitol
Police surveillance footage that contains the scaffolding on the south of
the Inauguration stage. Video surveillance at around 2:35 p.m. shows
McCaughey on the top level of the scaffolding (as circled below). This
individual appears to be holding an item in his hand and making motions
that are consistent with someone using a cell phone to take photos and
video. The location of this individual on the scaffolding is consistent
with the location of the person that filmed the short video provided to
Witness #1’s mutual friends by McCaughey.

267
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

Witness #1 directed the FBI to view a post by the MPD’s official

Twitter account, specifically to a comment posted in response to the
MPD’s Twitter post containing a video depicting McCaughey along with
other rioters in the tunnel just past the lower west terrace archway.
Witness #1 stated the video gives a clear depiction of McCaughey and
McCaughey is heard speaking in the video.[81]

268
Telegram Channel @nettrain
 Further review of the video
by the FBI revealed McCaughey briefly converses with the individual
that appears to be recording the video who asks McCaughey “what’s
your name, where are you from.” McCaughey initially states “none of
that is important right now” and the camera pans away leaving
McCaughey out of camera view. A voice is immediately heard on the
video, believed to be McCaughey, stating “Connecticut, Connecticut” as
if replying to the question “where are you from”.

The FBI noted in its affidavit that

McCaughey’s home address listed with the Connecticut Department of
Motor Vehicles is in Connecticut.
Witness #1 was able to provide multiple details about
McCaughey, such as information about his living situation, his residence,
and his work. The FBI has been able to confirm the accuracy of many of
these details through independent investigation.

269
Telegram Channel @nettrain
 Witness #1 provided a cell phone number
associated with McCaughey, and the FBI queried law enforcement
database records and discovered that phone number appeared to be
registered to McCaughey’s mother and serviced by AT&T.

The FBI created a detailed timeline of key

events related to McCaughey at the Capitol. At 2:26 p.m., McCaughey
appears to be Parading, Demonstrating, or Picketing in a Capitol
Building outside the perimeter of the Capital Grounds, as pictured in the
below image still from a body-worn camera. McCaughey is circled in the
image.

Pictures reproduced in charging documents.

At 2:35 p.m., USCP surveillance footage shows McCaughey

descending the scaffolding stairs toward the lower levels of the

270
Telegram Channel @nettrain
scaffolding.
At 3:05 p.m., USCP surveillance footage shows McCaughey
entering the tunnel past the lower west terrace archway which leads to
the Capitol, as shown in the still shot below with a circle. Around 3:06
p.m., the same camera footage shows McCaughey holding a clear police
riot shield, as shown in the still shot below with an arrow. Around 3:08
p.m., McCaughey disappears from the camera’s view while walking
toward the lower west terrace door with the clear police riot shield, the
same direction in which Officer Hodges and the other law enforcement
officers were attempting to block the entrance from the rioters.

271
Telegram Channel @nettrain
 McCaughey’s actions from 3:08 p.m. to
3:13 p.m. are primarily captured in YouTube Video #1. The time in
YouTube Video #1 is not displayed, so the FBI cross-referenced the
video time stamp based on a comparison with body-worn camera
footage.

Pictures reproduced in charging documents.

McCaughey is seen pushing the clear police riot shield up

against a uniformed law enforcement officer who is attempting to keep
rioters from entering the lower west terrace door. McCaughey states,
“Just go home dude” to the uniformed law enforcement officer and then
repeats, “go home.”

272
Telegram Channel @nettrain
 In YouTube Video #1, according to the FBI, what appears to be
the phrase “this guy is pretty hurt, let him back, let him back” is heard. It
is unclear if it was spoken by McCaughey or someone else. McCaughey
touches Officer Hodges helmet and lowers Officer Hodges’ helmet’s
shield.

Pictures reproduced in charging documents.

McCaughey taps the officer behind Officer Hodges on the

shoulder and appears to state, ”Hey you, hey you, this guy isn’t doing too
well,” appearing to be referencing Officer Hodges.
McCaughey appears to state, “Let this guy through, he’s hurt,
he’s hurt, let him back,” while McCaughey points to Officer Hodges.

273
Telegram Channel @nettrain
The officer behind Officer Hodges then nods and appears to wave in
help.
According to the federal affidavit, a few seconds later,
McCaughey appears to state “my shield” and he then hits the riot shield
up against another officer. McCaughey appears to state “get the fuck out
of here, move.”

At 3:13 p.m., McCaughey becomes visible on the body worn

camera of an officer that appears to be helping Officer Hodges or another
officer get off the front of the line. McCaughey can be seen striking the
officer (hereinafter “Officer 2”) with his shield a couple of times as
Officer 2 tries to then drive him back with his baton.

274
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

At 3:15 p.m., USCP surveillance footage then captures

McCaughey exiting the tunnel past the lower west terrace archway of the
U.S. Capitol, as circled in the still shots below.

275
Telegram Channel @nettrain
 Events at this time were also captured in a
separate video taken by a different person and posted to YouTube
(“YouTube Video #2”).
A third video posted on YouTube (“YouTube Video #3”) shows
events that took place near the lower west terrace door and captures
McCaughey exiting the lower west terrace archway. In the screenshots
below, one of which has an arrow added above him, McCaughey is seen
walking through the lower west terrace archway away from the lower
west door of the Capitol. (He appears as if something has irritated his
eyes.) As he exits, the crowd can be heard chanting “fuck Antifa.”

276
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

False Leads
During the course of the investigation, law enforcement received
multiple additional tips from around the country from people providing
information about whom they believed BOLO 62-AFO to be. Different
MPD officers who had seen the BOLO notice flagged two different
individuals as resembling the BOLO. Four private citizens submitted tips
identifying four different individuals as the individual pictured in BOLO
62-AFO.
The FBI compared video surveillance and still shots and
available photos of the individuals identified and determined that none
were the individual in BOLO 62-AFO. Beyond the tips, the FBI is not
aware of any evidence linking any of the individuals identified by the
tips or flagged by MPD officers to the crime described herein. In
addition, two anonymous tips appear to reference McCoughey. One
anonymous tipster identified him as Patrick McCoughey of Connecticut.
Another anonymous tipster from Connecticut identified him as Patrick
McCoy.
CHARGES FILED:
1. Assaulting, resisting, or impeding certain officers using a
dangerous weapon;
2. Civil disorder;
3. Obstruction of an official proceeding;

277
Telegram Channel @nettrain
4. Aiding and abetting;
5. Disorderly and disruptive conduct in a restricted building or
grounds with a deadly or dangerous weapon;
6. Engaging in physical violence in a restricted building or grounds
with a deadly or dangerous weapon;
7. Disorderly conduct in a Capitol building; and
8. Act of physical violence in the Capitol grounds or buildings.

278
Telegram Channel @nettrain
William D. Merry, Jr.
Speaker Nancy Pelosi sign stealer

Pictures reproduced in charging documents.

On or about January 8, 2021, multiple

individuals submitted tips online to the FBI to identify a person seen in a
widely circulated video by ITV News, a television news network based
in the United Kingdom. The video depicted rioters storming the Capitol
Building on January 6, 2021. The tipsters provided screenshots or stills
from the video. In the video, a group of individuals can be seen
streaming in and out of a room in the Capitol Building with a curved
entryway and a wooden sign above the doorway stating “Speaker of the
House Nancy Pelosi.”
The ITV reporter narrating the video can be heard saying at this
moment: “They breached and entered the Speaker’s office itself.”

279
Telegram Channel @nettrain
 A male with a graying beard, wearing a
red “Trump 2020” hat and red bandana around his neck (“Person #1”),
circled in the above screenshot of a federal affidavit, appears to be
standing near the same office with the curved entryway, except the
wooden sign is missing from above the door. Person #1 then appears to
be saying, “Here you go, here you go, brother” while holding up a
broken engraved piece of wood.

Standing next to Person #1 and holding up

the same piece of wood is a female with brown hair, round sunglasses,
and a white and gray winter hat (“Person #2”). The fractured wood
appears to be a piece of the same wooden sign previously seen above the
Speaker’s office, as the words “the House” and letters “Nancy” are
clearly visible.

In an online tip to the FBI, an individual

(“Tipster #1”) identified Person #2 in the video, as an individual named
Emily Hernandez from Missouri. The FBI contacted Tipster #1, who
advised that Tipster #1 and Hernandez had mutual acquaintances. Tipster
#1 recognized Hernandez through their association on social media.

On or about January 12, 2021, the FBI was

again informed through an additional tip (“Tipster #2”) that Person #2
was Hernandez. The FBI contacted Tipster #2, who confirmed via email
that Person #2 was Hernandez. They advised that they did not know
Hernandez personally but had mutual acquaintances connected through
social media. At the request of the FBI, Tipster #2 consulted the mutual
acquaintances that they shared with Hernandez and reported back that
Person #1 was believed to be Hernandez’s uncle. Tipster #2

280
Telegram Channel @nettrain
recommended that the FBI contact another individual (“Interviewee 1”)
who was introduced to Hernandez through mutual acquaintances but has
not seen her in several years.

On or about January 13, 2021, the FBI

contacted Interviewee 1, who advised that Hernandez had said she had
gone to Washington, D.C. with her uncle the day of the Capitol riots.

The FBI conducted research on public

source databases and identified Hernandez’s parents. Additional open
source searches revealed that Hernandez’s mother’s maiden name was
Merry. Using open source searches of Hernandez’s father’s Facebook
profile, the FBI identified a Facebook profile for a “Bill Merry” (with
username “bill.merry.90”) and discovered a photograph of Bill Merry
and a female who resembled Hernandez at a St. Louis Cardinals baseball
game.

On or about
January 18, 2021, the FBI confirmed through Tipster #2 that Hernandez
was the female standing next to Merry at the St. Louis Cardinals baseball
game, as seen here.

281
Telegram Channel @nettrain
 On or about January 20, 2021, the FBI
searched a government database and located a 2019 vehicle registration
in Merry’s name, which listed Merry as the owner of the vehicle with a
notation that the vehicle would transfer on death to an “Emily
Hernandez.”

Screen capture of the Speaker of the House sign that was included in a separate affidavit
for an unrelated person of interest from the Capitol riots.

On or about January 21, 2021, the FBI

discovered an image submitted by an individual (“Tipster #3”) who does
not know Merry or Hernandez personally but had submitted a
photograph of the Capitol riots to the FBI on or about January 10, 2021,
of what appears to be Person #1 outdoors in a crowd holding up the same
fractured wooden sign previously seen above the Speaker’s office, with
the words “the House” and letters “Nancy” visible. A woman resembling
Hernandez, with the same hat and sunglasses, can be seen standing
behind him.

282
Telegram Channel @nettrain
Pictures reproduced in charging documents.

283
Telegram Channel @nettrain
 The FBI conducted research in
government databases and learned that there was an individual named
William Merry associated with a specific residence in Missouri. A search
of government databases returned a driver’s license with a photograph of
Merry, which lists the same residence. In comparing various images, the
images of Person #1 are consistent with the physical appearance of
William Merry

On or about January 21, 2021, the FBI

served legal process on Facebook for username “bill.merry.90”. In
response to the legal process, Facebook returned two telephone numbers
attributed to the Facebook account (“Phone Number #1” and “Phone
Number #2”).

On or about January 21, 2021, the FBI

served legal process on AT&T for the two phone numbers identified by
Facebook. AT&T returned information indicating that Phone Number #1
was currently registered to a different individual and thus appears to be
an old telephone number of William Merry. Phone Number #2 was still
registered to William Merry at the same residence that appears on
Merry’s driver’s license and on the vehicle registration described above.

On or about January 14, 2021, the FBI

consulted with the House of Representatives’ curator to determine the
value of the Speaker’s name plate that had been posted above her office.
The curator estimated that the cost to replace the name plate would be
$870.

CHARGES FILED:

284
Telegram Channel @nettrain
1. Theft of government property;
2. Knowingly entering or remaining in any restricted building or
grounds;
3. Disorderly conduct which impedes the conduct of government
business; and
4. Disruptive conduct in the Capitol buildings.

285
Telegram Channel @nettrain
Richard Michetti
Called his ex-girlfriend a “moron” then she turned him in

Picture reproduced in charging documents.

On approximately January 7, 2021, a

witness (“Witness #1”) reported to law enforcement that Richard
Michetti, with whom Witness #1 had a prior romantic relationship, sent
several text messages and two videos to Witness #1 on January 6, 2021,
using his mobile phone. Portions of the videos show Michetti on the
grounds of the Capitol during the January 6, 2021, riots, while others
appear to have been filmed inside the Capitol Building.
On January 11, 2021, Witness #1 was interviewed by Special
Agents of the FBI and provided Michetti’s date of birth, his address, and
phone number.

Witness #1 stated Michetti believed the

election was stolen from Trump. The Special Agents reviewed the

286
Telegram Channel @nettrain
messages sent to Witness #1.
At approximately 4:26 p.m., Michetti texted Witness #1, “If you
can’t see the election was stolen you’re a moron,” and other messages.
Tipsters from across the country submitted images and videos of
the riots to an FBI online submission website. One of the images
submitted shows Michetti (circled in the below photo) standing on the
U.S. Capitol steps on January 6, 2021, among a large group of protestors
and rioters.

Pictures reproduced in charging documents.

The FBI showed the below enlargement to Witness #1, who

positively identified Michetti.

287
Telegram Channel @nettrain
 Based on a description of Michetti and of the clothing he was
wearing on January 6, 2021, additional video footage and images were
identified that captured Michetti inside various parts of the U.S. Capitol.
In each image, Michetti appears wearing a Chicago White Sox
baseball cap, blue backpack, dark jacket or hoodie, and tan pants. These
clothing items match the clothing worn by Michetti in the images shown
to Witness #1.

288
Telegram Channel @nettrain
Pictures reproduced in charging documents.
Near the Rotunda Door

289
Telegram Channel @nettrain
 Surveillance video of the Rotunda

The FBI obtained a printed copy of a

receipt from the Yotel Hotel in Washington, D.C. showing Michetti
checked into the Hotel on January 5, 2021, and checked out on January
6, 2021. This hotel is located approximately one block from the U.S.
Capitol grounds.

CHARGES FILED:
1. Obstruction of an official proceeding;
2. Aiding and abetting;
3. Entering and remaining in a restricted building or grounds;

290
Telegram Channel @nettrain
4. Disorderly and disruptive conduct in a restricted building or
grounds;
5. Disorderly conduct in a Capitol building; and
6. Parading, demonstrating, or picketing in a Capitol building.

291
Telegram Channel @nettrain
Matthew Ryan Miller
Fire Extinguisher-spraying, cape and cowboy hat-wearing rioter

Pictures reproduced in charging documents.

After the Capitol riots, the FBI collected

images obtained through open source media, including the below
screenshot of an Instagram post submitted by a cooperating witness
(“Witness #1”). The header contained a profile picture of the user and the
words "President's Park (White House)." Witness #1 had been familiar
with Matthew Ryan Miller for approximately seven years. Witness #1
confirmed the image was obtained from Miller’s Instagram account.

292
Telegram Channel @nettrain
 Although the Subject Male's face in the
Instagram screenshot was obscured by large goggle-style sunglasses and
a black bandana face mask with a skull design, Witness #1 was confident
the male suspect was Miller, because Miller has maintained the same
hairstyle for approximately seven years, and because the Subject Male in
the screenshot captured is consistent with Miller's appearance and
physical characteristics.
The federal affidavit for this case, three screenshots of which are
below, included evidence of Miller’s actions during the riots. In other
photos and video, Miller was dressed in a black cowboy hat, a
Washington Capitals red, white and blue jersey, and a black backpack
with blue trim on the shoulder straps. Miller was viewed discharging a
fire extinguisher at the steps leading to an entrance to the Capitol.

293
Telegram Channel @nettrain
 294
Telegram Channel @nettrain
 295
Telegram Channel @nettrain
Pictures reproduced in charging documents.

296
Telegram Channel @nettrain
 Witness #1 believed Miller was both the Subject Male deploying
a fire extinguisher in the images and the unmasked Subject Male.
Witness #1 further recognized Miller in another photograph wearing the
distinctive black cowboy hat, the Washington Capitals jersey, and both
the Maryland State Flag and the Gadsden Flag tied around his neck as a
cape or scarf.

Picture reproduced in charging documents.

297
Telegram Channel @nettrain
 Investigators located
a Facebook account which contained several photos they believed to be
of Miller, including this photo received through the FBI online tips.
The individual’s appearance in the Facebook photograph is
consistent with a photograph of Miller obtained from the Maryland
Motor Vehicle Administration.
Witness #1 was shown photographs from the Facebook account
believed to be used by Miller. In addition to positively identifying Miller
in those photographs, Witness #1 also provided the names of Miller’s

associates in photos from the Facebook account,

further demonstrating Witness #1’s familiarity with Miller.
The FBI conducted open source searches for photos of the
suspect unmasked, dressed in his distinctive clothing, and located the
below image of Miller unmasked, drinking from a bottle of water.

298
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

The FBI found other images of Miller wearing the distinctive

clothing and items, scaling the walls of the west side of the Capitol plaza
using a section of the temporary crowd control barriers as a ladder, and
assisting other crowd members with scaling Capitol walls and other
architectural obstacles on the U.S. Capitol grounds.

299
Telegram Channel @nettrain
 300
Telegram Channel @nettrain
 The FBI also reviewed the image below obtained from various
sources on Twitter, and believe, based on his distinctive dress, including
distinctive ski goggles/sunglasses, that it depicts Miller (circled in the
lower right corner of the image) on U.S. Capitol grounds.

Picture reproduced in charging documents.

CHARGES FILED:
1. Civil disorder;
2. Obstruction of an official proceeding;
3. Aiding and abetting;
4. Assaulting, resisting, or impeding certain officers using
a dangerous weapon;
5. Entering and remaining in a restricted building or
grounds with a deadly or dangerous weapon;
6. Disorderly and disruptive conduct in a restricted
building or grounds with a deadly or dangerous weapon;
7. Engaging in physical violence in a restricted building or
grounds with a deadly or dangerous weapon;

301
Telegram Channel @nettrain
 8. Disorderly conduct in a Capitol building;
9. Act of physical violence in the Capitol grounds or
buildings; and
10. Stepping, climbing, removing, or injuring property on
the Capitol grounds.

302
Telegram Channel @nettrain
Aaron Mostofsky
#CaveMan, son of a Brooklyn judge

Pictures reproduced in charging documents.

On January 6, 2021, the

Subject Male who identified himself to a New York Post reporter in an
interview was profiled in a New York Post article titled, “NYC man says
he stormed U.S. Capitol to fight stolen election.” In the video interview,
“Aaron” explained his actions by stating: “the election was stolen”, “we
were cheated”, and “I don’t think 75 million people voted for Trump. I
think it was close to 85 million”. “Aaron” continued to tell the
interviewer that he traveled from Brooklyn, New York.

303
Telegram Channel @nettrain
 The New York Post
video interview was conducted inside the Capitol Building, during which
“Aaron” is observed carrying what appears to be a U.S. Capitol Police
riot shield containing the U.S. Capitol Police logo, as well as wearing a
U.S. Capitol Police officer’s bullet proof vest labeled “Police”. In the
video interview “Aaron” states that he took a police riot shield that he
found on the floor. “Aaron” then motioned to the police vest on his chest,
in what appears to be him indicating that he also found that item on the
floor and took it into his possession. He also states that he found a hat on
the ground but he returned that item to a police officer because that
might be someone’s personal item. The police riot shield and police vest
are items of value belonging to the U.S., specifically the U.S. Capitol

Police. The riot shield is valued at $256.65. The

police vest is comprised of a carrier, body plates within the vest, and side
ballistics, with a total value of $1,905.00.

On January 7, 2021, the FBI located a

second article from the New York Post titled, “NYC man who breached
U.S. Capitol is son of prominent Brooklyn judge”. The article identified
“Aaron” as Aaron Mostofsky.

A search of New York State Department

of Motor Vehicle images associated with Aaron Mostofsky revealed a

304
Telegram Channel @nettrain
photograph that matched the depiction of the individual interviewed
within the U.S. Capitol known as “Aaron”.

The image from the New York State

Department of Motor Vehicles is provided here.

On January 7, 2021,
an FBI review of social media accounts belonging to Aaron Mostofsky
identified an Instagram account which contained videos from both inside
and outside the U.S. Capitol taken by a male believed to be Mostofsky.
One video posted on January 6, 2021, which appears to show Mostofsky
on a bus, and appears to be a self-taken video, was labeled “D.C. bound
stopthesteal”.

In a separate post made by Mostofsky at

approximately 6:09 a.m. on January 6, 2020, he indicates that he is “…
on this bus going to D.C.” Furthermore, when trying to coordinate
meeting up with a friend within the group on January 6, 2020,
Mostofsky’s message states: “If we find each other look for a guy
looking like a caveman.” He later states, in a likely reference to the
presidential election: “Even a caveman knows it was stolen.”

305
Telegram Channel @nettrain
 Further research identified Mostofsky’s
Facebook account in which he posted the comment on November 7,
2018: “Since the republicans lost the house I have the following
questions 1 when and where are we protesting/rioting…”

On January 8, 2021, a search warrant was

issued by the U.S. District Court for the Eastern District of New York
related to Mostofsky’s Instagram account. Review of these records show
additional posts regarding his presence in the Capitol Building.
In particular, the records show that on January 7, 2021, a photo
was sent to Mostofsky by another user showing him within the Capitol
carrying a riot shield containing the U.S. Capitol Police logo, as well as
wearing a Capitol Police officer’s bullet proof vest labeled “Police.” The
photo is consistent with images from Mostofsky’s news interview from
within the U.S. Capitol, including Mostofsky’s attire. The shared photo
is shown below.

306
Telegram Channel @nettrain
 Mostofsky received a message regarding the photo
saying: “Your famous.” In response, Mostofsky stated: “IK
unfortunately.” The sender asked: “why unfortunately.” Mostofsky
responded “Cause now people actually know me.” Mostofsky in this
conversation confirms that he is the person. During the same
conversation Mostofsky also describes his presence in the U.S. Capitol
stating: “But it was like I’m here now how did I get there.”
CHARGE FILED:
1. Civil Disorder;
2. Obstruction of an Official Proceeding and Aiding and
Abetting;
3. Assaulting, resisting, or impeding certain officers;
4. Theft of Government Property;
5. Entering and remaining in a restricted building or
grounds;
6. Disorderly and Disruptive Conduct in a Restricted
Building or Grounds;
7. Disorderly Conduct in a Capitol Building;

307
Telegram Channel @nettrain
8. Parading, Demonstrating, or Picketing in a Capitol
Building.

308
Telegram Channel @nettrain
Clayton Ray Mullins
#Slickback police assaulter

Pictures reproduced in charging documents.

On January 6, 2021, Officer A.W. of the Metropolitan Police

Department (“MPD”) was directed to assist the Capitol Police in
maintaining security of the Capitol Building. Between 4:00 p.m. and
5:00 p.m., Officer A.W. walked through the interior tunnel of the Capitol
Building and assumed a post in an archway that provided access to the
building’s lower west terrace. The approximate location of Officer A.W.
is noted below by the center circle.

309
Telegram Channel @nettrain
 On or about January 12, 2021, Officer A.W. was interviewed by
MPD as part of an investigation into assaults of officers occurring at the
U.S. Capitol on January 6, 2021.

During the interview, Officer A.W.

advised that he was pulled into the crowd and was kicked, struck with
poles, and stomped on by several individuals. Officer A.W. recalled
having his helmet ripped off his head and being stripped of his Civil
Disturbance Unit baton, gas mask (later recovered), and MPD-issued
cellular phone. Officer A.W. was maced after his mask was ripped off.
At some point during the assault, Officer A.W. was able to retrieve his
gas mask and one individual prevented the rioters from further assaulting
Officer A.W., allowing him to get on his feet and head back to the tunnel
area. Once Officer A.W. was back in the tunnel, another officer realized
Officer A.W. was bleeding from his head. Officer A.W. was
subsequently escorted to the east side of the Capitol Building before
being taken to the hospital. At the hospital, Officer A.W. was treated for
a laceration on his head which required two staples to close. Officer
A.W. also sustained a bruise to his right elbow.

Prior to investigating the assault of Officer

A.W., FBI investigators were already investigating the assault of fellow
MPD Officer B.M. (“B.M”). Minutes before Officer A.W. was pulled

310
Telegram Channel @nettrain
into the crowd of rioters, Officer B.M. was also assaulted at the Capitol
Building’s lower west terrace tunnel entrance.

As FBI investigators analyzed social

media content related to the assault of Officer B.M. and other MPD
officers, investigators discovered video footage and photographs of a
Subject Male (“Subject Male”) wearing a dark colored jacket, black
gloves and light blue jean pants, participating in the assault of Officer
A.W.

Numerous videos and photographs of the

Subject Male assaulting Officer A.W. were posted on Twitter, primarily
under the hashtag #seditionhunters. In addition, the hashtag #slickback
began trending in relation to the Subject Male and the slicked back style
in which he wore his hair. Portions of the below Twitter photos were
redacted by law enforcement to obscure another individual’s image.[82]

311
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

Footage of the Subject Male’s assault on

Officer A.W. was captured by body worn cameras of multiple MPD
officers. In the video, at least one other officer makes multiple attempts
to pull Officer A.W. away from the Subject Male, essentially engaging in
a battle of tug of war.

312
Telegram Channel @nettrain
 Video from the body-worn camera of a different officer, MPD
Officer D.P., captured the following image of the Subject Male a few
seconds later, as he continued to pull the leg of Officer A.W.

Pictures reproduced in charging documents.

313
Telegram Channel @nettrain
 On or about January 25, 2021, law
enforcement received a tip identifying the Subject Male as Clayton Ray
Mullins, which led to a review of his Kentucky driver’s license. The
biographical data from Mullins’ driver’s license provided information for
Mullin’s financial account at FNB Bank, Inc. (“FNB Bank”).

On or about February 5,
2021, investigators interviewed an FNB Bank employee (“Witness #1”)
who had an approximately 30-year banking relationship with Mullins.
Witness #1 was shown this photo, which captured Mullins at the lower
west terrace of the Capitol Building on January 6, 2021.[83]

Witness #1 identified the individual in the

photo as Clayton Mullins and advised Mullins was in the FNB Bank
lobby the day before, on February 4, 2021.

314
Telegram Channel @nettrain
 After speaking with Witness #1, law enforcement obtained
surveillance video footage from FNB Bank. The footage depicted
Mullins standing at a teller station in the lobby of FNB Bank on
February 4, 2021. On or about February 11, 2021, Witness #1 was shown
the below image of Mullins taken from the FNB Bank surveillance
video. Witness #1 identified the individual in the photograph as Clayton
Mullins.

FNB Bank, Inc. security surveillance footage from February 4, 2021

CHARGES FILED:
1. Assaulting, resisting, or impeding certain officers;
2. Obstruction of law enforcement during civil disorder;
3. Knowingly entering or remaining in any restricted building or
grounds without lawful authority;
4. Disorderly and disruptive conduct in a restricted building or
grounds;
5. Engaging in physical violence in a restricted building or
grounds; and
6. Violent entry and disorderly conduct on Capitol grounds.

315
Telegram Channel @nettrain
Eric Gavelek Munchel and Lisa Eisenhart
“Zip Tie Guy #2” and his Mom

Twitter post from January 6, 2021.[84]

During the attack on the Capitol, a Subject Male (“Subject

Male”) became known on social media as “Zip Tie Guy #2” (Larry
Brock, discussed previously in this chapter, was labeled Zip Tie Guy #1).
Zip Tie Guy #2 was wearing or displayed several distinctive items,
including:

a. a baseball cap that appears to have

been manufactured by Black Rifle Coffee Company,
depicting a rifle and a flag, with writing on the left side
of the cap near the back of the cap;
b. a patch on the center of his chest displaying the
"Punisher" comic book character;
c. a Tennessee "thin blue line" patch depicting the State of
Tennessee bisected by a horizontal blue line; and
d. a long-sleeve shirt in a fatigues pattern with black
rectangles on the upper sleeves.

316
Telegram Channel @nettrain
 The Subject Male is carrying plastic
restraints and an item in a holster on his right hip. Flex cuffs are used by
law enforcement to restrain and/or detain subjects. The Subject Male
appears to have a cell phone mounted on his chest, with the camera
facing outward, ostensibly to record events that day.
On January 6, 2021, the Subject Male was photographed
walking on the Capitol grounds with a white female, as depicted in
another photograph obtained via open source search.

317
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

On January 6, 2021, a person who appears to be the Subject

Male was recorded on a DLive LiveStream in a hotel lobby, without a
face covering, where he is wearing a long-sleeved shirt in a fatigues
pattern with a black rectangle on the upper sleeves, and a dark baseball
cap with writing on the left side of the cap near the back of the cap.

318
Telegram Channel @nettrain
Pictures reproduced in charging documents.

319
Telegram Channel @nettrain
 Members of the public worked to identify the Subject Male by
identifying markings he displayed during the Capitol attack.[85], [86], [87]

320
Telegram Channel @nettrain
 321
Telegram Channel @nettrain
 According to the federal affidavit, on
January 8, 2021, persons on various online platforms began to make
identifications of the Subject Male as Eric Gavelek Munchel, in part by
referencing his Facebook page

Munchel is depicted in the circular

Facebook photo below wearing what appears to be a white t-shirt with
the words "Kid Rock" or something similar on the left breast. "Kid
Rock's Big Ass Honky Tonk" is a bar located in downtown Nashville,
Tennessee. Munchel's Facebook page was taken down in the late evening
hours on January 9, 2021, and is no longer accessible.

Before Munchel's Facebook page was

taken down, various actors on social media captured screenshots of
Munchel depicted online. On the below Instagram post from August 18,
2020, a person who appears to be Munchel is depicted wearing what
appears to be a white t-shirt with the words "Kid Rock" or something
similar on the left breast. This same person, who appears to be Munchel,
also appears to have one or more brown wristbands on his right wrist.

322
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

Another photograph depicts a person who appears to be

Munchel, holding an American flag and a shotgun, standing in front of a
television playing a statement by Trump; a baseball cap that appears to

323
Telegram Channel @nettrain
have been manufactured by Black Rifle Coffee Company (depicting a
rifle and a flag) is resting on a small desk behind him; and wearing one
or more brown wristbands on his right wrist.

324
Telegram Channel @nettrain
 Picture reproduced in charging documents.

According to a law enforcement database search, Munchel's

address, as of approximately September 2019, was in Tennessee. He was
issued a driver's license from the State of Tennessee in 2020 with the
below photo.

325
Telegram Channel @nettrain
 The person who appears to be walking with Munchel on the
Capitol grounds is a white female. Law enforcement had probable cause
to believe that person was Lisa Eisenhart. A search of a law enforcement
database yielded the following photo for Eisenhart, with a date of birth in
1964.

Pictures reproduced in charging documents.

326
Telegram Channel @nettrain
 According to the government's
investigation, Munchel flew on Southwest Airlines from Nashville to
Florida, in March 2020. That flight was booked by a person named Lisa
Eisenhart with a date of birth of 1964.

According to a search of a law

enforcement database, Eisenhart's aliases include Lisa Marie Gavelek.
Munchel's middle name is Gavelek.
A further search of law enforcement databases revealed that
Munchel and Gavelek had a physical address in Florida, in common, and
a post office box address in Georgia, in common.

On January 6, 2021 law enforcement

encountered Munchel at the Grand Hyatt Hotel, address 1000 H Street
NW, Washington, D.C. Munchel gave law enforcement the name of Eric
Munchel when stopped. At the time, Munchel was wearing camouflage
pants wearing a black holster containing what appeared to be a handgun.
Law enforcement interviewed Munchel and identified that he was
carrying a black and yellow "Taser Pulse" taser that emits an electric
shock. Munchel stated that he possessed the taser for self-protection as
he had participated at the pro-Trump rally.
A video surveillance camera at the Grand Hyatt Hotel captured
Munchel and Eisenhart walking out of the hotel at 12:37 p.m. on January
6, 2021. The video depicts Munchel wearing a black baseball hat, dark
clothing, boots, and a decal in the middle of his chest, which is consistent
with the clothing he is observed wearing at the Capitol. Moreover,
Eisenhart is wearing the same clothing that she is seen wearing at the
Capitol while standing with Munchel.

327
Telegram Channel @nettrain
 Picture reproduced in charging documents.

A screenshot from a cell phone video taken from inside of the

Capitol Building depicts Munchel and Eisenhart walking together up the
stairs. The clothing that both individuals are wearing is consistent with
what both individuals wore while leaving the hotel.

328
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

On Day 2 of Trump’s second impeachment trial, February 10,

2021, images of Munchel were included as evidence to illustrate the
events of the Capitol attack on January 6, 2021.

329
Telegram Channel @nettrain
 Image presented during Trump’s second impeachment trial, February 10, 2021.

CHARGES FILED FOR EACH:

1. Obstruction of an official proceeding;
2. Knowingly entering and remaining in a restricted building
and grounds;
3. Violent entry or disorderly conduct; and
4. Aiding and abetting.

330
Telegram Channel @nettrain
Joseph Lino Padilla (a.k.a. Jose Padilla)
SCUBA masked rioter

Picture reproduced in charging documents.

On January 9, 2021, the FBI received an

anonymous tip (“Tipster #1”) that Jose Padilla, later fully identified as
Joseph Lino Padilla, made posts on his Facebook page and a web-site
known as “thedonald.win,” under a specific username, in which Padilla
admitted to taking part in the riots at the Capitol. Subsequent
investigation confirmed Padilla was the user of both the Facebook page
and the username on thedonald.win that Tipster #1 provided.

The FBI reviewed a Tennessee driver’s

license photo issued to Padilla and compared it to the Facebook page
identified by Tipster #1 and the two photographs appear to be the same
individual.

331
Telegram Channel @nettrain
 On January 11, 2021, another tipster
(“Tipster #2”) contacted the FBI to report that they know Padilla and
recognized Padilla in videos shown on television. According to Tipster
#2, another individual (“Tipster #3”) was also familiar with Padilla and
had multiple in person interactions with Padilla. Tipster #3 identified
Padilla through videos circulating online, which prompted Tipster #2 to
find videos online of Padilla in an altercation with a police officer at a
guard rail and another video in which Padilla is seen throwing a pole.
Tipster #2 stated that according to individuals who still remain in contact
with Padilla, Padilla has recently been immersed in the alt-right and had
a “Q-Anon mentality.”
The federal affidavit presented details of Padilla’s actions at the
Capitol.
At approximately 1:31 pm, Padilla approaches the barricade line
and is eventually pushed away by a Metropolitan Police Department
officer. Padilla is wearing a dark blue jacket, a SCUBA mask over his
eyes, and a black backpack. Padilla is recorded pushing the barricade in
front of him and shouting, “Push! Push! Fucking push!” Screenshots of
the federal affidavit are below.

332
Telegram Channel @nettrain
Pictures reproduced in charging documents.

333
Telegram Channel @nettrain
Pictures reproduced in charging documents.

334
Telegram Channel @nettrain
 On January 7, 2021, Padilla posted the following message on his
Facebook page:

"There's a lot of memes and posts flying

around saying that the people who were fighting last night were all
Antifa provacateurs etc. I just want to say that as a first hand observer of
every point of last night, that it was not Antifa. They were Patriots who
were trying to Restore the Republic after being attacked by the cops,
who struck first. Even those who broke the windows next to the doorway
to the Capitol were Patriots trying to find a way to tum the Flanks of the
cops."

On January 8, 2021, Padilla posted the

following on his Facebook page, which included a link to an
approximately 21 second video of rioters at the U.S. Capitol posted to
the website Streamable.com.

Pictures reproduced in charging documents.

335
Telegram Channel @nettrain
 Tipster #2 provided the
photograph below, which was posted on Padilla’s Facebook page on
March 4, 2012. Tipster #2 indicated Padilla was wearing the same jacket
at the Capitol on January 6, 2021.

336
Telegram Channel @nettrain
 On January 14, 2021, law enforcement
attempted to interview Padilla, who responded by stating, “I do not
answer questions.”
During the period January 7 to January 18, 2021, Padilla used a
certain username to post numerous comments in chats on the web-site

thedonald.win. The FBI knew the username

belonged to Padilla for several reasons. The Tipster #1 indicated that
Padilla had an old Twitter account with the same username as the
username on thedonald.win. The FBI reviewed records from the
username associated with the Twitter account and confirmed it belonged

to Padilla. The username on thedonald.win

describes a specific city as “very close to where I live.” Through a search
of law enforcement databases, the FBI confirmed Padilla’s address as

being in near proximity to that specific city in

Georgia. [The city name has been redacted in this case study.]
The same Streamable.com video posted on Padilla’s Facebook
page is also posted by the same username on thedonald.win, with the
comment “Pardon my haorse voice, I had already been beaten and
sprayed multiple times.” The username on thedonald.win posted
additional biographical and location information which the FBI has
confirmed is identical to Padilla.

337
Telegram Channel @nettrain
 Finally, on or about January 14, 2021, the
username on thedonald.win posted that the FBI visited him that morning
and “just told them I didn’t answer questions.” Below are several
comments posted by the username on thedonald.win:
“After I had my right hand knuckles and ring finger crushed for
just talking to an officer I knew was a soldier and reminding him of his
duty to refuse unlawful orders, I got pissed, and so did many others.
That’s when we started pushing.”
“I was right there. I have the wounds to prove it. I pushed the
rails, I pushed the stairs, and then pushed the doorway. I was beaten
unconscious twice, sprayed more times than I care to count, received
strikes from batons that should have been lethal (Multiple temple and
carotid strikes) except that God was on my side.”

“They may have let

the first group in for the fear mongering. The rest of us they smashed our
hands, tased us, and sprayed us for the crime of standing at the railing
yelling. Then we got pissed and started to push. Then they ran up the
stairs and we followed, and I think God the guys on the left of the
building were able to push up the stairs, allowing the capture the second
tier and start knocking on the Capitol Building doors.”

“Honestly, the guy breaking the windows

weren’t Antifa. They were Patriots trying to find a new way in so we
could flank the cops who were holding the doorway.”

338
Telegram Channel @nettrain
 “If we could have occupied the Capitol,
we could have invoked the right given to us in the 2nd paragraph of the
Declaration of Independence…. We would have been in the Seat of
Power. All we would need to do is declare our grievances with the
government and dissolve the legislature, and replace it with Patriots who
were there. Then simply re-adopt the Constitution with amendments
added to secure future Federal elections.”

CHARGES FILED:
1. Obstruction of law enforcement during civil disorder;
2. Assaulting a law enforcement officer with a deadly or
dangerous weapon;
3. Entering or remaining in any restricted building or grounds
without lawful authority with a deadly or dangerous weapon;
4. Disorderly and disruptive conduct in a restricted building or
grounds with a deadly or dangerous weapon;
5. Engaging in physical violence in a restricted building or
grounds with a deadly or dangerous weapon; and
6. Violent entry and disorderly conduct on Capitol grounds.

339
Telegram Channel @nettrain
Rachel Marie Powell
#PinkHatLady, #BullhornLady

According to a federal affidavit, at the Capitol riots a Subject

Female (“Subject Female”) wearing a pink hat and a black jacket with a
fur lined hoodie used a bullhorn to instruct others how to attempt gaining
control of the Capitol.
The screenshot below depicts the Subject Female, highlighted in
a box, giving instructions with a bullhorn. The video depicts individuals
inside a room of the Capitol Building discussing how to further penetrate
the Capitol. One individual is heard asking, ''What's the floor plan."
Another man with a helmet is heard shouting, "We just need a plan. We
need enough people. We need to push forward."

340
Telegram Channel @nettrain
Pictures reproduced in charging documents.

341
Telegram Channel @nettrain
 Shortly after, the Subject Female is clearly
seen speaking through a bullhorn and giving detailed instructions about
the layout of the Capitol Building to others inside the room. She can be
heard stating that she had just been inside the Capitol Building in the
adjacent room, and that they should "coordinate together if you are going
to take this building." The Subject Female also notes that they "have
another window to break."
Law Enforcement identified multiple photos and videos that
depict the Subject Female’s actions. The image below shows the Subject
Female with a pink hat and a black jacket with a fur lined hood making
her way to a window.

Pictures reproduced in charging documents.

The image below depicts the Subject Female, highlighted with a

box, within close proximity of a key access point to the Capitol that was
the epicenter of visible assaults directed toward law enforcement officers
protecting the Capitol.

342
Telegram Channel @nettrain
 343
Telegram Channel @nettrain
 Law Enforcement identified photos and videos of the Subject
Female using a large pipe as a ramming device to breach windows of the
Capitol to gain access. The image below depicts the Subject Female
highlighted in a box, handling a large pipe along with another individual
wearing a green jacket, red and black backpack and red hat, violently
ramming a window of the Capitol Building. The window damaged by
using the pipe was worth more than $1,000.

Pictures reproduced in charging documents.

Law Enforcement also identified photos and videos of the

Subject Female in which she is seen crawling over a breached window of
the Capitol.

344
Telegram Channel @nettrain
 345
Telegram Channel @nettrain
 Law Enforcement identified photos and videos of the Subject
Female once she was inside the Capitol.

Pictures reproduced in charging documents.

Video footage from the Capitol captured the Subject Female at

approximately 2:41 p.m., entering the Capitol through the west lower
terrace exterior door along with a large number of individuals who
forced law enforcement to retreat toward the inside of the building. The
Subject Female is holding a cell phone.

346
Telegram Channel @nettrain
 Members of the

347
Telegram Channel @nettrain
public sought to help identify the Subject Female, who was sometimes
tagged as #PinkHatLady or #BullhornLady.[88]

On or about January 16, 2021, the FBI published an online Be

on the Lookout poster seeking information of the Subject Female with
multiple photos of her.

348
Telegram Channel @nettrain
 As a result of the poster, the FBI received
an anonymous tip identifying Rachel Marie Powell of Pennsylvania, and
included her Facebook account. A review of publicly available photos
from her Facebook account depicts Powell below

Pictures reproduced in charging documents.

Additionally, publicly available photos from her Facebook

depicts Powell with the same set of hearing protector earmuffs that she
carried on January 6, 2021.

349
Telegram Channel @nettrain
 Law enforcement subpoenaed Facebook
for Powell’s account information, which included a phone number.
That phone number was determined to be serviced by Verizon
and linked to an Apple iPhone device. Law enforcement determined that
same phone number connected to cellphone towers in Washington, D.C.
on January 6, 2021.

In an article in The New Yorker magazine

titled, “A Pennsylvania Mother’s Path to Insurrection,” the journalist
Ronan Farrow interviewed Powell. According to the article, during the
interview, Powell reviewed photographs and videos of “the Bullhorn
Lady,” and acknowledged that many of the images showed her, and
offered detailed descriptions of the skirmishes they depicted.

350
Telegram Channel @nettrain
 Farrow wrote, “She declined to comment on some of her
conduct — including smashing windows and shouting orders to fellow-
rioters — that could carry criminal charges. ‘Listen, if somebody doesn’t
help and direct people, then do more people die?’ she said. ‘That’s all
I’m going to say about that. I can’t say anymore. I need to talk to an
attorney.’”[89]

351
Telegram Channel @nettrain
 On Facebook, Powell was associated with Cherish Creamery, a
Pennsylvania creamery that sells cheeses and other dairy products
locally. The company pinned a Facebook post distancing themselves
from Powell.[90]

CHARGES FILED:
1. Obstruction;
2. Depredation of government property;
3. Entering or remaining in a restricted building or grounds with a
dangerous weapon; and
4. Violent entry or disorderly conduct.

352
Telegram Channel @nettrain
Christine Marie Priola
Tracked by public WiFi

Pictures reproduced in charging documents.

During the January 6, 2021 Capitol riots, a

Subject Female (“Subject Female”) trespassed onto the Senate Chamber
floor. The FBI issued a Be on the Lookout poster including the Subject
Female holding a sign under one arm and a mobile phone. She is wearing
a red coat and distinctive pants with lettering down the side.
On January 8, 2021, the Subject Female was identified on
Twitter as Christine Priola, an occupational therapist with the Cleveland
Municipal School District (“CMSD”).[91]

353
Telegram Channel @nettrain
 A Deputy U.S. Marshal investigating this
case identified Priola as Christine Marie Priola of Ohio, by comparing
photos from the Ohio Law Enforcement Gateway with photos from
January 6, 2021. The Deputy Marshall received verification from the
CMSD that Priola had resigned from her position on January 7, 2021.

On January 8, 2021, investigators obtained

warrant authorization to search Priola’s house. The warrant was executed
the same day and law enforcement agents recovered a laptop computer,
two desktop computers, several thumb drives, and an Apple iPhone.
Clothing, a sign, and other materials consistent with the photographs of
Priola taken on January 6, 2021 were also recovered.

354
Telegram Channel @nettrain
 Forensic investigation of Priola’s iPhone
confirmed that the T-Mobile account associated with the iPhone was
registered in Priola’s name.

During a subsequent search of Priola’s

iPhone, investigators were unable to recover data for photos, videos,
chats or messages from approximately January 4 through January 7,
2021. Agents were also unable to recover device location data for
January 6, 2021 from 5:40 a.m. through 4:17 p.m.

Agents were able to recover device

location data for 4:23 p.m. on January 6, 2021, which indicated the
iPhone was using a WiFi system located at GPS coordinates (38.892002,
-77.006646). According to Google Maps, these coordinates correspond
to a location just northeast of the U.S. Capitol Building. Entering the
above coordinates into Google Maps places a marker at a main road
north of the Capitol Building, and is noted by the below arrow.

355
Telegram Channel @nettrain
 Connecting the breadcrumbs of
information to find reasonable links, a search for nearby, possible WiFi
sources shows that the U.S. Capitol Café (noted with an arrow on the
below map) is also listed on Google Maps with the same coordinates. It
is conceivable, subject to further investigation, that Priola may have
visited that location. It is also possible that a visitor may decide to
manually connect their smartphone to a public WiFi service or a phone’s
settings may allow for automatic connection. Either way, that connection
data is recorded and can be inspected further.

356
Telegram Channel @nettrain
 In Priola’s January 7,
2021, resignation letter to the Cleveland Municipal School District,
Priola cites her refusal to take “the corona virus 19 vaccine in order to
return to in person learning,” and other conspiracy theories for her
resignation.[92]

CHARGES FILED:

357
Telegram Channel @nettrain
1. Knowingly entering or remaining in any restricted building or
grounds without lawful authority;
2. Violent entry and disorderly conduct on Capitol grounds; and
3. Unlawful activities on Capitol grounds, parades, assemblages
and display of flags.

358
Telegram Channel @nettrain
Robert Maurice Reeder
Quick hit identification by facial recognition software

359
Telegram Channel @nettrain
Pictures reproduced in charging documents.

360
Telegram Channel @nettrain
 The FBI published numerous “Be on the
Lookout” (“BOLO”) bulletins asking the public for assistance
identifying Capitol rioters. On or about January 7, 2021, the Office of the
State’s Attorney in Maryland submitted a tip to the FBI that facial
recognition software identified two Maryland residents as possible
matches for BOLO photo # 14, pictured above.

One of two potential matches was

identified as Robert Reeder. The Maryland Motor Vehicle
Administration had a photo of Reeder.

On or about January 19, 2021, Reeder,

through counsel, contacted the Government and provided a compilation
video of photos and videos taken by Reeder on his cell phone on January
6, 2021. The video, approximately 22 minutes and five seconds in
length, appears to be in chronological order. A screenshot of the video is
below.

361
Telegram Channel @nettrain
 At approximately 19 minutes 40 seconds
in the compilation video, timestamp “4:05 - 4:30 p.m.,” from outside the
Capitol Building, Reeder tells the camera: “I’m leaving now... I got tear
gassed at least four times inside the Capitol... I saw the lady they say got
shot, I walked right past her in a pool of blood. And it’s just... completely
crazy in there.”

At approximately 19 minutes 59 seconds

in the same video, Reeder states: “Just left the Capitol, I was one of the
last people out. I was in there for over half an hour. I got gassed several
times inside the Capitol, many times outside the Capitol. Got shot with
pepper balls. It was fucking nuts. We had to do... ah... battle with the
Police inside. It was crazy... absolutely insane.”

Picture reproduced in charging documents.

CHARGES FILED:
1. Knowingly entering or remaining in any restricted building or
grounds without lawful authority; and

362
Telegram Channel @nettrain
2. Violent entry and disorderly conduct on Capitol grounds.

363
Telegram Channel @nettrain
Nicholas Rodean
Wore his employee ID tag to the Capitol riots

Pictures reproduced in charging documents.

Media coverage of the January 6, 2021 Capitol riots showed a

Subject Male (“Subject Male”) who entered the Capitol Building dressed
in a red hat that with the word “Trump” on it, carrying a large red flag
reading “Trump is My President,” and wearing an apparent badge from
the individual’s place of employment. The individual appears to be a
Caucasian male with a beard. Photos posted on media sites show this
individual in the halls of Congress.
The Metropolitan Police Department issued a Persons of Interest
poster for the Subject Male.

364
Telegram Channel @nettrain
 Social media from around the world posted about the Capitol
riots, including the below Twitter post from an account in Europe.[93]

The Subject Male’s ID tag was easily enlarged and shared

widely on social media, including the below post tagging his then-

365
Telegram Channel @nettrain
current employer, Navistar Direct Marketing in Maryland.[94]

The Subject Male was identified as Nicholas Rodean. Law

enforcement also identified Rodean through open source databases,
including Maryland DMV driver’s license records.
On January 7, Navistar posted a statement on Facebook
indicating Rodean’s employment had been terminated.[95]

366
Telegram Channel @nettrain
 On January 8, 2021, an attorney who
stated that he represented Rodean called in to the FBI’s Washington Field
Office to voluntarily speak with law enforcement, and confirmed that
Rodean would like to turn himself in to law enforcement. Washington,
D.C. Metropolitan Police confirmed that Rodean turned himself in at the
2nd District precinct station on January 13, 2021 in the morning.[96]

CHARGES FILED:
1. Entering and remaining in a restricted building;
2. Disorderly and disruptive conduct in a restricted building;
3. Violent entry and disorderly conduct in a Capitol building; and
4. Parading, demonstrating, or picketing in a Capitol building.

367
Telegram Channel @nettrain
Jennifer Leigh Ryan (a.k.a. Jenna Ryan)
“Y’all know who to hire for your realtor. Jenna Ryan for your
realtor.”

Pictures reproduced in charging documents.

On January 05, 2021, a Facebook user

Brian Miller tagged the Facebook account of Jennifer Leigh Ryan (a.k.a.
Jenna Ryan) in a series of photographs from U.S. Trinity Aviation in
Denton, Texas. According to open source information, the caption on the
photos noted, "We're so excited! D.C. bound to #StopTheSteal." Ryan is
the female circled in red in the photographs below.

368
Telegram Channel @nettrain
 After Miller's post, on January 5, 2021,
Ryan posted multiple videos on her Facebook account that appear to be
taken on board a small private aircraft, on which she was traveling with
others to Washington D.C.

369
Telegram Channel @nettrain
 On January 6, 2021, Ryan posted a video
on her Facebook account that depicts her in a bathroom mirror stating,
"We're gonna go down and storm the capitol. They're down there right
now and that's why we came and so that's what we are going to do. So
wish me luck." Subsequently, on January 6, 2021, Ryan posted a 21-
minute Facebook Live video on her Facebook account of her and a group
walking toward the U.S. Capitol building. Ryan posted photographs of
herself at the U.S. Capitol building grounds to her social media accounts,
including Facebook and Twitter.

370
Telegram Channel @nettrain
 Of particular note is an
image Ryan posted of herself to her Twitter account, which depicts Ryan
in front of a broken window at the U.S. Capitol Building, with the
caption: “Window at The capital [sic]. And if the news doesn’t stop lying
about us we’re going to come after their studios next…”

371
Telegram Channel @nettrain
 Open source searches also uncovered a
now-deleted Facebook Live video taken by Ryan as she entered the
Capitol via the Rotunda entrance. The video was captured prior to
deletion and reposted to YouTube for public viewing. The video shows
Ryan in a large crowd attempting to walk through the entrance to the
Capitol, which had visibly broken windows at the time. At the beginning
of the live video, Ryan is heard stating, “we are going to fucking go in
here. Life or death, it doesn’t matter. Here we go,” as she approaches the
top of the stairs in front of the columns immediately in

front of the doors on the west side of the Capitol

Building.
Ryan then turned on her rear facing camera--exposing her face--
and stated, “Y’all know who to hire for your realtor. Jenna Ryan for your
realtor.” By minute 08:45 of the video, Ryan has made it to the front
door of the building, clearly desecrated, with broken glass windows
shattered, and security alarms sounding, as she yells “U-S-A! U-S-A!”
and “Here we are, in the name of Jesus!” Once inside the building among
the crowd, Ryan is heard joining a chant “Fight for freedom! Fight for
freedom!” and yelling, “This is our house!” Ryan Is circled below.

372
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

In the hours immediately following the breach of the U.S.

Capitol building, Ryan posted on Twitter: “We just stormed the Capital.
It was one of the best days of my life.”

Law enforcement agents retrieved a

driver's license photograph of Ryan, a resident of Texas, and confirmed
Ryan bore a resemblance to the pictures above.

CHARGES FILED:
1. Entering and remaining in a restricted building;
2. Disorderly and disruptive conduct in a restricted building
3. Violent entry and disorderly conduct in a Capitol building
4. Parading, demonstrating, or picketing in a Capitol building

373
Telegram Channel @nettrain
Jeffrey P. Sabol
Police assaulter

Pictures reproduced in charging documents.

According to a federal affidavit, on January 6, 2021, Officer

B.M. of the Washington, D.C. Metropolitan Police Department ("MPD")
was working his evening shift and was directed to assist the Capitol
Police in maintaining security of the Capitol Building. Between 4:00
p.m. and 5:00 p.m., Officer B.M. walked through an interior tunnel of
the U.S. Capitol Building and assumed a post in an archway which
provided access to the building's exterior. The approximate location of
Officer B.M. was noted by Officer B.M. and is denoted by the circle in
the middle of the below image.

374
Telegram Channel @nettrain
 From this archway, alongside other uniformed law enforcement
officers, Officer B.M. observed hundreds of individuals gathered outside.
Some of these individuals were throwing and swinging various objects at
the group of law enforcement officers. While standing in the archway to
prevent the group of individuals from breaching the Capitol Building,
and while wearing his official MPD uniform, some of these individuals
grabbed Officer B.M. and dragged him down the stairs of the Capitol
Building. These individuals forced Officer B.M. into a prone position on
the stairs and proceeded to forcibly and repeatedly strike Officer B.M. in
the head and body with various objects.

Specifically, a Subject Male (“Subject

Male”) that was depicted in at least one photograph and numerous videos
wearing a tan colored jacket, black helmet, green backpack and black
gloves near and overtop of Officer B.M. This individual can be seen in
the below photo holding an instrument believed to be a police officer's
baton across the police officer's lower neck. His left hand is on the back
side of Officer B.M.

375
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

The Subject Male can be seen running up the stairs of the

Capitol and attempting to grab the leg of a presumed police officer. This
individual is circled in the still frame from the video below. The
presumed officer seems to kick the individual away from him causing
the individual to fall backwards down the stairs.

Some moments later, the Subject Male is captured again seen

ascending the stairs of the Capitol, but this time the individual seems to
grab a police officer and pulls the officer down the stairs. It also seems

376
Telegram Channel @nettrain
that this individual is punching the back of the police officer as he drags
him down the stairs. It should be noted that the individual in the still
photograph is dressed in the exact same clothes, including the backpack
and gloves, as the individual seen in the video.

Pictures reproduced in charging documents.

On January 11,
2021, five days after the Capitol assault, at approximately 4:30 p.m.,
officers from the Clarkstown, New York Police Department, responded
to a vehicle with Massachusetts license plates driving erratically in the
town of New City, New York. The vehicle was located and the driver,
subsequently identified as Jeffrey Sabol, was found covered in blood,
suffering from severe lacerations to both thighs and arms. While officers
aided Sabol, he made several spontaneous statements to include but not
limited to: "I am tired, I am done fighting", "My wounds are self-
inflicted", I was “fighting tyranny in the D.C. Capital," and "I am wanted
by the FBI."

377
Telegram Channel @nettrain
 Clarkstown Police searched Sabol's
vehicle, which contained a green backpack and a tan Carhartt jacket
similar to the ones depicted in the still-shots above. The vehicle was
secured and towed to the Clarkstown Police Impound Yard.

On January 12, 2021, law enforcement

officers spoke with Sabol while he was recovering at the Westchester
Medical Center. Sabol advised that on January 6, 2021, he was at the
U.S. Capitol and he was wearing a brown Carhartt jacket, a black or gray
helmet, a big green backpack, and black gloves. The Carhartt jacket was
the same jacket that was located in his vehicle the night he attempted
suicide, according to Sabol.
On January 13, 2021, law enforcement again spoke with Sabol.
Sabol reviewed the video of the riots on January 6, 2021 at the Capitol
and stated he was in the video, wearing the clothes described above.

Sabol stated he ran up the stairs and jumped over a

barricade and dragged a police officer down the stairs away from the
tunnel. Sabol acknowledged that the video seemed to depict him
throwing punches at the police officer, but he claims he was "patting him
on the back" and saying, "we got you man.”

378
Telegram Channel @nettrain
 Once at the bottom of the stairs, Sabol claims he
"covered the police officer for his own safety" while others hit the police
officer with poles. Sabol retreated from that location and ended up on the
left side of the stairway with a crowd of people. Sabol told law
enforcement that, approximately fifteen minutes later, a "call to battle
was announced" and Sabol "answered the call because he was a patriot
warrior." Sabol claims he took a police baton out of an officer's hand and
used it to "protect the officer" who was on the ground.

Sabol was shown

the above-referenced still photo of a police officer lying face down on
the ground with Sabol over him. Sabol acknowledged that he is the
individual in the picture and acknowledged that this picture looked bad.
He could not recall if he hit the police officer with the baton because he
was in a fit of rage and the details are cloudy.
CHARGES FILED:
1. Assaulting, resisting, or impeding certain officers using a
dangerous weapon;
2. Assaulting, resisting, or impeding certain officers;
3. Civil disorder;

379
Telegram Channel @nettrain
4. Entering and remaining in a restricted building or grounds with a
deadly or dangerous weapon;
5. Disorderly and disruptive conduct in a restricted building or
grounds with a deadly or dangerous weapon;
6. Engaging in physical violence in a restricted building or grounds
with a deadly or dangerous weapon; and
7. Violent entry and disorderly conduct in a Capitol building.

380
Telegram Channel @nettrain
Robert Sanford
Chester, PA Fire Department fire extinguisher hurler

Pictures reproduced in charging documents.

A January 6, 2021 video (“Video #1”) captured by an individual

who was present in the Capitol riots crowd recorded a man (“Subject
Male”) hurling a red fire extinguisher at a group of police officers.

In the lower left

corner of the video, the Subject Male is visible stepping over a short wall
with a red object in their hands. The Subject Male is wearing what
appears to be a stocking cap, a dark jacket or shirt with a plaid pattern,
and a light and dark two-tone backpack. Immediately after stepping over
the short wall, the subject draws the fire extinguisher back in his right
hand and then hurls the object at the group of police officers. The object
appears to strike one officer, who was wearing a helmet, in the head. The
object then ricochets and strikes another officer, who was not wearing a
helmet, in the head. The object then ricochets a third time and strikes a
third officer, wearing a helmet, in the head.

381
Telegram Channel @nettrain
 Immediately after throwing the object, the
Subject Male moves quickly in the opposite direction. A screen capture
of this video is below, with the Subject Male circled in the lower left
corner.
The video was shot from an elevated position and showed an
area of the Capitol with a large group of police officers surrounded on at
least three sides by a group of insurrectionists. A Capitol Police Special
Agent identified the area shown in the video as being the lower west
terrace of the Capitol Building.

Pictures reproduced in charging documents.

Capitol Police Officer W.Y. reported that

he and twenty officers and two sergeants were deployed to the lower
west terrace of the Capitol at some point after 12:00 p.m. on January 6,
2021. While Officer W.Y. was attempting to control the crowd, he felt a
hard strike to the back of his helmet. When he turned to see where the

382
Telegram Channel @nettrain
blow had originated, Officer W.Y. saw a fire extinguisher on the ground
but could not determine who had struck him. He was subsequently
evaluated at a hospital and cleared to return to duty.
Law enforcement reviewed a second video (“Video #2”)
captured on January 6, 2021, showing the Capitol attack from a different
angle. The video was captured by an individual who was present in the
crowd and shot at ground level, covering much of the same events as
captured by Video #1. Video #2 is approximately one hour and 28
minutes long. From approximately 47 minutes and 11 seconds until
approximately 47 minutes and 17 seconds, a person wearing clothing
that matches those of the Subject Male is visible. The angle of Video #2
along with the proximity reveals more details of the Subject Male. The
federal affidavit included the below screenshots.

On January 12, 2021, a tipster (“Tipster

#1”) contacted an FBI Resident Agency in Pennsylvania stating a person
they knew, Robert Sanford, an approximately 55-year-old male, had
confessed to Tipster #1 that he was the person the FBI was looking for.

383
Telegram Channel @nettrain
Tipster #1 indicated that they had known Sanford for many years, that
they were friends, and that Sanford had recently retired from the Chester
Fire Department, located in Chester, Pennsylvania.
In a recorded interview on January 12, 2021, Tipster #1 told FBI
Special Agents that Sanford told Tipster #1 he had travelled to
Washington, D.C. on a bus with a group of people. The group had gone
to the White House and listened to Trump’s speech and then followed the
President’s instructions and gone to the Capitol. Sanford acknowledged
to Tipster #1 the photograph of the man in the CFD hat was, in fact,
Sanford. When shown screen captures from Video #2, Tipster #1
identified the Subject Male in the screen captures as Sanford.

Sanford was issued a driver’s license from

Pennsylvania in 2018 with the below photo. The name listed on the
license was Robert Lee Sanford, Jr. The address listed on that driver’s
license was approximately 11 minutes from both Chester Fire Station
#81 and Chester Fire Station #82 in Chester, Pennsylvania. The date of
birth listed on the driver’s license indicated that Sanford was 55 years
old, as estimated by Tipster #1.

According to the federal affidavit, a comparison of the Pennsylvania

384
Telegram Channel @nettrain
DMV photo to the screen captures taken from Video #2 shows
significant physical similarities, including the shape of the upper face,
nose, eye color, and connected earlobes. The lower face is difficult to
compare due to the Subject Male having a full goatee. However, the
visible features reveal a strong similarity between the two indicating that
the Subject Male is, in fact, Sanford.

During the course of this investigation, the

FBI received an anonymous tip that another individual (a “Potential
Suspect”) was the subject in the still photographs referenced above. That
Potential Suspect resided in Illinois. Upon further investigation, the FBI
learned that the Potential Suspect’s name did not appear on flight
manifests to the Washington, D.C. area for the relevant time frame.

Additionally, the logs from license plate

readers in the District of Columbia did not indicate the Potential

385
Telegram Channel @nettrain
Suspect’s vehicle entered the District of Columbia during the relevant
time frame.
Furthermore, upon examining photographs of the Potential
Suspect comparing them to still images of the footage from the Capitol
grounds referenced above, there are differences between the Potential
Suspect’s facial features and the facial features of the Subject Male in the
still images, specifically, the Potential Suspect’s nose and eyebrow shape
both appeared to be different. Law enforcement also learned through that
Potential Suspect’s attorney that the Potential Suspect had an alibi for the
time of the incident at the U.S. Capitol Building.

CHARGES FILED:
1. Civil disorder;
2. Assaulting, resisting, or impeding certain officers using a
dangerous weapon;
3. Entering and remaining in a restricted building or grounds with a
deadly or dangerous weapon;
4. Disorderly and disruptive conduct in a restricted building or
grounds; and
5. Act of physical violence in the Capitol grounds or buildings.

386
Telegram Channel @nettrain
Peter Francis Stager
Flag wielding police beater

Pictures reproduced in charging documents.

On January 6, 2020, Officer B.M. (“B.M.”) of the Washington

D.C. Metropolitan Police Department (“MPD”) was working his evening
shift in his official capacity. During that shift, Officer B.M. was directed
to report to the U.S. Capitol building to assist the U.S. Capitol Police in
their duties to maintain security of the U.S. Capitol building.
Between 4:00 p.m. and 5:00 p.m. that same day, Officer B.M.
walked through an interior tunnel of the U.S. Capitol building and
assumed a post in an archway which provided access to the building’s
exterior. The approximate location of Officer B.M. was noted by Officer
B.M. and is denoted below by the circle in the center of the image.

387
Telegram Channel @nettrain
 While standing in the archway to prevent the group of
individuals from breaching the U.S. Capitol building, and while wearing
his official MPD uniform, some of these individuals grabbed Officer
B.M. and dragged him down the stairs of the Capitol building. These
individuals forced Officer B.M. into a prone position on the stairs and
proceeded to forcibly and repeatedly strike Officer B.M. in the head and
body with various objects.

On January 12,
2021, the FBI received a tip via electronic submission from a
confidential source of information (“Source #1”), identifying one of the
individuals who assaulted Officer B.M. on the stairs of the U.S. Capitol
building as Peter Francis Stager. FBI Special Agents interviewed Source
#1, who stated they recognized Stager from two videos posted on a
Twitter thread. The first video (“Video #1”) depicted Stager among a
large group of individuals on the stairs of the U.S. Capitol building.
Stager climbed the stairs while holding a flagpole with a United States
flag affixed to it and used the pole to repeatedly strike Officer B.M.
while Officer B.M. remained prone on the steps of the U.S. Capitol

388
Telegram Channel @nettrain
building. Screen captures from Video #1 are below showing Stager
assaulting Officer B.M. with a flagpole.

Pictures reproduced in charging documents.

389
Telegram Channel @nettrain
 In the
second video (“Video #2”), Source #1 identified the male speaking as
Stager, who stated, “Everybody in there is a treasonous traitor. Death is
the only remedy for what’s in that building.” According to the federal
affidavit, the FBI Special Agent investigating this case believed “that
building” was a reference to the U.S. Capitol building, and “everybody
in there” was a reference to the Congressmen and Congresswomen inside
the U.S. Capitol building at the time.
A screen capture from Video #2 is here.

390
Telegram Channel @nettrain
 Source #1 told Agents that after viewing the above reference
videos, Source #1 contacted a mutual acquaintance of both Stager and
themself (“Source #2”). Source #2 told Source #1 that Source #2 had
already spoken directly with Stager following the events on January 6,
2021. Source #2 also told Source #1 that Stager identified himself as the
individual in both Video #1 and Video #2.

Agents then
interviewed Source #2, a close associate of Stager. Source #2 also
recognized Stager as the individual in Video 1 striking Officer B.M. with
a flagpole, and as the individual in Video #2 who was “ranting.” Source
#2 spoke directly with Stager via telephone following the events on
January 6, 2021. During that phone conversation, Stager confirmed that
he [Stager] was the individual in both Video #1 and Video #2.
Referring to Video #1, Stager told Source #2 that he [Stager] did
not know the man he was striking on the ground with the flagpole was a
cop and that he thought the person he was striking was ANTIFA. On the
Twitter thread provided by Source #1, there was a photo of Officer B.M.
lying prone on the steps of the U.S. Capitol building while surrounded by
the large group of individuals. Clearly present on Officer B.M.’s
uniform, across his back, are the words “METROPOLITAN POLICE.”
Also visible in the photo is Stager, holding a flagpole, with an
American flag attached, with what appears to be a clear view of Officer
B.M. in uniform, lying on the stairs.
Source #2 told Agents that Stager told him that he [Stager] had
to apologize to Source #2 and to his [Stager’s] children for his behavior.
Additionally, Stager told Source #2 that he intended to turn himself in to
law enforcement for his actions, but had yet to do so.
Referencing Video #2, Stager told Source #2 that he [Stager]
was “wired up” from being either pepper-sprayed or tear-gassed and that
was why he made the comments he did on camera.
Law enforcement identified Stager using the above information
provided by Source #1 and Source #2.

391
Telegram Channel @nettrain
 A query of the Arkansas Department of
Motor Vehicles yielded a driver’s license photo of Stager which was
compared to that of the individual in both Video #1 and Video #2. The
investigator submitting the affidavit believed they were of the same
individual.

CHARGES FILED:
1. Obstruction of an official proceeding and aiding and abetting;
2. Assaulting, resisting, or impeding certain officers using a
dangerous weapon;
3. Civil disorder;
4. Entering and remaining in a restricted building or grounds with a
deadly or dangerous weapon;
5. Disorderly and disruptive conduct in a restricted building or
grounds with a deadly or dangerous weapon;
6. Engaging in physical violence in a restricted building or grounds
with a deadly or dangerous weapon; and
7. Violent entry and disorderly conduct in a Capitol building

392
Telegram Channel @nettrain
Katherine Staveley Schwab (a.k.a. Katie)
Weeee

On January 05, 2021, an individual (“Individual I”) posted a

series of photographs of Katherine Schwab on their Facebook page.
According to open source information, the photographs were taken on a
private plane flying to Washington, D.C. This investigation has shown
that Individual #1 as well as Jenna Ryan, Jason Hyland, and Individual
#4 ("the group") traveled with Schwab to Washington, D.C. on January
5, 2021. Schwab is the female circled in the photographs below.

393
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

After Individual #1’s post on January 5,

2021, Ryan also posted multiple videos on her Facebook account that
appear to be taken on a small private aircraft, on which she was traveling
with Schwab and the other members of the group to Washington, D.C.

394
Telegram Channel @nettrain
 As detailed in the federal affidavit, according to open source
research, Ryan posted “Weeee” on the below photo featuring Schwab.

Pictures reproduced in charging documents.

Later in the evening, on January 5, 2021, Individual #1 posted a

photo on their Facebook page and tagged the Manassas Regional Airport
in Manassas, Virginia. Schwab and the four others in her group had
arrived in the Washington, D.C. area. Schwab is circled in the
photograph below.

395
Telegram Channel @nettrain
 Law enforcement agents retrieved a
driver's license photo of Schwab, a resident of Texas, and confirmed
Schwab bore a resemblance to the pictures above.
An FBI Special Agent conducting this investigation reviewed
surveillance footage from cameras inside the Capitol Building. The
investigator identified images that depict Schwab inside the Capitol near
the Rotunda door and attempting to walk through the crowds. Schwab is
circled in the photos below.

396
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

In the hours following the breach of the U.S. Capitol Building,

Schwab replied to a Facebook message in which a user (“User #1”)
posted, “looks like you got on the steps of the Capital [sic],” Schwab
replied, “a little further than that.” About an hour later, Facebook User
#1 posted “awesome did you get pics inside”. Schwab responded, “no
because they closed the door behind us and had their guns drawn at a
few…interesting though, the national guard was in there and didn’t move
an inch. They sat back. They didn’t fight against us at all…because there

397
Telegram Channel @nettrain
was no need to. After the girl was shot and killed that’s when we raised
hell.”

Picture reproduced in charging documents.

On January 15, 2021, FBI agents

interviewed Schwab at her residence in Texas. The interview was
recorded. She referred to herself and the others who traveled with her as
“patriots.” She stated that on the Saturday or Sunday before, which
would be January 2, 2021 or January 3, 2021, she posted on her
Facebook account that she was looking for other patriots to join her in
Washington, D.C. Schwab stated that Hyland, who was a friend,
arranged a private flight. (During the interview, Schwab requested not to
provide Hyland's name to protect his privacy, however, it is included in
the federal affidavit.)
Schwab said she did not know the other individuals in the group
prior to traveling to Washington, D.C. The only person from the group

398
Telegram Channel @nettrain
that Schwab knew prior to the flight was Hyland, the individual who
arranged the flight.
She explained that on January 6, 2021, the group left the hotel
around 7:30am and walked to The Ellipse, the outdoor expanse near the
White House. According to Schwab, they listened to some of the
speakers until approximately 10:30am. The group then walked toward
the Capitol Building and made it to the area where the food trucks were
located. Nothing was happening at this time and it was very cold outside,
so Schwab and three members of the group, Ryan, Individual #4, and
Hyland, decided to depart and return to the hotel. One member of the
group, Individual #1, stayed at the Capitol.
Upon returning to the hotel, Schwab stated she, Ryan, Individual
#4, and Hyland watched the news on television. They heard

the Capitol Building had been breached, and they

wanted to see what was going on. Schwab, Ryan, Individual #4, and
Hyland took an Uber to the Capitol Building. Schwab noticed that there
were some “bad apples” within the large crowd. Schwab walked up the
steps of the Capitol Building to the open doors. Though Schwab did not
see any violence or anyone destroying anything, she observed the door to
the Capitol Building had been destroyed.
Schwab stated she was pushed by the crowds through the
original set of doors entering the building and into a lobby area. She then
went through a second set of doors. According to her statements, because
of her small stature Schwab was being crushed by the crowd. She then
requested the assistance of a Capitol Police Officer to exit the building.
The police officer helped Schwab out of the crowd and identified an exit
that was on the left side of the lobby. At this point, Schwab exited the
Capitol Building.

399
Telegram Channel @nettrain
 Schwab was aware of the various social
media posts that Ryan posted from the Capitol Building and was shown
several during the interview. She stated that Ryan posted a video of
Schwab outside the Capitol Building. Schwab stated that the words that
Ryan used in her social media posts were “very bad”. According to
Schwab, some of the videos that Ryan posted made members of the
group look “bad”. (The FBI investigation of Jenna Ryan, a.k.a. Jennifer
Leigh Ryan, was discussed previously in this chapter.)

CHARGES FILED:
1. Knowingly entering or remaining in any restricted building or
grounds without lawful authority; and
2. Disorderly conduct on Capitol grounds.

400
Telegram Channel @nettrain
Marissa A. Suarez and Patricia Todisco
License plate readers tracked their travel to Washington, D.C.

Pictures reproduced in charging documents.

Marissa A, Suarez Patricia Todisco

On or about January 12, 2021, the FBI

Newark Joint Terrorism Task Force (“JTTF”) received information
concerning Marissa Suarez’s alleged participation in the Capitol riots
from the Monmouth County Sheriff’s Office (“MCSO”). Suarez is a
probationary corrections officer at Monmouth County Corrections
Facility (“MCCF”). Specifically, the MCSO informed the FBI that the
Union Beach Police Department received a report from a witness
(“Witness #1”) about Suarez’s activities during the attack on the Capitol,
including several video clips filmed by Suarez. These video clips were
shared by Suarez with Witness #1, who maintained a relationship with

401
Telegram Channel @nettrain
Suarez for several years. Witness #1 stated their relationship between
Suarez and Witness #1 had recently become strained but the two still
communicated.

Subsequent investigation by law

enforcement revealed that on Wednesday, January 6, 2021, Suarez was
scheduled to work at the MCCF, but she used an emergency holiday and
thus was absent from work.
Videos submitted to law enforcement by Witness #1 depict
various moments from the attack on the Capitol. Nearly all the videos
were taken while the camera was moving and being held at or near the
height of the heads of others in the crowd, consistent with the manner in
which cellular telephones are commonly used to make video recordings
or take photographs.

While the videos do not show Suarez’s

face (i.e., they are recorded from Suarez’s point of view) at least one of
the videos shows a woman later identified as Patricia Todisco, who
appears to have traveled with Suarez to Washington, D.C. Screenshots
from this video are below, which appear to have been filmed at the
Senate Wing door entrance in the Capitol, with a circle around Todisco.
Additionally, a woman’s voice can be heard on the videos commenting
on the events captured. On several occasions, the woman’s voice calls
Todisco by name.

402
Telegram Channel @nettrain
 Both Witness #1, as well as an MCSO
lieutenant who trained Suarez and has spent numerous hours with her,
have identified the woman’s voice on the videos as belonging to Suarez.

403
Telegram Channel @nettrain
Pictures reproduced in charging documents.

404
Telegram Channel @nettrain
 Law enforcement showed the below screenshots of the footage
to Witness #1, who positively identified Suarez in the first screenshot
and indicated that they believed the person immediately to the right of
Suarez in the picture, with the black wool hat and puff on top could have
been Todisco, whom Witness #1 had known for multiple years. Witness
#1 then looked at the second photograph (which has a clearer view of the
front of the woman’s face). Witness #1 then stated that the female next to
the person carrying the American flag was Todisco.

Pictures reproduced in charging documents.

Law enforcement agents obtained driver license photographs of

Suarez and Todisco and confirmed the individuals Witness #1 identified
in the surveillance photos are consistent in appearance with Suarez and
Todisco.
The security footage further shows that Suarez and Todisco were
each consistent with a person using a device to take pictures and/or video
record a scene. A screenshot from the video is below, which includes the

405
Telegram Channel @nettrain
individuals identified as Suarez and Todisco (noted with arrows) as each
has what appears to be a cellular phone in hand.

In addition to the videos and the security footage, text messages

sent from Suarez’s cellular phone on January 6 and January 7, 2021 to
Witness #1 further establish that Suarez and Todisco were inside the
Capitol Building during the demonstrations. The messages were
extracted from Witness #1’s phone by law enforcement with Witness
#1’s signed consent. Text messages from Suarez were transcribed
verbatim as they appear in the original exchange, including
typographical and grammatical errors. Messages from January 6, 2021

included:
“We’re inside hahaha“ (3:26 p.m.)
“This is insane” (5:40 p.m.)
“On our way back... shit got violent so we left” (6:55 p.m.)
Text messages sent from Suarez’s phone the following day,
January 7, 2021, shed further light on the activities of Suarez and
Todisco as Suarez wrote the following:

406
Telegram Channel @nettrain
 “When we found out pence fucked us, we
all stormed the Capitol Building and everyone forced entry and started
breaking shit... it was a like a scene out of a movie” (9:57 a.m.)
On January 6, 2021, U.S. Senator Jeffrey Merkley of Oregon
posted to his Twitter account, documenting damage done to his office as
a result of the breach. In the video, Merkley indicated items were stolen,
damaged, and destroyed. A screenshot of his Twitter video is on the
following page, where Merkley can be seen in the mirror reflection.[97]
On January 15, 2021, a Twitter account holder posted video that
appeared to be from the January 6 attack on the Capitol. The video
showed a person who appeared to be Todisco, walking out of an office,
as shown in the still shot below, marked with a circle. The chairs, table,
telephone, and mirror frame appear to be consistent with those in the
office posted by Merkley in his Twitter video. The conference room in
which Todisco is present appears to be Senate room S140, the private
“hideaway” office of Senator Merkley within the Capitol. A screenshot,
as reproduced in the charging documents, is included on the next page.

Based on information in the database

compiled by the New Jersey Motor Vehicle Commission, law
enforcement confirmed Suarez was the lessee and registrant of a silver
2019 Jeep Wrangler, (the “Subject Vehicle”).

407
Telegram Channel @nettrain
 Law enforcement databases showed the license plate of the
Subject Vehicle was recorded traveling a route consistent with travel
between the area in which Suarez resides and works and the Washington,
D.C. area on January 6, 2021. Specifically, the Subject Vehicle license
plate was recorded:

408
Telegram Channel @nettrain
 a. crossing the Delaware Memorial
Bridge leading from the New Jersey Turnpike onto
Interstate 95 in Delaware on January 6, 2021 at
approximately 6:20 a.m.;
b. traveling along Interstate 95 southbound through
Maryland;
c. moving northbound along the same route in the evening
hours; and
d. passing northbound over the same bridge from Interstate
95 in Delaware onto the New Jersey Turnpike at
approximately 8:45 p.m. that same day.
CHARGES FILED FOR EACH:
1. Knowingly entering or remaining in any restricted building or
grounds without lawful authority; and
2. Violent entry and disorderly conduct on Capitol grounds.

409
Telegram Channel @nettrain
Dustin Byron Thompson and Robert Anthony Lyon
Got caught waiting for an Uber with a stolen Senate coat rack

Pictures reproduced in charging documents.

Suspect Male #1 Suspect Male #2
a.k.a. Dustin Byron Thompson a.k.a. Robert Anthony Lyon

At approximately 6:00 p.m. on January 6, 2021, two U.S.

Capitol Police Special Agents (collectively, “USCP Agents”) observed
two males sitting on the sidewalk at the northwest corner of South
Capitol Street and C Street Southwest, Washington, D.C. The two males
appeared to be part of the events that had just occurred at the Capitol.

Subject Male #1 was wearing a Trump

2020 winter cap and a bullet proof vest and Subject Male #2 had a
Trump 2020 flag and an orange winter cap and. The USCP Agents
initiated contact with the two men, who said they did not need any
assistance and were just waiting for an Uber, the car ride service. The

410
Telegram Channel @nettrain
USCP Agents told the two that they were in a secure zone and directed
them to a location where they could be picked up.

As both subjects left to locate their Uber,

Subject Male #1 picked up a coat rack that was behind him. The coat
rack appeared to have been taken from the inside of the Capitol Building.
The USCP Agents instructed Subject #1 to put the coat rack down, and
he complied. Because Subject #1 was in possession of stolen property
from the Capitol riots that had just occurred, the USCP Agents stopped
both subjects.

Subject Male #1 fled on foot and got

away, but Subject Male #2 was cooperative and did not attempt to flee.
Subject Male #2 produced his Ohio driver’s license, which
identified him as Robert Lyon with a residential address in Ohio.

Lyon told the USCP Agents that Subject Male #1 who had just run away
was named Dustin Thompson. Lyon showed his phone, which displayed
Thompson’s phone number as well as multiple calls between the two
men. Lyon also showed USCP Agents the below picture of Thompson
that Lyon had taken with his camera.
USCP Agents recognized the man in the photo as the same man
that fled on foot moments before. After the USCP Agents questioned

411
Telegram Channel @nettrain
Lyon, he was allowed to leave.

Lyon provided consent for police to search

his bag for stolen property. The USCP Agents confiscated marijuana,
two pipes, and an open bottle of bourbon from Lyon’s bag.
On January 11, 2021, Lyon was interviewed at his residence in
Ohio by two FBI Special Agents (“FBI Agents”). When the interview
took place, Lyon had not been advised of his rights. Lyon stated that he
has known Thompson for a few years and met at a university in Ohio.
Lyon confirmed Thompson’s phone number and provided Thompson’s
home address.

According to Lyon, it was Thompson’s

idea to travel to Washington, D.C. Lyon further advised that at some
point after the rally, while the two were still in the vicinity of the Capitol,
Thompson walked away. Lyon estimated that it was around 4:00pm or
4:30pm. Lyon stated that eventually Thompson returned. When
Thompson returned, Lyon stated that he was holding a coat rack made of
wood with bronze racks. Lyon stated that he did not ask where the rack
came from.

Lyon provided consent to download his

phone’s camera images. Upon review, the FBI Agents noticed Lyon had
sent a message to Thompson that said, “We need to get the fuck out with
this trophy.”

412
Telegram Channel @nettrain
 When asked why
this message came from Lyon if Lyon did not take the coat rack, Lyon
became visibly nervous and expressed his desire to clear up any
misunderstanding and cooperate with the FBI Agents. Ultimately, Lyon
reiterated that he had not been inside of the Capitol, but he believed that
Thompson had been inside of the Capitol because Thompson later
approached Lyon carrying a wood and bronze coat rack.
Lyon provided FBI Agents with consent to download his
Samsung Note 4. Upon review of the data from the phone, there was one
picture and one video sent from Thompson to Lyon on January 6, 2021.
Both messages were sent from the number associated with Thompson.
Additionally, the name below the phone number is “Dustin.”

In the photo, Thompson is posing with the

stolen coat rack. The timestamp for the message transmitting the photo is
8:27:44 UTC, or 3:27 p.m. local time.

413
Telegram Channel @nettrain
Images reproduced in charging documents.

414
Telegram Channel @nettrain
 The timestamp for the message
transmitting the video is 8:04:14 UTC, or 3:04 p.m. local time. Two
seconds into the video, Thompson passes in front of a mirror with his
phone. The man in the video is wearing the same Trump 2020 winter cap
captured in the photo where Thompson is posing with the coat rack. In
the video, Thompson yells “Wooooo! ‘Merica Hey! This is our house!”
The video continues for several seconds, showing a ransacked office.

415
Telegram Channel @nettrain
 Images reproduced in charging documents.

Coordinated Universal Time (UTC) is the primary time standard

by which the world regulates clocks and time. UTC is used in many
internet and World Wide Web standards. Time zones around the world
are expressed using positive or negative offsets from UTC. In the Eastern
Time zone, where Washington, D.C. is located, the negative offset is five
hours, or “UTC-05:00.”
Lyon told the FBI Agents that, after he was questioned on
January 6, 2021, he returned to his hotel room where he found

416
Telegram Channel @nettrain
Thompson. The two drove back to Ohio together the next day. Based on

the information Lyon provided, FBI Agents

located Thompson’s Ohio Department of Motor Vehicles (“DMV”)
photograph. Both Lyon and another witness who was also interviewed by
FBI Agents (“Witness #1”), identified the DMV photograph as a picture
of Thompson.

By comparing the barcode on the coat rack

with the inventory of items in the Capitol Building, USCP Agents
confirmed that the coat rack that Thompson tried to carry away before
fleeing was assigned to a specific room in the Capitol Building, Room
S132.
Subsequent investigative efforts revealed security footage from
inside the Capitol Building. In that footage, Thompson is captured
entering the Capitol Building. An image from that video is below, with
Thompson circled. The timestamp of the video reads 2:48:07 p.m.
Thompson continues into the building, eventually walking into an office
on his right.

417
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

When Thompson leaves the office, he is holding a bottle of

bourbon, circled below.

418
Telegram Channel @nettrain
 About four minutes after Thompson leaves the Capitol Building,
he returns with Lyon. Thompson and Lyon enter the same room together.

Pictures reproduced in charging documents.

When they exit the room, Thompson is holding a coat rack.

419
Telegram Channel @nettrain
 As depicted in the still images above, Lyon is wearing the same
distinctive orange winter cap in the Capitol Building security footage
that he was wearing when he identified himself to USCP Agents on
January 6, 2021. Further, USCP Agents positively identified Lyon in the
Capitol Building security footage as the man they interviewed on
January 6, 2021, and the man who identified himself to the USCP Agents
verbally and by driver’s license as Lyon.

420
Telegram Channel @nettrain
CHARGES FILED FOR EACH:
1. Obstruction of an official proceeding and aiding and abetting;
2. Theft of government property;
3. Entering and remaining in a restricted building or grounds;
4. Disorderly and disruptive conduct in a restricted building or
grounds;
5. Disorderly conduct in a Capitol building;
6. Parading, demonstrating or picketing in a Capitol building

421
Telegram Channel @nettrain
William Vogel
Large Red Hat

Pictures reproduced in charging documents.

An FBI investigator reviewed multiple

videos provided to the FBI by multiple tipsters, where the individual
taking the video is participating in the riots on the U.S. Capitol grounds
and inside the U.S. Capitol Building. Specifically, the videos show the
person taking the video marching on the Capitol grounds while people

422
Telegram Channel @nettrain
chant, “Whose house? Our house!” The videos show multiple people
actively damaging scaffolding and police barriers around the Capitol
Building and the individual recording enters into the Capitol Building as
well. Some videos were recorded on Snapchat and show the individual
recording the video moving through various halls and corridors inside
the U.S. Capitol Building, as shown by the two screenshots from the
video below.

Pictures reproduced in charging documents.

While inside the Capitol Building, the individual taking the

video records law enforcement officers retreating from the rioters. The
person taking the video can also be heard on the audio supporting the
actions of other persons engaged in disorderly conduct.

423
Telegram Channel @nettrain
 The videos show the Snapchat usernames
“will vogel” and “willvogelmusic.” The emoji created alongside both
usernames is consistent with the actual appearance of William Vogel in
other photos obtained pursuant to this investigation. Numerous tipsters
contacted the FBI to report these videos and the subsequent posting of
these same videos on Facebook.

“Tipster #1,” who has known Vogel

socially for several years, recognized the Snapchat user “will vogel” to
belong to William Vogel of New York and claimed to be “100% sure”
that the voice of the person taking the video and narrating was the voice
of Vogel.
“Tipster #2” saw videos from what Tipster #2 described as
Vogel’s personal Snapchat account posted to Vogel’s personal Facebook
account. Tipster #2, who has known Vogel socially for several years,
verified that both accounts belong to William Vogel of New York.
Tipster #3 saw a video from the Snapchat account “will vogel.”
Tipster #3 has known William Vogel socially for several years, and
verified that the account belongs to William Vogel of New York.

Tipster #4, who has known Vogel socially

for several years, saw a video on Facebook and verified that the
Facebook account as well as the related Snapchat account belong to

424
Telegram Channel @nettrain
William Vogel of New York. Tipster #4 also stated that Vogel was “very
vocal” about being at the January 6, 2021 “Stop the Steal” rally in
Washington, D.C. Portions of the video described above appear to be in
the area of the National Mall with Vogel moving from Trump’s rally site
to the Capitol grounds.

Vogel was identified as the account holder

of Facebook account “Will Vogel.” Facebook subscriber records confirm
that the account holder identifies himself with the name Will Vogel,
verified his phone number, gave his current residential city and state,
registered his email and Facebook confirmed the user’s mobile device
type as a Samsung SM-G955U1. Data searches through multiple services
identified one William Vogel, with a legal address in New York.

Google documentation confirms that the

user of the same email address mentioned above is “Will Vogel.”

Additionally, data searches affirm that

Vogel is the user of the previously identified phone number, which was
serviced by AT&T/Cingular Wireless. Records from AT&T confirm that
phone number is used on a Samsung SM-G955U1 cellular phone.

The FBI was able to confirm that Vogel

had a mailing address in New York, and had an active registration of a
vehicle with New York plates.
The FBI investigator reviewing this case obtained license plate
reader database information from a number of states, which showed the

425
Telegram Channel @nettrain
car registered to Vogel:

a. leaving New York, driving

southbound on the Henry Hudson Bridge in New York at
approximately 6:06:08 a.m. on January 6, 2021;
b. driving southbound over the Delaware Memorial Bridge,
connecting New Jersey and Delaware, at approximately
7:54:31 a.m.;
c. driving southbound through Maryland at approximately
8:44:56 a.m. on the JFK Memorial Highway;
d. driving southbound through Baltimore on the Harbor
Tunnel Thruway at approximately 9:15:27 a.m.;

e. later that afternoon driving

northbound in Anne Arundel, Maryland at
approximately 4:58:24 p.m.;
f. driving on the Harbor Tunnel Thruway in Baltimore at
approximately 8:12:29 p.m.;
g. driving northbound on the JFK Memorial Highway at
8:44:01 p.m.; and
h. returning to New York, driving on the George
Washington Bridge, at 23:59:22 p.m. on January 6,
2021.
The license plate reader evidence shows that Vogel left New
York in his car early on January 6, 2021, before the riots at the Capitol,
and then departed after the riots, driving through Maryland back to New
York that evening.

426
Telegram Channel @nettrain
 Records from Facebook show that Vogel
uses his Facebook account regularly to post and communicate with
others. On January 7, 2021, Vogel communicated via his Facebook
account with a Facebook friend (“User #1”) by sending User #1 a video
of the riots and occupation of the U.S. Capitol Building using
Facebook’s Messenger service. User #1 responded that they saw a
picture of William Vogel “in dc” after which the two discussed the events
of January 6, 2021. User #1 then sent the below photo to Vogel. Vogel
can be seen carrying a large red hat and a jacket. The large red hat is
noted with an arrow.

Pictures reproduced in charging documents.

In the below photo from the license plate reader hit on the JFK
Memorial Highway in Cecil County, Maryland from 8:44 a.m. on
January 6, Vogel can be seen wearing what appears to be the same jacket
while driving his vehicle and with what appears to be the same large red
hat (noted with an arrow) sitting in the front passenger seat area.

427
Telegram Channel @nettrain
Pictures reproduced in charging documents.

428
Telegram Channel @nettrain
 William Vogel also previously
posted a photo of himself, shown below, on his Facebook account
wearing what appears to be the same large red hat (noted with an arrow).

On January 7, 2021, Vogel sent another

Facebook friend (“User #2”) the video of his actions on January 6, 2021
via Facebook’s Messenger service. User #2 asked Vogel “did you take
that?” Vogel replied,” yes ma’am” and went on to state “So they have
these shadow twitter accounts and they're trying to report me to the
FBI/DOJ and put me away for 10 years for Domestic Terrorism, because
of my snapchat story, where I simply walked into the lobby of the
capital” and “And didn’t even film anything crime wise”.

On January 6, 2021, William Vogel had

another conversation using Facebook’s messenger service with another
Facebook friend (“User #3”), during which Vogel sent a location
verifying that he was in Washington, D.C. Vogel sent User #3 the
aforementioned video. During the ensuing messages, the two continued

429
Telegram Channel @nettrain
to talk about Vogel’s involvement during the riots and their thoughts on
Vogel’s criminal culpability.

CHARGES FILED:
1. Knowingly entering or remaining in any restricted building or
grounds without lawful authority;
2. Knowingly engaging in disorderly or disruptive conduct in any
restricted building or grounds; and
3. Violent entry and disorderly conduct on Capitol grounds.

430
Telegram Channel @nettrain
Riley June Williams
Speaker Nancy Pelosi Laptop Thief

Image reproduced in charging documents.

In the days following the January 6, 2021,

events, a witness (“Witness #1”) made several phone calls into the FBI’s
telephone tip line. The caller stated that he was the former romantic
partner of Riley June Williams, he saw Williams depicted in a YouTube
video taken on January 6, 2021 from inside the U.S. Capitol Building,
and provided the specific YouTube video link. Witness #1 stated that
Williams can be seen directing crowds inside the U.S. Capitol Building
up a staircase. Witness #1 also claimed to have spoken to friends of
Williams, who showed Witness #1 a video of Williams taking a laptop
computer or hard drive from Speaker Nancy Pelosi’s office.

Witness #1 stated that Williams intended

to send the computer device to a friend in Russia, who then planned to
sell the device to SVR, Russia’s foreign intelligence service. According
to Witness #1, the transfer of the computer device to Russia fell through
for unknown reasons and Williams still has the computer device or
destroyed it.

431
Telegram Channel @nettrain
 The video referred to is 32-minutes long,
with audio, and consists of a video report called “Storming the Capitol:
The Inside Story,” from ITV News, a British television network. At or
about 20 minutes and 40 seconds into the video, there appears at the
bottom of a staircase the subject, believed to be Williams, a Caucasian
female wearing a green t-shirt and brown trench coat and carrying a
black-and-white striped zebra-print bag over her shoulders. She has
brown shoulder length hair and wears eyeglasses. She is wearing a black
face mask below her chin, around her neck. She can be heard in the
video repeatedly yelling, “Upstairs, upstairs, upstairs,” and can be seen
physically directing other intruders to proceed up a staircase. The video
also shows a stream of rioters walking up a nearby staircase.
According to the federal affidavit, an FBI investigator confirmed
with U.S. Capitol Police that the staircase depicted in the video leads to
the office of Speaker of the U.S. House of Representatives, Nancy
Pelosi. The federal affidavit provided video screenshots as evidence.

432
Telegram Channel @nettrain
Pictures reproduced in charging documents.

433
Telegram Channel @nettrain
 The FBI investigator reviewed maps of the
interior areas of the Capitol and confirmed the subject appears to have
been in an area near the Crypt, sometimes referred to as the “Small
House Rotunda.” In the audio of the ITV News video, the reporter states
that the recording took place near the U.S. Capitol Building area called
the Crypt.

In the background of the top screenshot

above, a bust of Winston Churchill is visible behind the subject, which is
also consistent with the location in the Small House Rotunda. The maps
confirm that there is a nearby staircase, which leads to the office of
Speaker Pelosi.
In other videos, Williams can be seen in one or more of these
videos entering the U.S. Capitol, wearing the same green t-shirt, brown
trench coat, and black-and-white shoulder bag. A screenshot of one of
the videos is below.

434
Telegram Channel @nettrain
 Pictures reproduced in charging documents.

The FBI presented the below photo that depicts Williams inside
the Capitol Building, pointing and directing intruders. She is wearing the
same green t-shirt and brown trench coat. The photo appears to have
been taken in Statuary Hall inside the U.S. Capitol Building.

435
Telegram Channel @nettrain
 FBI investigators reviewed the below Pennsylvania driver’s
license photograph for Williams and compared it to the photographs and
videos and concluded it was the same person.

436
Telegram Channel @nettrain
 According to the
federal affidavit, FBI investigators spoke with local law enforcement
agents in Harrisburg, Pennsylvania about their recent interactions with
Williams’ parents. According to those officers, on January 11, 2021,
local law enforcement received a Suspicious Persons report filed by
Williams’ mother. Officers arrived at the address that Williams shared
with her mother and interviewed her mother. Williams was not present
but according to her mother, the suspicious person was assumed to be
Witness #1. While the officers were present, Williams’ mother used her
cell phone to place a video-enabled phone call to Williams. Officers
observed Williams on her mother’s cell phone screen and noted that
Williams was wearing a brown-colored jacket, consistent with the
screenshots above.

According to the Harrisburg officers, on

January 16, 2021, they again spoke with Williams’ mother who told
them that a British media crew had come to her home the night before,

437
Telegram Channel @nettrain
asking to speak with Williams, who was not present. The news crew
presented Williams’ mother with one or more images taken at the U.S.
Capitol on January 6, 2021. Her mother acknowledged that it was
Williams in the image.

According to the Harrisburg officers, on or

about January 16, 2021, officers called Williams’ father who resides
elsewhere in Pennsylvania. He stated that he drove to Washington, D.C.
with Williams for the protests on January 6, 2021. He stated that his
daughter and he did not stay together throughout the day and that
Williams was meeting up with other individuals she knew at the protests.
Williams later met up with her father outside of the U.S. Capitol
Building, and they returned home to Harrisburg together.
On or about January 16, 2021, ITV posted a second related video
to YouTube, titled “Revealed: ITV News identifies protester who
stormed the Capitol.” In this video, the reporter identifies “Riley
Williams” as the person depicted in portions of the prior ITV video
described above. The reporter then interviewed a woman who identified
herself as Williams’ mother and showed Williams’ mother video footage.

Williams’ mother stated that she recognized her

daughter inside the U.S. Capitol Building and that her daughter had
taken a sudden interest in Trump’s politics and “far right message
boards.” She claimed that Williams “took off,” “is gone,” and is waiting
for law enforcement to come to Williams and ask her about her activities
in the Capitol.
According to local law enforcement officers in Harrisburg,
Williams’ mother stated that Williams packed a bag and left her home
and told her mother she would be gone for a couple of weeks. Williams

438
Telegram Channel @nettrain
did not provide her mother any information about her intended
destination.

Sometime after January 6, 2021, Williams

changed her telephone number and deleted her social media accounts on
Facebook, Instagram, Twitter, Reddit, Telegram, and Parler.
A complaint and arrest warrant were issued in the U.S. District
Court for the District of Columbia on January 17, 2021. Williams, who
was aware of the warrant and charges, surrendered to authorities and was
arrested in Harrisburg, Pennsylvania, on January 18, 2021.

439
Telegram Channel @nettrain
 On January 18, 2021, FBI
agents obtained from Witness #1 copies of several video clips that
Witness #1 stated had been recorded and livestreamed by Williams and
subsequently copied or screen captured by a friend of Williams, which
depict events inside and outside the U.S. Capitol Building on January 6,
2021.
In one four-second video (“Williams Video #1”), the person
holding the cell phone camera is standing, angling the camera down
toward a wooden desk with an “HP” laptop. A female voice that
investigators believe to be Williams’ voice based on review of the ITV
YouTube video noted above can be heard saying, “Dude, put on gloves.”
Next, what appears to be a man’s arm then reaches toward the

laptop, with a black glove covering his hand, and

begins to lift the laptop off the table. There is text across the video clip

440
Telegram Channel @nettrain
that reads: “they got the laptop.” Given how loud Williams’ voice is, it
seems likely that she was the one holding the cell phone camera.

Investigators confirmed with U.S. Capitol

Police representatives that an “HP” brand laptop was stolen from
Speaker Pelosi’s office on January 6, 2021. Upon review of the footage,
Capital Police confirmed that Williams Video #1 was recorded from
Pelosi’s office.
Surveillance video taken outside of Pelosi’s office confirmed
that Williams can be seen entering and exiting Pelosi’s office.
Investigators also observed an individual re-posting on Twitter
the same videos provided by Witness #1 along with posts from a user
named “riley” on the social media platform Discord, which Witness #1
has stated Williams frequently uses. In these posts, “riley” states, among
other things, “I stole shit from Nancy Polesi [sic],” and “I took Polesis
[sic] hard drives.” Examples are posted below:

Images reproduced in charging documents.

441
Telegram Channel @nettrain
CHARGES FILED:
1. Knowingly entering or remaining in any restricted building or
grounds without lawful authority;
2. Violent entry and disorderly conduct on Capitol grounds;
3. Aiding and abetting others to embezzle, steal, purloin; and
4. Obstruct, influence, or impede any official proceeding.

442
Telegram Channel @nettrain
 443
Telegram Channel @nettrain
 444
Telegram Channel @nettrain
 Section III – Tactics, Techniques and
Procedures

Section Table of Contents

Topic Page
Chapter 12 – Best practices for OSINT Investigators
Chapter 13 ‒ Deepfakes and Cheapfakes
ThisPersonDoesNotExist.com
Adobe Photoshop Liquify Filter
FacePlusPlus.com
Sensity.ai
Fake Name Generator
Generate Person
Chapter 14 ‒ Facial recognition
Betaface
Automated Image and Analytics
PimEyes.com
FindClone.ru
Let’s Enhance
Chapter 15 ‒ Image Research
Reverse Image Searching
Google Image Search
Microsoft Bing
Yandex
TinEye
RevEye
Live Streaming Cameras
EarthCam
Insecam
Metadata Explained
Facebook, Instagram, Twitter scrub metadata
Analysis Tools
InVID-WeVerify Toolkit

445
Telegram Channel @nettrain
 Forensically
Adobe Photoshop
Chapter 16 ‒ Exercises in Photo Observation
Study #1
Study #2
Study #3
Study #4
Study #5
Study #6
Chapter 17 ‒ Reverse Engineering Social Media
Digital breadcrumbs
NameChk.com
CheckUsernames.com
KnowEm.com
Data Breach Databases
HaveIBeenPwned
Firefox Monitor
Email verification
Hunter.io
VerifyEmailAddress.org
Chapter 18 – Investigating Social Media Accounts
Facebook
Who Posted What?
Facebook Live Videos
Lookup-ID.com
FBSearch
Sowdust FB Search
Facebook Graph – Codes & Operators
Getfbstuff
DownAlbum
Downfacebook
FBDown and Video Downloader PLUS
Imgur
Instagram
StorySaver.net
DownloadGram
4K Stogram
LinkedIn
Contact Out

446
Telegram Channel @nettrain
 LinkedIn Premium Services
Identify sales robots and fake friends on LinkedIn
Reddit
Reddit Investigator
Reddit Graph
Karma Decay
Snapchat
Saving Snap Maps
Telegram
Telegram Channels
Telegogo
Telegram DB
Buzz.im
TGStat
Tik Tok
OSINT Combine’s Tik Tok Quick Search
TikTok Downloader
Tumblr
Twitch
Twitter
Twitter Advanced Search
TweetDeck
AllMyTweets.net
Location Based Searches
Tinfoleak
Twitonomy
TweetBeaver
Botometer
twXplorer
Twitter Video Downloader
YouTube
Watch Frame by Frame
YouTube Geofind
Amnesty International DataViewer
YouTube Metadata
RadiTube.com
RealPlayer Downloader
Y2mate Video Downloader
YouTube Converter
Chapter 19 ‒ Fringe Social Media

447
Telegram Channel @nettrain
 4chan
4pleb.org Archive
Nyafuu Archive
Other 4chan archives
8kun
Discord
DLive
Gab
Parler
Patriots.win
Chapter 20 ‒ Real World Data
People Searching – Paid Services
The National Sex Offender Public Website
Federal Bureau of Prisons Inmate locator
Inmate locator
Edmunds Car Data
Dun & Bradstreet Reports
Chapter 21 ‒ Archiving Data
Internet Archive
Archive Today
How to Capture Screenshots
Save to Adobe PDF
Hunch.ly
Snagit
Zotero

448
Telegram Channel @nettrain
 449
Telegram Channel @nettrain
 Chapter 12 – Best practices for OSINT
Investigators

In a January 15, 2021 article in the MIT Technology Review

titled, “A guide to being an ethical online investigator,” journalist Tanya
Basu provided several important points for both experienced and new
OSINT investigators to remember in the course of their work, including:
Your role is not to be a hacker. There’s a big difference
between accessing publicly available information, like a photo from a
Facebook profile page that documents illegal activity, and hacking into a
person’s otherwise private account to find that photo. That’s crossing the
line and is likely illegal.
There are many ethical issues to consider. Much of the online
activity carried out in the wake of the Capitol riots raises ethical
questions, too. Should a person who didn’t storm the Capitol but
attended the rallies leading up to the riots be identified and risk
punishment at work? Do those who were in and around the Capitol on
January 6 automatically lose the right to privacy even if they weren’t
involved in riots? Carefully consider what the boundaries of your
investigation should be and why.
Misidentification is a real danger. Crowdsourced efforts can be
problematic, because people may zero in on the wrong individual.
Mistakes can be devastating for the person misidentified.
Misidentification carries potential legal risks, too.
Consider joining an established effort rather than going solo.
Organizations such as Bellingcat have ethical standards put in place to
guide new sleuths.
Don’t doxx. Doxxing - or digging up personal information and
sharing it publicly - is illegal. If you come across passwords, addresses,
phone numbers, or any other similar identifier, do not share it. It is a
crime to do so. If you find something online that could be incriminating,
ask yourself, “Am I putting this person in danger?”
Show your methodology. Data researchers who do this work
are diligent and exhaustive in how they record their work and triple-

450
Telegram Channel @nettrain
check their information. Documenting your process is important to
ensure that people are properly identified and that others can learn from
and retrace your steps for subsequent prosecution.
Do not share names publicly online. Even if there’s no doubt
that you have figured out who a person is, hold back and, at the most,
submit your information to an organization like Bellingcat or the FBI to
check your work and make sure it is correct.
Your safety may be at risk. Many digital activists have burner
phones and backup computers, and work away from their families to
protect them.
Take care of your mental health. This work can involve
viewing violent images or an overabundance of media that starts to erode
your internal protections. Take time to process and protect your personal
well-being.
Share your information with law enforcement if appropriate.
According to the article, many activists have a strong distrust of US law
enforcement, pointing to the difference between how the Capitol rioters
and Black Lives Matter protesters were treated. But in the case of the
insurrection, which carries federal charges, experts and activists agree
that the right thing to do is to take information to the authorities.[98]

According to a January 15, 2021, article by the Global

Investigative Journalism Network titled, “How Open Source Experts
Identified the US Capitol Rioters,” journalist Rowan Philp interviewed
Giancarlo Fiorella, a senior investigator with Bellingcat, and Bertram
Hill, an open source investigator with BBC Africa Eye, on their practices
during an investigation and compiled the following list of ten tips and
techniques they used to document violent public events like the Capitol
insurrection. The specific platforms they mention are discussed later in
this Section.
1. Triage your downloads. Since people involved with riots are
likely to be the first to delete their own social media posts, be
sure to grab and archive videos and images as soon as possible.
Of these, posts by those who appear directly responsible for
criminal activity should be the first to be preserved, followed
by material from innocent bystanders, and then videos posted
on major platforms which could remove clips for violating hate

451
Telegram Channel @nettrain
 and violence policies. Posts from journalists can potentially be
downloaded later.
2. Divide platform responsibilities as major events break.
Divide the tasks of monitoring Twitter, Facebook, Telegram,
WhatsApp, and other platforms between each member.
3. Consider free third-party sites to archive video — but code
if you can. Consider platform-specific download sites - like
twittervideodownloader.com for Twitter, FBdown.net for
Facebook video, and y2mate.com for YouTube - and save the
archived clips to your drive. Hill warns that downloads to
third-party sites can potentially fall foul of platform rights
policies, and that using basic coding skills for “command-line”
software (where you type commands for text prompts) is a
safer option.
4. Look for original evidence from retweet reactions. “People
just talking about a clip can lead you to evidence,” Fiorella
explains. “Maybe the person who uploaded the video doesn’t
say anything, but maybe someone watching the clip will say
‘Oh my God, I think in this video you can see the shooting!’”
Typed curse words are often associated with violent moments,
so curses themselves can also be searched.
5. Find a strategy for archiving livestreams. Fiorella said
archiving livestreams proved more complicated than other
media during the Capitol siege. Hill said standard screen-record
functions “are notoriously tricky” but can sometimes suffice in
capturing live video; more efficient, paid-for services can be
purchased online.
6. Use Hunch.ly to archive your own search. Since some of the
dozens of pages you visit during a rapid scrape effort could be
deleted later — or become important later — use the Hunch.ly
plugin to automatically record your digital steps.
7. Secure text-based social media posts on reliable apps.
Fiorella archived text posts from the Capitol on the Wayback
Machine and Archive.today.
8. Search reliable databases for identifying symbols. Fiorella
says reliable symbol resources — such as the Anti-Defamation
League’s Hate Symbols Database — can be useful in
identifying far-right groups. Even the typeface of slogans on

452
Telegram Channel @nettrain
 flags and shirts can be checked on the WhatTheFont tool. For
instance, recent research indicates that the “Cloister Black
Light” font is most closely associated with militia groups.
9. Try a strong facial recognition app if all else fails. In
addition to traditional reverse image tools like Yandex and the
Google Images search, Fiorella says open source face
recognition app PimEyes has proven useful for investigators in
identifying individual rioters.
10. Monitor parallel news and open source research in real-
time. Building on what the news media and other researchers
find is key, says Fiorella.[99]

453
Telegram Channel @nettrain
 Chapter 13 ‒ Deepfakes and Cheapfakes

Manipulated videos, audio and images have been around for

years, but the rise of artificial intelligence and advanced editing software
have made them much, much harder to spot. As an October 19, 2020,
CNN article pointed out, “Manipulated video is everywhere. After all,
our favorite movies and TV shows use editing and computer-generated
imagery to create fantastical scenes all the time. Where things get hairy
is when doctored videos are presented as accurate depictions of real
events.” There are two general kinds of deception:
Deepfakes: These are videos that are altered or generated using
artificial intelligence, neural networks and machine learning.
Cheapfakes: These are videos that are altered using traditional
video editing tools like editing dubbing, speeding up or slowing down, or
splicing together different scenes to change context.
Edward J. Delp, a professor at the School of Electrical and
Computer Engineering at Purdue University, has been studying media
forensics for 25 years. In his interview with CNN, he said wider access
to AI software and advanced editing tools means almost anyone can
create fake content. And it doesn’t need to be sophisticated to be
effective. “People will buy into things that reinforce their current
beliefs,” he said. “So they’ll believe even a poorly manipulated video if
it’s about someone they don’t like or think of in a certain way.”
According to CNN, media literacy educator and expert Theresa
Giarrusso described five different types of misinformation:
1. Manipulated media: Photoshops, edited “cheapfakes” and
some deepfakes.
2. Fabricated media: Generated media, like fake faces, and
some deepfakes.
3. False context: When a photo, piece of video or even entire
event is taken out of content and attached to a different
narrative.
4. Imposter media: When someone pretends to be a reputable
news source, or impersonates a news source.

454
Telegram Channel @nettrain
5. Satire: Misinformation knowingly created for the purpose
of entertainment or commentary.[100]

455
Telegram Channel @nettrain
ThisPersonDoesNotExist.com
https://thispersondoesnotexist.com/
As an example of the power of artificial intelligence in spreading
misinformation, ThisPersonDoesNotExist.com is one of several websites
that uses AI to generate fake portraits. Hitting refresh on the site presents
a new face, each one created from scratch, drawing from a huge dataset
of faces.
None of these faces are of a real human being, each was
generated using AI.

456
Telegram Channel @nettrain
Adobe Photoshop Liquify Filter
https://www.adobe.com/creativecloud.html
Adobe Photoshop, available through the Adobe Creative Cloud
suite of powerful programs, has easy-to-use facial manipulation tools
that anyone, even non-technical people, can use to alter a person’s look.
Photoshop’s Liquify filter uses a simple slider control menu to let users
alter several facial features, including:
Eyes – change eye size, height, width, eye tilt, and eye
distance;
Nose – change height and width;
Mouth – change smile, mouth height, width, and upper and
lower lip thicknesses; and
Shape – change forehead height, chin height, jawline width,
and face width

Below are two faces (from ThisPersonDoesNotExist.com) that I

manipulated using Photoshop’s Liquify filter (2021 version of
Photoshop) to illustrate Photoshop’s capabilities.

457
Telegram Channel @nettrain
Original, unaltered image

Eye size: decreased

Eye height: decreased
Eye width: increased
Eye tilt: drooping
Eye distance: decreased

458
Telegram Channel @nettrain
Nose height: lengthened
Nose width: widened
Smile: decreased
Lower lip: increased
Mouth width: increased
Forehead: lowered
Chin height: lowered
Face width: widened

Eye side: increased

Nose height: shortened
Nose width: narrowed
Smile: increased
Mouth width: widened
Mouth height: increased
Chin height: lengthened
Jawline: narrowed
Face width: narrowed

459
Telegram Channel @nettrain
Original, unaltered image

Eye height: decreased

Eye tilt: drooping
Nose height: lengthened
Nose width: widened
Smile: decreased

460
Telegram Channel @nettrain
Mouth width: increased
Mouth height: increased
Forehead: lowered
Chin height: lowered
Jawline: widened
Face width: narrowed

Eye side: increased

Eye height: increased
Eye distance: increased
Nose height: lengthened
Nose width: narrowed
Smile: increased
Mouth width: increased
Mouth height: increased
Forehead: heightened
Chin height: lowered
Jawline: narrowed
Face width: narrowed

461
Telegram Channel @nettrain
FacePlusPlus.com
https://www.faceplusplus.com/face-merging/
FacePlusPlus is one of many face merging sites out there, which
takes two facial images and morphs them into a new person.

462
Telegram Channel @nettrain
Sensity.ai
https://sensity.ai/
Sensity is a premium service that claims to be the world’s first
detection platform for deepfakes. Sensity.ai seeks to analyze suspicious
files and URLs to detect types of AI-generated visual threats. Users can
upload images or submit a website link for inspection, and Sensity’s
analysis looks for signs of manipulation and synthesis on the face area.

Sensity.ai can also analyze and rate a public figure’s deepfake

risk, and part of their paid service is personal branding protection. For
public figures, it calculates a risk score by searching for the following:
Deepfakes – visual media manipulated or synthesized with
artificial intelligence;
Cheapfakes – visual content edited with lower-end
software;
Stolen media – proprietary visual content stolen and/or
repurposed;
Lookalikes – visual content deceptively representing the
person by somebody looking similar;
Creation requests – intercepted requests for creation of one
of the above; and
Face sets – archives containing (thousands of) photos of the
person above used to create deepfakes.
From my experience, their photo analysis ratings were not very
accurate, but I assume that will improve over time so it will remain on

463
Telegram Channel @nettrain
my list of tools.

464
Telegram Channel @nettrain
 Their public figure search function is illustrative of how
commonplace deepfakes have become in our world. As an example,
below is Sensity.ai’s assessment of President Joe Biden, who has a 100%
risk rating that his image is being copied in deepfakes.

The premium versions will allow you to click the links to the
identified deepfakes, cheapfakes, and other categories. Sensity.ai also has
a feature to help request removal of the manipulated images.

465
Telegram Channel @nettrain
Fake Name Generator
https://www.fakenamegenerator.com
Fake Name Generator creates a lengthy list of personal details for
a fictional person including place of employment, favorite color, and type
of vehicle owned. Below are examples for both a male and female
identity. This and similar services can be used for creating fake bot
profiles to appear more like a real human being.

466
Telegram Channel @nettrain
 467
Telegram Channel @nettrain
 468
Telegram Channel @nettrain
 469
Telegram Channel @nettrain
Generate Person
https://cdn.rawgit.com/Marak/faker.js/master/examples/browser/
index.html#
Another fake identity generator, Generate Person creates random
contact information. The city, state, and zip codes generated may not
exist in the real world.

470
Telegram Channel @nettrain
 471
Telegram Channel @nettrain
 Chapter 14 ‒ Facial recognition

I’ve seen many OSINT discussions about photo analysis begin

with an overview of reverse image searching using various search
engines and resources, a topic that is essential for many investigations.
Because the Capitol riots were so focused on identifying individual
suspects, however, I am going to jump ahead and focus first on facial
recognition resources in this chapter, and then discuss broader reverse
image searching tactics in the next chapter.

Betaface
https://www.betaface.com

Betaface can search an image to detect multiple faces and isolate

each face by cropping out extraneous background areas. The program
then detects as many as 101 facial points on each face and measures or
characterizes facial features. Betaface analyzes each face and estimates
an extensive list of characteristics including gender, age, smile, ethnicity
detection, glasses, skin color, facial hair, hair color type, and hairstyle
detection. It even decides if a person is considered attractive or not.
Advanced features include search, identification, verification, faces
similarity, and face matching.
You can upload images and retrieve image metadata, create face
recognition databases and namespaces, search persons in your

472
Telegram Channel @nettrain
namespaces, and verify identity. Betaface is free for non-commercial or
low traffic commercial applications. Paid options are also available.
Betaface seeks to detect and classify:
gender, age, ethnicity, emotion (smile/neutral);
eyeglasses, mustache and beard;
face and facial features description (shape, relative size and
location);
eyes, hair, skin, clothes and background colors;
facial hair amount; and
approximate hairstyle (length, thickness, form).

While Betaface’s measurements, like any other facial

recognition program, will have a margin of error, its ability to batch
analyze faces can still be a useful tool in creating datasets of a group that
can be searched by a wide range of quantitative or descriptive
measurements, for example, collating all suspects who wear eyeglasses
or are bald.

473
Telegram Channel @nettrain
 After running some images through Betaface’s online demo the
results were impressive, particularly for a free resource. Here is one
example using a lower-resolution screengrab of a police officer’s body-
worn camera footage of Capitol rioters:

Pictures reproduced in charging documents.

Betaface was able to recognize four faces. Clicking on a face

will display Betaface’s estimated measurements.

474
Telegram Channel @nettrain
 Below are three test samples. On the left is the original. On the
right are facial points detected using the Betaface analysis.

475
Telegram Channel @nettrain
Pictures reproduced in charging documents.

476
Telegram Channel @nettrain
 Betaface provided 73 different measurements, grades, or Yes/No
assessments on each face, including their level of confidence on any
estimate, expressed as a percentage. For example, for facial feature #1,
whether a face has a 5 o’clock or not, Betaface reports a 43 percent
confidence level that Face #1 does not have a 5 o’clock shadow
(although he does appear to have one), certainty that Face #2 does not
have one, and an 86 percent certainty that Face #3 does not. Feature #2,
the face’s age, appears to be significantly off for Faces #1 and #2, but
may be closer in accuracy for Face #3.

# Feature Face #1 Face #2 Face #3

1. 5 o’clock
no (43%) no no (86%)
shadow
2. age 19 (60%) 17 (60%) 19 (60%)
3. arched
no no (76%) no
eyebrows
4. attractive no no (40%) no (97%)
5. bags under
no (1%) no (55%) no (39%)
eyes
6. bald no (4%) no (43%) no (60%)
7. bangs no (79%) no (60%) no (14%)
8. beard no (23%) no no (96%)
9. big lips no (86%) no (35%) no (54%)
10. big nose no (12%) yes (40%) yes (5%)
11. black hair no (55%) yes (60%) no (64%)
12. blond hair no (74%) no (96%) no (83%)
13. blurry yes (41%) no (32%) yes (38%)
14. brown hair no (59%) no (71%) no (21%)
15. bushy
no (63%) no (34%) no (87%)
eyebrows
16. chubby yes (28%) yes (34%) yes (5%)
17. double chin yes (1%) yes (19%) no (26%)
18. expression neutral smile (53%) neutral

477
Telegram Channel @nettrain
 (52%) (53%)
19. gender male (81%) female (7%) male (49%)
20. glasses no yes yes
21. goatee no (53%) no no
22. gray hair no (5%) no (37%) no (20%)
23. heavy
no (91%) no (60%) no
makeup
24. high
no (43%) yes (22%) no (68%)
cheekbones
25. mouth open yes no (68%) no (47%)
26. mustache no (27%) no (95%) no (87%)
27. narrow eyes yes (47%) no (80%) yes (18%)
28. oval face yes (9%) yes (28%) no (48%)
29. pale skin no (80%) yes (27%) yes (10%)
30. pitch -8.75 -9.36 -7.57
31. pointy nose no no (99%) no
32. race white white white (93%)
33. receding
no (36%) no (20%) no (77%)
hairline
34. rosy cheeks no no no
35. sideburns no (59%) no no
36. straight
no (18%) yes (4%) no (24%)
hair
37. wavy hair no (99%) no (17%) no (57%)
38. wearing
no (88%) no (42%) no (49%)
earrings
39. wearing hat yes (33%) no (41%) yes (63%)
40. wearing
no no (33%) no
lipstick
41. wearing
no (95%) no (44%) no (50%)
necklace
42. wearing
no (10%) no (21%) no (43%)
necktie
43. yaw -8.14 -3.81 4.98
44. young no (26%) no (11%) no (21%)
45. chin size extra large extra small extra small

478
Telegram Channel @nettrain
46. color 848199 (1%) 1e4a44 (0%) 8667a5 (1%)
background
47. color
45302e
clothes fdefed (27%) 0
(16%)
middle
48. 6e5d6a 53323c
color eyes 643c37
(32%) (99%)
49. 5e73a6 151b1d 4d433e
color hair
(37%) (90%) (67%)
50. color skin 936560 c79398 e495b8
51. eyebrows
extra low average average
corners
52. eyebrows
average extra low extra low
position
53. eyebrows
extra thin extra thin extra thin
size
54. eyes
extra low low low
corners
55. eyes
close extra far average
distance
56. eyes
low extra low extra low
position
57. eyes shape average average thin
58. glasses rim no no no
59. hair beard none none none
60. hair color not natural brown light
black (90%)
type light (37%) (67%)
61. hair
no no yes
forehead
62. hair length none very short none
63. hair
none none none
mustache
64. hair sides very thin thin very thin
65. hair top average short average
66. head shape heart rect extra rect
67. head width extra narrow wide extra wide
68. mouth extra raised extra raised extra raised

479
Telegram Channel @nettrain
 corners
69. mouth
extra thick average extra thin
height
70. mouth
extra small average small
width
71. nose shape extra straight extra straight extra straight
72. nose width extra narrow extra wide extra wide
73. teeth visible no no no

480
Telegram Channel @nettrain
Automated Image and Analytics

Artificial Intelligence applications in military, government,

corporate and even personal applications are vast and continue to
advance rapidly. The below example is intended to provide a glimpse
into AI’s applications far beyond facial recognition.
As just one illustration of AI’s use in a situation in which
identifying and categorizing different measurable elements may be
important, the below is a screenshot from a commercial product
demonstration by TheHive.ai, a firm that helps commercial customers
use AI to automate business processes that rely on interpreting video,
image, text, or audio. One of their many solutions is helping identify
labels and logos visible at live events or on videos. In this demo image
from a soccer game, their AI can identify and categorize brand names,
words, and images such as brand logos. Objects are marked in orange
boxes, with the description, such as “jersey,” while words and logos are
marked in green boxes with the actual identifier, such as “Qatar
Airways” branding or “Nike” logos.[101]
In a situation such as the Capitol riots, it is reasonable to assume
similar AI can be applied to identify symbols and designations of
militias, protest signs and flags, and numerous other measurable
elements such as “gas mask” or “helmet” to gather information on
rioters.

481
Telegram Channel @nettrain
PimEyes.com
https://pimeyes.com/en

PimEyes is an online face search engine that goes through the

internet to find pictures containing given faces. PimEyes uses face
recognition search technologies to perform a reverse image search of a
face to try and find other images containing that same face. PimEyes
uses a reverse image search algorithm and enhances it by face
recognition technology to find a face on the Internet.
In the results, PimEyes displays not only similar photos to the
one uploaded to the search bar but also pictures in which the subject may
appear on a different background, with other people, or possibly even
with a different haircut. PimEye allows for a demo but to be useful for
extensive OSINT work the service has to be purchased.

482
Telegram Channel @nettrain
FindClone.ru
https://findclone.ru/
FindClone is a Russian search took that draws heavily upon the
Russian online social media and social networking service Vkontakte
(“VK”). VK is available in multiple languages but it is predominantly
used by Russian-speakers. FindClone searches public photos as well as
photos marked on VK as private or deleted. When searching for a target
face in other images, FindClone is powerful (that is, intrusive) when
searching new photos for the target face, FindClone inspects the new
photos’ main subjects as well as faces in the backgrounds, if any.
Because it draws upon Russian social media, this is strongest for
investigations in that part of the world.
To create a FindClone.ru account, you need to provide a phone
number – a real one, not a digital burner number. To verify your number,
FindClone will call the phone number and provide a 5-digit confirmation
code.
FindClone allows for 30 free searches every 30 days.

483
Telegram Channel @nettrain
Let’s Enhance
https://letsenhance.io/
Let’s Enhance uses AI to increase resolution without quality
loss, up to 16 times magnification according to the company’s website.
Let’s Enhance’s AI automatically recognizes small faces and seeks to
provide better and more accurate face reconstruction.
Let’s Enhance uses imaging technology based on Deep
Convolutional Neural Networks. Before the appearance of this
technology, it was difficult to increase image size dramatically without
losing quality. The best previous option was using Photoshop’s Bicubic
Interpolation, which could increase image resolution but did not add any
new information about the image to improve the quality or prevent an
enlarged image from being unsharp or blurry. Let’s Enhance’s Neural
Network and AI are trained on a huge dataset of images, so it learns
typical features of physical objects – bricks of walls, hair and skin. After
the network recognizes those features on an uploaded image, the
program is able to add extra details, based on its general knowledge of
the world.

Below are images released by the FBI that I ran through Let’s
Enhance. The close up images show noticeable clarity, however, on
wide-angle images of crowds possible improvements and clarity were
less noticeable.

484
Telegram Channel @nettrain
 Original image Enhanced image

Original image reproduced in charging documents.

The above enhanced image of the man is difficult to notice a

significant improvement, however, zooming in on the above faces,
shown below, does provide noticeabe improvement in detail of facial
features.

485
Telegram Channel @nettrain
Original image Enhanced image

Original image reproduced in charging documents.

486
Telegram Channel @nettrain
Original image Enhanced image

Original image reproduced in charging documents.

487
Telegram Channel @nettrain
 Original blurry video screenshot Enhanced image is
incrementally improved

488
Telegram Channel @nettrain
 489
Telegram Channel @nettrain
Original image reproduced in charging documents.

490
Telegram Channel @nettrain
 Chapter 15 ‒ Image Research

Reverse Image Searching

Reverse image lookups can show where else an image may exist
online, which can provide investigators with new leads to pursue to
develop a more comprehensive profile of an individual or event.

Google Image Search

Right Click on Chrome for Reverse Image Search
Using a Google Chrome browser, you can right click on an
image and Google’s Search Google for Image pops up as an option.
Reverse image searching will display other images that appear like the
one you’re searching for. Google’s feature is helpful and quick, but
doesn’t always deliver solid results. It’s a good start, however.

Google Search Engine

https://www.google.com/imghp?hl=EN
Clicking the camera icon gives options to enter a URL or upload
an image to search.

491
Telegram Channel @nettrain
 492
Telegram Channel @nettrain
 https://www.google.com/advanced_image_search
Google also has Advanced Image Search where you can search
by keywords and phrases, and narrow search results by image size,
aspect ratio, colors, image type, region, site or domain, file type, and
usage rights.

493
Telegram Channel @nettrain
Microsoft Bing
Bing has an image icon in its search bar where you select an
image or URL to search.

Yandex
https://yandex.com/
The Russian site Yandex provides a more robust image search
tool, with strong capabilities to recognize faces, landscapes, and objects.
It draws heavily on user-generated content and social networks to find
similar photos taken from different angles. It’s strongest for European or
Eastern European content. North America and other continents are not as
richly populated in their searches but still a good resource to use in your
research.

494
Telegram Channel @nettrain
TinEye
https://tineye.com/
TinEye looks for exact matches of images, including those that
have been cropped, resized, or edited. It does not typically find similar,
varied images.

495
Telegram Channel @nettrain
RevEye
RevEye is a Chrome extension that allows you to right click on
an image and it will perform a batch reverse image search using Google,
Bing, Yandex, and TinEye. The results are returned in four separate tabs
in your browser, adding more automation and speed to your image
research.

496
Telegram Channel @nettrain
Live Streaming Cameras
Depending on the circumstances of your investigation, on
occasion it may be helpful to obtain live footage of a particular area or
region. Depending on your investigation, even if a camera may not be in
the immediate area of interest, cameras that are closest in proximity,
even if miles away, may provide helpful insight, such as weather
conditions or other pieces of data. Two sites with live streaming cameras
that you should be aware of are EarthCam and Insecam.

EarthCam
https://www.earthcam.com/
EarthCam provides live video from cameras around the world.

If a remote investigator were researching the Capitol riots, they could try
using EarthCam to see if nearby cameras were available as a resource.
The below screenshot shows which cameras are in the Washington, D.C.
area showing available cameras.

497
Telegram Channel @nettrain
 Because it is a major landmark, EarthCam does provide a live
view of the Capitol Building. This screenshot of the Capitol is taken on
March 23, 2021.

EarthCam allows users to digitally zoom in on camera views,

which can be a useful feature depending on the circumstances. Below the
Capitol dome is shown at maximum magnification.

498
Telegram Channel @nettrain
Insecam
http://insecam.org/
Insecam is another live camera site that can provide different
perspectives of an area or region.

The cameras for Washington, D.C. tended to be closer to

ground-level but will vary on location of interest. Other locations will
have different angles and perspectives.

Metadata Explained
Metadata means “data about data,” and provides background
details about an electronic file, including photos and videos. Photo

499
Telegram Channel @nettrain
metadata is information attached to an image file that may include the
location where the photo was taken, date, time, and other information
such as the names of people, companies, or products in the image. Also,
captions, keywords, and headlines may be added to provide more detail
on what the image shows. Photo metadata is also known as
Exchangeable Image File Format (or EXIF) data.
Smartphones and digital cameras can automatically record
location and date information.
Many of the analysis tools discussed below draw upon a file’s
metadata to attempt to determine the origins of a file.

Facebook, Instagram, Twitter scrub metadata

When people upload photos to Facebook, Instagram, or Twitter,
the metadata is automatically removed before publishing, which may
make investigations more challenging. Do be aware, however that the
human factor can provide much more information than metadata may
otherwise have provided. For example, friends tagging a subject in their
photos, checking in to the location where the photo was taken, and
commenting on the activity can be revealing. What’s more, reverse
image searching may reveal similar photos taken in a location of interest,
which may provide additional information.

Analysis Tools
InVID-WeVerify Toolkit
InVID WeVerify is an organized suite of verification tools (also
recommended by Amnesty International, which calls it a “Swiss Army
knife” of digital verification[102]). Available as a Chrome or Firefox
extension, this plugin has been designed as a verification tool to help
journalists, fact-checkers and human rights defenders save time and be
more efficient in their fact-checking and debunking tasks on social
networks, especially when verifying videos and images. The plugin was
launched in July 2017 by the InVID European project, a Horizon 2020
innovation action funded by the European Union. It is provided in
English, French and Spanish languages.

500
Telegram Channel @nettrain
InVID WeVerify tools allow a user to:
1. get contextual information on
a. Facebook videos,
b. Twitter videos, and
c. YouTube videos
2. perform reverse image search on
a. Google,
b. Yandex,
c. Bing,
d. Tineye,
e. Baidu, and
f. Karma Decay (for Reddit) search engines
3. fragment videos into keyframes from
a. Facebook,
b. Instagram,
c. YouTube,
d. Twitter, and
e. Daily Motion
4. enhance and explore keyframes and images through a
magnifying lens,
5. query Twitter more efficiently through time intervals and
many other filters,
6. read video and image metadata,
7. check the video copyrights, and
8. apply forensic filters on still images.

501
Telegram Channel @nettrain
 I particularly like the Keyframes feature, which will capture
screenshots of a video taken in one-second intervals, providing a visual
storyboard of a video for faster reference.

InVID also provides educational resources on understanding

disinformation and how to spot fake news.

502
Telegram Channel @nettrain
Forensically
https://29a.ch/photo-forensics/#forensic-magnifier
Forensically is a set of free tools for digital image forensics. It
includes clone detection, error level analysis, metadata extraction and
more. Forensically helps reveal image details that would otherwise be
hidden to help determine if an image has been edited, altered, or
manipulated. Forensically points out that the absence of evidence is not
evidence of absence and extraordinary claims require extraordinary
evidence.
In the example below, Forensically examines an image of a UFO
above a city.

Their Clone Detection tool identified cloud formations

duplicated in the image, and highlighted the manipulations. Because the
clone function is looking for duplicates, the UFO itself is not highlighted
as there is only one of that element in the image.

503
Telegram Channel @nettrain
 504
Telegram Channel @nettrain
Adobe Photoshop
https://www.adobe.com/products/photoshop.html
You can also view a photo’s EXIF file information in Adobe
Photoshop and other editing programs. In Photoshop, go to File and then
File Info to see available details.

505
Telegram Channel @nettrain
 506
Telegram Channel @nettrain
Chapter 16 ‒ Exercises in Photo Observation

To illustrate how much subtle information photographs can

reveal, here are some examples of what can be found in images people
might post. Of course, there are a myriad of variations on what may be in
a person’s collection of photos across different social media accounts.
Looking at a single photo may reveal elements of a person’s information.
An investigator would seek to compile a range of clues from a subject’s
accounts to compose a comprehensive profile of that person’s habits,
interests, and activities.
For all the following examples, I used publicly available stock
photos which are intended for commercial use. The individuals in the
photos gave their respective photographers permission to use their
images for publication. There is no intention to reveal personal
information on any individuals in these photographs.
An investigator could easily magnify photos to search for
details. In the following examples you will be asked to inspect the photos
for clues to their location or other details. In the answers, I will provide
details on what closer inspection can reveal in each photo.
Google Maps, including their Street View and Satellite View
features, and Google Earth are extremely powerful tools to do
reconnaissance, as you’ll see in these examples.
The purpose of these next exercises is to show how images can
be analyzed to assist OSINT investigators on their cases.

507
Telegram Channel @nettrain
Study #1

Where was this photograph of these two women taken?

(Photo by Gabriella Clare Marino on Unsplash)

Answers on next page.

508
Telegram Channel @nettrain
Study #1 Answers

Zooming in on the top center of the photograph reveals the street

behind them is named Della Posta Vecchia.
Initially, it was unclear exactly what the street name was as the
letters were blurry. When I was searching for that name using Google,
Google conveniently auto-completed the proper spelling after I entered
the first two words. Having Google’s suggested spelling, I was then able
to confirm that was the street name in the photo.
Searching Google Maps for Della Posta Vecchia provided a
handful of cities with that street name. Using Google Maps Street View I
was able to locate the specific city.

509
Telegram Channel @nettrain
Study #2

What can you determine about where this photo was taken?

(Photo by Henry Ivany on lifeofpix.com)

Answers on next page.

510
Telegram Channel @nettrain
Study #2 Answers

Zooming in on the reflection on the roof and windshield, you

can see more details of the building and sky above. This photo appears to
be taken on the roof deck of a parking structure, next to the building in
the reflection.
The building façade itself appears to be a lighter color on the
lower portion, and darker on the upper portion. Or they are two
buildings, one is short and lighter in color, the other is taller with more
windows. You can also see the patterns, relative sizes, and patterns of
different parts of the building or buildings.
If you knew which city or town this photo might have been
taken in (for example, if you knew what city the person in the photo
lived in), you could use the process of elimination to try to pinpoint this
location. Searching for “parking garage” on Google Maps, then looking
at locations using Street View and Google Earth to find the building(s) in
the reflection would help narrow down possibilities.

511
Telegram Channel @nettrain
Study #3

What details can you deduce from this photo?

(Photo by Chloe Kal on Pexels)

Answers on next page.

512
Telegram Channel @nettrain
Study #3 Answers

Zooming in on the reflection on his sunglasses is revealing.

You can see that a woman with shoulder-length hair, who
appears to be wearing a short-sleeved shirt and a skirt, is taking his
photo. She is using what appears to be a digital camera based on how she
is holding the device in both hands and the position of her arms.
(Someone taking a photo with their smartphone would not hold it that
way.)
Directly behind the man is a building or buildings directly and
an adjoining wall. In the sunglasses reflection there appears to be a light-
colored, stepped wall and an in-ground pool. There are large trees on the
other side of the wall.
If you knew the general location where the man lived, a search
using Google Maps in Satellite View (to give a bird’s eye view of the
area) might help locate the buildings and enclosed pool area bordered by
trees on the other side of the wall. Google Maps Street View could show
you the front of the location as well as the street address.

513
Telegram Channel @nettrain
Study #4

What can you determine about where this man is located?

(Photo by Sina Khansari on Unsplash)

Answers on next page.

514
Telegram Channel @nettrain
Study #4 Answers

The building he is in is painted a dark exterior color, and from

the exterior wall it appears to have wood siding.
The balcony has a short wall, approximately, three feet high, and
a metal safety railing above it.
The door and window to the balcony appear to have relatively
large panes of glass, giving them a distinctive pattern that may be easy to
identify from the street.
There appear to be tall trees in front of the balcony.
Not too far away, roughly 500 to 1000 feet away, is a tall
building that appears to be at least 10 stories tall, likely taller. It is very
wide with a sloped roof. From the look of it, it might be a hotel or
possibly an apartment building.

Searching online based on the above information and other

breadcrumbs collected on a target from other photos and sources could
yield very accurate location information.

515
Telegram Channel @nettrain
Study #5

What time of day was this photo taken?

What else can you determine about this location?

(Photo by Andrea Piacquadio on Pexels)

Answers on next two pages.

516
Telegram Channel @nettrain
Study #5 Answers

Notice the angle of the sunlight on the stone blocks above the
woman’s head. That there is no sunlight at ground level would imply this
photo was taken at dusk as the sun was beginning to set. The lower light
would be blocked by the trees across the street. You might argue that this
could also have been taken at sunrise, when the sun is also low. That’s
possible, but looking at the photo’s context, including the woman’s
demeanor, it seems more likely that this would have been taken during
the day rather than very early in the morning. It’s an assumption to make,
but not an unreasonable one.
Assuming this is, in fact, at dusk, then the sunlight on the wall
would suggest this side of the building faces west, the direction the sun
sets. So, if someone were looking for this location, they would know
which side of the street to look on, significantly reducing the number of
places to search.

Answers continued on the next page.

517
Telegram Channel @nettrain
Study #5 Answers (continued)

Zooming in on the reflection on the glass window behind the

woman’s head reveals what appears to be a streetlamp, which may have
a distinctive style. It appears to be an old-fashioned black street lamp
with glass panes.
If it’s not a streetlamp, it is still likely distinctive enough that
appearing in a search next to the building would confirm the location of
the photograph.

Additionally…
You can easily make out the building’s details including the
architectural style and light-colored stone as well as the large plate glass
windows at street level.
Across the street you can see the thin, tall trees lining the
sidewalk. The street signs on the pole further down the street would help
confirm the location if someone were looking for it.

518
Telegram Channel @nettrain
Study #6

Where is this?

(Photo by Yogendra Singh on Pexels)

Study #6 Answers

This photo was taken in India. If someone were broadly familiar

with the region, there are some clues that might help identify this
specific location.
The wide pathway is flat and well-maintained, clearly intended
for people to walk on. The local trees and foliage can be researched if
helpful. Also, the steep rock formations indicate this path was cut into
the side of a hill or mountain.
Make note of what clues you can gather on the people in the
photo. The adult, who appears likely to be male, is using a hiking stick. It
appears to be a hiking stick rather than a walking cane because of the
height of the stick. A walking cane would be shorter. Use of a hiking
stick implies this is a long trail to walk on.
So, how did you do on these exercises?

519
Telegram Channel @nettrain
 520
Telegram Channel @nettrain
 Chapter 17 ‒ Reverse Engineering Social
Media

Digital breadcrumbs
It is not possible to develop a complete profile of a suspect from
just one source, so it’s important to have perspective on the many
different techniques and procedures that can be applied in an
investigation. Different websites visited, tools and apps applied, and
search tactics will uncover a wide range of breadcrumbs of information.
The investigator has to apply reason and common sense to weigh the
importance, validity and relevance of each piece of information and
decide which ones are most important in developing a profile of a
subject. This is where the art and science come together.
It is sometimes tempting to go down “rabbit holes” digging
deeper into a thread or information lead but, if that rabbit hole is
ultimately going in an unproductive or tangential direction, precious time
and energy may be expelled inefficiently. It is important to continually
take a step back and assess the status of an investigation and ensure it
appears to be headed in the correct direction toward uncovering the
information sought.
The following are several different resources for cross-
referencing a subject’s data, such as a possible username, to see if that
piece of information exists across the internet on different platforms.
Usernames, in particular, are often reused by individuals across different
social media accounts and other websites.
One of the important takeaways from the next three resources –
NameChk.com, CheckUsernames.com, and KnowEm.com – is gaining
an appreciation of the vast number of different types of websites where a
person can create a user account. Even if you are unable to see what their
specific activity inside any particular account may be (although in further
chapters we discuss how to conduct many site-specific searches), just
knowing the specific sites a subject has accounts on can help provide
breadcrumbs useful in crafting their more comprehensive profile. Seeing
their interests and affiliations can open up new leads to pursue.

521
Telegram Channel @nettrain
NameChk.com
https://namechk.com/
NameChk will search a wide range of sites for a username you
specify and will indicate if an account with that username already exists
on each site. If you are investigating a subject, entering their known or
suspected usernames, and variations thereof, may help develop a clearer
picture of their online activities.

Enter a username in the search bar.

NameChk searches a large number of sites.

522
Telegram Channel @nettrain
 If the subject username is not in use at a site, the site will be
marked in green. If a username exists, the site will be darkened.
Research on each of the darkened sites may provide additional
information on the subject.

523
Telegram Channel @nettrain
CheckUsernames.com
https://checkusernames.com/
CheckUsernames performs a similar search on 160 social
networks for its free version, and can search up to 300 social media sites
in its paid version.

524
Telegram Channel @nettrain
KnowEm.com
https://knowem.com/
KnowEm is an affiliate site to CheckUsernames and claims to
search over 500 social networks and 150 domain names for a username.

525
Telegram Channel @nettrain
 526
Telegram Channel @nettrain
 527
Telegram Channel @nettrain
 528
Telegram Channel @nettrain
 529
Telegram Channel @nettrain
Data Breach Databases
According to UrbanDictionary.com, “pwned” is a variation
(albeit a poor one) of “owned.” The term originated from a typo in the
online game Warcraft, where a designer misspelled “owned.” When the
computer beat a player, the game was supposed to announce the loser
“has been owned.” Instead, it said the player “has been pwned.”
Use either of the below sites to see if emails or passwords have
been exposed in known data breaches. Entering a subject’s email may
provide information on which websites they have registered accounts.

HaveIBeenPwned
https://haveibeenpwned.com/
HaveIBeenPwned contains databases of known data breaches in
which victims’ emails and passwords were stolen. Importantly, it’s a
repository where people can check to see if their emails are among the
more than 10 billion (Yes, billion) user accounts stolen from (as of the
date of this guide’s publication) 481 breached websites.

530
Telegram Channel @nettrain
Firefox Monitor
https://monitor.firefox.com/
Firefox Monitor will search for known breaches. You can set up
a free Monitor account to be alerted to new breaches involving your
email address as well.

531
Telegram Channel @nettrain
Email verification

Hunter.io
https://hunter.io/
If you know or suspect a subject works at or is associated with
any specific company, Hunter.io can search a company’s domain to
determine the email pattern used by that organization to help you
determine a subject’s possible email address.

Hunter.io is available in both free and premium versions.

532
Telegram Channel @nettrain
VerifyEmailAddress.org
https://www.verifyemailaddress.org/
This site can help verify an email address and check if an
address is valid. VerifyEmaillAddress will connect to the target’s email
server to confirm the validity of the email address that you are searching.

Confirmation results for a subject email.

533
Telegram Channel @nettrain
 534
Telegram Channel @nettrain
 Chapter 18 – Investigating Social Media
Accounts

This chapter covers numerous tools and resources that can be

used to search through popular social media sites. While this directory is
sizeable, bear in mind that over time some tools and resources may go
offline or cease to operate. The important thing to remember is that,
while the apps may change, the procedures and strategies for conducting
efficient, robust open source investigations remain the same. Searching
online for new tools by using search terms such as “batch download
Facebook videos” or “Twitter archive” will help keep your OSINT
toolbox up to date as needed.

Facebook
Who Posted What?
https://whopostedwhat.com/
WhoPostedWhat.com is a Facebook keyword search tool. It
allows users to search keywords on specific dates, months, or years. It is
also possible to use multiple keywords. You can also search for posts
between two specific dates.

535
Telegram Channel @nettrain
 536
Telegram Channel @nettrain
Facebook Live Videos
https://www.facebook.com/watch/live/
Facebook Live is a feature of Facebook that uses the camera on
a computer or mobile device to broadcast real-time video to Facebook.
Live broadcasters can decide who on Facebook can see their video and
use this content to engage their audience during the moments and events
that are important to them.

537
Telegram Channel @nettrain
Lookup-ID.com
https://lookup-id.com/
A Facebook ID is a many-digit number (e.g.,
100000624203965). Some Facebook searches require you to use an
account’s numerical Page ID, which is different than their username.
Lookup-ID.com helps you to find the Facebook ID for your profile or a
Group.

FBSearch
https://fb-search.com/
FBSearch performs a similar ID search from a username.

538
Telegram Channel @nettrain
Sowdust FB Search
https://sowdust.github.io/fb-search/
also available here at Graph Tips Beta: https://graph.tips/beta/
Sowdust FB Search is a simple interface that shows how the
Facebook search function works, allowing users to perform a more
detailed search. For some searches, using a keyword is necessary. If you
don't want to filter via keyword, try to leave this field blank at first. If
you get no results, you can also try to add more "neutral" filters (i.e., sort
by chronological order). If it still doesn't work, try to put the name of the
entity you are filtering for as a keyword. For example, if you are looking
for people living in London, just use "London" as a keyword.

539
Telegram Channel @nettrain
Facebook Graph – Codes & Operators
http://www.researchclinic.net/facebook/
Facebook's search box has very limited and unpredictable
functionality. Older search approaches can sometimes be used to obtain
better search results. By formulating a special web address, we can use
Facebook's older "Graph" search and, with patience and imagination, we
can use this to perform detailed searches.
These special search web addresses all begin with the prefix
https://www.facebook.com/search/ and are followed by a combination of
ID numbers and special "search operator" commands.
This site provides a directory of the numerous different
categories and search terms that can be used for advanced searching of
Facebook should you need to do so.

540
Telegram Channel @nettrain
Getfbstuff
https://getfbstuff.com/
Getfbstuff downloads Facebook videos in MP4 format and HD
quality to your devices (Android, iPhone, Mac, Windows, Linux). The
video downloader goes to the Facebook video page, and directly extracts
the MP4 links of the video.
.

541
Telegram Channel @nettrain
DownAlbum
DownAlbum is a Chrome extension that allows you to download
media from numerous social media site including
Facebook
Instagram
Pinterest
Twitter
Ask.fm
Weibo

542
Telegram Channel @nettrain
Downfacebook
http://www.downfacebook.com/
There are many videos on Facebook which are not available for
public viewing. Those video's privacy setting has been set to 'Private'.
Private videos can be seen by either the owner or those with whom
video's owner have shared it or allowed them for viewing. Generally, this
private video feature is useful in protecting the privacy of the user. Due
to the private nature of the video, these cannot be downloaded simply via
URL of the video, rather they require the source code of the video page
or changing the privacy setting of the video. Depending upon the
following conditions, different methods will be involved to download the
video. If the video is shared with you Downfacebook may be able to help
you download it.

543
Telegram Channel @nettrain
FBDown and Video Downloader PLUS
https://www.fbdown.net/
FBDown and its Video Downloader PLUS Chrome extension
(which also works on Android phones using a Chrome browser) can
download videos up to 4K in quality.

544
Telegram Channel @nettrain
Imgur
https://imgur.com/search
Imgur is a gigantic, disorganized mess of memes, photos, and
anything else users feel like posting online, which – basically – makes it
a good representation of the entire internet. For purposes of
completeness in an investigation, searching Imgur for hashtags,
keywords, or phrases may be helpful if time permits. Fortunately,
Imgur’s advanced search allows you to refine your search time period to
the current day, week, month, year, or all time, which may keep a search
more efficient and cut down on the noise that has to be scrolled past.

545
Telegram Channel @nettrain
Instagram
StorySaver.net
https://www.storysaver.net/
StorySaver allows you to enter an Instagram username into its
search box and will display any currently shared stories from that
account available to download. Stories from public accounts may be
downloaded as well.

DownloadGram
https://downloadgram.com/
DownloadGram is a simple site that that allows you to save
Instagram photos, videos, IGTV, and Reels.

546
Telegram Channel @nettrain
4K Stogram
https://www.4kdownload.com/products/product-stogram
In 4k Stogram, you can enter the name of an Instagram user,
hashtag or location into the application. 4K Stogram allows you to save
Instagram photos and videos with their original captions, download
multiple Instagram posts at once, and grab all or select specific types of
Instagram content for saving. 4K Stogram is available in a basic free
version and premium versions.

547
Telegram Channel @nettrain
LinkedIn

Contact Out
Contact Out is a Chrome extension that allows you to see phone
numbers, email addresses, and links to social media profiles for LinkedIn
users. ContactOut claims to have over one billion emails, 99% accurate to
the exact person you need to get in touch with. Contact Out searches other
social media sites and the broader web for cross referencing.

548
Telegram Channel @nettrain
 549
Telegram Channel @nettrain
LinkedIn Premium Services
https://premium.linkedin.com/
Not surprisingly, LinkedIn offers several premium services that
allow more granular searching of its members. Used by job seekers,
recruiters, marketers, and salespersons, LinkedIn’s premium services are
priced based on the type of search functionality needed. The below is a
screenshot of one of its Recruiter advance search pages showing the
range of qualifiers available for research.

550
Telegram Channel @nettrain
Identify sales robots and fake friends on LinkedIn
Not too long ago I added a piece of digital bait to my LinkedIn
profile to test if the “new friend” invitations I regularly receive were
being sent to me by real people or automated robots. The results were
eye-opening.
I receive anywhere from one to a few invitations a day, and
roughly half of those come from 3rd hand connections, meaning they
don’t know me or anyone else I’m connected to on LinkedIn. Oftentimes
the invitations don’t include a message, just a connection request so
there’s no context and I haven’t met the individuals previously. More and
more, companies and salespeople are using automated programs to scrub
LinkedIn for leads. To test if any of my connection requests were
automated, I added an emoji icon before my first name in my
professional profile. To insert the graphic, I edited my profile name using
the LinkedIn app on my mobile phone, which allowed me to use the on-
screen keyboard with emojis. I chose a globe. It seemed more
appropriate than the beer mug or smiley face choices. For good measure,
I also added a different emoji, a blue map, at the end of my headline to
see if that may get picked up by any automation.
Soon enough, about 1 out of every 4 or 5 new invitations I
received said something along the lines of “Hi there �� Daniel Farber,
I work in the IT industry and am interested in connecting. Any interest?”
Ummm… no.

The connection invites continue to trickle in day after day.

Adding an emoji at the beginning of my first name tells me which ones I

551
Telegram Channel @nettrain
can ignore since they truly are cold calls and to them I’m just an
automated keyword search.

552
Telegram Channel @nettrain
Reddit
https://www.reddit.com/
Reddit is a social news aggregation, web content rating, and
discussion website, including livestream content through Reddit’s Public
Access Network. Registered members submit content to the site such as
links, text posts, and images, which are then voted up or down by other
members. Reddit is an enormous mosh pit of posts, opinions, and noise,
but because of its reach it can sometimes provide useful information for
an investigation.

Reddit Investigator
https://www.redditinvestigator.com/
Reddit Investigator gathers the data that Reddit makes available
on a given user and organizes it to provide a comprehensive view of their
activity. This may save time instead of going through all of a user’s posts.
Reddit Investigator is optimized for Google Chrome but works in other
browsers.

553
Telegram Channel @nettrain
 Reddit Investigator organizes data and may present insights into
a user’s activities. The below illustration is for former California
Governor Arnold Schwarzenegger’s Reddit account, where he is a
popular and active user.

554
Telegram Channel @nettrain
Reddit Graph
https://roadtolarissa.com/redditgraphs/
Reddit Graph visualizes a user’s comment history and provides
insight into topics discussed over time and level of activity. The below
illustration is for former California Governor Arnold Schwarzenegger’s
Reddit account.

555
Telegram Channel @nettrain
Karma Decay
http://karmadecay.com/
Karma Decay is supposed to be able to search Reddit for
duplicates of an image that you either upload or provide a URL for. The
results do not appear to be wholly reliable, so it should be just one of
multiple tools used.

556
Telegram Channel @nettrain
Snapchat

Saving Snap Maps

https://map.snapchat.com
Snapchat public videos, during the few brief days while they still
exist on Snapchat, can be viewed by location using Snap Maps. If you
are investigating a live or recent event, such as the Capitol riots, and
want to download videos before they are deleted, you can perform the
following steps to save offline.
Go to Snap Maps at the address above and then click on a video
on the heatmap. The most recent videos will show the brightest spots on
a map.

557
Telegram Channel @nettrain
 In this example, I clicked on a video taken at the Capitol
Building (recorded on a date that was not January 6, 2021 so it was a
tourist video). I used a Chrome browser but other browsers will work in
a similar way.

Go into the Chrome options, click on More Tools, then select

Developer Tools (the shortcut is CTRL-U), which opens the below
information.

558
Telegram Channel @nettrain
 After selecting the Network tab at the top bar, narrow down the
search by clicking the Media tab on the second line. This will display
different MP4 video files and JPG image files. Right click on the video
files one at a time and select “Open in New Tab.” Each video will open
in a separate tab for you to view.

Go to the tab containing the correct video you want to save.

559
Telegram Channel @nettrain
 Right click on the video and select “Save video as” and
download it to your computer or on the cloud.

Back on the Maps page, you can also hover over the JPG image
files and a thumbnail will open to show the image, which can help you
identify the videos listed nearby in the table if there happen to be a large
number of videos in the feed.

560
Telegram Channel @nettrain
Telegram
Telegram is a messenger app that allows for encrypted chats in
both open and closed groups. Telegram allows extremists, illegal
activities, and black or gray market activity to operate freely on its
platform. Telegram grew in popularity after mainstream social media
sites began restricting extremists.
Groups can have an unlimited number of members, which can
allow for passive monitoring of groups should you be interested in
following a topic, as your presence in a large group may not be
noticeable.
To sign up, Telegram requires a phone number that can receive a
text message verification, but digital burner numbers appear to work for
signup purposes. Users can choose to be anonymous – names, avatars,
and usernames are optional on Telegram.
One distinctive aspect of Telegram is that each of the posts on
public channels has a unique URL associated with it, which allows for
targeted indexing, archiving, and scraping on browsers.

Telegram Channels
You can search Telegram through its different channels and
narrow down your searches by using relevant local search terms
(including local languages or slang descriptions).

561
Telegram Channel @nettrain
 For example, searching for #Trump brings up a list of relevant
channels.

The fifth option on the list is right-wing media outlet One

America News Network.

Clicking the Statistics box in the upper right above will provide
nominal statistics, such as One America’s user growth over time.

562
Telegram Channel @nettrain
Telegogo
bit.ly/telegogo
Telegago is a customized Google search engine specific to
Telegraph. It searches both public and private groups, messages, and also
contacts.

563
Telegram Channel @nettrain
Telegram DB
https://telegramdb.org/
Telegram Database is a basic search engine that claims to have
archived 1.2 million searchable chats from public groups and channels as
of March 5, 2021, which can be valuable for historic research.

Buzz.im
https://search.buzz.im/
Buzz.im is another search engine that allows you to search
Telegram users, messages, and channels.

564
Telegram Channel @nettrain
TGStat
https://tgstat.com/
TGStat provides statistics on the largest channels on Telegram.

TGStat can search by country, language, category or time period

to narrow down your target area to investigate activity and trends.

565
Telegram Channel @nettrain
 566
Telegram Channel @nettrain
Tik Tok

OSINT Combine’s Tik Tok Quick Search

https://www.osintcombine.com/tiktok-quick-search
OSINT Combine created this tool to provide a quick method to
search usernames and hashtags on TikTok via a browser. All results take
the user to the source on the TikTok.com website or are provided as a
Google search result.

TikTok Downloader
https://snaptik.app/
To download a video using TikTok Downloader, first copy the
Share Video link on TikTok and then enter it in the TikTok Downloader
input field.

567
Telegram Channel @nettrain
Tumblr
https://www.tumblr.com/
Tumblr allows users to post multimedia and other content to a
short-form blog. Users can follow other users' blogs. Bloggers can also
make their blogs private.
Tumblr’s search functionality allows you to search all posts, or
narrow searches down to only text, photos, quotes, links, chats, audio,
video, or questions asked. The results can be sorted by either most
popular or most recent posts.

568
Telegram Channel @nettrain
Twitch
https://www.twitch.tv/
Twitch is a live-streaming service, heavily targeted toward
gamers. Alt-right and extremist activity appears to be declining on the
platform, due in part to Twitch banning Trump from their community.

569
Telegram Channel @nettrain
Twitter
Twitter Advanced Search
https://twitter.com/search-advanced
Twitter provides advanced search capabilities across a wide
range of parameters.

570
Telegram Channel @nettrain
 571
Telegram Channel @nettrain
TweetDeck
https://tweetdeck.twitter.com/
TweetDeck is a well-designed set of tools offered by Twitter to
conduct granular searches. Using search parameters such as keywords,
date range, language, location, author or mentions, and even level of
engagement (such as looking for tweets with at least 100 retweets, likes
or replies), you can perform historic search and also set up a running
feed. The search menu allows you to set multiple parameters so you can
narrow your searches and eliminate much extraneous information or
tangential tweets.
TweetDeck allows you to have several search columns active
simultaneously so you can create a dashboard of your target topics that
are saved for repeated use.
These are the different types of columns you can create in
TweetDeck. The Search column gives you the most flexibility.

The screenshots on the next page show the different options

available in the Search feature.

572
Telegram Channel @nettrain
 573
Telegram Channel @nettrain
 574
Telegram Channel @nettrain
AllMyTweets.net
https://www.allmytweets.net/
AllMyTweets grabs the last 3,200 tweets (that’s three thousand
two hundred!) from any user account. Journalists and researchers may
use this site when an individual becomes a person of interest for
whatever reason. Sites like this can capture a person’s lengthy online
history much faster than that person in question might be able to delete
their posts.

Location Based Searches

If you choose to do things manually, you can search Twitter for
tweets based on the reported location the tweet was made. Be aware,
however, that it is easy to fake a geolocation for a tweet. Nevertheless,
this can be helpful when researching a situation.
To search by location, you would use the search operator
“geocode:” and provide the coordinates (which can be found using
Google Maps or other mapping platforms) and a search radium in
kilometers. For example, to search for tweets reportedly sent from a 0.1-
kilometer radius from the Capitol, enter the following into Twitter’s
search bar (with no spaces in between search terms):
geocode:38.892002,-77.006646,0.5km

575
Telegram Channel @nettrain
Tinfoleak
https://tinfoleak.com/
In addition to searching a Twitter user’s basic information,
Tinfoleak can search for a user’s devices and operating systems,
applications and social networks, place and geolocation coordinates to
generate a tracking map of locations visited, and hashtag history of the
user. It can also show user tweets in Google Earth and download all
pictures posted by a Twitter user.

576
Telegram Channel @nettrain
Twitonomy
https://www.twitonomy.com/
Twitonomy provides detailed and visual analytics on a user's
tweets, retweets, replies, mentions, and hashtags. It also allows you to
export tweets, retweets, mentions and reports to Excel and PDF.
Twitonomy can monitor a user’s interactions with other Twitter users
including mentions, retweets, and favorites.

Below is a screenshot of Twitonomy’s search for the keyword

“HomegrownTerrorists”

577
Telegram Channel @nettrain
TweetBeaver
https://tweetbeaver.com/
TweetBeaver gathers the data at a granular level, and can help
identify relationships and connections between different users. The site
offers a number of cross-referencing features such as checking to see if
two accounts follow each other, downloading a user’s friends or follower
list, finding common followers between two accounts, and finding if two
users both follow other accounts. TweetBeaver can gather data on any
non-private account and returns most searches as a CSV file to allow for
further filtering and analysis.

Botometer
https://botometer.osome.iu.edu/
Botometer checks the activity of Twitter accounts and gives
them a score based on how likely they are to be bots. Higher scores are
more likely to be a bot account.

578
Telegram Channel @nettrain
 As an example, the below account is of an actual person who
tweets rarely and is fairly inactive on Twitter. Botometer rated that
account as likely being a human being.

The below account is of a highly visible influencer and active

user with millions of followers. Botometer rated it as a real account but
gave it a slightly higher bot rating.

The below account was set up solely to retweet certain types of

tweets, and is noted as a bot with a score of 4.6 out of 5 points.

579
Telegram Channel @nettrain
twXplorer
https://twxplorer.knightlab.com/
Created by Northwestern University’s Knight Lab, twXplorer
allows a user to enter a search term to see the last 500 related tweets.
TxWplorer also breaks down the most common terms, hashtags, and
links so you can filter and drill down further. It provides a bar graph
showing the most popular other words that appear and the most popular
hashtags in tweets containing your search terms.
Below are their results for the search term “StopTheSteal”

And here is twXplorer’s result for the search term

“CapitolRioter.”

580
Telegram Channel @nettrain
Twitter Video Downloader
https://twittervideodownloader.com/
and mirror site: https://twdownloader.net/
This is a straightforward video downloader with the added
feature of allowing you to choose the video resolution so that you can
save the highest quality videos for your research.

You can select which video resolution you would like to save.

581
Telegram Channel @nettrain
YouTube

Watch Frame by Frame

http://www.watchframebyframe.com/
As the name says, this website lets you watch YouTube and
Vimeo videos frame by frame and in slow motion. It offers a number of
different frame intervals, from as precise as viewing every single frame,
to every 2nd, 4th, 8th, 16th, or 32nd frame, or time intervals from 0.01
seconds to 10 seconds. Speeds for video playback range from ¼ speed, ½
speed, regular speed, and 2x faster speed.

This control panel is straightforward and depending on your

investigation the different playback speeds and frame views may be very
helpful in seeing details in videos.

582
Telegram Channel @nettrain
YouTube Geofind
https://mattw.io/youtube-geofind/
YouTube Geofind allows you to search YouTube for
geographically tagged videos by location, topic, or channel. Videos are
viewable in a map and exportable to CSV.

The advanced option allows you to view live events only as

well.

583
Telegram Channel @nettrain
Amnesty International DataViewer
https://citizenevidence.amnestyusa.org/
The YouTube Data Viewer is a web-based video verification tool
offered through The Citizen Evidence Lab, created by Amnesty
International. Users input a YouTube URL, and the tool outputs
information about the video that is helpful in verifying a video. This
includes upload time and thumbnails that can be used for reverse image
searching.

YouTube Metadata
https://mattw.io/youtube-metadata/
YouTube Metadata is another analysis tool that displays the
underlying file information in an organized manner to assist with
verification efforts.

584
Telegram Channel @nettrain
RadiTube.com
https://tool.raditube.com/
RadiTube is a tool for journalists and researchers to search
through conspiracy and far-left & far-right wing channels on YouTube.
According to the developer, RadiTube tracks the most radical YouTube
channels, and makes it searchable for an audience of journalists,
researchers and academics. Often(sometimes referred to as
“OSINT”)ltimes the only way creators can interact with their audience is
through the comments section. RadiTube extracts all these comments so
you can find out what they are actually talking about, which can be a
powerful search feature. RadiTube may help an investigator understand
the people involved with these channels by analyzing their comments.
The search interface is not particularly elegant. Here is the basic
search bar.

585
Telegram Channel @nettrain
 The broad search results can be narrowed down by categories
including alt-right, QAnon, breadtube, Marxism, alternative health,
conspiracy, Dutch conspiracy, and spirituality.

The search results for “stop the steal” show comments that
include that term.

586
Telegram Channel @nettrain
RealPlayer Downloader
https://www.real.com/realplayer
RealPlayer Downloader is my go-to for capturing video from the
web. I purchased the full version, which allows me to download the
highest quality (up to 4K) available for a given video. It can also queue
up videos if I have several to download as I search for evidence or
information. Finally, RealPlayer Downloader will also allow me to
download an entire YouTube playlist. On Chrome it has a convenient
feature where it tries to recognize if videos exist on a site, then I can
click their small download button for quickly saving video.

Videos can be queued and automatically downloaded if I have

several files to save.

587
Telegram Channel @nettrain
Y2mate Video Downloader
https://www.y2mate.com/en74
Y2mate is a free service that allows you to convert and
download video from YouTube, Facebook, Video, Dailymotion, Youku,
and other sites. Y2mate supports downloading video formats including
MP4, M4V, 3GP, WMV, FLV, MO, MP3, and WEBM.

Y2mate provides instructions to download YouTube videos in a

faster manner.

588
Telegram Channel @nettrain
YouTube Converter
https://youtubeconvert.cc/en1/
YouTubeConverter converts videos into audio (MP3, WAV, AAC,
M4A, OGG) and video (MP4, AVI, WMV, WEBM) formats. It also can
convert YouTube videos into screenshots or GIFs up to 30 seconds long.

589
Telegram Channel @nettrain
 Chapter 19 ‒ Fringe Social Media

Many of the fringe social media sites are designed to be

intentionally opaque and difficult to navigate, creating environments that
make illicit or unsavory activity easier to conduct. The intention of this
chapter is to provide a snapshot of some of the many fringe sites out
there.

Browse and engage with these sites

carefully. Many of them represent the
worst of humanity.
I recommend you actually do not engage with them unless
absolutely necessary, and take appropriate caution in your activities.
In a small number of cases, archived copies of a site (such as
4chan, discussed in this chapter) are available where you can search the
content without have to participate or connect to the original site’s live
platform.
In addition to the larger extremist platforms discussed in this
chapter, some other platforms out there include Minds, Woat, MeWe,
BitChute, and VK. As time goes on, some sites may disappear but new
ones will likely take their place.
One website mentioned in the Section II’s Case Studies –
thedonald.win – was shut down by its owner in late January 2021,
however, the URL redirects visitors to another site the owner created to
continue promoting his extremist opinions.[103]

590
Telegram Channel @nettrain
4chan
I would describe 4chan as a cesspool but that’s being unfair to
cesspools.

Threads on 4chan.org are alive for a relatively short time and

then get removed. Most posts of 4chan are made anonymously, a
registered user account is not required. Information such as the user’s
personal IP address is viewable only to 4chan’s administrators and is not
made publicly available.
If a user wants to identify themselves in their posts, they can add
a “tripcode,” which can help verify a user's identity to others, and are a
type of pseudo-registration. To use a normal tripcode, a user places a
hash mark ("#") followed by a word or short phrase after what they've
entered into the [Name] field (for example, "User#password"). Upon
submission, the server will generate the hash unique to that particular
word or phrase.
A tripcode is generated only using the text entered after the hash
mark. The entered name, IP address, or cookie information do not affect
the output. Normal tripcodes are not secure, and can be cracked with
relative ease. For a more secure solution, secure tripcodes are available.
[104]

Because 4chan relies on advertising revenue, it markets itself to

advertisers. In March 2021, 4chan claimed to have more than half-a-
billion page impressions per month, 20 million unique visitors per
month, and up to 1 million posts per day. Their users were about 70
percent male and about 30 percent female, with ages typically ranging
from 18 to 34 years old. Almost half were located in the U.S., the rest
were worldwide. Furthermore, 4chan states the majority of their users
attended or are currently enrolled in college.

591
Telegram Channel @nettrain
 4chan organizes its content into boards, and threads are what get
posted.

592
Telegram Channel @nettrain
4pleb.org Archive
http://archive.4plebs.org/
4plebs is an unofficial archive of certain boards of 4chan.org.
Their archives include the boards /adv/, /f/, /hr/, /o/, /pol/, /s4s/, /sp/, /tg/,
/trv/, /tv/ and /x/. This archive is not part of 4chan and 4chan rules do not
apply here. This site archives all threads on those boards to preserve
them for later viewing. 4plebs began archiving the different 4chan
threads between 2013 to 2015 and continues to do so to the present day.
[105]

Searching 4plebs’s archive of 4chan’s “Politically Incorrect”

board for “StopTheSteal” returned several chats.

593
Telegram Channel @nettrain
 Users are anonymous on the postings. As highlighted below, if a
user replies to an existing post, that post is identified in the reply so users
can follow the conversation.

594
Telegram Channel @nettrain
Nyafuu Archive
https://archive.nyafuu.org/
Nyafuu Archive is another website that archives multiple boards
from 4chan. The code is open sourced (the project is called FoolFuuka).
The threads, thumbnails and posts were originally posted on 4chan.org's
boards. Due to the fact that content in 4chan boards will usually
disappear in a few hours, depending on the posting speed of each board,
this service automatically retrieves and archives posts from some of
4chan's boards and makes them available permanently.[106]

595
Telegram Channel @nettrain
Other 4chan archives
Below is a list compiled by 4plebs.org that lists other archives of
4chan and the different boards each archive contains.[107]

Archive Status Software Boards archived

/adv/ /f/ /hr/ /o/ /pol/ /s4s/ /sp/
4plebs Online foolfuuka
/tg/ /trv/ /tv/ /x/
/bant/ /asp/ /c/ /con/(dead) /e/ /n/
Nyafuu Archive Online foolfuuka /news/ /out/ /p/ /toy/ /vip/ /vp/
/vst/ /vt/ /w/ /wg/ /wsr/
Rebecca Black
Online foolfuuka /cgl/ /g/ /mu/
Tech
/3/ /biz/ /cgl/ /ck/ /diy/ /fa/ /g/
warosu Online fuuka
/ic/ /jp/ /lit/ /sci/ /tg/ /vr/
/a/ /aco/ /an/ /c/ /co/ /d/ /fit/ /gif/
Desuarchive Online foolfuuka /his/ /int/ /k/ /m/ /mlp/ /qa/ /r9k/
/tg/ /trash/ /vr/ /wsg/
fireden.net Online foolfuuka /a/ /cm/ /ic/ /sci/ /tg/ /v/ /vg/ /y/
(Onion mirror)
arch.b4k.co Online foolfuuka /g/ /jp/ /mlp/ /v/
/f/ /cm/ /hm/ /lgbt/ /news/ /trash/
bstats Online b-stats
/qst/ /y/
/bant/ /3/ /a/ /aco/ /adv/ /an/ /asp/
/b/ /biz/ /c/ /cgl/ /ck/ /cm/ /co/
/con/ /d/ /diy/ /e/ /f/ /fa/ /fit/ /g/
/gd/ /gif/ /h/ /hc/ /his/ /hm/ /hr/ /i/
/ic/ /int/ /jp/ /k/ /lgbt/ /lit/ /m/
Archived.Moe Online foolfuuka /mlp/ /mu/ /n/ /news/ /o/ /out/ /p/
/po/ /pol/ /q/ /qa/ /qst/ /r/ /r9k/ /s/
/s4s/ /sci/ /soc/ /sp/ /t/ /tg/ /toy/
/trash/ /trv/ /tv/ /u/ /v/ /vg/ /vip/
/vp/ /vr/ /w/ /wg/ /wsg/ /wsr/ /x/
/y/
The /b/ Archive Online foolfuuka /bant/ /b/
Archive Of Sins Online foolfuuka /h/ /hc/ /hm/ /r/ /s/ /soc/
scalearchive Online foolfuuka /trash/ (Only "Scaly generals")
TokyoChronos Online foolfuuka /jp/ /vrpg/

596
Telegram Channel @nettrain
8kun
8kun is another platform, oftentimes more extreme than 4chan.
8kun, previously called 8chan, Infinitechan or Infinitychan, is an
imageboard website composed of user-created message boards. An
owner moderates each board, with minimal interaction from site
administration. After going offline in August 2019, the site rebranded
itself as 8kun and was relaunched in November 2019

Discord
Discord users communicate with voice calls, video calls, text
messaging, media and files in private chats or as part of communities
called "servers."

597
Telegram Channel @nettrain
DLive
DLive was purchased by the BitTorrent company in 2019. Due
to the site's lax enforcement of prohibited content guidelines, DLive has
become a popular alternative to YouTube and Twitch. DLive uses
blockchain for its servers and donation systems.

Gab
Hate speech is extensively present on Gab. There are several
accounts making coordinated efforts toward recruiting Millennials to the
alt-right. Gab is positioned at the border of mainstream social networks
like Twitter and fringe communities like 4chan.[108]

598
Telegram Channel @nettrain
Parler
Parler has a significant user base of Donald Trump supporters,
conservatives, conspiracy theorists, and far-right extremists. Posts on the
service often contain far-right content, anti-Semitism, and conspiracy
theories such as QAnon.

Patriots.win
Patriots.win is another alt-right social media platform.

599
Telegram Channel @nettrain
 Chapter 20 ‒ Real World Data

There are a wide range of other potential online sources of

information that can be considered in an investigation. The following are
different avenues a researcher may explore depending on the subject
being investigated.

People Searching – Paid Services

Numerous data brokers will provide aggregated information
reports on individuals for a fee. The records include the usual contact
information – names, addresses, emails, phone numbers – that may be
publicly findable online with enough effort. These sites may also provide
other information, including possible relatives and previous addresses,
arrest records, and other personal information. Some of the paid services
include:

411.com
addresses.com
advanced-people-search.com
advancedbackgroundchecks.com
anywho.com
archives.com
beenverified.com
checkthem.com
clustrmaps.com
cyberbackgroundchecks
.com
dexknows.com
easybackgroundchecks.com
emailfinder.com
freephonetracer.com
grey-pages.com
hauziz.com

600
Telegram Channel @nettrain
identitypi.com
instantcheckmate.com
intelius.com
mylife.com
neighbor.report
nuwber.com
people.yellowpages.com
peoplefinders.com
peoplelooker.com
peoplelookup.com
peoplesmart.com
phonesbook.com
premium.whitepages.com
privateeye.com
publicrecords.com
publicrecordsnow.com
spokeo.com
thepublicrecords.com
theidentitypages.com
truthfinder.com
ussearch.com
usa-people-search.com
whitepages.com
xlek.com
zabasearch.com

601
Telegram Channel @nettrain
The National Sex Offender Public Website
https://www.fbi.gov/scams-and-safety/sex-offender-registry
This database is coordinated by the Department of Justice and
enables the public to search the latest information from all 50 states, the
District of Columbia, Puerto Rico, Guam, and numerous Indian tribes for
the identity and location of known sex offenders. You can also search
registry websites maintained by individual jurisdictions by following the
links. The information contained in the national registry and the state and
tribal registries is identical, but the national registry enables a search
across multiple jurisdictions. The registry is available at this address:

602
Telegram Channel @nettrain
Federal Bureau of Prisons Inmate locator
https://www.bop.gov/inmateloc/
Locate the whereabouts of a federal inmate incarcerated from
1982 to the present. Due to the First Step Act, sentences are being
reviewed and recalculated to address pending Good Conduct Time
changes. As a result, an inmate's release date may not be up-to-date.
Website visitors should continue to check back periodically to see if any
changes have occurred.

603
Telegram Channel @nettrain
Inmate locator
http://www.theinmatelocator.com/
This site is a sizeable directory of different state and local
incarceration databases.

604
Telegram Channel @nettrain
 605
Telegram Channel @nettrain
Edmunds Car Data
https://www.edmunds.com/appraisal/
If you have either the license plate number or VIN number of a
vehicle, Edmunds free appraisal estimator can search for that vehicle and
will provide the make, model and year of a car as well as the zip code it
is registered in.

606
Telegram Channel @nettrain
Dun & Bradstreet Reports
https://www.dnb.com/business-directory.html
Dun & Bradstreet’s business directory will provide a free
snapshot of any company’s ownership, estimated revenues, and affiliates,
if any. If your investigation involves a business owner or senior
executive, a Dun & Bradstreet report may provide additional insight.
Paid reports are available with more detailed information, including a
company’s credit history showing if a company pays its bills in a timely
manner.

Below is a sample Dun & Bradstreet report on a small business.

607
Telegram Channel @nettrain
 608
Telegram Channel @nettrain
 Chapter 21 ‒ Archiving Data

It’s always important to properly document the information you

uncover should you need to use it as evidence of a crime or violation
having been committed. There are several ways to do so, both on your
device and online.

Internet Archive
https://archive.org/
The Internet Archive, also called the Wayback Machine, is an
American digital library with the stated mission of "universal access to
all knowledge." It provides free public access to collections of digitized
materials, including websites, software applications/games, music,
movies/videos, moving images, and millions of books.

The images on the following pages show the advance search

capabilities to narrow down archived webpages or media available on the
Internet Archive.

609
Telegram Channel @nettrain
 610
Telegram Channel @nettrain
 611
Telegram Channel @nettrain
 612
Telegram Channel @nettrain
Archive Today
https://archive.is/
Archive Today is a time capsule for web pages. It takes a
“snapshot” of a web page that will always be online even if the original
page disappears. It saves a text and a graphical copy of the page for
better accuracy and provides a short and reliable link to an unalterable
record of any web page. This can be useful if you want to take a snapshot
of a page that could be changed or deleted soon. Saved pages will have
no active elements and no scripts, so they keep you safe as they cannot
have any popups or malware.

613
Telegram Channel @nettrain
How to Capture Screenshots
There are several ways to capture your screen for documentation
and evidence purposes. Make sure to capture the URL, data information
and other identifying details to help validate the information being
captured. Here’s how to screenshot your computers and smartphones:
On Macs. Press [Shift]+[Command]+[4] keys at the same time.
The screenshot should save to your desktop.
On Windows PCs. Press the [Windows]+[PrintScreen] button at
the same time. The file will be default saved to the Pictures>Screenshots
folder.
On iPhones. For iPhones with FaceID, press the [Side Button]
and [Volume Up] buttons at the same time. For iPhones with TouchID
and Side Button, press the Side button. Press the [Side Button] and
[Home] button at the same time.
On Android devices. Press [Power] and {Volume Down] at the
same time for a few seconds. If that doesn’t work, try holding [Power]
down for a few seconds.

Save to Adobe PDF

https://helpx.adobe.com/acrobat/using/print-to-pdf.html
You can select Adobe PDF in almost any Windows or macOS
application while printing. Print to PDF creates an electronic copy of
your file that you can save to disk. Adobe Acrobat needs to be installed
on your computer, otherwise, the Adobe PDF printer or the Save As
Adobe PDF option will not appear.

614
Telegram Channel @nettrain
Hunch.ly
https://www.hunch.ly/
Hunchly is a web capture tool specifically designed to document
online investigations. It automatically collects, documents, and annotates
every web page you visit. Using this tool, you never have to remember to
take a screenshot, cut and paste a URL, or save documents while you’re
browsing.
Hunchly automatically creates an audit trail of all of the steps
you go through during your research sessions. It allows you to track
where you’ve been and what you’ve seen along the way.
When I conduct research, I tend to jump rapidly from site to site,
clicking open every relevant link I might come across in news articles or
website, and there is always a risk I don’t screenshot or bookmark a page
that may contain perhaps a breadcrumb or a more significant piece of
data.
Hunchly will keep reference information on:
Website pages
Documents
Search engine results
Discussion forum posts
Social media posts and discussions
Dark web research
Court filings
URLs and timestamps

615
Telegram Channel @nettrain
Snagit
https://www.techsmith.com/screen-capture.html
Snagit is a paid service (currently a one-time cost of $50) that
has more features, including capturing your entire desktop, a window, or
a scrolling screen. There are many other screen capture options out there
as well.

616
Telegram Channel @nettrain
Zotero
https://www.zotero.org/
Zotero is primarily an academic research tool that helps collect,
organize, and analyze research and share it in a variety of ways. I have
found it helpful in gathering large amounts of information for my
journalism and research projects, allowing me to cite sources
extensively. Zotero stores author, title, and publication fields and exports
that information as formatted references. Zotero interacts seamlessly
with online resources: when it senses you are viewing a book, article, or
other object on the web, it can automatically extract and save complete
bibliographic references. It runs both as a web service and offline on
your personal devices, along with a Microsoft Word add-on.

Zotero organizes your source materials and allows for efficient

referencing and citing to support your research.

617
Telegram Channel @nettrain
 618
Telegram Channel @nettrain
 Appendix

Appendix Table of Contents

Topic Page
A Primer on Key Terms and Definitions
U.S. Constitution – 1st Amendment
What Does Free Speech Mean?
Freedom of Assembly explained
Coup d’Etat
Criminal complaint
Domestic Terrorism
Terminology
Methodology
Sedition
Procedural Terms
Capitol Breach Cases

619
Telegram Channel @nettrain
 A Primer on Key Terms and Definitions

Definitions matter. To ensure discussions, debates, arguments,

and –most importantly – laws and justice are applied equally and
equitably for all people, clarifying what exactly someone, something, or
some action is or is not is crucial both for the immediate situation at hand
as well as for consistency in the future.
The following definitions are provided verbatim from
authoritative sources to provide context and some framework around the
events of January 6, 2021.

U.S. Constitution – 1st Amendment

Congress shall make no law respecting an establishment of
religion, or prohibiting the free exercise thereof; or abridging the
freedom of speech, or of the press; or the right of the people peaceably to
assemble, and to petition the Government for a redress of grievances.[109]

What Does Free Speech Mean?

Among other cherished values, the 1st Amendment protects
freedom of speech. The U.S. Supreme Court often has struggled to
determine what exactly constitutes protected speech. The following are
examples of speech, both direct (words) and symbolic (actions), that the
Court has decided are either entitled to 1st Amendment protections, or
not, and the relevant court case is noted for each ruling as reference.

Freedom of speech includes the right:

Not to speak (specifically, the right not to salute the flag).
− West Virginia Board of Education v. Barnette, 319 U.S.
624 (1943).
Of students to wear black armbands to school to protest a
war (“Students do not shed their constitutional rights at the
schoolhouse gate.”).

620
Telegram Channel @nettrain
 − Tinker v. Des Moines, 393 U.S. 503 (1969).
To use certain offensive words and phrases to convey
political messages.
− Cohen v. California, 403 U.S. 15 (1971).
To contribute money (under certain circumstances) to
political campaigns.
− Buckley v. Valeo, 424 U.S. 1 (1976).
To advertise commercial products and professional services
(with some restrictions).
− Virginia Board of Pharmacy v. Virginia Consumer
Council, 425 U.S. 748 (1976); Bates v. State Bar of
Arizona, 433 U.S. 350 (1977).
To engage in symbolic speech, (e.g., burning the flag in
protest).
− Texas v. Johnson, 491 U.S. 397 (1989); U.S. v. Eichman,
496 U.S. 310 (1990).

Freedom of speech does not include the right:

To incite actions that would harm others (e.g., Shouting
“fire” in a crowded theater).
− Schenck v. U.S., 249 U.S. 47 (1919).
To make or distribute obscene materials.
− Roth v. U.S., 354 U.S. 476 (1957).
To burn draft cards as an anti-war protest.
− U.S. v. O’Brien, 391 U.S. 367 (1968).
To permit students to print articles in a school newspaper
over the objections of the school administration.
− Hazelwood School District v. Kuhlmeier, 484 U.S. 260
(1988).
Of students to make an obscene speech at a school-
sponsored event.
− Bethel School District #43 v. Fraser, 478 U.S. 675 (1986).
Of students to advocate illegal drug use at a school-
sponsored event.
− Morse v. Frederick, __ U.S. __ (2007).[110]
Freedom of Assembly explained
Grants individuals the right to gather in groups, in public
spaces, for any otherwise legal purpose. This is right is
closely associated with the idea of protest.[111]

621
Telegram Channel @nettrain
Coup d’Etat
We define a coup d'état as the sudden and irregular (i.e., illegal
or extra-legal) removal, or displacement, of the executive authority of an
independent government.3 Thus, we include as coups situations in which
the initiators leave the incumbent chief executive in a titular position but
impose a higher authority (e.g., a military junta or dictator) that is the de
facto executive power. We view the overthrow of a colonial government
as a regime change rather than a coup. Coups are usually, but not always,
initiated by a small group of elites within the government. While coups
are normally executed by the threat or use of force, they can also result
from a societal paralysis generated by massive civil strife. Some coups
involve violence; others are bloodless. If the initiators of a coup are
successful in exercising control of government, then the coup is
considered to be successful. Many coups are not successfully executed;
many others are disrupted in the planning stages (i.e., before execution is
even attempted).[112]

Criminal complaint
A criminal complaint is a formal accusation of criminal conduct
for purposes of establishing probable cause, not evidence of guilt. A
defendant is presumed innocent unless proven guilty.[113]

Domestic Terrorism
According to a November 2020, FBI memo titled, “Domestic
Terrorism: Definitions, Terminology, and Methodology,” Domestic
Terrorism for the FBI's purposes is referenced in U.S. Code at 18 U.S.C.
2331(5), and is defined as activities:
Involving acts dangerous to human life that are a violation
of the criminal laws of the United States or of any State;
Appearing to be intended to:
− Intimidate or coerce a civilian population;
− Influence the policy of government by intimidation or
coercion; or
− Affect the conduct of a government by mass destruction,
assassination or kidnapping; and

622
Telegram Channel @nettrain
 Occurring primarily within the territorial jurisdiction of the
United States.
The memo discusses individual’s protections under the 1st
Amendment, (which includes the right to assemble and right to protest).
It states out, “Under FBI policy and federal law, no investigative activity
may be based solely on 1st Amendment activity. The FBI does not
investigate, collect, or maintain information on US persons solely for the
purpose of monitoring activities protected by the 1st Amendment. All
personnel should exercise sound judgment and discretion in evaluating
the totality of circumstances surrounding any of these indicators in order
to determine whether a law enforcement or intelligence response or
activity is warranted.”
The remainder of the Domestic Terrorism discussion below is
verbatim from the FBI memo:
This is a definitional statute, not a charging statute. The FBI
talks about the threat these actors pose as Domestic Terrorism threats,
but each of the FBI's threat categories, described in further detail below,
uses the words "violent extremism" because the underlying ideology
itself and the advocacy of such beliefs is not prohibited by US law.
In using the term Domestic Terrorism, the Department of
Homeland Security looks to the Homeland Security Act definition of
terrorism, 6 U.S.C. 101(18), which is substantially similar but not
identical to the title 18 definition. That provision defines terrorism as any
activity that:
Involves an act that:
− Is dangerous to human life or potentially destructive of
critical infrastructure or key resources; and
− Is a violation of the criminal laws of the United States or
of any State or other subdivision of the United States;
and
Appears to be intended:
− To intimidate or coerce a civilian population;
− To influence the policy of a government by intimidation
or coercion; or
− To affect the conduct of a government by mass
destruction, assassination, or kidnapping.
In this vein, the FBI and DHS use the term Domestic Violent
Extremist (“DVE”) to describe an individual based and operating

623
Telegram Channel @nettrain
primarily within the territorial jurisdiction of the United States who seeks
to further their ideological goals wholly or in part through unlawful acts
of force or violence. The FBI memo points out that the mere advocacy of
ideological positions and/or the use of strong rhetoric does not constitute
violent extremism, and in some cases direct or specific threats of
violence must be present to constitute a violation of federal law.
As an exception, however, the DHS Office of Intelligence &
Analysis (I&A) does so in accordance with its Attorney General-
approved Intelligence Oversight Guidelines. I&A uses the term
"domestic terrorist," defined in those guidelines, interchangeably with
"domestic violent extremist" to describe such an actor.

Terminology
The US Government, including the FBI and DHS, continually
reviews and evaluates intelligence to ensure it is appropriately
identifying and categorizing a variety of national security threats to the
Homeland. As part of this continual internal review, the FBI and DHS
reconfigure broad threat categories as the threats evolve. While
categories help the FBI better understand the criminal actors we pursue,
we recognize actors' motivations vary, are nuanced, and sometimes are
derived from a blend of ideologies. The categories also inform the
intelligence and prevention efforts of DHS. Currently, the US
Government broadly divides the DT threat among the following threat
categories:
Racially or Ethnically Motivated Violent Extremism: This
threat encompasses the potentially unlawful use or threat of force or
violence in furtherance of ideological agendas derived from bias, often
related to race or ethnicity, held by the actor against others or a given
population group. Racially or Ethnically Motivated Violent Extremists
purport to use both political and religious justifications to support their
racially- or ethnically-based ideological objectives and criminal
activities.
Anti-Government or Anti-Authority Violent Extremism:
This threat encompasses the potentially unlawful use or threat of force or
violence in furtherance of ideological agendas, derived from anti-
government or anti-authority sentiment, including opposition to
perceived economic, social, or racial hierarchies, or perceived
government overreach, negligence, or illegitimacy.

624
Telegram Channel @nettrain
 Animal Rights/Environmental Violent Extremism: This threat
encompasses the potentially unlawful use or threat of force or violence in
furtherance of ideological agendas by those seeking to end or mitigate
perceived cruelty, harm, or exploitation of animals and/or the perceived
exploitation or destruction of natural resources and the environment.
Abortion-Related Violent Extremism: This threat
encompasses the potentially unlawful use or threat of force or violence in
furtherance of ideological agendas relating to abortion, including
individuals who advocate for violence in support of either pro-life or
pro-choice beliefs.
All Other Domestic Terrorism Threats: This category
encompasses threats involving the potentially unlawful use or threat of
force or violence in furtherance of ideological agendas which are not
otherwise defined under or primarily motivated by one of the other
Domestic Terrorism threat categories. Such agendas could flow from, but
are not limited to, a combination of personal grievances and beliefs,
including those described in the other Domestic Terrorism threat
categories. Some actors in this category may also carry bias related to
religion, gender, or sexual orientation.

Methodology
The FBI recognizes a Domestic Terrorism Incident as an
ideologically-driven criminal act, including threats or acts of violence
made to specific victims, made in furtherance of a domestic ideological
goal, that has occurred and can be confirmed. A single incident may be
comprised of a scheme or a serial criminal or violent activity conducted
by the same perpetrator(s) using the same tactic(s).
The FBI recognizes a Domestic Terrorism Plot as a
combination of criminal activity and planning that collectively reflect
steps toward criminal action in furtherance of a domestic ideological
goal. Disrupted Domestic Terrorism Plots are plots which, in the FBI's
assessment, absent law enforcement intervention could have resulted in a
Domestic Terrorism incident.[114]

Sedition
If two or more persons in any State or Territory, or in any place
subject to the jurisdiction of the U.S., conspire to overthrow, put down,

625
Telegram Channel @nettrain
or to destroy by force the Government of the U.S., or to levy war against
them, or to oppose by force the authority thereof, or by force to prevent,
hinder, or delay the execution of any law of the U.S., or by force to seize,
take, or possess any property of the U.S. contrary to the authority
thereof, they shall each be fined under this title or imprisoned not more
than twenty years, or both. 18 U.S. Code § 2384 - Seditious
conspiracy[115]

626
Telegram Channel @nettrain
Procedural Terms
The following are procedural terms that were used in official
court filings submitted by law enforcement authorities referenced in the
case studies in Section 2. The definitions are from law.com’s legal
dictionary.[116]

Term Definition
affiant a person who signs an affidavit and swears to its
truth before a notary public or some person
authorized to take oaths, like a County Clerk.
affidavit any written document in which the signer swears
under oath before a notary public or someone
authorized to take oaths (like a County Clerk),
that the statements in the document are true. in
many states a declaration under penalty of
perjury, which does not require the oath-taking
before a notary, is the equivalent of an affidavit.
arrest a judge's order to law enforcement officers to
warrant arrest and bring to jail a person charged with a
crime, also called a warrant of arrest. The
warrant is issued upon a sworn declaration by the
district attorney, a police officer or an alleged
victim that the accused person committed a
crime.
assault the threat or attempt to strike another, whether
successful or not, provided the target is aware of
the danger. The assaulter must be reasonably
capable of carrying through the attack. In some
states if the assault is with a deadly weapon (such
as sniping with a rifle), the intended victim does
not need to know of the peril. Other state laws
distinguish between different degrees (first or
second) of assault depending on whether there is
actual hitting, injury or just a threat. "Aggravated
assault" is an attack connected with the
commission of another crime, such as beating a
clerk during a robbery or a particularly vicious

627
Telegram Channel @nettrain
 attack. 2) n. the act of committing an assault, as
in "there was an assault down on Third Avenue."
Assault is both a criminal wrong, for which one
may be charged and tried, and civil wrong for
which the target may sue for damages due to the
assault, including for mental distress.
attest 1) to confirm (usually in writing) that a
document is genuine.
2) to bear witness that someone actually signed a
document, such as a will. All states require at
least two witnesses (three in Vermont) to attest
that a will was signed and declared to be a will
(except a will written in one's own handwriting
in some states).
charge in a criminal case, the specific statement of what
crime the party is accused (charged with)
contained in the indictment or criminal
complaint.
complainant a person or entity who begins a lawsuit by filing
a complaint and is usually called the plaintiff, or
in some cases the petitioner.
complaint the first document filed with the court (actually
with the County Clerk or Clerk of the Court) by a
person or entity claiming legal rights against
another. The party filing the complaint is usually
called the plaintiff and the party against whom
the complaint is filed is called the defendant or
defendants. Complaints are pleadings and must
be drafted carefully (usually by an attorney) to
properly state the factual as well as legal basis
for the claim, although some states have
approved complaint forms which can be filled in
by an individual. A complaint also must follow
statutory requirements as to form. For example, a
complaint must be typed on a specific type of
paper or on forms approved by the courts, name
both the party making the claim and all
defendants, and should state what damages or
performance is demanded (the prayer). When the

628
Telegram Channel @nettrain
 complaint is filed, the court clerk will issue a
summons, which gives the name and file number
of the lawsuit and the address of the attorney
filing the complaint, and instructs the defendant
that he/she/it has a specific time to file an answer
or other response. A copy of the complaint and
the summons must be served on a defendant
before a response is required. Under a unique
statute, New York allows a summons to be
served without a complaint. A complaint filing
must be accompanied by a filing fee payable to
the court clerk, unless a waiver based on poverty
is obtained.
conviction the result of a criminal trial in which the
defendant has been found guilty of a crime.
criminal law those statutes dealing with crimes against the
public and members of the public, with penalties
and all the procedures connected with charging,
trying, sentencing and imprisoning defendants
convicted of crimes.
District an elected official of a county or a designated
Attorney district with the responsibility for prosecuting
(D.A.) crimes. The duties include managing the
prosecutor's office, investigating alleged crimes
in cooperation with law enforcement, and filing
criminal charges or bringing evidence before the
Grand Jury that may lead to an indictment for a
crime. In some states a District Attorney is
officially entitled County Attorney or State's
Attorney. U.S. Attorneys are also called Federal
District Attorneys and are prosecutors for
districts (there are several in larger states) within
the Department of Justice, are appointed by the
President and serve at his/her pleasure.
district 1) in the federal court system, a trial court for
court federal cases in a court district, which is all or a
portion of a state.
2) a local court in some states.

629
Telegram Channel @nettrain
 federal the court system which handles civil and criminal
courts cases based on jurisdictions enumerated in the
Constitution and federal statutes. They include
federal district courts which are trial courts,
district courts of appeals and the U.S. Supreme
Court, as well as specialized courts such as
bankruptcy, tax, claims (against the government)
and veterans' appeals.
felony 1) a crime sufficiently serious to be punishable
by death or a term in state or federal prison, as
distinguished from a misdemeanor which is only
punishable by confinement to county or local jail
and/or a fine.
2) a crime carrying a minimum term of one year
or more in state prison, since a year or less can be
served in county jail. However, a sentence upon
conviction for a felony may sometimes be less
than one year at the discretion of the judge and
within limits set by statute. Felonies are
sometimes referred to as "high crimes" as
described in the U.S. Constitution.
Grand Jury a jury in each county or federal court district
which serves for a term of a year and is usually
selected from a list of nominees offered by the
judges in the county or district. The traditional 23
members may be appointed or have their names
drawn from those nominated. A Grand Jury has
two responsibilities
1) to hear evidence of criminal accusations in
possible felonies (major crimes) presented by the
District Attorney and decide whether the accused
should be indicted and tried for a crime. Since
many felony charges are filed by the District
Attorney in a municipal or other lower court
which holds a preliminary hearing to determine if
there is just cause for trial instead of having the
Grand Jury hear the matter, this function is of
minor importance in many jurisdictions.

630
Telegram Channel @nettrain
 2) to hear evidence of potential public wrong-
doing by city and county officials, including acts
which may not be crimes but are imprudent,
ineffective or inefficient, and make
recommendations to the county and cities
involved.
indictment a charge of a felony (serious crime) voted by a
Grand Jury based upon a proposed charge,
witnesses' testimony and other evidence
presented by the public prosecutor (District
Attorney). To bring an indictment the Grand Jury
will not find guilt, but only the probability that a
crime was committed, that the accused person
did it and that he/she should be tried. District
Attorneys often only introduce key facts
sufficient to show the probability, both to save
time and to avoid revealing all the evidence. The
Fifth Amendment to the U.S. Constitution
provides that "No person shall be held to answer
for a capital, or otherwise infamous crime, unless
on presentment of a Grand Jury…." However,
while grand juries are common in charging
federal crimes, many states use grand juries
sparingly and use the criminal complaint,
followed by a "preliminary hearing" held by a
lower court judge or other magistrate, who will
determine whether or not the prosecutor has
presented sufficient evidence that the accused has
committed a felony. If the judge finds there is
enough evidence, he/she will order the case sent
to the appropriate court for trial.
magistrate 1) a generic term for any judge of a court, or
anyone officially performing a judge's functions.
2) in a few states, an officer of the court at the
lowest level who hears small claims lawsuits,
serves as a judge for charges of minor crimes
and/or conducts preliminary hearings in criminal
cases to determine if there is enough evidence

631
Telegram Channel @nettrain
 presented by the prosecution to hold the accused
for trial.
3) in federal courts, an official who conducts
routine hearings assigned by the federal judges,
including preliminary hearings in criminal cases.
Miranda the requirement, also called the Miranda rule, set
warning by the U.S. Supreme Court in Miranda v.
Arizona (1966) that prior to the time of arrest and
any interrogation of a person suspected of a
crime, he/she must be told that he/she has: the
right to remain silent, the right to legal counsel,
and the right to be told that anything he/she says
can be used in court against him/her. The
warnings are known as Miranda rights or just
"rights." Further, if the accused person confesses
to the authorities, the prosecution must prove to
the judge that the defendant was informed of
these rights and knowingly waived them, before
the confession can be introduced in the
defendant's criminal trial. The Miranda rule
supposedly prevents self-incrimination in
violation of the Fifth Amendment to the U.S.
Constitution. Sometimes there is a question of
admissibility of answers to questions made by
the defendant before he/she was considered a
prime suspect, raising a factual issue as to what
is a prime suspect and when does a person
become such a suspect?
probable sufficient reason based upon known facts to
cause believe a crime has been committed or that
certain property is connected with a crime.
Probable cause must exist for a law enforcement
officer to make an arrest without a warrant,
search without a warrant, or seize property in the
belief the items were evidence of a crime. While
some cases are easy (pistols and illicit drugs in
plain sight, gunshots, a suspect running from a
liquor store with a clerk screaming "help"),
actions "typical" of drug dealers, burglars,

632
Telegram Channel @nettrain
 prostitutes, thieves, or people with guilt "written
across their faces," are more difficult to
categorize. "Probable cause" is often subjective,
but if the police officer's belief or even hunch
was correct, finding stolen goods, the hidden
weapon or drugs may be claimed as self-
fulfilling proof of probable cause. Technically,
probable cause has to exist prior to arrest, search
or seizure.
prosecute 1) in criminal law, to charge a person with a
crime and thereafter pursue the case through trial
on behalf of the government. This is normally the
function of the District Attorney (called States
Attorney or city prosecutor in some places) and
the U.S. Attorney in federal criminal cases. A
state Attorney General may prosecute in crimes
of statewide importance, and the U.S. Attorney
General, through the Solicitor General, may
prosecute for crimes involving matters of
national significance.
2) to conduct any legal action by a lawyer on
behalf of a client, including both civil and
criminal cases, but most commonly referring to
prosecution for crimes.
protest 1) to complain in some public way about any act
already done or about to be done, such as
adoption of a regulation by a county board,
sending troops overseas, or use of the death
penalty.
2) to dispute the amount of property taxes, the
assessed evaluation of property for tax purposes
or an import duty.
3) a written demand for payment of the amount
owed on a promissory note which has not been
paid when due or a check which has been
dishonored (not paid by the bank).
riot 1) technically a turbulent and violent disturbance
of peace by three or more people acting together.

633
Telegram Channel @nettrain
 2) an assemblage of people who are out of
control, causing injury or endangering the
physical safety of others and/or themselves,
causing or threatening damage to property and
often violating various laws both individually
and as a group. The common thread is that the
people in a riot have the power through violence
to break the public peace and safety, requiring
police action. Often a riot is declared after the
crowd has been informed by police officers that
the people constitute an "unlawful assembly" and
are ordered to "disperse" immediately
(historically in England called "reading the riot
act"). If the crowd does not disperse, its members
become subject to arrest for the crime of rioting,
disturbing the peace, resisting arrest or other
separate crimes ranging from assault to unlawful
possession of firearms.
search a written order by a judge which permits a law
warrant enforcement officer to search a specific place
(e.g., 112 Magnolia Avenue, Apartment 3, or a
1991 Pontiac, Texas license number 123ABC)
and identifies the persons (if known) and any
articles intended to be seized (often specified by
type, such as "weapons," "drugs and drug
paraphernalia," "evidence of bodily harm"). Such
a search warrant can only be issued upon a sworn
written statement of a law enforcement officer
(including a prosecutor). The 4th Amendment to
the Constitution specifies: "…no warrants shall
issue, but upon probable cause, supported by
oath or affirmation, and particularly describing
the place to be searched and the persons or things
to be seized." The 14th Amendment applies the
rule to the states. Evidence unconstitutionally
seized cannot be used in court, nor can evidence
traced through such illegal evidence.
subpoena an order of the court for a witness to appear at a
particular time and place to testify and/or

634
Telegram Channel @nettrain
produce documents in the control of the witness
(if a "subpoena duces tecum"). A subpoena is
used to obtain testimony from a witness at both
depositions (testimony under oath taken outside
of court) and at trial. Subpoenas are usually
issued automatically by the court clerk but must
be served personally on the party being
summoned. Failure to appear as required by the
subpoena can be punished as contempt of court if
it appears the absence was intentional or without
cause.

635
Telegram Channel @nettrain
 Capitol Breach Cases
Below is a list of defendants charged in federal court in the
District of Columbia related to crimes committed at the U.S. Capitol in
Washington, D.C, on Wednesday, Jan. 6, 2021.
Every case is being prosecuted by the U.S. Attorney’s Office for
the District of Columbia. Following arrests, or surrender, defendants
must appear before district court magistrate/judge where the arrest takes
place, in accordance with the Federal Rules of Criminal Procedure.[117]

Location of
Arrest / Case
Name Charges Case Status Number
ABUAL- Entering and remaining in a Arrested New Jersey /
RAGHEB, restricted building; Disorderly 1/19/21 in the 1:21-cr-43
Rasha N. and disruptive conduct in a District of New
restricted building; Violent Jersey.
entry and disorderly conduct in
a Capitol building; Parading,
demonstrating, or picketing in a
Capitol building

ADAMS, Civil disorder; Obstruction of an Arrested Texas,

Daniel Page official proceeding; Assaulting, 1/16/21 in the Eastern
Resisting or Impeding Certain Eastern District /
Officers; Entering and District of 1:21-cr-84
remaining in a restricted Texas.
building or grounds; Disorderly
and disruptive conduct in a
restricted building or grounds;
Disorderly conduct in a Capitol
building; Impeding Passage
Through the Capitol Grounds or
Buildings; Parading,
demonstrating, or picketing in a
Capitol building

ALAM, Assault on a Federal Officer Arrested Pennsylvania,

636
Telegram Channel @nettrain
Zachary with a Dangerous or Deadly 1/30/21 in the Eastern
Jordan Weapon; Destruction of Eastern District /
Government Property over District of 1:21-mj-165
$1,000; Obstruction of an Pennsylvania.
official proceeding; Unlawful
Entry on Restricted Building or
Grounds; Violent Entry and
Disorderly Conduct

ALBERTS, Unlawful Possession of a Arrested on Maryland /

Christopher Firearm on Capitol Grounds or 1/7/21. Initial 1:21-cr-26
Michael Buildings; Unlawful Entry or appearance /
Remaining on Restricted detention
Grounds without Lawful hearing on
Authority; Carrying a Pistol 1/7/21.
without a License Outside Defendant
Home or Place of Business; released.
Possession of a Large Capacity Preliminary
Ammunition Feeding Device Hearing set for
1/28/21 at 2:00
p.m.

ALLAN, Theft of government property; Arrested California,

Tommy Entering and remaining in a 1/22/21 in the Eastern
Frederick restricted building or grounds; Eastern District /
Disorderly and disruptive District of 1:21-cr-64
conduct in a restricted building California.
or grounds; Entering and
Remaining on the Floor of
Congress; Disorderly conduct in
a Capitol building; Parading,
demonstrating, or picketing in a
Capitol building

ALVARADO, Restricted building or grounds; / 1:21-mj-

Wilmar Violent entry or disorderly 169
Jeovanny conduct; Civil disorders;
Montano Assaulting, resisting, or
impeding certain officers or
employees; Obstruction of an
official proceeding

ALVEAR Entering and remaining in a Arrested Virginia,

Gonzalez, restricted building or grounds; 2/12/21 in the Eastern
Eduardo Disorderly and disruptive Eastern

637
Telegram Channel @nettrain
Nicolas (aka, conduct in a restricted building District of District /
Alvear or grounds; Disorderly conduct Virginia. 1:21-mj-189
Gonzalez in a Capitol building; Parading, Initial
Eduardo demonstrating, or picketing in a Appearance
Nicolas; aka, Capitol building 2/12/21 at
Nicolas 2:00pm.
Alvear)
ANDRIES, Knowingly Entering or Maryland /
John D. Remaining in any Restricted 1:21-cr-93
Building or Grounds Without
Lawful Authority; Violent entry
and disorderly conduct on
Capitol grounds

ASHLOCK, Conspiracy; Obstruction of law / 1:21-mj-

Ryan enforcement during civil 241
disorder; Obstruction of
Justice/Congress; Knowingly
Entering or Remaining in any
Restricted Building or Grounds
Without Lawful Authority

AUNGST, Restricted Building or Grounds; Arrested Pennsylvania,

Mark Violent Entry or Disorderly 2/4/21 in the Middle
Roderick Conduct Middle District District /
of 1:21-mj-176
Pennsylvania.
Initial
appearance
2/4/21.

AYRES, Willfully and knowingly utter Arrested Ohio,

Stephen loud, threatening, or abusive 1/25/21 in the Northern
Michael language, or engage in Northern District /
disorderly or disruptive conduct, District of 1:21-mj-154
at any place in the Grounds or Ohio
in any of the Capitol Buildings
with the intent to impede,
disrupt, or disturb the orderly
conduct of a session of
Congress or either House of
Congress, or the orderly
conduct in that building of a
hearing before, or any
deliberations of, a committee of

638
Telegram Channel @nettrain
 Congress or either House of
Congress

BAKER, Knowingly entering or Arrested North

Stephen remaining in any restricted 2/1/21 in the Carolina,
Maury building or grounds without Eastern Eastern
lawful authority; Violent entry District of District /
and disorderly conduct on North 1:21-mj-170
Capitol grounds Carolina.
Initial
appearance
2/1/21 at
10:00am.

BANCROFT, Knowingly entering or Arrested Pennsylvania,

Dawn remaining in any restricted 1/29/21 in the Eastern
building or grounds without Eastern District /
lawful authority; Knowingly District of 1:21-mj-182
engaging in disorderly or Pennsylvania.
disruptive conduct in any
restricted building or grounds;
Violent entry and disorderly
conduct on Capitol grounds

BARANYI, Entering and remaining in a Arrested on New Jersey /

Thomas restricted building; Disorderly 1/12/21. Initial 1:21-cr-62
and disruptive conduct in a appearance in
restricted building or grounds; the District of
Disorderly conduct in a Capitol New Jersey on
building; Parading, 1/12/21.
Demonstrating, and Picketing in
a Capitol Building

BARNETT, Obstruction of an official Initial Arkansas,

Richard proceeding; Aiding and Appearance Western
abetting; Entering and 1/12/21 at 3pm District /
remaining in a restricted CST (virtual – 1:21-cr-38
building or grounds with a WDAR
deadly or dangerous weapon; District Court).
Disorderly and disruptive
conduct in a restricted building
or grounds with a deadly or
dangerous weapon; Entering
and Remaining in Certain
Rooms in the Capitol Building;

639
Telegram Channel @nettrain
 Disorderly conduct in a Capitol
building; Parading,
demonstrating, or picketing in a
Capitol building; Theft of
Government Property

BAUER, Entering and remaining in a Arrested on Kentucky,

Robert L. restricted building; Disorderly 1/15/21 in the Western
and disruptive conduct in a Western District /
restricted building; Violent District of 1:21-mj-59
Entry and Disorderly Conduct at Kentucky.
the Grounds and in a Capitol
Building

BECKLEY, Unlawful entry of a restricted Arrested Kentucky,

Damon building; disorderly conduct on 1/16/21 in the Western
Michael Capitol grounds Western District /
District of 1:21-mj-60
Kentucky.

BENNETT, Knowingly Entering or Arrested District of

Andrew Remaining in a physical 1/26/2021 in Columbia /
violence against any person or the District of 1:21-mj-141
property in any restricted Columbia.
building or grounds without
lawful authority; Disorderly
conduct on Capitol grounds

BETANCUR, Entering and remaining in a Arrested Maryland /

Bryan (aka restricted building or grounds; 1/17/21 in the 1:21-mj-72
Bryan Disorderly and disruptive District of
Clooney, aka conduct in a restricted building Maryland.
Maximo or grounds; Entering and
Clooney) Remaining in Certain Rooms in
the Capitol Building; Disorderly
conduct in a Capitol building or
Grounds; Parading,
demonstrating, or picketing in a
Capitol building

BIGGS, Obstruction of an official Arrested Florida,

Joseph proceeding; Restricted Building 1/20/21 in the Middle
Randall or Grounds; Violent and Middle District District /
Disorderly Conduct of Florida. 1:21-mj-126
Initial

640
Telegram Channel @nettrain
 appearance
1/20/21 in the
Middle District
of Florida.

BINGERT, Certain Acts During Civil Arrested Pennsylvania,

Craig Michael Disorder 1/18/21 in the Eastern
Eastern District /
District of 1:21-mj-104
Pennsylvania.

BISIGNANO, Obstruction of an official Arrested California,

Gina Michelle proceeding; Aiding and 1/19/21 in the Central
abetting; Civil disorder; Central District District /
Destruction of Government of California. 1:21-cr-36
Property; Entering and Ordered
remaining in a restricted detained.
building or grounds; Disorderly Indicted
and disruptive conduct in a 1/29/21.
restricted building or grounds;
Engaging in physical violence
in a restricted building or
grounds; Disorderly conduct in
a Capitol building

641
Telegram Channel @nettrain
BLACK, Restricted building or Arrested in Northern Alabama,
Joshua grounds; violent entry Alabama on Northern
Matthew and disorderly conduct 1/14/2021. District /
Detention, 1:21-mj-49
preliminary, and
identity hearings set
for 1/20/21 at
2:30pm.

BLAIR, David Assault on Federal / 1:21-mj-

Alan Officer or on Person 211
Assisting Federal
Officer; Obstruction of
law enforcement during
civil disorder;
Knowingly entering or
remaining in any
restricted building or
grounds without lawful
authority; Disorderly
Conduct on Restricted
Grounds Impeding
Govt. Business;
Physical Violence on
Restricted Grounds;
Violent entry and
disorderly conduct on
Capitol grounds

BLEDSOE, Knowingly entering or Arrested in TN on Tennessee /

Matthew remaining in any 1/15/21. 1:21-mj-48
restricted building or Video initial
grounds without lawful appearance in federal
authority; Violent entry court in Memphis
and disorderly conduct 1/15/21 at 11:00am
on Capitol grounds CST.

BONET, James Entering and remaining Arrested 1/27/21 in New York,

in a restricted building; the Northern District Northern
Disorderly and of New York. District /
disruptive conduct in a 1:21-mj-164
restricted building;
Violent entry and
disorderly conduct in a
Capitol building;

642
Telegram Channel @nettrain
 Parading,
demonstrating, or
picketing in a Capitol
building

BOZELL IV, Obstructing an Official / 1:21-mj-

Leo Brent Proceeding and 222
Attempting to do so;
Restricted Building and
Grounds; Disorderly
Conduct

BROCK, Larry One count of Initial appearance Texas,

Rendall knowingly entering or 1/12/21. (NDTX Northern
remaining in any District Court). District /
restricted building or 1:21-mj-23
grounds without lawful
authority and one count
of violent entry and
disorderly conduct on
Capitol grounds

BROMLEY, Unlawful Entry to / 1:21-mj-

Phillip Andrew Restricted Building; 227
Disorderly conduct on
Capitol grounds

BRONSBURG, Restricted Building or Arrested 2/4/21 in the Pennsylvania,

Tammy A. Grounds; Violent Entry Middle District of Middle
(aka, Tammy or Disorderly Conduct Pennsylvania. Initial District /
Butry) appearance 2/4/21. 1:21-mj-176

BROWN, Terry Entering and remaining Arrested on 1/11/21. Pennsylvania

in a restricted building; Released on / 1:21-cr-41
Disorderly and conditions. The
disruptive conduct in a preliminary hearing is
restricted building; scheduled for
Violent entry and Tuesday, January 19,
disorderly conduct in a 2021 at 10:00 a.m.
Capitol building;
Parading,
demonstrating, or
picketing in a Capitol
building

643
Telegram Channel @nettrain
CALDWELL, Conspiracy; Conspiracy Arrested 1/19/21 in Virginia,
Thomas to Impede or Injure the Western District Western
Edward Officer; Destruction of of Virginia. District /
Government Property; 1:21-mj-119
Obstruction of an
official proceeding;
Restricted Building or
Grounds; Violent Entry
or Disorderly Conduct

CALHOUN Jr., Obstruction of an Arrested 1/15/21 in Georgia,

William Mccall official proceeding; the Middle District of Middle
Restricted Building or Georgia. Detention District /
Grounds; Violent Entry hearing on 1/21/21 at 1:21-mj-40
or Disorderly Conduct 10:30am in the
Middle District of
Georgia. Ordered
detained.

CAMARGO, Civil disorder; Entering Arrested 1/20/21 in Virginia,

Samuel and remaining in a the Eastern District of Eastern
restricted building or Virginia. District /
grounds; Disorderly or 1:21-mj-68
Disruptive Conduct in
a Restricted Building or
Grounds; Disorderly
conduct in a Capitol
building

CAPSEL, Knowingly entering or Arrested 1/26/21 in Illinois,

Matthew remaining in any the Southern District Southern
restricted building or of Illinois. District /
grounds without lawful Initial appearance 1:21-mj-22
authority; and 1/29/21 at 9:30am CT
knowingly engages in in the Southern
any physical violence District of Illinois.
against any person or Released on bond
property in any with conditions.
restricted building or
grounds; or attempts or
conspires to do so;
Forcibly assaulted,
resisted, opposed,
impeded, intimidated,
or interfered with any
officer or employee of

644
Telegram Channel @nettrain
 the U.S. or of any
agency in any branch of
the U.S. Government
(including any member
of the uniformed
services) while engaged
in or on account of the
performance of official
duties; Committed or
attempted to commit
any act to obstruct,
impede, or interfere
with law enforcement
officer lawfully
engaged in the lawful
performance of his
official duties incident
to and during the
commission of a civil
disorder which in any
way or degree
obstructs, delays, or
adversely affects
commerce or the
movement of any
article or commodity in
commerce or the
conduct or performance
of any federally
protected function.

CASTRO, Knowingly Entering or / 1:21-mj-

Mariposa Remaining in any 142
Restricted Building or
Grounds Without
Lawful Authority;
Violent entry and
disorderly conduct on
Capitol grounds

Chansley, Civil disorder; Complaint filed Arizona /

Jacob Anthony Obstruction of an 1/8/21. Indicted 1:21-cr-3
(aka, Jacob Official Proceeding; 1/11/21.
Angeli) Entering and remaining
in a restricted building;
Disorderly and

645
Telegram Channel @nettrain
 disruptive conduct in a
restricted building;
Violent entry and
disorderly conduct in a
Capitol building;
Parading,
demonstrating, or
picketing in a Capitol
building

CHRESTMAN, Conspiracy; Civil Arrested 2/11/21 in Missouri,

William disorder; Obstruction of the Western District Western
an official proceeding; of Missouri. District /
Threatening to assault a 1:21-mj-218
Federal Law
Enforcement Officer;
Knowingly Entering or
Remaining in any
Restricted Building or
Grounds Without
Lawful Authority (with
1752(b)(1)(A)
enhancement);
Disorderly conduct on
Capitol grounds

CIARPELLI, Knowingly entering or New York /

Albert A. remaining in any 1:21-mj-38
restricted building or
grounds without lawful
authority; Violent entry
and disorderly conduct
on Capitol grounds

CLARK, Restricted Buildings or Pennsylvania

Christy Grounds; Violent Entry / 1:21-mj-209
or Disorderly Conduct

CLARK, Restricted Buildings or Pennsylvania

Matthew Grounds; Violent Entry / 1:21-mj-209
or Disorderly Conduct

COFFMAN, Possession of an Arrested on 1/7/21. Alabama /

Lonnie unregistered firearm Initial appearance on 1:21-cr-4
(destructive device) and 1/7/21. Detained.

646
Telegram Channel @nettrain
 carrying a pistol Detention/Preliminary
without a license. Hearing set for
1/12/21. 3:00 p.m.
Indicted on 1/11/21.
COLON, Louis Conspiracy; Civil Arrested 2/11/21 in Missouri,
Enrique disorder; Obstruction of the Western District Western
an official proceeding; of Missouri. District /
Knowingly entering or 1:21-mj-218
remaining in any
restricted building or
grounds; Without
Lawful Authority (with
1752(b)(1)(A)
enhancement);
Disorderly conduct on
Capitol grounds

COLT, Josiah Obstruction; Aiding Arrested in Idaho. Idaho / 1:21-

and abetting; Entering cr-74
and remaining in a
restricted building;
Disorderly and
disruptive conduct in a
restricted building;
Violent entry and
disorderly conduct in a
Capitol building

CONNELL, Civil disorder; Arrested 1/16/21 in Louisiana,

Cody Page Obstruction of an the Western District Western
Carter official proceeding; of Louisiana. District /
Assaulting, Resisting or 1:21-cr-84
Impeding Certain
Officers; Entering and
remaining in a
restricted building or
grounds; Disorderly
and disruptive conduct
in a restricted building
or grounds; Disorderly
conduct in a Capitol
building; Impeding
Passage Through the
Capitol Grounds or
Buildings; Parading,
demonstrating, or

647
Telegram Channel @nettrain
 picketing in a Capitol
building

Cooke, Nolan Acts during civil Arrested 1/21/2021 in Texas,

B. disorder; the Eastern District of Eastern
entering/remaining on Texas. District /
restricted buildings or 1:21-mj-143
grounds &
disorderly/disruptive
conduct in or near
restricted building or
grounds; unlawful
activities on Capitol
grounds

648
Telegram Channel @nettrain
COUNCIL, Knowingly entering or Arrested 1/14/21 Florida,
Matthew remaining in any restricted in the Middle Middle
building or grounds without District of District /
lawful authority and violent Florida. Initial 1:21-mj-8
entry and disorderly conduct Appearance
on Capitol grounds. Council 1/14/21 in the
allegedly unlawfully entered Middle District
the Capitol Building, and when of Florida.
stopped by law enforcement, Released on
he pushed the officer. personal
recognizance
bond.
Status hearing
set for 2/11/21 at
11:00am in
telephonic.

COURTRIGHT, Entering and remaining in a Arrested West

Gracyn Dawn restricted building; Disorderly 1/19/2021 in Virginia,
and disruptive conduct in a Southern District Southern /
restricted building; Disorderly of West Virginia 1:21-cr-72
Conduct in a Capitol Building; The parties are to
Parading, demonstrating, or appear before the
picketing in a Capitol building; Court for an
Theft of Government Property Arraignment set
for 2/11/2021 at
2:00 PM by
VTC.

CRASE, Dalton Entering and remaining in a Kentucky /

Ray restricted building or grounds; 1:21-mj-
Disorderly and disruptive 183
conduct in a restricted building
or grounds; Disorderly conduct
in a Capitol building or
Grounds; Parading,
demonstrating, or picketing in
a Capitol building

CROWL, Conspiracy; Conspiracy to Arrested 1/18/21 Ohio,

Donovan Ray Impede or Injure Officer; in the Southern Southern
Destruction of Government District of Ohio. District /
Property; Obstruction of an 1:21-mj-
official proceeding; Restricted 119

649
Telegram Channel @nettrain
 Building or Grounds; Violent
Entry or Disorderly Conduct

CROY, Glenn Unlawful Entry on restricted Colorado /

Wes Lee buildings or grounds; Violent 1:21-mj-
entry and disorderly conduct 234
on Capitol grounds

CUA, Bruno Assault on a Federal Officer; Arrested 2/6/21 Georgia,

Joseph Civil disorder; Obstruction of in the Northern Northern
an official proceeding; District of District /
Restricted Building or Georgia. 1:21-mj-
Grounds; Enter or remain on 187
the floor or gallery of either
House of Congress, Violent
Entry or Disorderly Conduct,
Engage in physical violence,
Obstruct, or impede passage,
and parade, demonstrate, or
picket on Capitol Grounds

CUDD, Jenny Obstruction of an official Released on Texas /

Louise proceeding; Entering and personal 1:21-cr-68
remaining in a restricted recognizance
building or grounds; bond.
Disorderly and disruptive
conduct in a restricted building
or grounds; Disorderly conduct
in a Capitol building; Parading,
demonstrating, or picketing in
a Capitol building; Aiding and
Abetting

CURZIO, Entering and remaining in a Initial Florida,

Michael restricted building; Disorderly appearance in the Middle
and disruptive conduct in a Middle District District /
restricted building; Violent of Florida on 1:21-cr-41
entry and disorderly conduct in 1/14/2021.
a Capitol building; Parading,
demonstrating, or picketing in
a Capitol building

DAUGHTRY, Restricted Building or Grounds Arrested 1/15/21 Georgia,

Michael Shane in the Middle Middle
District of District /

650
Telegram Channel @nettrain
 Georgia. 1:21-mj-
Detention 41
hearing on
1/21/21 at
10:30am in the
Middle District
of
Georgia. Ordered
detained.

DECARLO, Conspiracy; Obstruction of an Arrested 1/26/21 Texas,

Nicholas official proceeding; in the Northern Northern
Destruction of Government District of Texas. District /
Property; Theft of government 1:21-cr-73
property; Restricted Building
or Grounds; Aiding and
Abetting

DEGRAVE, Assaulting, resisting, or Arrested 1/28/21 Nevada /

Nathaniel J. impeding certain officers; Civil in the District of 1:21-cr-90
(aka, Nathan disorder; Obstruction of an Nevada.
DeGrave) official proceeding; Entering Initial
and remaining in a restricted appearance
building or grounds; 2/1/21 at 3:00pm
Disorderly and disruptive in the District of
conduct in a restricted building Nevada. Ordered
or grounds; Disorderly conduct detained.
in a Capitol building; Impeding Preliminary
Passage Through the Capitol hearings set for
Grounds or Buildings; Act of 2/16/21.
physical violence in the
Capitol grounds or buildings;
Parading, demonstrating, or
picketing in a Capitol building

DRESCH, Karl Obstruction of an official Arrested 1/20/21 Michigan,

proceeding; Entering and in the Western Western
remaining in a restricted District of District /
building or grounds; Michigan. 1:21-cr-71
Disorderly and disruptive
conduct in a restricted building
or grounds; Disorderly conduct
in a Capitol building; Parading,
demonstrating, or picketing in
a Capitol building

651
Telegram Channel @nettrain
Egtvedt, Daniel Assault on a federal officer or Maryland /
Dean person assisting a federal 1:21-mj-
officer; Obstruction of law 212
enforcement during civil
disorder; Obstruction of
Justice/Congress; Unlawful
entry, disorderly conduct, and
physical violence into, in, or on
a restricted building or
grounds; Disorderly Conduct
and Physical Violence on
Capitol Grounds

EHMKE, Destruction of Government Arrested 1/13/21 California,

Hunter Allen Property; Obstruction of an in California. Central
official proceeding; Disorderly Initial District /
conduct in a Capitol building; Appearance in 1:21-cr-29
Parading, demonstrating, or federal court in
picketing in a Capitol building the Central
District of
California
1/14/21.
Defendant was
released on bond
with home
detention and
electronic home
monitoring.
Initial
appearance in
federal court in
the District of
Columbia
scheduled for
1/21/21.

EHRKE, Entering and remaining in a Arrested 1/19/21 California,

Valerie Elaine restricted building; Disorderly in the Eastern Eastern
and disruptive conduct in a District of District /
restricted building; Violent California. 1:21-cr-97
entry and disorderly conduct in
a Capitol building; Parading,
demonstrating, or picketing in
a Capitol building

652
Telegram Channel @nettrain
EISENHART, Obstruction of an official Arrested 1/16/21 Tennessee
Lisa proceeding; Restricted in Tennessee. / 1:21-mj-
Building or Grounds; Violent Initial 71
Entry or Disorderly Conduct; appearance
Aiding and Abetting 1/19/21 in the
Middle District
of Tennessee.
Detention
hearing set for
January 25,
2021. Ordered
detained and
transported to
D.C.

ERICSON, Unlawful Entry on restricted Arrested 1/22/21 Oklahoma,

Andrew C. buildings or grounds; Violent in the Eastern Eastern
entry and disorderly conduct District of District /
on Capitol grounds Oklahoma. 1:21-mj-
131
Evans, Derrick One count of knowingly West
entering or remaining in any Virginia /
restricted building or grounds 1:21-mj-
without lawful authority; and 16
one count of violent entry and
disorderly conduct on Capitol
Grounds.

FAIRLAMB, Civil disorder; Obstruction of Arrested 1/22/21 New

Scott Kevin an official proceeding; in the District of Jersey /
Assaulting, Resisting, or New Jersey.
Impeding Certain Officers;
Entering and remaining in a
restricted building or grounds
with a deadly or dangerous
weapon; Disorderly and
Disruptive Conduct in a
Restricted Building or
Grounds; Impeding Ingress and
Egress in a Restricted Building
or Grounds; Engaging in
physical violence in a
restricted building or grounds;
Disorderly conduct in a Capitol
building; Impeding Passage
Through the Capitol Grounds

653
Telegram Channel @nettrain
 or Buildings; Act of physical
violence in the Capitol grounds
or buildings; Parading,
demonstrating, or picketing in
a Capitol building

FAULKNER, Destruction of Government Ohio /

Troy Elbert Property; Obstruction of an 1:21-mj-
official proceeding; Entering 167
and Remaining in Restricted
Building or Grounds;
Disorderly and disruptive
conduct in a restricted building
or grounds; Engaging in
physical violence in a
restricted building or grounds;
Disorderly conduct in a Capitol
building; Stepping, climbing,
removing, or injuring property
on the Capitol grounds

FEE, Thomas Knowingly Entering or New York

Remaining in any Restricted / 1:21-mj-
Building Without Lawful 88
Authority; Violent entry and
disorderly conduct on Capitol
grounds

FELLOWS, Restricted Building or Arrested 1/17/21. New York,

Brandon Grounds; Violent Entry or Hearing set for Northern
Disorderly Conduct 1/19/21 in the District /
Northern District 1:21-cr-83
of New York.

654
Telegram Channel @nettrain
FISCHER, Joseph Obstruction of law Arrested Pennsylvania,
W. enforcement during civil 2/19/2021 in Middle
disorder; Knowingly the Middle District /
entering or remaining in District of 1:21-mj-237
any restricted building or Pennsylvania.
grounds without lawful Initial
authority; Violent entry appearance
and disorderly conduct 2/19/21.
on Capitol grounds; Ordered
Obstruction of detained
Justice/Congress pending a
detention
hearing
scheduled for
2/23/21 in the
Middle
District of
Pennsylvania.

FISHER, Samuel J. Unlawful Entry on Arrested New York,

(aka Brad Holiday) Restricted Grounds; 1/20/21 in the Eastern
Disorderly Conduct on Eastern District /
Restricted Grounds District of 1:21-mj-146
New York.

FITCHETT, Cindy Entering and remaining Virginia /

in a restricted building; 1:21-cr-41
Disorderly and disruptive
conduct in a restricted
building; Violent entry
and disorderly conduct in
a Capitol building;
Parading, demonstrating,
or picketing in a Capitol
building

FITZSIMONS, Kyle Civil disorder; Arrested Maine / 1:21-

Obstruction of an official 2/4/21 in the mj-190
proceeding; Inflicting District of
Bodily Injury on Certain Maine.
Officers; Entering and
remaining in a restricted
building or grounds;
Disorderly and disruptive
conduct in a restricted

655
Telegram Channel @nettrain
 building or grounds;
Engaging in physical
violence in a restricted
building or grounds;
Disorderly conduct in a
Capitol building; Act of
physical violence in the
Capitol grounds or
buildings

FOY, Michael Joseph Civil disorder; Arrested Michigan,

Obstruction of an official 1/21/21 in the Eastern
proceeding; Assaulting, Eastern District /
resisting, or impeding District of 1:21-mj-136
certain officers using a Michigan.
dangerous weapon;
Entering and remaining
in a restricted building or
grounds with a deadly or
dangerous
weapon; Entering and
remaining in a restricted
building or grounds;
Disorderly and disruptive
conduct in a restricted
building or grounds; Act
of physical violence in
the Capitol grounds or
buildings

FRACKER, Jacob Obstruction of an official / 1:21-mj-36

proceeding; Aiding and
abetting; Entering and
remaining in a restricted
building; Disorderly and
disruptive conduct in a
restricted building;
Violent entry and
disorderly conduct in a
Capitol building or
Grounds

GALLAGHER, Entering and remaining New

Thomas in a restricted building; Hampshire /
Disorderly and disruptive 1:21-cr-41
conduct in a restricted

656
Telegram Channel @nettrain
 building; Violent entry
and disorderly conduct in
a Capitol building;
Parading, demonstrating,
or picketing in a Capitol
building

GARCIA, Gabriel Certain Acts During Arrested Florida,

Augustin Civil Disorder, Aiding 1/19/21 in the Southern
and abetting; Knowingly Southern District /
entering or remaining in District of 1:21-mj-95
any restricted building or Florida.
grounds without lawful
authority; Violent entry
and disorderly conduct
on Capitol grounds

GENCO, Raechel Knowingly entering or Pennsylvania

remaining in any / 1:21-mj-231
restricted building or
grounds without lawful
authority

GERDING, Christina Knowingly entering or Arrested Illinois,

remaining in any 1/28/21 in the Central
restricted building or Central District /
grounds without lawful District of 1:21-mj-148
authority; Knowingly Illinois.
Engaging in Disorderly Defendant
or disruptive Conduct in released on
any Restricted Building conditions.
or Grounds; Violent entry Next hearing
and disorderly conduct 2/2/21 via
on Capitol grounds video in
federal court in
the District of
Columbia.

GERDING, Jason Knowingly entering or Arrested Illinois,

remaining in any 1/28/21 in the Central
restricted building or Central District /
grounds without lawful District of 1:21-mj-148
authority; Knowingly Illinois.
Engaging in Disorderly Defendant
or disruptive Conduct in released on

657
Telegram Channel @nettrain
 any Restricted Building conditions.
or Grounds; Violent entry Next hearing
and disorderly conduct 2/2/21 via
on Capitol grounds video in
federal court in
the District of
Columbia.
GIESWEIN, Robert Obstruction of an official Arrested Colorado /
proceeding; Assaulting, 1/18/21 in the 1:21-cr-24
resisting, or impeding District of
certain officers using a Colorado.
dangerous weapon; Detention
Destruction of hearing
Government Property; 1/25/21.
Entering and remaining Ordered
in a restricted building or detained.
grounds with a deadly or
dangerous weapon

GIONET, Anthime Knowingly entering or Arrested Texas,

Joseph remaining in any 1/15/21 in Houston /
restricted building or Houston, 1:21-mj-14
grounds without lawful Texas.
authority; violent entry
and disorderly conduct
on Capitol grounds.

GOLD, Simone Restricted Building or Arrested California,

Melissa Grounds; Violent Entry 1/18/21 in the Central
and Disorderly Conduct Central District /
District of 1:21-cr-85
California.
Released on
conditions.
Virtual hearing
in federal court
in the District
of Columbia
on 1/21/21.

GOODWYN, Daniel Knowingly entering or Arrested Texas,

remaining in any 1/29/2021 in Eastern
restricted building or the Eastern District /
grounds without lawful District of 1:21-mj-63
authority; Violent entry Texas.

658
Telegram Channel @nettrain
 and disorderly conduct
on Capitol grounds

GORDON, Vaughn Entering and remaining Arrested Louisiana,

in a restricted building; 1/14/21 in Western
Disorderly and disruptive Louisiana. District /
conduct in a restricted Initial 1:21-cr-99
building; Violent entry appearance
and disorderly conduct in (virtual) in
a Capitol building; federal court in
Parading, demonstrating, the Western
or picketing in a Capitol District of
building Louisiana
1/15/21.
Released on
conditions.

GOSSJANKOWSKI, Knowingly enter or Arrested District of

Vitali remain in any restricted 1/18/21 in Columbia /
building or grounds Washington, 1:21-mj-115
without lawful authority D.C.
to do so; knowingly, and
with intent to impede or
disrupt the orderly
conduct of Government
business or official
functions, engage in
disorderly or disruptive
conduct in, or within
such proximity to, any
restricted building or
grounds when, or so that,
such conduct, in fact,
impedes or disrupts the
orderly conduct of
Government business or
official functions; and
did so while using or
carrying a dangerous
weapon.

GRACE, Jeffrey Knowingly Entering or Arrested Washington,

Remaining in any 2/4/21 in the Western
Restricted Building or Western District. /
Grounds Without Lawful District of 1:21-mj-178
Authority Washington.

659
Telegram Channel @nettrain
 Initial
appearance
2/4/21
in Oregon.

GRAYSON, Kenneth Knowingly entering or Arrested Pennsylvania,

remaining in any 1/26/21 in the Western
restricted building or Western District /
grounds; Disorderly District of 1:21-mj-163
conduct which impedes Pennsylvania.
the conduct of
government business;
Disruptive Conduct in
the Capitol Buildings;
Parading, Demonstrating,
or Picketing in the
Capitol Buildings;
Obstructing or Impeding
Any Official Proceeding

GRIDER, Destruction of Arrested Texas, Austin

Christopher Ray Government Property; 1/21/2021 in / 1:21-cr-22
Aiding and abetting; Austin, Texas.
Entering and remaining Currently
in a restricted building or detained
grounds; Disorderly and pending
disruptive conduct in a Detention
restricted building or Hearing on
grounds; Obstruction of 1/27/21 in the
an official proceeding; Western
Disorderly conduct in a District of
Capitol building; Texas.
Impeding Passage
Through the Capitol
Grounds or Buildings;
Act of physical violence
in the Capitol grounds or
buildings

GRIFFIN, Couy Entering and remaining Arrested District of

in a restricted building; 1/17/21 in Columbia /
Disorderly and Washington, 1:21-cr-92
Disruptive Conduct in a D.C.
Restricted Building

660
Telegram Channel @nettrain
GRIFFITH, Jack Knowingly enter or Arrested Tennessee,
Jesse (aka Juan remain in any restricted 1/16/21 in Nashville /
Bibiano) building or grounds Nashville, TN. 1:21-mj-79
without lawful authority Initial
to do; knowingly, and appearance on
with intent to impede or 1/19/2021.
disrupt the orderly Released with
conduct of Government conditions.
business or official
functions, engage in
disorderly or disruptive
conduct in, or within
such proximity to, any
restricted building or
grounds when, or so that,
such conduct, in fact,
impedes or disrupts the
orderly conduct of
Government business or
official functions; or
attempts or conspires to
do so.

Grillo, Philip Sean Unlawful Entry on New York /

restricted buildings or 1:21-mj-
grounds; Violent entry 00245
and disorderly conduct
on Capitol grounds;
Obstruction of
Justice/Congress

GUNDERSEN, Knowingly entering or Arrested Pennsylvania,

Brian remaining in any 1/27/21 in the Middle
restricted building or Middle District /
grounds without lawful District of 1:21-mj-161
authority; Knowingly, Pennsylvania.
with intent to impede
government business or
official functions,
engaging in disorderly
conduct on Capitol
grounds; Engaging in
disorderly or disruptive
conduct on the Capitol
Buildings or grounds;
parading, demonstrating,

661
Telegram Channel @nettrain
 or picketing in the
Capitol Buildings

HALE- Civil disorder; Aiding and Arrested New Jersey /

CUSANELLI, abetting; Obstruction of an 1/17/21 in the 1:21-cr-37
Timothy Louis official proceeding; Entering District of New
and remaining in a restricted Jersey.
building or grounds;
Impeding Ingress and Egress
in a Restricted Building;
Disorderly conduct in a
Capitol building; Parading,
demonstrating, or picketing
in a Capitol building

HARDING, Knowingly entering or Initial New York,

Peter J. remaining in any restricted appearance on Western
building or grounds without 1/14/21 at 2pm District / 1:21-
lawful authority; Violent ET in the mj-33
entry and disorderly conduct Western
on Capitol grounds District of New
York (virtual).
Initial
appearance in
federal court in
the District of
Columbia on
1/19/21.

HARKRIDER, Civil disorder; Obstruction of Arrested Texas, Eastern

Alex Kirk an official proceeding; 1/18/21 in the District / 1:21-
Assaulting, resisting, or Eastern District mj-103
impeding certain officers of Texas.
using a dangerous weapon;
Theft of government
property; Entering and
remaining in a restricted
building or grounds with a
deadly or dangerous weapon;
Disorderly and disruptive
conduct in a restricted
building or grounds with a
deadly or dangerous weapon;
Unlawful Possession of a

662
Telegram Channel @nettrain
 Dangerous Weapon on
Capitol Grounds or
Buildings; Disorderly
conduct in a Capitol building;
Act of physical violence in
the Capitol grounds or
buildings; Parading,
demonstrating, or picketing
in a Capitol building

Hatley, Knowingly entering or Arrested Arizona /

Andrew remaining in any restricted 1/19/21 in the 1:21-mj-78
building or grounds without District of
lawful authority; Knowingly, Arizona.
With Intent to Impede
Government Business or
Official Functions, Engaging
in Disorderly conduct on
Capitol grounds; Engaging in
disorderly or Disruptive
Conduct on Capitol Buildings
or Grounds; Parading
Demonstrating, or Picketing
in the Capitol Buildings

HAZELTON, Obstruction of an official New Jersey /

Stephanie (aka proceeding; Civil disorder; 1:21-mj-149
Ayla Wolf, aka Aiding and abetting; Entering
Ayla Wolfe) and remaining in a restricted
building or grounds;
Disorderly and disruptive
conduct in a restricted
building or grounds;
Disorderly conduct in a
Capitol building; Impeding
Passage Through the Capitol
Grounds or Buildings

HEMENWAY, Entering and remaining in a Arrested on Virginia,

Edward restricted building; 1/15/21 in Charlottesville
Disorderly and disruptive Charlottesville, / 1:21-mj-59
conduct in a restricted VA.
building; Violent Entry and
Disorderly Conduct at the
Grounds and in a Capitol
Building

663
Telegram Channel @nettrain
Hernandez, Knowingly entering or Arrested Missouri, St.
Emily remaining in any restricted 1/19/21 in St. Louis (Eastern
building or grounds; Louis (Eastern District of
Disorderly Conduct which District of Missouri) /
Impedes the Conduct of Missouri). 1:21-mj-73
Government Business; Steal,
sell, convey or dispose of
anything of value of the U.S.;
Disruptive Conduct in the
Capitol Buildings; Parading,
Demonstrating, or Picketing
in the Capitol Buildings

HILES, Jacob Knowingly entering or Arrested Virginia,

remaining in any restricted 1/19/21 in Norfolk
building or grounds without Norfolk, VA (Eastern
lawful authority; Knowingly, (EDVA). District of
With Intent to Impede Released on a Virginia) /
Government Business or personal 1:21-mj-70
Official Functions, Engaging recognizance
in Disorderly conduct on bond;
Capitol grounds; Parading, presentment
Demonstrating, or Picketing date in federal
in the Capitol Buildings court in the
District of
Columbia on
1/22/21.

HODGKINS, Obstructing or Impeding Any Florida / 1:21-

Paul Allard Official Proceeding and mj-213
Aiding and abetting;
Knowingly Entering or
Remaining in any Restricted
Building or Grounds Without
Lawful Authority and
Impeding or Disrupting
Official Functions; Violent
Entry and Disorderly
Conduct in Capitol Buildings

HONEYCUTT, Knowingly entering or Arrested Florida,

Adam Avery remaining in any restricted 2/11/21 in the Middle
building or grounds without Middle District District / 1:21-
lawful authority; Violent of Florida. mj-216

664
Telegram Channel @nettrain
 entry and disorderly conduct
on Capitol grounds

HUGHES, Civil disorder; Obstruction of Arrested 2/1/21 Montana /

Jerod Wade an official proceeding; in the District 1:21-mj-180
Destruction of Government of Montana.
Property; Entering and
Remaining in a Restricted
Building or Grounds;
Disorderly and disruptive
conduct in a restricted
building or grounds; Entering
and Remaining on the Floor
of Congress; Entering and
Remaining in Certain Rooms
in the Capitol Building;
Disorderly conduct in a
Capitol building; Parading,
demonstrating, or picketing
in a Capitol building

HUGHES, Civil disorder; Obstruction of Arrested 2/1/21 Montana /

Joshua Calvin an official proceeding; in the District 1:21-mj-180
Destruction of Government of Montana.
Property; Entering and
Remaining in a Restricted
Building or Grounds;
Disorderly and disruptive
conduct in a restricted
building or grounds; Entering
and Remaining on the Floor
of Congress; Entering and
Remaining in Certain Rooms
in the Capitol Building;
Disorderly conduct in a
Capitol building; Parading,
demonstrating, or picketing
in a Capitol building

Hyland, Jason Knowingly entering or Arrested 2/2/21 Texas, Eastern

Lee remaining in any restricted in the Eastern District / 1:21-
building or grounds without District of mj-181
lawful authority; Disorderly Texas.
conduct on Capitol grounds

665
Telegram Channel @nettrain
IANNI, Knowingly entering or Arrested Massachusetts,
Suzanne (aka, remaining in any restricted 1/19/21 in Boston / 1:21-
Sue Ianni) building or grounds without Boston. mj-109
lawful authority; Disorderly
conduct on Capitol grounds

JACKSON, Assaulting an Officer of the Arrested District of

Emanuel U.S.; Assaulting an Officer of 1/18/21 in the Columbia /
the U.S. with a deadly or District of
dangerous weapon; Columbia.
obstruction of an official
proceeding; unlawful entry
and physical violence on
restricted building or
grounds; violent entry and
disorderly conduct on Capitol
grounds

JANCART, Knowingly Entering or / 1:21-mj-246

Derek Remaining in any Restricted
Building or Grounds Without
Lawful Authority; Violent
entry and disorderly conduct
on Capitol grounds

JENSEN, Knowingly entering or Iowa / 1:21-cr-

Douglas Austin remaining in any restricted 06
building or grounds without
lawful authority; disrupting
the orderly conduct of
government business; violent
entry and disorderly conduct
in a Capitol Building;
parading, demonstrating, or
picketing in a Capitol
Building; and obstructing a
law enforcement officer
during a civil disorder

JOHNATAKIS, Obstruction of an official Arrested Washington,

Taylor James proceeding; Assaulting, 2/11/21 in the Western
resisting, or impeding certain Western District /
officers; Civil disorder; District of
Entering and remaining in a Washington.
restricted building or

666
Telegram Channel @nettrain
 grounds; Disorderly and
disruptive conduct in a
restricted building or
grounds; Engaging in
physical violence in a
restricted building or
grounds; Impeding Passage
Through the Capitol Grounds
or Buildings; Act of physical
violence in the Capitol
grounds or buildings

JOHNSON, One count of knowingly Arrested in Florida,

Adam entering or remaining in any Middle District Middle
restricted building or grounds of Florida District / 1:21-
without lawful authority; one 1/08/21. Initial mj-20
count of theft of government Appearance in
property; and one count of Middle District
violent entry and disorderly of Florida
conduct on Capitol grounds. 1/11/21.

JONES, Chad Assault on a federal officer; Arrested Kentucky,

Barrett certain acts during a civil 1/16/21 in the Western
disorder; destruction of Western District / 1-21-
government property over District of mj-76
$1,000; obstruction of justice; Kentucky.
unlawful entry on restricted
building or grounds; violent
entry and disorderly conduct
on Capitol grounds

KELLER, Civil disorder; Obstruction of Colorado /

Klete Derik an official proceeding; 1:21-mj-42
Entering and remaining in a
restricted building or
grounds; Disorderly conduct
in a Capitol building;
Impeding Passage Through
the Capitol Grounds or
Buildings; Parading,
demonstrating, or picketing
in a Capitol building

KELLY, Obstruction of an official Arrested in the New York,

Christopher M. proceeding; Aiding and Southern Southern

667
Telegram Channel @nettrain
 abetting; Unlawful Entry to District of New District / 1:21-
Restricted Building or York on mj-128
Grounds; Violent Entry and 1/20/21. Initial
Disorderly Conduct appearance
2/9/21 via
video
teleconference.

KELLY, Kash Knowingly Entering or Illinois / 1:21-

Lee Remaining in any Restricted mj-67
Building or Grounds Without
Lawful Authority; Violent
entry and disorderly conduct
on Capitol grounds

KELLY, Leo Knowingly entering or Arrested Iowa,

remaining in any restricted 1/18/21 in the Northern
building or grounds without Northern District / 1:21-
lawful authority; Violent District of mj-93
Entry with Intent to Disrupt Iowa.
the Orderly Conduct of
Official Business and
Disorderly conduct on
Capitol grounds

KONOLD, Conspiracy; Civil disorder; Arrested Arizona /

Cory Obstruction of an official 2/11/21 in 1:21-mj-218
proceeding; Knowingly Arizona.
entering or remaining in any
restricted building or
grounds; Without Lawful
Authority (with 1752(b)(1)
(A) enhancement);
Disorderly conduct on
Capitol grounds

KONOLD, Conspiracy; Civil disorder; Arrested Arizona /

Felicia Obstruction of an official 2/11/21 in 1:21-mj-218
proceeding; Knowingly Arizona.
entering or remaining in any
restricted building or
grounds; Without Lawful
Authority (with 1752(b)(1)
(A) enhancement);

668
Telegram Channel @nettrain
 Disorderly conduct on
Capitol grounds

KUEHNE, Conspiracy; Civil disorder; Arrested Missouri,

Christopher Obstruction of an official 2/11/21 in the Western
proceeding; Knowingly Western District / 1:21-
entering or remaining in any District of mj-218
restricted building or Missouri.
grounds; Without Lawful
Authority (with 1752(b)(1)
(A) enhancement);
Disorderly conduct on
Capitol grounds

Lang, Edward Civil disorder; Assaulting, Arrested on New York /

Jacob resisting, or impeding certain 1/16/21 in New 1:21-cr-53
officers; Assaulting, York.
Resisting, or Impeding
Certain Officers Using a
Dangerous Weapon;
Obstruction of an official
proceeding; Aiding and
abetting; Disorderly and
disruptive conduct in a
restricted building or grounds
with a deadly or dangerous
weapon; Disorderly conduct
in a Capitol building; Act of
physical violence in the
Capitol grounds or buildings

669
Telegram Channel @nettrain
LEFFINGWELL, Knowingly entering or Arrested on 1/7/21. Washington /
Mark remaining in any Initial appearance 1:21-cr-5
restricted building or on 1/7/21. Detention
grounds without lawful Hearing set for
authority; assault on a 1/8/21. Defendant
federal law released on pre-trial
enforcement officer; conditions.
and violent entry and Preliminary Hearing
disorderly conduct on set for 1/29/21.
Capitol grounds. Indicted on 1/11/21.

LEWIS, Jacob Entering and Arrested 1/27/2021 California,

remaining in a in the Central Central
restricted building; District of District /
Disorderly and California. Initial 1:21-cr-100
disruptive conduct in a appearance
restricted building; 1/27/21. Released
Violent entry and on conditions.
disorderly conduct in a Virtual initial
Capitol building; appearance in
Parading, federal court in the
demonstrating, or District of Columbia
picketing in a Capitol on 2/10/21.
building

LINDSEY, Terry Unlawful Entry on Ohio / 1:21-

Lynn restricted buildings or mj-234
grounds; Violent entry
and disorderly conduct
on Capitol grounds

LOFTUS, Kevin Entering and Arrested in WI. Wisconsin /

remaining in a Defendant released 1:21-cr-81
restricted building; on personal
Disorderly and recognizance.
disruptive conduct in a Conference set for
restricted building; 3/22/2021 via
Violent entry and Telephonic/VTC.
disorderly conduct in a
Capitol building;
Parading,
demonstrating, or
picketing in a Capitol
building

670
Telegram Channel @nettrain
LOLLAR, Knowingly Entering or Arrested 1/15/21. / 1:21-mj-45
Joshua R. Remaining in any
Restricted Building or
Grounds Without
Lawful Authority and
Impeding or
Disrupting Official
Functions; Obstructing
or Impeding Law
Enforcement Officer
During Civil Disorder
and Obstructing
Federally Protected
Functions; Violent
entry and disorderly
conduct on Capitol
grounds

LOLOS, John Knowingly entering or / 1:21-mj-22

remaining in any
restricted building or
grounds without lawful
authority; Violent entry
and disorderly conduct
on Capitol grounds

LOPATIC Sr, Assaulting, resisting, Pennsylvania

Michael John or impeding certain / 1:21-cr-35
officers; Civil
disorder; Entering and
remaining in a
restricted building or
grounds; Disorderly
and disruptive conduct
in a restricted building
or grounds; Engaging
in physical violence in
a restricted building or
grounds; Violent entry
and disorderly conduct
in a Capitol building

LYON, Robert Obstruction of an Arrested 1/25/21 in Ohio,

Anthony official proceeding and the Southern District Southern
aiding and abetting; of Ohio. District /
Theft of Government 1:21-mj-153

671
Telegram Channel @nettrain
 Property and Aiding
and abetting; Entering
and remaining in a
restricted building or
grounds; Disorderly
and disruptive conduct
in a restricted building
or grounds; Disorderly
conduct in a Capitol
building; Parading,
demonstrating or
picketing in a Capitol
building

LYONS, Kevin Entering and Arrested 1/13/21 in Illinois,

James remaining in a Illinois. Made Northern
restricted building; initial appearance in District /
Entering and federal court in the 1:21-cr-79
Remaining in Certain Northern District of
Rooms in the Capitol Illinois. Initial
Building; Disorderly appearance in D.C.
conduct in a Capitol District Court
building scheduled for
1/19/21 via video
appearance.

MADDEN, Knowingly enter or Arrested 1/21/21 in New York,

Dominic remain in any the Eastern District Eastern
restricted building or of New York. District /
grounds without lawful Defendant released 1:21-cr-55
authority to do; on personal
knowingly, and with recognizance.
intent to impede or
disrupt the orderly
conduct of
Government business
or official functions,
engage in disorderly or
disruptive conduct in,
or within such
proximity to, any
restricted building or
grounds when, or so
that, such conduct, in
fact, impedes or
disrupts the orderly

672
Telegram Channel @nettrain
 conduct of
Government business
or official functions;
utter loud, threatening,
or abusive language, or
engage in disorderly or
disruptive conduct, at
any place in the
grounds or in any of
the Capitol Buildings
with the intent to
impede, disrupt, or
disturb the orderly
conduct of a session of
Congress or either
House of Congress;
parade, demonstrate, or
picket in any of the
Capitol Buildings

MALDONADO, Restricted Building or Arrested 2/10/21 in Florida,

Steve Omar (aka, Grounds; Violent Entry the Middle District Middle
Emilio or Disorderly Conduct, of Florida District /
Maldonado) and parade, (Orlando). Initial 1:21-mj-210
demonstrate, or picket appearance 2/10/21.
on Capitol Grounds Released on
conditions.

Mariotto, Entering and Arrested 1/22/21 in Florida,

Anthony R. (aka, remaining in a the Southern District Southern
Tony Mariotto) restricted building or of Florida. District /
grounds; Disorderly 1:21-cr-94
and disruptive conduct
in a restricted building
or grounds; Entering
and remaining in the
Gallery of Congress;
Disorderly conduct in
a Capitol building;
Parading,
demonstrating, or
picketing in a Capitol
building

MARQUEZ, Obstruction of an Florida / 1:21-

Felipe official proceeding; cr-136

673
Telegram Channel @nettrain
 Entering and
remaining in a
restricted building or
grounds; Disorderly
and disruptive conduct
in a restricted building
or grounds; Entering
and Remaining in
Certain Rooms in the
Capitol Building;
Disorderly conduct in
a Capitol building

MARTIN, Restricted Building or Arrested 1/28/21 in Missouri,

Zachary Hayes Grounds; Unlawful the Western District Western
(aka Zac Martin) Activities on Capitol of Missouri. District /
Grounds, Disorderly 1:21-mj-150
Conduct and
Demonstrating in the
Capitol Building

MAZZOCCO, Knowingly entering or Arrested 1/17/21 in Texas, San

Matthew Carl remaining in any San Antonio, Texas. Antonio /
restricted building or 1:21-mj-96
grounds without lawful
authority; Violent entry
and disorderly conduct
on Capitol grounds

MCAULIFFE, Knowingly entering Arrested 1/28/2021 New York,

Justin and remaining on in the Eastern Eastern
restricted grounds District of New District /
without lawful York. 1:21-mj-135
authority and/or
engaging in disorderly
conduct within
proximity to a
restricted building to
impede official
functions

McCaughey III, Assaulting, resisting, Arrested 1/19/21 in New York,

Patrick Edward or impeding certain the Southern District Southern
officers using a of New York. District /
dangerous weapon; Indicted 1/29/21. 1:21-cr-24

674
Telegram Channel @nettrain
 Civil
disorder; Obstruction
of an official
proceeding; Aiding
and abetting;
Disorderly and
Disruptive Conduct in
a Restricted Building
or Grounds with a
Deadly or Dangerous
Weapon; Engaging in
physical violence in a
restricted building or
grounds with a deadly
or dangerous weapon;
Disorderly Conduct in
a Capitol Building; Act
of physical violence in
the Capitol grounds or
buildings

MCCREARY, Obstruction of an Massachusetts

Brian official proceeding; / 1:21-cr-125
Entering and
remaining in a
restricted building or
grounds; Disorderly
and Disruptive
Conduct in a
Restricted Building or
Grounds; Disorderly
Conduct in a Capitol
Building; Parading,
demonstrating, or
picketing in a Capitol
building

MEGGS, Connie Conspiracy; Arrested in the Florida,

Obstruction of an Middle District of Middle
official proceeding and Florida. District /
aiding and abetting;
Destruction of
Government Property
and Aiding and
abetting; Entering and
Remaining in a

675
Telegram Channel @nettrain
 Restricted Building or
Grounds

MEGGS, Kelly Conspiracy; Arrested in the Florida,

Obstruction of an Middle District of Middle
official proceeding and Florida. District /
aiding and abetting;
Destruction of
Government Property
and Aiding and
abetting; Entering and
Remaining in a
Restricted Building or
Grounds

MELLIS, Forcibly assault, resist, / 1:21-mj-

Jonathan oppose, impede, 224
Gennaro (aka, intimidate, or interfere
Jon Gennaro) Officers and aiding and
abetting; Civil
disorder; Restricted
Building or Grounds;
Violent Entry or
Disorderly Conduct,
obstruct, or impede
passage, and engage in
physical violence on
Capitol Grounds;
Obstruction of
Justice/Congress

MELS, James Knowingly entering or Arrested 2/11/21 in Michigan,

Allen remaining in any the Eastern District Eastern
restricted building or of Michigan. Initial District /
grounds without lawful Appearance 2/11/21. 1:21-mj-223
authority; Violent entry Released on
and disorderly conduct conditions.
on Capitol grounds

MEREDITH Jr., Interstate Arrested 1/8/21. / 1:21-mj-17

Cleveland Grover Communication of Initial Appearance
Threats; Possession of 1/8/21. Detained
Unregistered Firearms; pending detention
Possession of hearing scheduled
Unregistered for 1/13/21.

676
Telegram Channel @nettrain
 Ammunition;
Possession of Large
Capacity Ammunition
Feeding Devices

Merry Jr., Theft of government Arrested 2/4/21 in Missouri,

William D. property; Knowingly the Eastern District Eastern
entering or remaining of Missouri. District /
in any restricted 1:21-mj-173
building or grounds;
Disorderly conduct
which impedes the
conduct of government
business; Disruptive
Conduct in the Capitol
Buildings

Michetti, Richard Knowingly Entering or / 1:21-mj-

Remaining in any 238
Restricted Building or
Grounds Without
Lawful Authority;
Violent entry and
disorderly conduct on
Capitol grounds;
Obstruction of
Justice/Congress;
Principals

Miller, Garret Civil disorder; Arrested 1/20/21 in Texas,

Obstruction of an the Northern District Northern
official proceeding; of Texas. Initial District /
Assaulting, resisting, appearance 1/22/21. 1:21-mj-117
or impeding certain Detention hearing
officers; Interstate 1/25/21. Ordered
Threats to Injure or detained.
Kidnap; Entering and
Remaining in a
Restricted Building or
Grounds; Disorderly
and disruptive conduct
in a restricted building
or grounds; Impeding
Ingress and Egress in a
Restricted Building or
Grounds; Disorderly

677
Telegram Channel @nettrain
 conduct in a Capitol
building; Impeding
Passage Through the
Capitol Grounds or
Buildings; Parading,
demonstrating, or
picketing in a Capitol
building

Miller, Matthew Civil disorder; Arrested 1/25/2021 Maryland /

Ryan Obstruction of an in the District of 1:21-cr-75
official proceeding; Maryland. Ordered
Aiding and abetting; detained.
Assaulting, resisting, Preliminary hearing
or impeding certain (telephonic/VTC)
officers using a set for 2/8/21.
dangerous weapon; Arraignment/Motion
Entering and Hearing set for
remaining in a 2/16/2021 via
restricted building or video.
grounds with a deadly
or dangerous weapon;
Disorderly and
disruptive conduct in a
restricted building or
grounds with a deadly
or dangerous weapon;
Engaging in physical
violence in a restricted
building or grounds
with a deadly or
dangerous weapon;
Disorderly Conduct in
a Capitol Building; Act
of physical violence in
the Capitol grounds or
buildings; Stepping,
climbing, removing, or
injuring property on
the Capitol grounds

678
Telegram Channel @nettrain
MINK, Jordan Unlawful Entry Arrested 1/19/21 in the Pennsylvania,
Robert on Restricted Western District of Western
Building or Pennsylvania. District /
Grounds While 1:21-mj-84
Using or
Carrying a
Deadly or
Dangerous
Weapon;
Unlawful Injury
to Property on
Capitol Grounds;
Violent Entry,
Disorderly
Conduct,
Physical Violence
on Capitol
Grounds;
Destruction of
government
property valued
at over $1,000;
Theft of
government
property; Aiding
and Abetting.
MISH Jr., David Entering and Arrested in the Eastern District Wisconsin,
Charles remaining in a of Wisconsin. Initial Eastern
restricted appearance in the Eastern District /
building; District of Wisconsin 1/15/21. 1:21-mj-64
Disorderly and Released on conditions. Initial
disruptive appearance in federal court in
conduct in a the District of Columbia set
restricted for 1/22/21 (virtual).
building; Violent
entry and
disorderly
conduct in a
Capitol building;
Parading,
demonstrating, or
picketing in a
Capitol building

MONCADA, Knowingly Arrested 1/18/21 in the Eastern New York,

Nicolas Anthony entering or District of New York. Eastern

679
Telegram Channel @nettrain
 remaining in any District /
restricted 1:21-mj-84
building or
grounds without
lawful authority;
Violent Entry
Disorderly
conduct on
Capitol grounds

MONTGOMERY, Entering and Arrested 1/17/21 in Colorado. Colorado /

Patrick remaining in a 1:21-cr-46
restricted
building;
Disorderly and
disruptive
conduct in a
restricted
building;
Entering and
Remaining in the
Gallery of Either
House of
Congress; Violent
Entry and
Disorderly
Conduct at the
Grounds and in a
Capitol Building

MOSTOFSKY, One felony count New York /

Aaron of theft of 1:21-mj-34
government
property.

Mullins, Clayton Assaulting, Kentucky /

Ray resisting, or 1:21-mj-233
impeding certain
officers;
Obstruction of
law enforcement
during civil
disorder;
Knowingly
entering or
remaining in any

680
Telegram Channel @nettrain
 restricted
building or
grounds without
lawful authority;
Disorderly and
disruptive
conduct in a
restricted
building or
grounds;
Engaging in
physical violence
in a restricted
building or
grounds; Violent
entry and
disorderly
conduct on
Capitol grounds

Munchel, Eric Obstruction of an Initial appearance in the Tennessee,

Gavelek official Middle District of Tennessee Middle
proceeding; 1/12/21. Preliminary/Detention District /
Restricted hearing rescheduled to 1:21-mj-71
Building or 1/22/21. Ordered detained
Grounds; Violent pending appeal. Ordered
Entry or detained and transported to
Disorderly D.C.
Conduct; Aiding
and Abetting

MUNTZER, Obstruction of an Arrested 1/18/21 in the District Montana /

Henry Phillip official of Montana. 1:21-mj-43
(aka, Hank proceeding;
Muntzer) Entering or and
Remaining in a
Restricted
Building or
Grounds;
Disorderly and
disruptive
conduct in a
restricted
building or
grounds;
Disorderly

681
Telegram Channel @nettrain
 conduct in a
Capitol building;
Parading,
demonstrating, or
picketing in a
Capitol building

NALLEY, Verden Obstruction of an / 1:21-mj-40

Andrew official
proceeding;
Restricted
Building or
Grounds; Violent
Entry or
Disorderly
Conduct

NICHOLS, Ryan Civil disorder; Arrested 1/18/21 in the Eastern Virginia,

Obstruction of an District of Texas. Eastern
official District /
proceeding; 1:21-mj-102
Assaulting,
resisting, or
impeding certain
officers using a
dangerous
weapon; Theft of
government
property;
Entering and
remaining in a
restricted
building or
grounds with a
deadly or
dangerous
weapon;
Disorderly and
disruptive
conduct in a
restricted
building or
grounds with a
deadly or
dangerous
weapon;

682
Telegram Channel @nettrain
 Unlawful
Possession of a
Dangerous
Weapon on
Capitol Grounds
or Buildings;
Disorderly
conduct in a
Capitol building;
Act of physical
violence in the
Capitol grounds
or buildings;
Parading,
demonstrating, or
picketing in a
Capitol building

NORDEAN, Aid and Abet Arrested 2/3/21 in the Western Washington,

Ethan (aka, Ruffio Injury or District of Washington. Western
Panman) Depredation District /
Against
Government
Property;
Obstruct or
Impede an
Official
Proceeding;
Knowingly
Entering or
Remaining in
Restricted
Building or
Grounds; Violent
entry and
disorderly
conduct on
Capitol grounds

OCHS, Nicholas Conspiracy; Complaint filed 1/7/21. Initial Hawaii /

Obstruction of an Appearance set for 1/27/21. 1:21-cr-73
official
proceeding;
Destruction of
Government
Property; Theft

683
Telegram Channel @nettrain
 of government
property;
Restricted
Building or
Grounds; Aiding
and Abetting

ORTIZ, Knowingly Arrested 1/27/21 in the Eastern New York,

Christopher W. entering or District of New York. Eastern
remaining in any District /
restricted 1:21-mj-158
building or
grounds without
lawful authority;
violent entry and
disorderly
conduct on
Capitol grounds

PACKER, Robert Entering and Initial Appearance scheduled Virginia,

Keith remaining in a 1/13/21 (EDVA District Eastern
restricted Court). Released on a personal District /
building; Violent recognizance bond with two 1:21-mj-39
Entry and special conditions (stay away
Disorderly order from D.C. and appear at
Conduct and virtual hearing next week).
Parading, Preliminary hearing
demonstrating, or (telephonic/VTC) set for
picketing in a 2/11/21.
Capitol building

Padilla, Joseph Obstruction of Georgia /

Lino (aka, Jose law enforcement 1:21-mj-252
Padilla) during civil
disorder;
Assaulting a law
enforcement
officer with a
deadly or
dangerous
weapon; Entering
or remaining in
any restricted
building or
grounds without
lawful authority

684
Telegram Channel @nettrain
 with a deadly or
dangerous
weapon;
Disorderly and
disruptive
conduct in a
restricted
building or
grounds with a
deadly or
dangerous
weapon;
Engaging in
physical violence
in a restricted
building or
grounds with a
deadly or
dangerous
weapon; Violent
entry and
disorderly
conduct on
Capitol grounds

PARKER, Bennie Conspiracy; Arrested 2/18/21 in the Ohio,

Alvin Obstruction of an Northern District of Ohio. Northern
official District /
proceeding and 1:21-mj-228
aiding and
abetting;
Destruction of
Government
Property and
Aiding and
abetting; Entering
and Remaining in
a Restricted
Building or
Grounds

PARKER, Sandra Conspiracy; Arrested 2/18/21 in the Ohio,

Ruth Obstruction of an Northern District of Ohio. Northern
official District /
proceeding and 1:21-mj-228
aiding and

685
Telegram Channel @nettrain
 abetting;
Destruction of
Government
Property and
Aiding and
abetting; Entering
and Remaining in
a Restricted
Building or
Grounds

PEPE, William Conspiracy; Arrested on 1/12 in New York. New York /

Assaulting, 1:21-mj-32
resisting, or
impeding certain
officers; Civil
disorder;
Government
Property or
Contracts;
Obstruction of an
official
proceeding;
Robbery of
Personal Property
of the U.S.;
Restricted
Building or
Grounds; Aiding
and Abetting

PERNA, Matthew Knowingly Arrested 1/19/21 in the Pennsylvania,

entering or Western District of Western
remaining in any Pennsylvania. Initial District /
restricted appearance 1/19/21. 1:21-mj-107
building or
grounds without
lawful authority;
Disorderly
conduct on
Capitol grounds

PERT, Rachael Unlawful Entry Arrested 1/26/21 in the Middle Florida,

Lynn on Restricted District of Florida. Initial Middle
Building or appearance 1/26/21. Released District /
Grounds; Violent on Conditions. 1:21-mj-160

686
Telegram Channel @nettrain
 entry and
disorderly
conduct on
Capitol Grounds

PETERSON, Knowingly Arrested 2/12/21 in the Pennsylvania,

Russell James entering or Western District of Western
remaining in any Pennsylvania. District /
restricted
building or
grounds;
Disorderly
conduct which
impedes the
conduct of
government
business;
Disruptive
Conduct in the
Capitol
Buildings;
Parading,
Demonstrating,
or Picketing in
the Capitol
Buildings

PEZZOLA, Conspiracy; Arrested 1/15/21. Initial New York,

Dominic (aka Assaulting, appearance in the Western Western
Spaz, aka Spazzo, resisting, or District of New York on District of /
Aka Spazzolini) impeding certain 1/15/21. 1:21-mj-47
officers; Civil
disorder;
Government
Property or
Contracts;
Obstruction of an
official
proceeding;
Robbery of
Personal Property
of the U.S.;
Restricted
Building or
Grounds; Aiding
and Abetting

687
Telegram Channel @nettrain
PHAM, Tam Knowingly Arrested 1/20/21 in the Texas,
Dinh entering or Southern District of Texas. Southern
remaining in any District /
restricted 1:21-mj-116
building or
grounds without
lawful authority;
Violent entry and
disorderly
conduct on
Capitol grounds

PHIPPS, Daniel Entering and Arrested 1/26/21 in the Texas,

D. remaining in a Southern District of Texas. Southern
restricted District /
building; 1:21-mj-125
Disorderly and
disruptive
conduct in a
restricted
building; Violent
entry and
disorderly
conduct in a
Capitol building;
Parading,
demonstrating, or
picketing in a
Capitol building

Powell, Rachel Obstruction; Arrested 2/4/21 in the Western Pennsylvania,

Marie Depredation of District of Pennsylvania. Western
government District /
property; 1:21-mj-197
Restricted
Building or
Grounds with a
Dangerous
Weapon;
Restricted
Building or
Grounds; Violent
Entry or
Disorderly
Conduct

688
Telegram Channel @nettrain
PRIOLA, Knowingly Initial appearance 1/14/21 in Ohio,
Christine entering or the Northern District of Ohio. Northern
remaining in any Defendant was released on District /
restricted bond with home detention and 1:21-mj-53
building or electronic home monitoring.
grounds without
lawful authority;
Violent entry and
disorderly
conduct on
Capitol grounds;
Unlawful
Activities on
Capitol Grounds,
Parades,
Assemblages and
Display of Flags

PRUITT, Joshua Civil disorder; Arrested on 1/7/21. Initial / 1:21-cr-23

Obstruction of an appearance / detention hearing
official on 1/7/21. Defendant released.
proceeding; Preliminary Hearing set for
Aiding and 1/28/21.
abetting;
Destruction of
Government
Property;
Entering and
remaining in a
restricted
building or
grounds;
Disorderly and
disruptive
conduct in a
restricted
building or
grounds;
Disorderly
Conduct in a
Capitol Building;
Acts of Physical
Violence in the
Capitol Building

689
Telegram Channel @nettrain
QUICK, Michael Restricted Missouri /
Building or 1:21-mj-220
Grounds;
Unlawful
Activities on
Capitol Grounds;
Disorderly
Conduct;
Parading and
Demonstrating in
the Capitol
Building

QUICK, Stephen Restricted Missouri /

Brian Building or 1:21-mj-221
Grounds;
Unlawful
Activities on
Capitol Grounds;
Disorderly
Conduct;
Parading and
Demonstrating in
the Capitol
Building

REED, Blake A. Knowingly Arrested 1/17/21 in Nashville. Tennessee,

entering or Initial appearance on 1/19/21. Nashville /
remaining in any Released with conditions. 1:21-mj-81
restricted
building or
grounds without
lawful authority;
Violent entry and
disorderly
conduct on
Capitol grounds

690
Telegram Channel @nettrain
Reeder, Robert Knowingly entering or Maryland /
Maurice remaining in any 1:21-mj-261
restricted building or
grounds without lawful
authority; Violent entry
and disorderly conduct
on Capitol grounds

REFFITT, Guy Obstruction of an Arrested 1/18/21 in Texas, Eastern

Wesley official proceeding and the Eastern District District / 1:21-
aiding and abetting; of Texas. cr-32
Entering and remaining
in a restricted building
or grounds;
Obstruction of Justice -
Hindering
Communication
Through Physical
Force or Threat of
Physical Force

REVLETT, Unlawful Entry on Arrested 1/25/21 in Kentucky,

Jordan T Restricted Grounds; the Western District Western
Violent Entry or of Kentucky. District / 1:21-
Disorderly Conduct mj-130

RIDDLE, Jason Knowingly entering or New

Daniel (aka, remaining in any Hampshire /
Jason Riddle) restricted building or 1:21-mj-204
grounds without lawful
authority; Theft of
government property;
Violent entry and
disorderly conduct on
Capitol grounds

RILEY, Jorge A. Obstructing of an Arrested 1/19/21 in California,

Official Proceeding; the Eastern District Eastern
Aiding and Aiding; of California. District / 1:21-
Entering and remaining cr-69
in a restricted building
or grounds; Disorderly
and disruptive conduct
in a restricted building
or grounds; Disorderly

691
Telegram Channel @nettrain
 conduct in a Capitol
building; Parading,
demonstrating, or
picketing in a Capitol
building

RIVERA, Jesus Knowingly entering or Arrested 1/20/21 in Florida,

(aka, JD Rivera, remaining in any the Northern Northern
Jesus Delmora restricted building or District of Florida. District / 1:21-
Rivera) grounds without lawful Initial Appearance mj-118
authority; Knowingly, 1/20/21.
With Intent to Impede
Government Business
or Official Functions,
Engaging in Disorderly
conduct on Capitol
grounds; Engaging in
Disorderly or
Disruptive Conduct on
Capitol Buildings or
Grounds; Parading,
Demonstrating, or
Picketing in the
Capitol Buildings

ROBERTSON, Obstruction of an / 1:21-mj-36

Thomas official proceeding;
Aiding and abetting;
Entering and remaining
in a restricted building;
Disorderly and
disruptive conduct in a
restricted building;
Violent entry and
disorderly conduct in a
Capitol building or
Grounds

Rodean, Entering and remaining Arrested in D.C. District of

Nicholas in a restricted building; 1/13/21. Columbia /
Disorderly and 1:21-cr-57
disruptive conduct in a
restricted building;
Violent entry and
disorderly conduct in a
Capitol building;

692
Telegram Channel @nettrain
 Parading,
demonstrating, or
picketing in a Capitol
building

ROSA, Eliel Obstruction of an Released on Texas / 1:21-

official proceeding; personal cr-68
Entering and remaining recognizance bond.
in a restricted building
or grounds; Disorderly
and disruptive conduct
in a restricted building
or grounds; Disorderly
conduct in a Capitol
building; Parading,
demonstrating, or
picketing in a Capitol
building; Aiding and
Abetting

RUBENACKER, Knowingly entering or New York /

Greg remaining in any 1:21-mj-172
restricted building or
grounds without lawful
authority; Violent entry
and disorderly conduct
on Capitol grounds

RUKSTALES, Entering and remaining Illinois / 1:21-

Bradley in a restricted building; mj-12
Disorderly and
disruptive conduct in a
restricted building;
Violent entry and
disorderly conduct in a
Capitol building;
Parading,
demonstrating, or
picketing in a Capitol
building

Ryan, Jennifer Knowingly entering or Arrested on / 1:21-cr-50

Leigh remaining in any 1/15/21.
restricted building or
grounds without lawful

693
Telegram Channel @nettrain
 authority; Disorderly
conduct on Capitol
grounds

Sabol, Jeffrey P. Assaulting, resisting, Arrested 1/27/21 in New York,

or impeding certain the Southern Southern
officers using a District of New District / 1:21-
dangerous weapon; York. mj-77
Assaulting, resisting,
or impeding certain
officers; Civil
disorder; Entering and
remaining in a
restricted building or
grounds with a deadly
or dangerous
weapon; Disorderly
and disruptive conduct
in a restricted building
or grounds with a
deadly or dangerous
weapon; Engaging in
physical violence in a
restricted building or
grounds with a deadly
or dangerous
weapon; Violent entry
and disorderly conduct
in a Capitol building

SAHADY, Mark Knowingly entering or Arrested on 1/19/21 Massachusetts,

remaining in any in Boston. Boston / 1:21-
restricted building or mj-108
grounds without lawful
authority; Disorderly
conduct on Capitol
grounds

SAMSEL, Ryan Forcibly assaulted, Arrested 1/30/21 in Pennsylvania,

resisted, opposed, the Eastern District Eastern / 1:21-
impeded, intimidated, of Pennsylvania. mj-188
or interfered with a
federal agent while
they are engaged in
their official duties;
Committed or attempt

694
Telegram Channel @nettrain
 to commit any act to
obstruct, impede, or
interfere with any
fireman or law
enforcement officer
lawfully engage in the
lawful performance of
his official duties;
Obstructed, influenced,
or impeded any official
proceeding, or attempt
to do so

SANDLIN, Assaulting, resisting, Arrested 1/28/21 in Nevada / 1:21-

Ronald L. or impeding certain the District of cr-88
officers; Civil disorder; Nevada. Initial
Obstruction of an appearance 2/1/21
official proceeding; in the District of
Entering and remaining Nevada. Ordered
in a restricted building detained.
or grounds; Disorderly Preliminary
and disruptive conduct hearings set for
in a restricted building 2/16/21.
or grounds; Disorderly
conduct in a Capitol
building; Impeding
Passage Through the
Capitol Grounds or
Buildings; Act of
physical violence in the
Capitol grounds or
buildings; Parading,
demonstrating, or
picketing in a Capitol
building

Sanford, Robert Civil disorder; Arrested in Pennsylvania /

Assaulting, resisting, Pennsylvania on 1:21-cr-86
or impeding certain 1/14/21.
officers using a
dangerous weapon;
Entering and remaining
in a restricted building
or grounds with a
deadly or dangerous
weapon; Disorderly

695
Telegram Channel @nettrain
 and disruptive conduct
in a restricted building
or grounds; Act of
physical violence in the
Capitol grounds or
buildings

SANTOS- Knowingly entering or Arrested 1/29/21 in Pennsylvania,

SMITH, Diana remaining in any the Eastern District Eastern
restricted building or of Pennsylvania. District / 1:21-
grounds without lawful mj-182
authority; Knowingly
engaging in disorderly
or disruptive conduct
in any restricted
building or grounds;
Violent entry and
disorderly conduct on
Capitol grounds

SCHAFFER, Jon Knowingly entering or Arrested 1/17/21 in Indiana,

Ryan remaining in any the Southern Southern
restricted building or District of Indiana. District / 1:21-
grounds without lawful mj-94
authority; Disrupting
the Orderly Conduct of
Government Business;
Knowingly Engages in
an Act of Physical
Violence Against Any
Person or Property in
any Restricted
Building or Grounds;
Violent entry and
disorderly conduct in a
Capitol building;
Engage in an Act of
Physical Violence in a
Capitol Building;
Parade, Demonstrate,
or Picket in a Capitol
Building

Schwab, Knowingly entering or Arrested 2/1/21 in Texas,

Katherine remaining in any the Northern Northern
restricted building or District of Texas.

696
Telegram Channel @nettrain
Staveley (aka, grounds without lawful District / 1:21-
Katie) authority; Disorderly mj-179
conduct on Capitol
grounds

SCHWARTZ, Forcibly Assaulting, Arrested 2/4/21 in Pennsylvania,

Peter Resisting, or Impeding the Western District Western
Certain Officers or of Pennsylvania. District / 1:21-
Employees; Initial appearance mj-186
Knowingly entering or 2/4/2021. Detention
remaining in any hearing scheduled
restricted building or for 2/10/21 in the
grounds without lawful Western District of
authority; Violent entry Pennsylvania.
and disorderly conduct
on Capitol grounds

SECOR, Obstruction of an Arrested 2/16/21 in California,

Christian official proceeding; the Central District Central
Civil disorder; of California. District / 1:21-
Assaulting, resisting, mj-00232
or impeding certain
officers; Entering and
remaining in a
restricted building or
grounds; Disorderly
and disruptive conduct
in a restricted building
or grounds; Entering
and Remaining on the
Floor of Congress;
Entering and remaining
in the Gallery of
Congress; Entering and
Remaining in Certain
Rooms in the Capitol
Building; Disorderly
conduct in a Capitol
building; Parading,
demonstrating, or
picketing in a Capitol
building

SEEFRIED, Knowingly entering or / 1:21-mj-46

Hunter remaining in any
restricted building or

697
Telegram Channel @nettrain
 grounds without lawful
authority; Violent entry
and disorderly conduct
on Capitol grounds

SEEFRIED, Knowingly entering or / 1:21-mj-46

Kevin remaining in any
restricted building or
grounds without lawful
authority; Violent entry
and disorderly conduct
on Capitol grounds

SHEPPARD, Knowingly entering or Ohio / 1:21-

Alexander remaining in any mj-248
restricted building or
grounds without lawful
authority; Disorderly
conduct which impedes
the conduct of
government business;
Violent Entry and
Disorderly Conduct on
Capitol Ground;
Parading,
Demonstrating, or
Picketing in the
Capitol Buildings;
Obstruction of
Justice/Congress

SHIVELY, Aiding and abetting; Arrested 1/19/21 in Pennsylvania,

Barton Wade Civil disorder; Forcibly the Middle District Middle
assault, resist, oppose, of Pennsylvania. District / 1:21-
impede, intimidate, or mj-106
interfere with any
officer or employee of
the U.S. or of any
agency in any branch
of the U.S.
Government while
engaged in or on
account of the
performance of official
duties; Restricted
Building or Grounds;

698
Telegram Channel @nettrain
 Violent Entry, Obstruct
or Impede Passage,
Engage in Physical
Violence on Grounds
or any of the Capitol
Buildings

SIDORSKI, Knowingly entering or Virginia /

Dennis remaining in any 1:21-mj-55
restricted building or
grounds without lawful
authority; Knowingly
Engages in Disorderly
or Disruptive Conduct
in any Restricted
Building or Grounds
Without Lawful
Authority; Violent
entry and disorderly
conduct on Capitol
grounds

SIMON, Mark Restricted Buildings or Arrested 1/28/21 in California,

Grounds; Unlawful the Central District Central
Activities on Capitol of California. Initial District /
Grounds appearance 1/28/21
in the Central
District of
California. Released
on bond. Next
hearing (virtual) on
2/3/21 in federal
court in the District
of Columbia.

SMITH, Jeffrey Violent entry and Arrested 1/27/21 in California,

Alexander (aka, disorderly conduct on the Southern Southern
Alex Smith) Capitol grounds; District of District / 1:21-
Knowingly Entering or California. Released mj-157
Remaining in any on bond. Next
Restricted Building or hearing (remote)
Grounds Without 2/3/21 in federal
Lawful Authority court in the District
of Columbia.

699
Telegram Channel @nettrain
SMOCKS, Troy Threats in Interstate Arrested 1/15/21 in Texas, Eastern
Anthony Commerce the Eastern District District / 1:21-
of Texas. mj-58

700
Telegram Channel @nettrain
SPARKS, Knowingly entering or Arrested 1/19/21 Kentucky,
Michael remaining in any restricted in the Western Western
building or grounds without District of District /
lawful authority; Violent Kentucky. 1:21-cr-87
entry and disorderly conduct
on Capitol grounds;
Obstructing Law
Enforcement

SPENCER, Knowingly entering or Arrested 1/19/21 North

Christopher remaining in any restricted in the Middle Carolina,
Raphael (aka, building or grounds without District of North Middle
Chris Spencer) lawful authority; Violent Carolina. District /
entry and disorderly conduct 1:21-mj-113
on Capitol grounds;
Obstruction of Justice

SPENCER, Knowingly entering or North

Virginia Marie remaining in any restricted Carolina /
(aka, Jenny building or grounds without 1:21-mj-205
Spencer) lawful authority; Violent
entry and disorderly conduct
on Capitol grounds

SPIGELMYER, Restricted Buildings or Pennsylvania

Paul Grounds; Violent Entry or / 1:21-mj-
Disorderly Conduct 209

STAGER, Peter Obstruction of an official Arrested 1/14/21 Arkansas,

proceeding and aiding and in Eastern
abetting; Assaulting, Arkansas. Initial District /
resisting, or impeding certain appearance 1:21-mj-57
officers using a dangerous 1/19/21 in the
weapon; Civil disorder; Eastern District
Entering and remaining in a of Arkansas.
restricted building or
grounds with a deadly or
dangerous
weapon; Disorderly and
disruptive conduct in a
restricted building or
grounds with a deadly or
dangerous
weapon; Engaging in
physical violence in a

701
Telegram Channel @nettrain
 restricted building or
grounds with a deadly or
dangerous weapon; Violent
entry and disorderly conduct
in a Capitol building

STEDMAN, Restricted Building or Arrested 1/21/21 New Jersey /

Patrick Alonzo Grounds; Disorderly conduct in the District of 1:21-mj-133
on Capitol grounds New Jersey.
Initial
appearance in the
District of New
Jersey 1/21/21.

STEELE, Laura Conspiracy; Obstruction of Arrested 2/17/21 North

an official proceeding and in the Middle Carolina,
aiding and abetting; District of North Middle
Destruction of Government Carolina. District /
Property and Aiding and
abetting; Entering and
Remaining in a Restricted
Building or Grounds

STEELE- Obstruction of an official Arrested in the Virginia,

SMITH, proceeding; Entering and Eastern District Glouchester
Melody remaining in a restricted of Virginia on (Eastern
building or grounds; 1/20/2021. District of
Disorderly and disruptive Virginia) /
conduct in a restricted 1:21-cr-77
building or grounds;
Entering and Remaining in
Certain Rooms in the Capitol
Building; Disorderly conduct
in a Capitol building

STEPAKOFF, Entering and remaining in a Arrested 1/29/21 Florida,

Michael restricted building; in the Middle Middle
Disorderly and disruptive District of District /
conduct in a restricted Florida. Initial 1:21-cr-96
building; Violent entry and appearance
disorderly conduct in a 1/29/21 in the
Capitol building; Parading, Middle District
demonstrating, or picketing of
in a Capitol building Florida. Released
on bond with

702
Telegram Channel @nettrain
 conditions. Next
hearing (virtual)
2/4/21 in federal
court in the
District of
Columbia.

STEVENS, Assaulting, resisting, or Florida /

Tristan impeding certain officers or 1:21-mj-198
Chandler employees; Civil disorder;
Restricted Building or
Grounds; Violent Entry or
Disorderly Conduct

STOLL, Justin Interstate Threats; Ohio / 1:21-

Tampering with a Witness by mj-30
Threat

STRAKA, Impeding law enforcement Arrested 1/25/21 Nebraska /

Brandon officer during civil disorder; in the District of 1:21-mj-134
knowingly entering and Nebraska. Initial
remaining on restricted appearance
grounds without lawful 1/26/21.
authority and/or engaging in Released on
disorderly conduct within conditions.
proximity to a restricted
building to impede official
functions; engage in
disorderly conduct with
intent to disturb a hearing
before Congress

STRAND, John Restricted Building or Arrested 1/18/21 California,

Herbert Grounds; Violent Entry and in the Central Central
Disorderly Conduct District of District /
California. 1:21-cr-85
Released on
conditions.

STRONG, Entering and remaining in a Arrested 1/22/21 California,

Kevin restricted building or in the Central Central
grounds; Disorderly and District of District /
disruptive conduct in a California. 1:21-mj-151
restricted building or
grounds; Disorderly conduct

703
Telegram Channel @nettrain
 in a Capitol building;
Parading, demonstrating, or
picketing in a Capitol
building

Suarez, Marissa Knowingly entering or Arrested 1/22/21 New Jersey /

A. remaining in any restricted in the District of 1:21-mj-123
building or grounds without New Jersey.
lawful authority; Violent Initial
entry and disorderly conduct appearance
on Capitol grounds 1/25/21.
Released on
conditions.
Appearance on
1/27/21 in
federal court in
the District of
Columbia.

SULLIVAN, Obstruction of an official Initial Utah / 1:21-

John Earl proceeding; Civil disorder; appearance in the cr-78
Entering and remaining in a District of Utah
restricted building or on 1/15/2021.
grounds; Disorderly and
disruptive conduct in a
restricted building or
grounds; Disorderly conduct
in a Capitol building;
Parading, Demonstrating, or
Picketing in a Capitol
Building; Aiding and
Abetting

SWEET, Entering and remaining in a Virginia /

Douglas restricted building; 1:21-cr-41
Disorderly and disruptive
conduct in a restricted
building; Violent entry and
disorderly conduct in a
Capitol building; Parading,
demonstrating, or picketing
in a Capitol building

Thompson, Obstruction of an official Arrested 1/25/21 Ohio,

Dustin Byron proceeding and aiding and in the Southern Southern

704
Telegram Channel @nettrain
 abetting; Theft of District of Ohio. District /
government property; 1:21-mj-153
Entering and remaining in a
restricted building or
grounds; Disorderly and
disruptive conduct in a
restricted building or
grounds; Disorderly conduct
in a Capitol building;
Parading, demonstrating or
picketing in a Capitol
building

Todisco, Knowingly entering or Arrested 1/22/21 New Jersey /

Patricia remaining in any restricted in the District of 1:21-mj-123
building or grounds without New Jersey.
lawful authority; Violent Initial
entry and disorderly conduct appearance
on Capitol grounds 1/25/21.
Released on
conditions.
Appearance on
1/27/21 in
federal court in
the District of
Columbia.

TORRE, Knowingly entering or Arrested 2/9/21 Georgia,

Benjamin remaining in any restricted in the Northern Northern
Henry building or grounds without District of District /
lawful authority; Violent Georgia. Initial 1:21-mj-191
entry and disorderly conduct Appearance
on Capitol grounds 2/9/21.

TORRENS, Knowingly entering or Tennessee /

Eric Chase remaining in any restricted 1:21-mj-171
building or grounds without
lawful authority; Violent
entry and disorderly conduct
on Capitol grounds

TUTROW, Knowingly entering or Arrested 1/27/21 Indiana,

Israel remaining in any restricted in the Southern Southern
building or grounds; District of District /
Disorderly conduct which Indiana. 1:21-mj-162

705
Telegram Channel @nettrain
 impedes the conduct of
government business;
Disruptive Conduct in the
Capitol Buildings; Parading,
Demonstrating, or Picketing
in the Capitol Buildings

UPTMORE, Knowingly entering or Arrested 1/26/21 Texas,

Chance remaining in any restricted in the Western Western
Anthony building or grounds without District of Texas. District /
lawful authority; Violent 1:21-mj-156
entry and disorderly conduct
on Capitol grounds

UPTMORE, Knowingly entering or Arrested 1/26/21 Texas,

James Herman remaining in any restricted in the Western Western
(aka "Sonny") building or grounds without District of Texas. District /
lawful authority; Violent 1:21-mj-156
entry and disorderly conduct
on Capitol grounds

VARGAS Knowingly entering or New Jersey /

SANTOS, remaining in any restricted 1:21-mj-54
Hector building or grounds without
Emmanuel lawful authority; Violent
entry and disorderly conduct
on Capitol grounds

VINSON, Lori Knowingly entering or Kentucky /

Ann (aka, Lori remaining in any restricted 1:21-mj-247
Ann Utley) building or grounds;
Disorderly conduct which
impedes the conduct of
government business;
Disruptive Conduct in the
Capitol Buildings; Parading,
Demonstrating, or Picketing
in the Capitol Buildings

VINSON, Knowingly entering or Kentucky /

Thomas Roy remaining in any restricted 1:21-mj-247
building or grounds;
Disorderly conduct which
impedes the conduct of
government business;

706
Telegram Channel @nettrain
 Disruptive Conduct in the
Capitol Buildings; Parading,
Demonstrating, or Picketing
in the Capitol Buildings

Vogel, William Knowingly entering or Arrested 1/26/21 New York,

remaining in any restricted in the Southern Southern
building or grounds without District of New District /
lawful authority; Knowingly York. 1:21-mj-159
Engages in Disorderly or
Disruptive Conduct in any
Restricted Building or
Grounds; Violent entry and
disorderly conduct on
Capitol grounds

WAGNER, Knowingly entering or Arrested 1/26/21 Indiana,

Joshua remaining in any restricted in the Southern Southern
building or grounds; District of District /
Disorderly conduct which Indiana. 1:21-mj-162
impedes the conduct of
government business;
Disruptive Conduct in the
Capitol Buildings; Parading,
Demonstrating, or Picketing
in the Capitol Buildings

WATKINS, Conspiracy; Conspiracy to Arrested 1/18/21 Ohio,

Jessica Impede or Injure Officer; in the Southern Southern
Destruction of Government District of Ohio. District /
Property; Obstruction of an 1:21-mj-119
official proceeding;
Restricted Building or
Grounds; Violent Entry or
Disorderly Conduct

WATSON, Civil Disorders; Restricted Alabama /

William Wright Building or Grounds with a 1:21-mj-97
Deadly or Dangerous
Weapon; Violent Entry or
Disorderly Conduct

WEBSTER, Assaulting, Resisting, or Arrested 2/22/21 New York,

Thomas Impeding Certain Officers in the Southern Southern
with a Deadly or Dangerous District of New

707
Telegram Channel @nettrain
 Weapon; Obstruction of law York. Initial District /
enforcement during civil Appearance 1:21-mj-244
disorder; Disorderly and 2/23/2021 and
disruptive conduct in a ordered
restricted building or detained.
grounds with a deadly or
dangerous weapon;
Engaging in physical
violence in a restricted
building or grounds with a
deadly or dangerous weapon;
Violent entry and disorderly
conduct on Capitol grounds.

WEEKS, Knowingly entering or Arrested 1/21/21 Florida,

Bradley remaining in any restricted in the Middle Middle
building or grounds without District of District /
lawful authority; Violent Florida. Initial 1:21-mj-127
entry and disorderly conduct appearance
on Capitol grounds 1/21/21.
Released on
conditions.
Virtual hearing
set for 1/26/21 at
1:00pm in
federal court in
the District of
Columbia.

WESTOVER, Obstruct, impede, or Arrested 2/4/21 Missouri,

Paul S. interfere with law in the Eastern Eastern
enforcement officer (Aiding District of District /
and Abetting); Knowingly Missouri. 1:21-mj-174
entering or remaining in any
restricted building or
grounds; Disorderly conduct
which impedes the conduct
of government business;
Disruptive Conduct in the
Capitol Buildings

708
Telegram Channel @nettrain
WILLAMS, Entering and remaining in a Kentucky /
Troy Dylan restricted building or grounds; 1:21-mj-183
Disorderly and disruptive conduct
in a restricted building or grounds;
Disorderly conduct in a Capitol
building or Grounds; Parading,
demonstrating, or picketing in a
Capitol building

Williams, Entering and remaining in a Arrested in the Florida,

Andrew restricted building; Disorderly and Middle District Middle
Disruptive Conduct in a Restricted of Florida District /
Building 1/13/21. 1:21-mj-30

Williams, Knowingly entering or remaining Arrested Pennsylvania,

Riley June in any restricted building or 1/18/21 in the Middle
grounds without lawful authority; Middle District District /
Violent entry and disorderly of
conduct on Capitol grounds Pennsylvania.
Released to
home
confinement
on conditions.
Hearing
(virtual) set for
1/25/21 in
federal court in
the District of
Columbia.
WILSON, Knowingly entering or remaining / 1:21-mj-
Zachary in any restricted building 229
John
WINN, Unlawful Entry on Restricted Arrested Florida,
Dana Joe Building or Grounds; Violent 1/26/21 in the Middle
entry and disorderly conduct on Middle District District /
Capitol Grounds of Florida. 1:21-mj-160
Initial
appearance
1/26/21.
Released on
Conditions.

WRIGLEY, Entering and remaining in a Arrested on Pennsylvania,

Andrew restricted building; Disorderly and 1/15/21 in the Middle
disruptive conduct in a restricted Middle District

709
Telegram Channel @nettrain
 building; Violent entry and of District /
disorderly conduct in a Capitol Pennsylvania. 1:21-mj-26
building; Parading, demonstrating, Initial
or picketing in a Capitol building appearance via
video on
1/25/21 in
federal court in
the District of
Columbia.

YOUNG, Conspiracy; Obstruction of an Arrested Florida,

Graydon official proceeding and aiding and 2/15/21 in the Middle
abetting; Destruction of Middle District District /
Government Property and Aiding of Florida.
and abetting; Entering and
remaining in a restricted building
or grounds; Tampering with
Documents or Proceedings

ZINK, Obstruction of an official Pennsylvania

Ryan Scott proceeding; Knowingly Entering / 1:21-mj-193
or Remaining in any Restricted
Building or Grounds Without
Lawful Authority and engages in
any act of physical violence
against any person or property in
any restricted building or
grounds.

710
Telegram Channel @nettrain
 711
Telegram Channel @nettrain
 About the Author

Daniel Farber Huang is

the author of the book, “Practical Cyber Security for Extremely Busy
People.”
He is a strategic consultant and advisor on cyber security and
other risk mitigation issues to a broad array of companies and
organizations, ranging from entrepreneurial start-ups to multi-national
corporations. He has worked closely with numerous federal, state, and
local law enforcement agencies across the U.S. on providing solutions to
their mobile technology requirements. Daniel has focused on providing
hardware and software solutions to federal field agents, the police, and
other authorities to support them in fulfilling their duties.
Before founding his own independent advisory firm, Daniel
worked for Goldman, Sachs & Co., Merrill Lynch and other major
investment banks advising a corporations and investors on domestic and
international corporate finance transactions. He was actively involved in
capital raising engagements encompassing in excess of $10 billion.
Daniel has advised a wide range of investment sponsors and strategies,
including private equity, venture capital, infrastructure, real estate,
emerging markets, hedge funds and specialized situations. Daniel is an
Advisor to Princeton University’s Keller Center for Innovation in

712
Telegram Channel @nettrain
Engineering Education, where he advises startups founders on business
best practices.
Outside of his consulting work, Daniel is a journalist and
documentary photographer focused on women’s and children’s issue and
the alleviation of poverty around the world. Daniel is a co-founder of
The Power of Faces, a major portrait project raising awareness of the
global refugee crisis. As an independent humanitarian advocate, Daniel
has documented refugee camps around the world, and has actively raised
awareness through multiple Talks on TED.com and other platforms. His
documentary work has been exhibited at Amnesty International, the
Middle East Institute, and numerous universities and colleges. His work
is included in the permanent collections of The International Center of
Photography, The Museum of the City of New York, New-York
Historical Society, Museum of Chinese in the Americas, New York City
Fire Museum and other institutions.
Daniel is a National Member of The Explorers Club, a
multidisciplinary professional society dedicated to the advancement of
field research and the ideal that it is vital to preserve the instinct to
explore. He is a Brand Ambassador for OP/TECH USA camera
accessories. Daniel is an Ambassador for the Wharton Alumni Social
Impact Club.
Daniel earned his Master’s degree (A.L.M.) in Journalism and a
Certificate in International Security from Harvard University, an M.B.A.
from The Wharton School, University of Pennsylvania in Finance and
Entrepreneurial Management, and a B.A. from New York University in
Economics.

713
Telegram Channel @nettrain
 Bibliography

chan.org. “FAQ - 4chan.” 4chan.org. Accessed March 1, 2021.

https://www.4chan.org/faq#trip.
plebs.org. “4plebs Credits & Links.” 4plebs.org. Accessed March 1, 2021.
http://archive.4plebs.org/_/articles/credits/.
ADL.org. “An Open Letter to the Companies That Advertise on
Facebook.” Anti-Defamation League. Accessed March 13, 2021.
https://www.adl.org/news/letters/an-open-letter-to-the-companies-
that-advertise-on-facebook.
———. “Extremists React to Pro-Trump Siege on Capitol.” Anti-
Defamation League. Accessed March 13, 2021.
https://www.adl.org/blog/extremists-react-to-pro-trump-siege-on-
capitol.
———. “Hate, Conspiracy Theories and Advertising on Facebook.” Anti-
Defamation League. Accessed March 13, 2021.
https://www.adl.org/blog/hate-conspiracy-theories-and-advertising-
on-facebook.
———. “Hateful and Conspiratorial Groups on Facebook.” Anti-
Defamation League. Accessed March 13, 2021.
https://www.adl.org/blog/hateful-and-conspiratorial-groups-on-
facebook.
Basu, Tanya. “A Guide to Being an Ethical Online Investigator.” MIT
Technology Review. Accessed March 12, 2021.
https://www.technologyreview.com/2021/01/14/1015931/how-to-
be-an-ethical-online-investigator-activist/.
BBC News. “Capitol Riots Timeline: The Evidence Presented against
Trump.” BBC News, February 13, 2021, sec. US & Canada.
https://www.bbc.com/news/world-us-canada-56004916.
Bowden, Bill. “FBI Found 2 Phones at Barnett Home, Not One Tied to
Capitol.” Arkansas Democrat Gazette, January 24, 2021.
https://www.arkansasonline.com/news/2021/jan/24/fbi-found-2-
phones-at-barnett-home-not-one-tied/.
Brewster, Thomas. “Sheryl Sandberg Downplayed Facebook’s Role In The
Capitol Hill Siege—Justice Department Files Tell A Very Different
Story.” Forbes, February 7, 2021.

714
Telegram Channel @nettrain
 https://www.forbes.com/sites/thomasbrewster/2021/02/07/sheryl-
sandberg-downplayed-facebooks-role-in-the-capitol-hill-siege-
justice-department-files-tell-a-very-different-story/.
Browning, Kellen, and Taylor Lorenz. “Pro-Trump Mob Livestreamed Its
Rampage, and Made Money Doing It.” The New York Times,
January 8, 2021, sec. Technology.
https://www.nytimes.com/2021/01/08/technology/dlive-capitol-
mob.html.
Browning, Kelly, and Taylor Lorenz. “Pro-Trump Mob Livestreamed Its
Rampage, and Made Money Doing It.” The New York Times,
January 8, 2021.
https://www.nytimes.com/2021/01/08/technology/dlive-capitol-
mob.html.
Bryan, John H. “Derrick Evans Statement 1:7:21 | Police | Politics.” Scribd,
January 7, 2021.
https://www.scribd.com/document/490068811/Derrick-Evans-
Statement-1-7-21.
Carman, Ashley. “Peloton Is Blocking the #StopTheSteal Hashtag from
Being Created or Used.” The Verge, January 11, 2021.
https://www.theverge.com/2021/1/11/22225197/peloton-stop-the-
steal-tag-banned-donald-trump.
Cherish Creamery. “Facebook Post.” Facebook.com, February 2, 2021.
https://www.facebook.com/cherishcreamery/posts/3661793643886
919.
Chughtai, Alia. “Timeline: The Deadly Capitol Hill Riots.” Al Jazeera,
January 9, 2021.
https://www.aljazeera.com/news/2021/1/9/timeline-capitol-hill-
riots.
Ciras, Heather, Laura Crimaldi, Anush Elbakyan, Daigo Fujiwara, John
Hancock, Ryan Huddle, Jazmine Ulloa, and Leanne Burden Seidel.
“Timeline of Pro-Trump Riot at US Capitol.” BostonGlobe.Com,
January 8, 2021.
https://apps.bostonglobe.com/nation/graphics/2021/01/us-capitol-
riots-timeline.
CISA.gov. “Joint Statement from Elections Infrastructure Government
Coordinating Council & the Election Infrastructure Sector
Coordinating Executive Committees | CISA.” Accessed March 4,
2021. https://www.cisa.gov/news/2020/11/12/joint-statement-
elections-infrastructure-government-coordinating-council-election.

715
Telegram Channel @nettrain
ConstituteProject.org. “Freedom of Assembly - Constitute.” Accessed
February 23, 2021.
https://www.constituteproject.org/topics/assem?lang=en.
———. “United States of America 1789 (Rev. 1992) Constitution.”
Accessed February 23, 2021.
https://www.constituteproject.org/constitution/United_States_of_A
merica_1992?lang=en.
Cornell University. “18 U.S. Code § 2384 - Seditious Conspiracy.” LII /
Legal Information Institute. Accessed March 4, 2021.
https://www.law.cornell.edu/uscode/text/18/2384.
C-SPAN. U.S. Senate Impeachment Trial of Former President Trump (Day
2), 2021. https://www.youtube.com/watch?v=yiCPdI0rW68.
DHS.gov. “DHS And Partners Convene First Election Infrastructure
Coordinating Council.” Department of Homeland Security,
October 14, 2017. https://www.dhs.gov/news/2017/10/14/dhs-and-
partners-convene-first-election-infrastructure-coordinating-council.
DLive Team. “A Message from DLive Regarding the Recent Protests ·
DLive Community.” DLive Community, January 8, 2021.
https://community.dlive.tv/2021/01/08/a-message-from-dlive-
regarding-the-recent-protests/.
———. “DLive Blog.” Medium. Accessed February 24, 2021.
https://medium.com/dlive-official-blog.
Dubberley, Sam. “How to: Use InVid-WeVerify – the ‘Swiss Army Knife’
of Digital Verification.” CITIZEN EVIDENCE LAB, December
11, 2019. https://citizenevidence.org/2019/12/11/how-to-use-invid-
the-swiss-army-knife-of-digital-verification/.
Evans, Derrick. “Derrick Evans Resignation Letter.Pdf.” Dropbox, January
9, 2021.
https://www.dropbox.com/s/0ii8ehbdi9qnuxt/Derrick%20Evans%2
0Resignation%20Letter.pdf?dl=0.
acebook.com. “Our Response to the Violence in Washington.” About
Facebook (blog), January 7, 2021.
https://about.fb.com/news/2021/01/responding-to-the-violence-in-
washington-dc/.
arley, Robert. “Timeline of National Guard Deployment to Capitol.”
FactCheck.Org (blog), January 13, 2021.
https://www.factcheck.org/2021/01/timeline-of-national-guard-
deployment-to-capitol/.
arrow, Ronan. “A Pennsylvania Mother’s Path to Insurrection.” The New
Yorker, February 1, 2021. https://www.newyorker.com/news/news-

716
Telegram Channel @nettrain
 desk/a-pennsylvania-mothers-path-to-insurrection-capitol-riot.
———. “An Air Force Combat Veteran Breached the Senate and
Descended on Nancy Pelosi’s Office Suite.” The New Yorker,
January 8, 2021. https://www.newyorker.com/news/news-desk/an-
air-force-combat-veteran-breached-the-senate.
BI.gov. “About the Biometric Center of Excellence.” Page. Federal
Bureau of Investigation. Accessed March 12, 2021.
https://www.fbi.gov/services/cjis/fingerprints-and-other-
biometrics/biometric-center-of-excellence-1/about-the-biometric-
center-of-excellence-1.
———. “Capitol Violence.” Page. Federal Bureau of Investigation.
Accessed March 12, 2021. https://www.fbi.gov/wanted/capitol-
violence.
———. “Combined DNA Index System (CODIS).” Folder. Federal
Bureau of Investigation. Accessed March 12, 2021.
https://www.fbi.gov/services/laboratory/biometric-analysis/codis.
———. “Director Wray’s Statement on Violent Activity at the U.S. Capitol
Building.” Press Release. Federal Bureau of Investigation.
Accessed March 12, 2021.
https://www.fbi.gov/news/pressrel/press-releases/director-wrays-
statement-on-violent-activity-at-the-us-capitol-building-010721.
———. “Domestic Terrorism: Definitions, Terminology, and
Methodology.” File. Federal Bureau of Investigation. Accessed
February 23, 2021. https://www.fbi.gov/file-repository/fbi-dhs-
domestic-terrorism-definitions-terminology-methodology.pdf/view.
———. “FBI Assistant Director in Charge Steven M. D’Antuono’s
Remarks 20210108.” Press Release, January 8, 2021.
https://www.fbi.gov/contact-us/field-
offices/washingtondc/news/press-releases/fbi-assistant-director-in-
charge-steven-m-dantuonos-remarks-on-press-call-regarding-
violence-at-us-capitol-010821.
———. “FBI Assistant Director in Charge Steven M. D’Antuono’s
Remarks 20210112.” Press Release, January 15, 2021.
https://www.fbi.gov/contact-us/field-
offices/washingtondc/news/press-releases/fbi-assistant-director-in-
charge-steven-m-dantuonos-remarks-on-press-call-regarding-
violence-at-us-capitol-011521.
———. “FBI Assistant Director in Charge Steven M. D’Antuono’s
Remarks 20210115.” Press Release, January 15, 2021.
https://www.fbi.gov/contact-us/field-

717
Telegram Channel @nettrain
 offices/washingtondc/news/press-releases/fbi-assistant-director-in-
charge-steven-m-dantuonos-remarks-on-press-call-regarding-
violence-at-us-capitol-011521.
———. “FBI Assistant Director in Charge Steven M. D’Antuono’s
Remarks 20210126.” Press Release, January 26, 2021.
https://www.fbi.gov/contact-us/field-
offices/washingtondc/news/press-releases/fbi-assistant-director-in-
charge-steven-m-dantuonos-remarks-on-press-call-regarding-
violence-at-us-capitol-012621.
———. “FBI Initiatives.” Page. Federal Bureau of Investigation. Accessed
March 12, 2021. https://www.fbi.gov/services/cjis/fingerprints-
and-other-biometrics/biometric-center-of-excellence-1/fbi-latent-
hit-of-the-year-program-1.
———. “FBI Washington Field Office Provides Statement on Pipe Bomb
Investigation.” Video. Federal Bureau of Investigation. Accessed
March 12, 2021. https://www.fbi.gov/video-repository/wfo-
pipebomb-investigation-030921.mp4/view.
———. “Next Generation Identification (NGI).” Page. Federal Bureau of
Investigation. Accessed February 25, 2021.
https://www.fbi.gov/services/cjis/fingerprints-and-other-
biometrics/ngi.
———. “PIPE BOMBS IN WASHINGTON, D.C.” Federal Bureau of
Investigation. Accessed March 10, 2021.
https://www.fbi.gov/wanted/seeking-info/suspected-pipe-bombs-
in-washington-dc.
———. Seeking Information: Pipe Bombs in Washington, D.C., 2021.
https://www.youtube.com/watch?v=YJ80LJIOn3E&t=2s.
———. “Video and Additional Information Released in Pipe Bomb
Investigation.” Press Release. Federal Bureau of Investigation.
Accessed March 10, 2021. https://www.fbi.gov/contact-us/field-
offices/washingtondc/news/press-releases/fbi-washington-field-
office-releases-video-and-additional-information-regarding-pipe-
bomb-investigation.
enton, Justin. “Maryland Man Who Entered Capitol Wearing Work Badge
Arrested, Ordered to Stay out of D.C. Pending Trial - Baltimore
Sun.” Baltimore Sun, January 13, 2021.
https://www.baltimoresun.com/news/crime/bs-md-cr-rodean-
surrender-capitol-charges-20210113-
njo56n23qnbojgvb46yypcb3oq-story.html.

718
Telegram Channel @nettrain
 rier, Sarah. “Facebook Helped Government Identify Capitol Rioters From
Photos.” BloombergQuint. Accessed March 14, 2021.
https://www.bloombergquint.com/technology/facebook-helped-
government-identify-capitol-rioters-from-photos.
George Washington University. “The George Washington University
Program on Extremism - Capitol Hill Siege.” Accessed February
24, 2021. https://extremism.gwu.edu/Capitol-Hill-Cases.
Greenberg, Andy. “This Site Published Every Face From Parler’s Capitol
Riot Videos | WIRED.” Accessed March 14, 2021.
https://www.wired.com/story/faces-of-the-riot-capitol-insurrection-
facial-recognition/.
Groeger, Lena V., Jeff Kao, Al Shaw, Moiz Syed, and Maya Eliahou.
“What Parler Saw During the Attack on the Capitol.” ProPublica,
January 17, 2021. https://projects.propublica.org/parler-capitol-
videos/.
Hayden, Michael Edison. “Meet DLive: The Livestreaming Platform Used
by Trump’s Capitol Insurrectionists.” Southern Poverty Law
Center, January 7, 2021.
https://www.splcenter.org/hatewatch/2021/01/07/meet-dlive-
livestreaming-platform-used-trumps-capitol-insurrectionists.
Healy, Jack. “These Are the 5 People Who Died in the Capitol Riot.” The
New York Times, January 11, 2021, sec. U.S.
https://www.nytimes.com/2021/01/11/us/who-died-in-capitol-
building-attack.html.
House.gov. “Electoral College Fast Facts.” Accessed March 25, 2021.
https://history.house.gov/Institution/Electoral-College/Electoral-
College/.
srael, Steve. “The Big Lie from Donald Trump.” TheHill, December 2,
2020. https://thehill.com/opinion/white-house/528417-the-big-lie-
from-donald-trump.
okic, Natasha. “15 Platforms That Have Banned Or Restricted Trump So
Far.” BuzzFeed, January 10, 2021.
https://www.buzzfeed.com/natashajokic1/trump-platforms-banned.
ustice.gov. “AYRES, Stephen Michael,” February 4, 2021.
https://www.justice.gov/usao-dc/defendants/ayres-stephen-
michael.
———. “BARNETT, Richard,” February 4, 2021.
https://www.justice.gov/usao-dc/defendants/barnett-richard.
———. “Capitol Breach Cases,” February 4, 2021.
https://www.justice.gov/usao-dc/capitol-breach-cases.

719
Telegram Channel @nettrain
———. “EGTVEDT, Daniel Dean,” February 26, 2021.
https://www.justice.gov/usao-dc/defendants/egtvedt-daniel-dean.
———. “Retired NYPD Officer Arrested, Charged in Federal Court for
Assaulting and Impeding MPD Officer during U.S. Capitol
Breach,” February 23, 2021. https://www.justice.gov/usao-
dc/pr/retired-nypd-officer-arrested-charged-federal-court-
assaulting-and-impeding-mpd-officer.
Klein, Scott, and Jeff Kao. “Why We Published More Than 500 Videos
Taken by Parler Users of the Capitol Riot.” ProPublica. Accessed
March 14, 2021. https://www.propublica.org/article/why-we-
published-parler-users-videos-capitol-attack?token=BqIo4xWW-
e2lFRkkEcQaP3yGUMVipeA4.
Krause, Kevin. “Judge Frees North Texan Who Faces Charges in the
Capitol Riot, despite Warnings from the FBI.” The Dallas Morning
News, January 14, 2021.
https://www.dallasnews.com/news/courts/2021/01/14/judge-frees-
larry-brock-facing-charges-in-capitol-riot-despite-warnings-from-
fbi/.
Law.com. “Legal Dictionary.” Law.com Legal Dictionary. Accessed March
10, 2021. https://dictionary.law.com.
LawInsider.com. “Dictionary.” Law Insider. Accessed March 12, 2021.
https://www.lawinsider.com/dictionary.
Laws.com. “1st Amendment (1st Amendment) Rights, Text - US
Constitution.” Kids Laws (blog), March 29, 2020.
https://kids.laws.com/first-amendment/.
———. “The Bill of Rights Amendments - US Constitution.” Constitution
of United States of America 1789 (blog), April 7, 2020.
https://constitution.laws.com/bill-of-rights/bill-of-rights-
amendments.
Lindsay, James M. “The 2020 Election by the Numbers.” Council on
Foreign Relations, December 15, 2020.
https://www.cfr.org/blog/2020-election-numbers.
Lytvynenko, Jane, and Molly Hensley-Chancy. “The Rioters Who Took
Over The Capitol Have Been Planning Online In The Open For
Weeks.” BuzzFeed News. Accessed March 13, 2021.
https://www.buzzfeednews.com/article/janelytvynenko/trump-
rioters-planned-online.
Munoz, Carlos R. “Man Who Stole Nancy Pelosi’s Lectern at U.S. Capitol
Could Be from Parrish, Florida.” Sarasota Herald-Tribune.
Accessed March 9, 2021.

720
Telegram Channel @nettrain
 https://www.heraldtribune.com/story/news/local/manatee/2021/01/
07/man-who-took-speaker-pelosis-podium-at-u-s-capitol-building-
believed-to-be-from-parrish/6579085002/.
National Archives. “2020 Electoral College Results.” National Archives.
Accessed March 25, 2021. https://www.archives.gov/electoral-
college/2020.
Navistar Direct Marketing. “Facebook Post.” Facebook.com, January 7,
2021.
https://www.facebook.com/navistardm/posts/3596465917096340.
Nyafuu.org. “Nyafuu Archive FAQ.” Nyafuu.org. Accessed March 1,
2021. https://archive.nyafuu.org/_/articles/FAQ/.
O’Brien, Hope. “Hundreds Gather Outside Maricopa Election Center for
Third Day of Protests.” Cronkite News - Arizona PBS (blog),
November 7, 2020.
https://cronkitenews.azpbs.org/2020/11/06/hundreds-gather-
outside-maricopa-election-center-for-third-day-of-protests/.
OSINTCombine.com. “Open Source Intelligence | Australia.” OSINT
Combine. Accessed March 13, 2021.
https://www.osintcombine.com.
arvini, Sarah, and Melissa Gomez. “On Social Media, Amateur Digital
Sleuths Try to Help Track Violent Capitol Rioters.” Los Angeles
Times, January 17, 2021.
https://www.latimes.com/california/story/2021-01-17/amateur-
social-media-sleuths-track-violent-capitol-rioters.
hilp, Rowan. “How Open Source Experts Identified the US Capitol
Rioters.” Global Investigative Journalism Network, January 15,
2021. https://gijn.org/2021/01/15/how-open-source-experts-
identified-the-us-capitol-rioters/.
chwartz, Drew. “The Instagram Account Naming and Shaming Pro-
Trump Rioters in D.C.” Accessed March 14, 2021.
https://www.vice.com/en/article/xgz5zw/the-instagram-account-
naming-and-shaming-pro-trump-rioters-in-dc.
herman, Amy. “A Timeline of What Donald Trump Said before the
Capitol Riot.” Poynter (blog), February 11, 2021.
https://www.poynter.org/fact-checking/2021/a-timeline-of-what-
donald-trump-said-before-the-capitol-riot/.
TheGuardian.com. “‘Stop the Vote’ and ‘Count the Votes’, Say Protesting
Trump Supporters – Video.” The Guardian, November 5, 2020,
sec. US news. https://www.theguardian.com/us-

721
Telegram Channel @nettrain
 news/video/2020/nov/05/stop-the-vote-count-the-vote-trump-
supporters.
TheHive.ai. “Mensio Sponsorship | Hive Media.” Accessed March 15,
2021. https://thehive.ai/mensio-sponsorship.
TheTrumpArchive.com. “Search on Trump Twitter Archive.” Accessed
March 10, 2021. //www.thetrumparchive.com.
Tillman, Zoe. “The FBI Has Tracked Down Some Of The Capitol Rioters
In Truly Surprising Ways.” BuzzFeed News, March 1, 2021.
https://www.buzzfeednews.com/article/zoetillman/capitol-
insurrection-rioter-cases-fbi-search.
Timberg, Craig, and Drew Harwell. “TheDonald’s Owner Speaks out on
Why He Finally Pulled Plug on Hate-Filled Site.” Washington
Post. Accessed March 24, 2021.
https://www.washingtonpost.com/technology/2021/02/05/why-
thedonald-moderator-left/.
Twitter.com. “@AltTaxPro Twitter Post.” Tweet. @AltTaxPro (blog),
January 6, 2021.
https://twitter.com/AltTaxPro/status/1346944595016380416/photo/
2.
———. “@ChampBiden Twitter Post.” Tweet. @ChampBiden (blog),
January 8, 2021.
https://twitter.com/ChampBiden/status/1347382525459533826.
———. “@End_Silence_Now Twitter Post.” Tweet. @End_Silence_Now
(blog), January 18, 2021.
https://twitter.com/End_Silence_Now/status/135125454287314534
4.
———. “@EUwatchers Twitter Post.” Tweet. @EUwatchers (blog),
January 6, 2021.
https://twitter.com/EUwatchers/status/1346919750752825347/phot
o/1.
———. “@FBI Twitter Post.” Tweet. Twitter (blog), March 9, 2021.
https://twitter.com/FBI/status/1369393018495721478.
———. “@firebirdNC Twitter Post.” Tweet. @firebird_nc (blog), January
7, 2021.
https://twitter.com/firebird_nc/status/1347275766820704257/photo
/3.
———. “@h_Sanatorium Twitter Post.” Tweet. @h_Sanatorium (blog),
January 16, 2021.
https://twitter.com/h_Sanatorium/status/1350282161564205059.

722
Telegram Channel @nettrain
———. “@jensteer/Jen Steer Twitter Post.” Tweet. @jensteer (blog),
January 8, 2021.
https://twitter.com/jensteer/status/1347614990874898436.
———. “@mmmcintyre Twitter Post.” Tweet. @mmmcintyre (blog),
January 8, 2021.
https://twitter.com/mmmcintyre/status/1347643578378579968.
———. “@nachos_johnson Twitter Post.” Tweet. @nachos_johnson
(blog), January 13, 2021.
https://twitter.com/nachos_johnson/status/1349365023056011265.
———. “Permanent Suspension of @realDonaldTrump,” January 8, 2021.
https://blog.twitter.com/en_us/topics/company/2020/suspension.ht
ml.
———. “@SenJeffMerkley/Senator Jeff Merkley Twitter Post.” Tweet.
@SenJeffMerkley (blog), January 7, 2021.
https://twitter.com/SenJeffMerkley/status/1347039504528498688.
———. “@SethAbramson/Seth Abramson Twitter Post.” Tweet.
@SethAbramson (blog), January 7, 2021.
https://twitter.com/SethAbramson/status/1346977323086729218/p
hoto/1.
———. “@SimonWGhost Twitter Post.” Tweet. @SimonWGhost (blog),
January 15, 2021.
https://twitter.com/SimonWGhost/status/1349959991889805312.
———. “@sparrowmedia Twitter Post.” Tweet. @sparrowmedia (blog),
January 9, 2021.
https://twitter.com/sparrowmedia/status/1347763091715608577/ph
oto/3.
University of Illinois at Urbana-Champaign. “The Coup D’etat Project.”
Cline Center for Democracy, University of Illinois at Urbana-
Champaign, September 2013.
https://uofi.app.box.com/s/koi8js58bsdz8f2zg778vi0uem4gu69k.
USA Today. “Help USA TODAY Identify Rioters Who Stormed the US
Capitol.” Google Docs. Accessed January 21, 2021.
https://docs.google.com/forms/d/e/1FAIpQLSf1wqki1tRZsxiPAz1
aamzMyq7XuIm0Z1MDnaxxWI4M3esRew/viewform?
usp=embed_facebook.
USCourts.gov. “What Does Free Speech Mean?” United States Courts.
Accessed February 23, 2021. https://www.uscourts.gov/about-
federal-courts/educational-resources/about-educational-
outreach/activity-resources/what-does.

723
Telegram Channel @nettrain
Wagner, Meg, Melissa Macaya, Mike Hayes, Melissa Mahtani, Veronica
Rocha, and Fernando Alfonso III. “Congress Finalizes Biden’s
Win after Riot Disrupts Capitol.” CNN, January 7, 2021.
https://www.cnn.com/politics/live-news/congress-electoral-
college-vote-count-2021/index.html.
Willingham, AJ. “Is That Video Real?” Accessed March 17, 2021.
https://www.cnn.com/interactive/2020/10/us/manipulated-media-
tech-fake-news-trnd/.
Zannettou, Savvas, Barry Bradlyn, Emiliano De Cristofaro, Michael
Sirivianos, Gianluca Stringhini, Haewoon Kwak, and Jeremy
Blackburn. “What Is Gab: A Bastion of Free Speech or an Alt-
Right Echo Chamber.” Proceedings paper. ACM Digital Library.
Geneva, Switzerland: International World Wide Web Conferences
Steering Committee, April 23, 2018.
https://doi.org/10.1145/3184558.3191531.

724
Telegram Channel @nettrain
 Index

act of terrorism 21
Adobe PDF 426
Adobe Photoshop 325
AllMyTweets.net 389
Amazon Alexa i
Anti-Defamation League 80, 83, 84, 489
Archive Today 425
Babbitt, Ashli 18, 20, 105
Basu, Tanya 285, 286
BBC Africa Eye 286
Bellingcat 285, 286
Big Lie 4, 6, 7, 14, 493
Boogaloos 81, 101
bots 367
Boyland,Roseanne 20
Capitol Hill Club 2, 62, 65, 71, 73, 74
Casablanca movie 79
coup d'état 434
COVID-19 4, 83, 143
criminal complaint 1, 142, 434, 439, 441
D’Antuono, Steven M. 30, 42, 43, 44, 54, 55, 491, 492
Democratic National Committee 2, 54, 55, 61, 64, 65, 67, 70, 74
Department of Homeland Security 5, 21, 435, 490
DLive 27, 28, 140, 141, 207, 284, 412, 490, 493
domestic terrorism 22, 272, 434, 435, 436, 437, 491
Election Day 4
Election Infrastructure Government Coordinating Council5
Election Infrastructure Sector Coordinating Council 5
Electoral College 4, 7, 9, 16, 493, 494
Exchangeable Image File Format 321
Facebook 2, 28, 83, 84, 85, 86, 107, 127, 141, 142, 144, 145, 147,
154, 156, 157, 160, 162, 163, 166, 173, 174, 186, 188, 195, 199, 209,
214, 216, 217, 218, 225, 227, 235, 236, 237, 251, 252, 253, 254, 269,

725
Telegram Channel @nettrain
 270, 271, 272, 273, 278, 281, 282, 285, 286, 321, 322, 352, 354, 355,
356, 357, 358, 359, 360, 402, 489, 490, 491, 492, 494
Faces of the Riot 2, 91, 96, 97
Farrow, Ronan 123, 226
FBI Biometric Center Of Excellence 49
FBI Combined DNA Index System 52, 491
FBI Criminal Justice Information Services 50
FBI Laboratory Division 52
FBI Next Generation Identification 50, 51, 492
FBI Operational Technology Division 49
Fiorella, Giancarlo 286
George Washington University 11, 12, 24, 101, 493
Gionet, Tim 27, 140
Giuliani, Rudolph 14
Goodman, Eugene 16
Google Chrome 313
Google Earth 326, 330
Google Maps 326, 328, 330, 332
Google Maps Satellite View 326, 332
Google Maps Street View 326, 328, 330, 332
Greenberg, Andy 96, 97
Greeson, Kevin D. 20
Grossman, David 14
HaveIBeenPwned 348
Hill, Bertram 286
Holmes, Sherlock i
HomeGrownTerrorists 2, 91
inspired believers 11, 12
Instagram 28, 83, 85, 86, 91, 93, 131, 132, 161, 162, 163, 164,
166, 167, 168, 169, 171, 193, 199, 209, 278, 281, 282, 321, 322, 359,
363, 364, 495
Israel, Steve 6
Lankford, James 16
law enforcement ii, 487
LinkedIn 367
mail-in voting 4
McGovern, James 17
metadata 321
MeWe 80
Microsoft Bing 315

726
Telegram Channel @nettrain
militant networks 11, 12
Mozilla Firefox Monitor 349
National Guard 13, 19, 491
Navarro, Peter 6
Oath Keepers 101
Obama, Barack 6
organized clusters 11, 12
Parler 2, 28, 77, 80, 81, 96, 97, 134, 278, 284, 413, 493
Pelosi, Nancy 16, 20, 99, 100, 114, 116, 117, 118, 119, 122, 123,
160, 168, 169, 171, 185, 274, 275, 279, 491, 494
Pence, Michael 9, 10, 16, 17, 19, 20, 81, 147
Philips, Benjamin 20
Philp, Rowan 286
pipe bomb 44, 54, 61, 65, 71
ProPublica 2, 77, 493
Proud Boys 14, 42, 86, 101
pwned 348
QAnon84, 86, 101, 125, 400, 413
Raines, Claude 79
Republican National Committee 2, 54, 55, 62, 65, 70, 71, 74
reverse image lookups 313
Romney, Mitt 16
Sandberg, Sheryl 28, 86, 489
Save America Rally 14, 15, 80
Schwartz, Drew 91, 93
screenshot 426
sedition 2, 91, 94, 437
Sedition Hunters 2, 91, 94
Sicknick, Brian 20
Snagit 428
Snapchat 28, 111, 129, 130, 268, 269, 270, 283, 372
Streamable 217, 218
Telegram 80, 278, 283, 286, 376, 379, 380
TheDonald.win 79, 404, 495
Three Percenters 101
TinEye 316
Twitch 28, 283, 384, 412
Twitter 2, 6, 13, 18, 19, 28, 63, 80, 81, 85, 86, 87, 89, 113, 121,
125, 133, 141, 165, 166, 169, 176, 178, 197, 202, 204, 206, 208, 218,
224, 228, 230, 234, 237, 238, 248, 249, 259, 278, 279, 281, 283, 286,

727
Telegram Channel @nettrain
 321, 322, 352, 359, 385, 387, 389, 390, 391, 392, 393, 395, 412, 495,
496
U.S. Constitution, 1st Amendment 22, 29, 167, 432, 435, 494
U.S. Constitution, 4th Amendment 443
U.S. Constitution, 6th Amendment 23
UrbanDictionary.com 348
Watson, Dr. John i
Wray, Christopher 29, 491
Yandex 315
YouTube 28, 60, 109, 110, 113, 122, 127, 153, 170, 176, 181,
183, 237, 274, 277, 278, 283, 286, 322, 396, 397, 398, 399, 401, 402,
403, 412

728
Telegram Channel @nettrain
 [1]
Justice.gov, “Capitol Breach Cases,” February 4, 2021,
https://www.justice.gov/usao-dc/capitol-breach-cases.
[2]
National Archives, “2020 Electoral College Results,” National
Archives, accessed March 25, 2021, https://www.archives.gov/electoral-
college/2020.
[3]
James M. Lindsay, “The 2020 Election by the Numbers,” Council
on Foreign Relations, December 15, 2020, https://www.cfr.org/blog/2020-
election-numbers.
[4]
House.gov, “Electoral College Fast Facts,” accessed March 25,
2021, https://history.house.gov/Institution/Electoral-College/Electoral-College/.
[5]
TheGuardian.com, “‘Stop the Vote’ and ‘Count the Votes’, Say
Protesting Trump Supporters – Video,” The Guardian, November 5, 2020, sec.
US news, https://www.theguardian.com/us-news/video/2020/nov/05/stop-the-
vote-count-the-vote-trump-supporters.
[6]
DHS.gov, “DHS And Partners Convene First Election Infrastructure
Coordinating Council,” Department of Homeland Security, October 14, 2017,
https://www.dhs.gov/news/2017/10/14/dhs-and-partners-convene-first-election-
infrastructure-coordinating-council.
[7]
CISA.gov, “Joint Statement from Elections Infrastructure
Government Coordinating Council & the Election Infrastructure Sector
Coordinating Executive Committees | CISA,” accessed March 4, 2021,
https://www.cisa.gov/news/2020/11/12/joint-statement-elections-infrastructure-
government-coordinating-council-election.
[8]
Steve Israel, “The Big Lie from Donald Trump,” TheHill, December
2, 2020, https://thehill.com/opinion/white-house/528417-the-big-lie-from-
donald-trump.
[9]
TheTrumpArchive.com, “Search on Trump Twitter Archive,”
accessed March 10, 2021, //www.thetrumparchive.com.
[10]
Amy Sherman, “A Timeline of What Donald Trump Said before
the Capitol Riot,” Poynter (blog), February 11, 2021,
https://www.poynter.org/fact-checking/2021/a-timeline-of-what-donald-trump-
said-before-the-capitol-riot/.
[11]
Justice.gov, “EGTVEDT, Daniel Dean,” February 26, 2021,
https://www.justice.gov/usao-dc/defendants/egtvedt-daniel-dean.
[12]
Justice.gov, “AYRES, Stephen Michael,” February 4, 2021,
https://www.justice.gov/usao-dc/defendants/ayres-stephen-michael.

729
Telegram Channel @nettrain
 [13]
George Washington University, “The George Washington
University Program on Extremism - Capitol Hill Siege,” accessed February 24,
2021, https://extremism.gwu.edu/Capitol-Hill-Cases.
[14]
C-SPAN, U.S. Senate Impeachment Trial of Former President
Trump (Day 2), 2021, https://www.youtube.com/watch?v=yiCPdI0rW68.
[15]
Robert Farley, “Timeline of National Guard Deployment to
Capitol,” FactCheck.Org (blog), January 13, 2021,
https://www.factcheck.org/2021/01/timeline-of-national-guard-deployment-to-
capitol/.
[16]
Heather Ciras et al., “Timeline of Pro-Trump Riot at US Capitol,”
BostonGlobe.Com, January 8, 2021,
https://apps.bostonglobe.com/nation/graphics/2021/01/us-capitol-riots-timeline.
[17]
Meg Wagner et al., “Congress Finalizes Biden’s Win after Riot
Disrupts Capitol,” CNN, January 7, 2021, https://www.cnn.com/politics/live-
news/congress-electoral-college-vote-count-2021/index.html.
[18]
Alia Chughtai, “Timeline: The Deadly Capitol Hill Riots,” Al
Jazeera, January 9, 2021, https://www.aljazeera.com/news/2021/1/9/timeline-
capitol-hill-riots.
[19]
BBC News, “Capitol Riots Timeline: The Evidence Presented
against Trump,” BBC News, February 13, 2021, sec. US & Canada,
https://www.bbc.com/news/world-us-canada-56004916.
[20]
Jack Healy, “These Are the 5 People Who Died in the Capitol
Riot,” The New York Times, January 11, 2021, sec. U.S.,
https://www.nytimes.com/2021/01/11/us/who-died-in-capitol-building-
attack.html.
[21]
LawInsider.com, “Dictionary,” Law Insider, accessed March 12,
2021, https://www.lawinsider.com/dictionary.
[22]
Law.com, “Legal Dictionary,” Law.com Legal Dictionary, accessed
March 10, 2021, https://dictionary.law.com.
[23]
Law.com.
[24]
Laws.com, “1st Amendment (First Amendment) Rights, Text - US
Constitution,” Kids Laws (blog), March 29, 2020, https://kids.laws.com/first-
amendment/.
[25]
FBI.gov, “Domestic Terrorism: Definitions, Terminology, and
Methodology,” File, Federal Bureau of Investigation, accessed February 23,
2021, https://www.fbi.gov/file-repository/fbi-dhs-domestic-terrorism-
definitions-terminology-methodology.pdf/view.

730
Telegram Channel @nettrain
 [26]
Laws.com, “The Bill of Rights Amendments - US Constitution,”
Constitution of United States of America 1789 (blog), April 7, 2020,
https://constitution.laws.com/bill-of-rights/bill-of-rights-amendments.
[27]
George Washington University, “The George Washington
University Program on Extremism - Capitol Hill Siege.”
[28]
Michael Edison Hayden, “Meet DLive: The Livestreaming
Platform Used by Trump’s Capitol Insurrectionists,” Southern Poverty Law
Center, January 7, 2021, https://www.splcenter.org/hatewatch/2021/01/07/meet-
dlive-livestreaming-platform-used-trumps-capitol-insurrectionists.
[29]
DLive Team, “DLive Blog,” Medium, accessed February 24, 2021,
https://medium.com/dlive-official-blog.
[30]
Kelly Browning and Taylor Lorenz, “Pro-Trump Mob
Livestreamed Its Rampage, and Made Money Doing It,” The New York Times,
January 8, 2021, https://www.nytimes.com/2021/01/08/technology/dlive-
capitol-mob.html.
[31]
Kellen Browning and Taylor Lorenz, “Pro-Trump Mob
Livestreamed Its Rampage, and Made Money Doing It,” The New York Times,
January 8, 2021, sec. Technology,
https://www.nytimes.com/2021/01/08/technology/dlive-capitol-mob.html.
[32]
DLive Team, “A Message from DLive Regarding the Recent
Protests · DLive Community,” DLive Community, January 8, 2021,
https://community.dlive.tv/2021/01/08/a-message-from-dlive-regarding-the-
recent-protests/.
[33]
Thomas Brewster, “Sheryl Sandberg Downplayed Facebook’s Role
In The Capitol Hill Siege—Justice Department Files Tell A Very Different
Story,” Forbes, February 7, 2021,
https://www.forbes.com/sites/thomasbrewster/2021/02/07/sheryl-sandberg-
downplayed-facebooks-role-in-the-capitol-hill-siege-justice-department-files-
tell-a-very-different-story/.
[34]
Zoe Tillman, “The FBI Has Tracked Down Some Of The Capitol
Rioters In Truly Surprising Ways,” BuzzFeed News, March 1, 2021,
https://www.buzzfeednews.com/article/zoetillman/capitol-insurrection-rioter-
cases-fbi-search.
[35]
FBI.gov, “Director Wray’s Statement on Violent Activity at the
U.S. Capitol Building,” Press Release, Federal Bureau of Investigation,
accessed March 12, 2021, https://www.fbi.gov/news/pressrel/press-
releases/director-wrays-statement-on-violent-activity-at-the-us-capitol-building-
010721.

731
Telegram Channel @nettrain
 [36]
FBI.gov, “FBI Assistant Director in Charge Steven M.
D’Antuono’s Remarks 20210108,” Press Release, January 8, 2021,
https://www.fbi.gov/contact-us/field-offices/washingtondc/news/press-
releases/fbi-assistant-director-in-charge-steven-m-dantuonos-remarks-on-press-
call-regarding-violence-at-us-capitol-010821.
[37]
FBI.gov, “Capitol Violence,” Page, Federal Bureau of
Investigation, accessed March 12, 2021, https://www.fbi.gov/wanted/capitol-
violence.
[38]
FBI.gov, “FBI Assistant Director in Charge Steven M.
D’Antuono’s Remarks 20210112,” Press Release, January 15, 2021,
https://www.fbi.gov/contact-us/field-offices/washingtondc/news/press-
releases/fbi-assistant-director-in-charge-steven-m-dantuonos-remarks-on-press-
call-regarding-violence-at-us-capitol-011521.
[39]
FBI.gov, “FBI Assistant Director in Charge Steven M.
D’Antuono’s Remarks 20210115,” Press Release, January 15, 2021,
https://www.fbi.gov/contact-us/field-offices/washingtondc/news/press-
releases/fbi-assistant-director-in-charge-steven-m-dantuonos-remarks-on-press-
call-regarding-violence-at-us-capitol-011521.
[40]
FBI.gov, “FBI Assistant Director in Charge Steven M.
D’Antuono’s Remarks 20210126,” Press Release, January 26, 2021,
https://www.fbi.gov/contact-us/field-offices/washingtondc/news/press-
releases/fbi-assistant-director-in-charge-steven-m-dantuonos-remarks-on-press-
call-regarding-violence-at-us-capitol-012621.
[41]
FBI.gov, “About the Biometric Center of Excellence,” Page,
Federal Bureau of Investigation, accessed March 12, 2021,
https://www.fbi.gov/services/cjis/fingerprints-and-other-biometrics/biometric-
center-of-excellence-1/about-the-biometric-center-of-excellence-1.
[42]
FBI.gov, “FBI Initiatives,” Page, Federal Bureau of Investigation,
accessed March 12, 2021, https://www.fbi.gov/services/cjis/fingerprints-and-
other-biometrics/biometric-center-of-excellence-1/fbi-latent-hit-of-the-year-
program-1.
[43]
FBI.gov, “Next Generation Identification (NGI),” Page, Federal
Bureau of Investigation, accessed February 25, 2021,
https://www.fbi.gov/services/cjis/fingerprints-and-other-biometrics/ngi.
[44]
FBI.gov, “Combined DNA Index System (CODIS),” Folder,
Federal Bureau of Investigation, accessed March 12, 2021,
https://www.fbi.gov/services/laboratory/biometric-analysis/codis.
[45]
FBI.gov, “PIPE BOMBS IN WASHINGTON, D.C.,” Federal
Bureau of Investigation, accessed March 10, 2021,

732
Telegram Channel @nettrain
https://www.fbi.gov/wanted/seeking-info/suspected-pipe-bombs-in-washington-
dc.
[46]
FBI.gov, “Video and Additional Information Released in Pipe
Bomb Investigation,” Press Release, Federal Bureau of Investigation, accessed
March 10, 2021, https://www.fbi.gov/contact-us/field-
offices/washingtondc/news/press-releases/fbi-washington-field-office-releases-
video-and-additional-information-regarding-pipe-bomb-investigation.
[47]
FBI.gov, “FBI Washington Field Office Provides Statement on Pipe
Bomb Investigation,” Video, Federal Bureau of Investigation, accessed March
12, 2021, https://www.fbi.gov/video-repository/wfo-pipebomb-investigation-
030921.mp4/view.
[48]
FBI.gov, Seeking Information: Pipe Bombs in Washington, D.C.,
2021, https://www.youtube.com/watch?v=YJ80LJIOn3E&t=2s.
[49]
Twitter.com, “@FBI Twitter Post,” Tweet, Twitter (blog), March 9,
2021, https://twitter.com/FBI/status/1369393018495721478.
[50]
USA Today, “Help USA TODAY Identify Rioters Who Stormed
the US Capitol,” Google Docs, accessed January 21, 2021,
https://docs.google.com/forms/d/e/1FAIpQLSf1wqki1tRZsxiPAz1aamzMyq7Xu
Im0Z1MDnaxxWI4M3esRew/viewform?usp=embed_facebook.
[51]
Lena V. Groeger et al., “What Parler Saw During the Attack on the
Capitol,” ProPublica, January 17, 2021, https://projects.propublica.org/parler-
capitol-videos/.
[52]
Scott Klein and Jeff Kao, “Why We Published More Than 500
Videos Taken by Parler Users of the Capitol Riot,” ProPublica, accessed March
14, 2021, https://www.propublica.org/article/why-we-published-parler-users-
videos-capitol-attack?token=BqIo4xWW-e2lFRkkEcQaP3yGUMVipeA4.
[53]
Jane Lytvynenko and Molly Hensley-Chancy, “The Rioters Who
Took Over The Capitol Have Been Planning Online In The Open For Weeks,”
BuzzFeed News, accessed March 13, 2021,
https://www.buzzfeednews.com/article/janelytvynenko/trump-rioters-planned-
online.
[54]
ADL.org, “Extremists React to Pro-Trump Siege on Capitol,” Anti-
Defamation League, accessed March 13, 2021,
https://www.adl.org/blog/extremists-react-to-pro-trump-siege-on-capitol.
[55]
OSINTCombine.com, “Open Source Intelligence | Australia,”
OSINT Combine, accessed March 13, 2021, https://www.osintcombine.com.
[56]
Ashley Carman, “Peloton Is Blocking the #StopTheSteal Hashtag
from Being Created or Used,” The Verge, January 11, 2021,

733
Telegram Channel @nettrain
https://www.theverge.com/2021/1/11/22225197/peloton-stop-the-steal-tag-
banned-donald-trump.
[57]
ADL.org, “Hate, Conspiracy Theories and Advertising on
Facebook,” Anti-Defamation League, accessed March 13, 2021,
https://www.adl.org/blog/hate-conspiracy-theories-and-advertising-on-facebook.
[58]
ADL.org, “An Open Letter to the Companies That Advertise on
Facebook,” Anti-Defamation League, accessed March 13, 2021,
https://www.adl.org/news/letters/an-open-letter-to-the-companies-that-advertise-
on-facebook.
[59]
ADL.org, “Hateful and Conspiratorial Groups on Facebook,” Anti-
Defamation League, accessed March 13, 2021,
https://www.adl.org/blog/hateful-and-conspiratorial-groups-on-facebook.
[60]
Facebook.com, “Our Response to the Violence in Washington,”
About Facebook (blog), January 7, 2021,
https://about.fb.com/news/2021/01/responding-to-the-violence-in-washington-
dc/.
[61]
Sarah Frier, “Facebook Helped Government Identify Capitol
Rioters From Photos,” BloombergQuint, accessed March 14, 2021,
https://www.bloombergquint.com/technology/facebook-helped-government-
identify-capitol-rioters-from-photos.
[62]
Twitter.com, “Permanent Suspension of @realDonaldTrump,”
January 8, 2021,
https://blog.twitter.com/en_us/topics/company/2020/suspension.html.
[63]
Natasha Jokic, “15 Platforms That Have Banned Or Restricted
Trump So Far,” BuzzFeed, January 10, 2021,
https://www.buzzfeed.com/natashajokic1/trump-platforms-banned.
[64]
Drew Schwartz, “The Instagram Account Naming and Shaming
Pro-Trump Rioters in D.C.,” accessed March 14, 2021,
https://www.vice.com/en/article/xgz5zw/the-instagram-account-naming-and-
shaming-pro-trump-rioters-in-dc.
[65]
Sarah Parvini and Melissa Gomez, “On Social Media, Amateur
Digital Sleuths Try to Help Track Violent Capitol Rioters,” Los Angeles Times,
January 17, 2021, https://www.latimes.com/california/story/2021-01-
17/amateur-social-media-sleuths-track-violent-capitol-rioters.
[66]
Andy Greenberg, “This Site Published Every Face From Parler’s
Capitol Riot Videos | WIRED,” accessed March 14, 2021,
https://www.wired.com/story/faces-of-the-riot-capitol-insurrection-facial-
recognition/.

734
Telegram Channel @nettrain
 [67]
George Washington University, “The George Washington
University Program on Extremism - Capitol Hill Siege.”
[68]
Justice.gov, “Capitol Breach Cases.”
[69]
Justice.gov, “BARNETT, Richard,” February 4, 2021,
https://www.justice.gov/usao-dc/defendants/barnett-richard.
[70]
Bill Bowden, “FBI Found 2 Phones at Barnett Home, Not One Tied
to Capitol,” Arkansas Democrat Gazette, January 24, 2021,
https://www.arkansasonline.com/news/2021/jan/24/fbi-found-2-phones-at-
barnett-home-not-one-tied/.
[71]
C-SPAN, U.S. Senate Impeachment Trial of Former President
Trump (Day 2).
[72]
Twitter.com, “@firebirdNC Twitter Post,” Tweet, @firebird_nc
(blog), January 7, 2021,
https://twitter.com/firebird_nc/status/1347275766820704257/photo/3.
[73]
Ronan Farrow, “An Air Force Combat Veteran Breached the Senate
and Descended on Nancy Pelosi’s Office Suite,” The New Yorker, January 8,
2021, https://www.newyorker.com/news/news-desk/an-air-force-combat-
veteran-breached-the-senate.
[74]
Kevin Krause, “Judge Frees North Texan Who Faces Charges in
the Capitol Riot, despite Warnings from the FBI,” The Dallas Morning News,
January 14, 2021, https://www.dallasnews.com/news/courts/2021/01/14/judge-
frees-larry-brock-facing-charges-in-capitol-riot-despite-warnings-from-fbi/.
[75]
Hope O’Brien, “Hundreds Gather Outside Maricopa Election
Center for Third Day of Protests,” Cronkite News - Arizona PBS (blog),
November 7, 2020, https://cronkitenews.azpbs.org/2020/11/06/hundreds-gather-
outside-maricopa-election-center-for-third-day-of-protests/.
[76]
Justice.gov, “EGTVEDT, Daniel Dean.”
[77]

Tillman, “The FBI Has Tracked Down Some Of The Capitol Rioters
In Truly Surprising Ways.”
[78]
John H. Bryan, “Derrick Evans Statement 1:7:21 | Police | Politics,”
Scribd, January 7, 2021, https://www.scribd.com/document/490068811/Derrick-
Evans-Statement-1-7-21.
[79]
Derrick Evans, “Derrick Evans Resignation Letter.Pdf,” Dropbox,
January 9, 2021,
https://www.dropbox.com/s/0ii8ehbdi9qnuxt/Derrick%20Evans%20Resignation
%20Letter.pdf?dl=0.

735
Telegram Channel @nettrain
 [80]
Carlos R. Munoz, “Man Who Stole Nancy Pelosi’s Lectern at U.S.
Capitol Could Be from Parrish, Florida,” Sarasota Herald-Tribune, accessed
March 9, 2021,
https://www.heraldtribune.com/story/news/local/manatee/2021/01/07/man-who-
took-speaker-pelosis-podium-at-u-s-capitol-building-believed-to-be-from-
parrish/6579085002/.
[81]
Twitter.com, “@h_Sanatorium Twitter Post,” Tweet,
@h_Sanatorium (blog), January 16, 2021,
https://twitter.com/h_Sanatorium/status/1350282161564205059.
[82]
Twitter.com, “@End_Silence_Now Twitter Post,” Tweet,
@End_Silence_Now (blog), January 18, 2021,
https://twitter.com/End_Silence_Now/status/1351254542873145344.
[83]
Twitter.com, “@SimonWGhost Twitter Post,” Tweet,
@SimonWGhost (blog), January 15, 2021,
https://twitter.com/SimonWGhost/status/1349959991889805312.
[84]
Twitter.com, “@SethAbramson/Seth Abramson Twitter Post,”
Tweet, @SethAbramson (blog), January 7, 2021,
https://twitter.com/SethAbramson/status/1346977323086729218/photo/1.
[85]
Twitter.com, “@ChampBiden Twitter Post,” Tweet, @ChampBiden
(blog), January 8, 2021,
https://twitter.com/ChampBiden/status/1347382525459533826.
[86]
Twitter.com, “@sparrowmedia Twitter Post,” Tweet,
@sparrowmedia (blog), January 9, 2021,
https://twitter.com/sparrowmedia/status/1347763091715608577/photo/3.
[87]
Twitter.com.
[88]
Twitter.com, “@nachos_johnson Twitter Post,” Tweet,
@nachos_johnson (blog), January 13, 2021,
https://twitter.com/nachos_johnson/status/1349365023056011265.
[89]
Ronan Farrow, “A Pennsylvania Mother’s Path to Insurrection,”
The New Yorker, February 1, 2021, https://www.newyorker.com/news/news-
desk/a-pennsylvania-mothers-path-to-insurrection-capitol-riot.
[90]
Cherish Creamery, “Facebook Post,” Facebook.com, February 2,
2021, https://www.facebook.com/cherishcreamery/posts/3661793643886919.
[91]
Twitter.com, “@mmmcintyre Twitter Post,” Tweet, @mmmcintyre
(blog), January 8, 2021,
https://twitter.com/mmmcintyre/status/1347643578378579968.
[92]
Twitter.com, “@jensteer/Jen Steer Twitter Post,” Tweet, @jensteer
(blog), January 8, 2021,

736
Telegram Channel @nettrain
https://twitter.com/jensteer/status/1347614990874898436.
[93]
Twitter.com, “@EUwatchers Twitter Post,” Tweet, @EUwatchers
(blog), January 6, 2021,
https://twitter.com/EUwatchers/status/1346919750752825347/photo/1.
[94]
Twitter.com, “@AltTaxPro Twitter Post,” Tweet, @AltTaxPro
(blog), January 6, 2021,
https://twitter.com/AltTaxPro/status/1346944595016380416/photo/2.
[95]
Navistar Direct Marketing, “Facebook Post,” Facebook.com,
January 7, 2021,
https://www.facebook.com/navistardm/posts/3596465917096340.
[96]
Justin Fenton, “Maryland Man Who Entered Capitol Wearing Work
Badge Arrested, Ordered to Stay out of DC Pending Trial,” baltimoresun.com,
accessed March 2, 2021, https://www.baltimoresun.com/news/crime/bs-md-cr-
rodean-surrender-capitol-charges-20210113-njo56n23qnbojgvb46yypcb3oq-
story.html.
[97]
Twitter.com, “@SenJeffMerkley/Senator Jeff Merkley Twitter
Post,” Tweet, @SenJeffMerkley (blog), January 7, 2021,
https://twitter.com/SenJeffMerkley/status/1347039504528498688.
[98]
Tanya Basu, “A Guide to Being an Ethical Online Investigator,”
MIT Technology Review, accessed March 12, 2021,
https://www.technologyreview.com/2021/01/14/1015931/how-to-be-an-ethical-
online-investigator-activist/.
[99]
Rowan Philp, “How Open Source Experts Identified the US Capitol
Rioters,” Global Investigative Journalism Network, January 15, 2021,
https://gijn.org/2021/01/15/how-open-source-experts-identified-the-us-capitol-
rioters/.
[100]
AJ Willingham, “Is That Video Real?,” accessed March 17, 2021,
https://www.cnn.com/interactive/2020/10/us/manipulated-media-tech-fake-
news-trnd/.
[101]
TheHive.ai, “Mensio Sponsorship | Hive Media,” accessed March
15, 2021, https://thehive.ai/mensio-sponsorship.
[102]
Sam Dubberley, “How to: Use InVid-WeVerify – the ‘Swiss Army
Knife’ of Digital Verification,” CITIZEN EVIDENCE LAB, December 11,
2019, https://citizenevidence.org/2019/12/11/how-to-use-invid-the-swiss-army-
knife-of-digital-verification/.
[103]
Craig Timberg and Drew Harwell, “TheDonald’s Owner Speaks
out on Why He Finally Pulled Plug on Hate-Filled Site,” Washington Post,
accessed March 24, 2021,

737
Telegram Channel @nettrain
https://www.washingtonpost.com/technology/2021/02/05/why-thedonald-
moderator-left/.
[104]
4chan.org, “FAQ - 4chan,” 4chan.org, accessed March 1, 2021,
https://www.4chan.org/faq#trip.
[105]
4plebs.org, “4plebs Credits & Links,” 4plebs.org, accessed March
1, 2021, http://archive.4plebs.org/_/articles/credits/.
[106]
Nyafuu.org, “Nyafuu Archive FAQ,” Nyafuu.org, accessed March
1, 2021, https://archive.nyafuu.org/_/articles/FAQ/.
[107]
4plebs.org, “4plebs Credits & Links.”
[108]
Savvas Zannettou et al., “What Is Gab: A Bastion of Free Speech
or an Alt-Right Echo Chamber,” Proceedings paper, ACM Digital Library (The
Web Conference 2018 (WWW ’18), Geneva, Switzerland: International World
Wide Web Conferences Steering Committee, April 23, 2018),
https://doi.org/10.1145/3184558.3191531.
[109]
“U.S. of America 1789 (Rev. 1992) Constitution - Constitute,”
accessed February 23, 2021,
https://www.constituteproject.org/constitution/United_States_of_America_1992
?lang=en.
[110]
“What Does Free Speech Mean?,” U.S. Courts, accessed February
23, 2021, https://www.uscourts.gov/about-federal-courts/educational-
resources/about-educational-outreach/activity-resources/what-does.
[111]
ConstituteProject.org, “Freedom of Assembly - Constitute,”
accessed February 23, 2021, https://www.constituteproject.org/topics/assem?
lang=en.
[112]
University of Illinois at Urbana-Champaign, “The Coup D’etat
Project,” Cline Center for Democracy, University of Illinois at Urbana-
Champaign, September 2013,
https://uofi.app.box.com/s/koi8js58bsdz8f2zg778vi0uem4gu69k.
[113]
Justice.gov, “Retired NYPD Officer Arrested, Charged in Federal
Court for Assaulting and Impeding MPD Officer during U.S. Capitol Breach,”
February 23, 2021, https://www.justice.gov/usao-dc/pr/retired-nypd-officer-
arrested-charged-federal-court-assaulting-and-impeding-mpd-officer.
[114]
FBI.gov, “Domestic Terrorism.”
[115]
Cornell University, “18 U.S. Code § 2384 - Seditious Conspiracy,”
LII / Legal Information Institute, accessed March 4, 2021,
https://www.law.cornell.edu/uscode/text/18/2384.
[116]
Law.com, “Legal Dictionary.”
[117]
Justice.gov, “Capitol Breach Cases.”

738
Telegram Channel @nettrain
Table of Contents
Introduction 6
Section I ‒ Assault on the United States Capitol 11
Chapter 1 - Who, What, When, Where, How, Why? 14
Chapter 2 ‒ January 6, 2021 17
Chapter 3 - A Note on Definitions and Approach 35
Chapter 4 ‒ Broadcasting the “revolution” 39
Chapter 5 ‒ FBI Calls on the Public for Help 49
Chapter 6 - FBI Capabilities and Resources 65
Chapter 7 – The Hunt for the Capitol Pipe Bomber 76
Chapter 8 ‒ The Media’s Hunt for Suspects 105
Chapter 9 ‒ Social Media Crackdown 110
Chapter 10 ‒ Public Crowdsourcing 127
Section II – Identifying the Capitol Rioters 139
Chapter 11 ‒ Knock Knock 142
Section III – Tactics, Techniques and Procedures 445
Chapter 12 – Best practices for OSINT Investigators 450
Chapter 13 ‒ Deepfakes and Cheapfakes 454
Chapter 14 ‒ Facial recognition 472
Chapter 15 ‒ Image Research 491
Chapter 16 ‒ Exercises in Photo Observation 507
Chapter 17 ‒ Reverse Engineering Social Media 521
Chapter 18 – Investigating Social Media Accounts 535
Chapter 19 ‒ Fringe Social Media 590
Chapter 20 ‒ Real World Data 600
Chapter 21 ‒ Archiving Data 609
Appendix 619
A Primer on Key Terms and Definitions 620

739
Telegram Channel @nettrain
Capitol Breach Cases 636
About the Author 712
Bibliography 714
Index 725

740
Telegram Channel @nettrain