Selfie-Snapping Rioters Leave FBI a Trail of Over 140,000 Images

(Bloomberg) -- The FBI arrested one man after a co-worker at a western Maryland restaurant reported seeing him in images of people assaulting the U.S. Capitol. A Texas man was charged after his ex-wife recognized him in a social-media video and called authorities, noting that it was a good picture.

Perhaps the most easily recognized interloper wore the same bearskin headdress with horns, and carried the same six-foot spear, as he did on his Facebook page. Prosecutors called it “distinctive attire” in charging documents.

These and more details gleaned from court documents reveal how the FBI has quickly identified more than 275 suspects -- the number is expected to grow quickly -- related to last week’s Capitol riot. More than 98 have been arrested, often with the aid of video taken or social media posted by the participants themselves. And investigators, academics and citizen sleuths are still combing though broadcast footage and websites such as Twitter Inc., YouTube and even archives of the now-defunct Parler platform favored by right-wing activists.

More than 140,000 pieces of digital media have been obtained by the FBI. “And we are scouring every one for investigative and intelligence leads,” Steven D’Antuono, assistant director in charge of the FBI’s Washington Field Office, told reporters. “We continue to ask for more.”

The FBI has opened a portal to accept tips and digital media depicting rioting and violence in and around the Capitol on Jan. 6, when a mob supporting President Donald Trump swarmed the building, scaling walls, breaking windows and beating police officers. The siege left five people dead, delayed the certification of President-elect Joe Biden’s victory and sparked a backlash among lawmakers who impeached Trump on Wednesday.

The FBI has declined to provide many details of how it’s conducting the search, but one police department says it’s helping the bureau link names and faces with facial recognition software. And a trail of location data left behind by the rioters’ mobile phones could prove useful. Service providers are obligated to turn over information in response to search warrants.

While the digital dragnet has proven useful to law enforcement, it carries risks for the many volunteer sleuths who are reposting screen shots they allege are lawbreakers.

Misidentifying someone as a rioter -- or even correctly identifying someone who was at the Capitol but not involved in criminal acts -- can be libelous, potentially triggering fines, lawsuits and expensive settlements with the people on the other end of those Twitter and Facebook Inc. posts.

“Anyone who thinks ‘Oh, I know that person’ needs to just call the authorities. It’s safer legally and it’s safer physically,” said Sandy Davidson, a First Amendment law expert and professor emeritus at the University of Missouri-Columbia. “You’ve done your citizen obligation without putting yourself at risk of legal harm and without wrongfully damaging someone else’s reputation.”

Boston Bomber

People misidentified as Capitol protesters can go to court, seeking damages to compensate them for reputational harm or lost wages if they get fired as a result. In a famous case of digital mis-identification, a Brown University student was incorrectly identified by cyber vigilantes as a suspect in the 2013 Boston Marathon bombing due to his resemblance to a photo circulated by police. He wasn’t involved but his family was hounded when his name was linked to the case.

Other experts caution against sweeping surveillance of people who may have been at the Capitol simply to join a legal political demonstration.

“Nothing prohibits people in the public from sharing information with law enforcement,” said Greg Nojeim, director of the Freedom, Security and Technology Project at the Center for Democracy and Technology. “Law enforcement has to be careful to ensure that the information it is receiving is helpful to investigating crime, as opposed to investigating free-speech activity.”

Authorities meanwhile are sifting methodically through the digital trail left by the mob. Arrest documents speak to the clues left in images, detailing all the co-workers and acquaintances who’ve led authorities to suspects after spotting their images in news reports or on social media.

Michael Sherwin, acting U.S. attorney for the District of Columbia, said there are “thousands of potential witnesses” that may lead to “hundreds of criminal cases” in an investigation that will stretch over months.

It’s one of the most expansive criminal investigations in the history of the Justice Department, with a wide assortment of agencies helping to build cases, including the Federal Bureau of Investigation and the U.S. Marshals. All 56 FBI field offices are involved.

Facebook’s Help

Despite its magnitude, the investigation to name and find those who swarmed the Capitol will be relatively simple, said Milan Patel, former chief technology officer of the FBI’s Cyber Division.

The agency can enlist Facebook and Twitter as well as the mobile carriers whose airwaves were used by rioters, Patel said in an interview.

“Social media companies let this fester for years, but you’re seeing a sea change,” said Patel, now global head of managed security services at BlueVoyant LLC. “They’re not going to stonewall any longer.”

Patel outlined standard procedure. Investigators can take one data point -- a photo, or a name or a social media identity -- and subpoena Facebook or Twitter. They’ll ask for additional data, like that person’s online persona, their posts, friends list, associated phone number, and data on their location.

“You take this data and you start mapping out where these people are, where they were in the past and you start putting them at the scene of the crime,” Patel said.

Like social media companies, telecoms will be essential to investigations, and be obligated to maintain and turnover subscriber call logs and location data once subpoenaed or presented with a warrant, said Jennifer Lynch, Surveillance Litigation Director at the Electronic Frontier Foundation.

Carriers and online companies say they cooperate with law enforcement.

Facebook has “worked to quickly provide responses to valid legal requests,” said Andy Stone, a spokesman for the company. “We are removing content, disabling accounts, and working with law enforcement to protect against direct threats to public safety.”

Wireless carriers also help authorities track suspects in investigations. “There are teams already working with law enforcement regarding what happened,” Verizon Communications Inc. Chief Executive Officer Hans Vestberg told reporters Jan. 10.

Facial Recognition

At least one police department is helping investigators using facial recognition software. Detectives in Miami have been uploading photos of potential suspects in the Capitol riot into a system provided by the closely held company Clearview AI.

The officers are screening photos of potential suspects from materials provided by the FBI, as well as from images they spot on social media and in news reports. So far, they have passed on at least six potential matches to the FBI, said Assistant Miami Police Chief Armando Aguilar.

“It’s only half the battle when we have video evidence,” Aguilar said. “The other half is trying to identify the person in the video and making the case that the person we think we’ve identified is, in fact, our suspect.”

Clearview Chief Executive Officer Hoan Ton-That said that since the Capitol riot his company has seen a spike in usage of its services. Clients upload a photo and the system compares it to a database of billions of images scraped from LinkedIn, Facebook, Twitter and other social media platforms.

That’s raised concerns among civil liberty and privacy advocates.

“The FBI has thousands of tips on the Capitol attack, and people posted their own information online from inside the building,” said the Electronic Frontier Foundation’s Lynch. “That should be where this investigation begins, not on face-recognition technology.”

Ton-That said that Clearview’s facial recognition technology is not used to monitor citizens regularly but is used to investigate crimes after they have happened.

“It’s not a 24/7 surveillance technology,” Ton-That said. “It’s only used for after the fact surveillance.”