In the several hundred criminal cases brought against individuals involved in the Jan. 6 attack on the U.S. Capitol, the Department of Justice and FBI have included scores of incriminating communications posted by defendants on social media sites including Facebook, Twitter, YouTube, and Parler. That makes even more conspicuous the near complete absence of any reference in the government documents to another public social media site – The Donald, where much of the Capitol attack was planned.

On Dec. 19, 2020, at 1:42 a.m. EST, then President Donald Trump tweeted, “Statistically impossible to have lost the 2020 Election. Big protest in D.C. on January 6th. Be there, will be wild!” Within five minutes after Trump’s tweet, a user on The Donald posted: “Trump Tweet. Daddy says be in DC on Jan. 6th.” The site’s moderators pinned the post to the top of the homepage where it remained until the morning of Jan. 6, 2021, attracting nearly 6,000 comments and 24,000 upvotes.

It was the first of thousands of posts and comments on the site related to Jan. 6. Users of The Donald declared that Trump’s tweet about Jan. 6 was “marching orders,” and one user interpreted a video from Dan Scavino — a well known figure to the community — as “literal war drums.” “The capitol is our goal,” posted another user. “Everything else is a distraction. Every corrupt member of congress locked in one room and surrounded by real Americans is an opportunity that will never present itself again.”

Tracking the reaction on The Donald, SITE Intelligence Group, an organization that monitors political extremism, explained that “the general consensus among the users was that Trump had essentially tweeted permission to disregard the law in support of him.”

The groundwork for a zealous subset of The Donald users to prepare to storm the Capitol was laid well before Jan. 6. The online forum started on Reddit, before being banned and migrating to its own domain. Launched in 2015 it quickly rose to the attention of then-candidate Donald Trump, who helped nurture the growth of the community while his senior campaign officials engaged with its content and reportedly “privately communicat[ed] with the most active users to seed new trends.” By Jan. 1, 2021, The Donald had high enough traffic to break the top 500 most-visited websites in the United States according to Alexa rankings, reaching #441 on New Year’s Day.

Now, nearly a year after the Jan. 6 insurrection that was planned in significant part on The Donald, a number of questions remain outstanding.

We focus here on the FBI investigations. The conspicuous absence of references to The Donald in the FBI special agent affidavits and other DOJ court filings raises concerns about the criminal investigations and efforts to achieve accountability for Jan. 6. We identify specific costs that come with the current approach.

The absence of references to The Donald, as we explain, also raises concerns about whether federal law enforcement agencies adequately understand ongoing and future threats of domestic political violence.

The Donald as a Staging Ground for the Capitol Attack

An archive of nearly 1,000 posts and tens of thousands of related comments, investigative material gathered by the nonprofit nonpartisan research organization Advance Democracy, press reports, and a volume of other evidence details the extent of the involvement of certain users in the events that took place on Jan. 6. Users of The Donald stepped forward as leaders to devise and coordinate the techniques, tactics and procedures used at the Capitol, showing clear premeditation of the often violent crimes many would apparently commit.

In terms of techniques, tactics and procedures discussed in advance of the assault on the Capitol, the site was awash in content. Many users discussed plans for gallows, and how to finance and transport the materials needed, including secretly bringing firearms into DC despite the district’s strict weapons bans. The discussion of gallows included satirical comments as well as practical advice about the materials and measurements to use, how to snap a person’s neck, and how to cover one’s tracks.

Specifics were shared on what types of zip ties to bring to detain people, as well as how to improvise weapons, including how to use a flagpole as “very effective weapon when used in the abdomen or throat in jabbing moves.” Maps and diagrams of the Capitol and its tunnels were shared.

According to a bipartisan Senate report, the Capitol Police’s Intelligence and Interagency Coordination Division (IICD) released a seven-page intelligence report highlighting The Donald, referencing its posts about logistics of attacking the Capitol and detailing comments such as “Bring guns. It’s now or never.”

 

Some users anticipated employing violence against police. “My crew is gonna open carry,” wrote one individual, saying “we will band together and protect each other from arrest, I will shoot police if they try to arrest anyone open carrying.” Another stated, “We can not allow any of us to be detained or arrested by police or be beaten by any commies. If needed we will crush them all.”

There is ample evidence that users of The Donald included key leaders bringing people to the Capitol and providing logistical and financial support for travel. Five key users — EPic, MemeFactory, mattsmith01010, GingerMinky, and r3deleven — appeared to have played a key role in organizing travel. For instance, user r3deleven, whose post promoting Jan. 6 remained pinned to the top of The Donald until the morning of Jan. 6, helped develop plans and routes for national caravans. (On Jan. 7, r3deleven posted a photo from the Capitol taken during the insurrection the prior day.) Another apparently key organizer, mattsmith01010, offered “financial assistance sponsorships…for patriots that otherwise wouldn’t be able to go” to DC. It is important to understand that these communications occurred in the context of a site replete with discussion about use of violence and other unlawful conduct in preparation for Jan. 6.

The FBI’s now widely known “Norfolk report” – sent to law enforcement agencies on the evening of Jan. 5 and warning of threats of violence the following day – was reportedly based on communications on The Donald. The intelligence report cited a thread discussing “being ready for war,” calling to “get violent” at the Capitol, and saying “Congress needs to hear glass breaking, doors being kicked in,” as well as users’ sharing a map of the Capitol’s underground tunnels and identifying rendezvous points.

On the day of the attack and following it, many users posted about being inside the Capitol building (including photographic evidence) and engaging in violence. Several users who appeared to have participated in the events told the community that they felt no remorse. Others continued to express interest in committing violent actions against the federal and state government.

The Conspicuous Absence

Given all the above, it is striking that out of several hundred individuals now charged for unlawful conduct on Jan. 6, the government makes reference to only one defendant’s communications on The Donald. In that singular instance, the criminal complaint notes that the defendants’ communications on the site came to the Bureau’s attention through an “anonymous tip.”

In contrast, the government’s filings in scores of other cases include FBI agents’ references to defendants’ communications on Facebook, Twitter, Parler, and Telegram. The FBI declined to comment.

The absence of any reference to The Donald was confirmed by Advance Democracy and by Candace Rondeaux, director of the Future Frontlines program at New America and professor at Arizona State University (ASU).

The lack of such references may reflect a lapse in the FBI’s work. It may also reflect a conscious decision on the part of the government. (More on those potential explanations later.) Either way, the current choice comes with potential harms.

Potential Harm to Investigations/Prosecutions

A possible lapse in the FBI’s collection, analysis, or use of content on The Donald could undermine the prosecution of cases along several dimensions. Consider the following four cases of Jan. 6 defendants identified by Advance Democracy and the potential costs either to not properly assessing or to not referencing their communications on The Donald in court filings.

Costs: Factual discrepancies in indictments

It could be damaging to prosecutors to include an inaccurate allegation in an indictment. Indeed, if there is any doubt about the accuracy of an alleged fact that’s not required to satisfy the elements of the offense, prosecutors would presumably omit the allegation.

The Justice Department’s indictment of six individuals, including four self-identified members of the “Three Percenter” militia, alleges that the four communicated over Telegram and traveled together to Washington, DC by ground in a rented SUV. One of them, however, appears to have maintained an account at The Donald, where he initially posted his plan to travel with others in a convoy. However, when he arrived in DC on Jan. 4, he posted on The Donald that he had arrived by air. If prosecutors knew the discrepancy, they would presumably omit his particular method of travel in the indictment.

[A note on attribution: the user employs the same unusual pseudonym that the FBI references in court documents, and made other online statements including about his residential location that match the FBI documents, according to publicly available images retained by Advance Democracy.]

Costs: Gaps in plea negotiations and bond hearings

Evidence that a defendant made admissions online about entering the Capitol and affirmatively stated that they had no remorse for their unlawful conduct would obviously strengthen a prosecutors’ hand. At the earlier stages of the criminal process, for example, such evidence could assist the government in obtaining a guilty plea and in securing conditions of release in a bond hearing.

On Aug. 4, the government arrested Tyler Welsh Slaeker on charges of two offences, including entering and remaining and disorderly and disruptive conduct in a restricted building. The FBI Affidavit submitted in support of the arrest warrant explains that Slaeker came to law enforcement’s attention after the 39-year old’s mother posted photographs of him inside the Capitol on her Facebook account. The government’s application for arrest essentially relies on those Facebook posts and CCTV images inside the Capitol; the documents make no mention of Slaeker’s social media posts.

At Slaeker’s bond hearing, the prosecutor and defense attorney sparred over the smidgen of evidence and, in particular, what could be inferred from Slaeker’s having worn a helmet inside the Capitol that day. The government’s attorney told the judge:

“You can see that Mr. Slaeker is not only present but he’s wearing a helmet throughout his time in the Capitol, which certainly suggests to the government that this is not an individual who seemingly just sheepishly followed a few individuals into the Capitol and then, quickly and abruptly, left when he realized what was going on.”

The defense counsel responded that the prosecutor’s heavy reliance on the helmet was “asking Your Honor to speculate and make assumptions.”

What the prosecutors apparently did not have at their disposal during the hearing were statements Slaeker made on The Donald, which were posted months before. On the site, he admitted he was one of the “first to go into the capitol,” said he was in the Rotunda including when police began encircling it, suggested his actions were premeditated (“Wandering through the doors was the plan”), and wrote, “I’m putting my neck on the line by telling all the feds that are scanning this site trying to catch a Trump supporter that I was there on the front line” (emphasis added). He also repeatedly stated he had no remorse, including:

“If anyone thought standing and waving flags at the Capitol building would have made a lick of difference no one would have stormed anything. It was only after years of clown world double standards that we said enough.”

“Waaa, what did throwing tea accomplish for us? This coercive act is too hard. Sure doesn’t seem like we got anything out of it.’ So sorry about the 6th you puss***.”

“I’m poking fun at the people here that keep saying we shouldn’t have entered the Capitol building.”

[A note on attribution: Although using a pseudonym, the account holder explicitly identifies himself as Tyler Welsh Slaeker (including saying, “I’m using my real account so everyone can see that I’m not some lefty plant pretending to be a supporter to stir up trouble”), posted a selfie in late December 2020 that matches the FBI affidavit, and, according to a screen capture from Advance Democracy, uploaded an image at the Capitol from Jan. 6 in which the metadata matches his three initials. In late August, he posted a screenshot that links to an article about his arrest.]

In another case of an individual — Anthony Robert Williams, indicted for entering the Capitol and obstructing congressional certification of the election — the FBI affidavit relies heavily on the defendant’s Facebook posts and footage of him inside the Capitol. Missing from any of the DOJ/FBI public documents is apparently the same individual’s The Donald social media posts. In the latter, a user openly identifying himself as Williams posted the following:

  • On the day that President Trump tweeted to come to DC on Jan. 6 and it “will be wild!,” Williams wrote “THE TWEET HAS BEEN SENT!!! JAN 6TH!!!” accompanied by a meme with text “ONE TWEET AND PATRIOTS WILL DESCEND ON WASHINGTON LIKE A BIBLICAL PLAGUE.”
  • Williams made militaristic references about his plans for Jan. 6 such as saying he would be carrying a map of “exfil routes;”
  • Williams published a photo of himself inside the Capitol on Jan. 6;
  • Williams described being in the Capitol (“When we made it into the Rotunda I felt the Founders smiling down on us.”)

Days after his arrest, he also expressed, in no uncertain terms, that he felt no regret:

“I was in the Capitol and have absolutely no remorse or fear in saying or doing it.”

In April 2021, he posted a statement suggesting he may be a continuing danger while out on bail. In response to a post from another user about southeast Michigan, he wrote:

“WE HOLDIN THE LINE HERE JUST LIKE WE DID IN DC WHEN WE STORMED THAT SWAMP! GOOGLE “SOUTHGATE MAN ARRESTED US CAPITOL.”

In that exchange, he also called himself a “Swamp Storm Veteran” which matches the FBI Affidavit about Williams. The FBI special agent in Detroit brought attention to the fact that Williams had, at least once in a Facebook exchange, “identifie[d] himself as an ‘Operation Storm Swamp Veteran’ following the events of January 6, 2021.”

Finally, a fourth defendant, Jacob Travis Clark, has been indicted for several counts including engaging in physical violence in the Capitol. The FBI Affidavit and other documents submitted to the court make no reference to a The Donald account. Clark has pleaded not guilty, and the government did not request his detention before trial.

Clark appears to have made incriminating statements on The Donald. These include an allusion to premeditated violence. On Jan. 3, 2021, he published an image of a guillotine in a post asking for assistance in travelling to DC for Jan. 6. The day after the assault on the Capitol, he commented on a post entitled, “Trump commits to ‘orderly’ transfer of power in newly released statement.” In response to the news, he wrote “We were all played.”

[A note on attribution: Advanced Democracy was able to identify The Donald account likely associated with Clark which matches his email address listed in the FBI Affidavit.]

In sum, there appears to be independent value provided by the missing source of information on The Donald. That information could help the government insulate its cases from foreseeable error, and strengthen its hand across the continuum of the federal criminal process from bringing charges to the final stage of determining appropriate sentences.

Costs: Uncharged individuals who also breached the Capitol

Using substantial publicly available information, Advance Democracy identifies over fifteen other users on The Donald who the organization believes have not been charged but whose communications (including photographic evidence) clearly indicate they participated in the same unlawful conduct that the government has seen fit to charge in many other cases. It is evident that some of these individuals have not been charged because Advance Democracy is able to establish the individual’s identity. In other cases, it’s still unlikely that the user has been charged but if they have, there’s yet again no express reference to their communications on The Donald in any of the Justice Department’s court filings.

The communications of these individuals include evidence of premeditation, coordination, external financing, and continued threat of dangerousness. What follows is a sample of four users:

User 1

Writing on Jan. 3, 2021, User 1 indicated he engaged in premeditated violence against law enforcement officers: “We can not allow any of us to be detained or arrested by police or be beaten by any commies. If needed we will crush them all.” He wrote that day: “EITHER TRUMP IS DECLARED THE WINNER BY SUNDOWN ON THE 6TH OR WE TEAR THAT CITY DOWN. BY ANY MEANS NECESSARY.” He also made repeated references to hanging elected officials. On Jan. 4, another user posted, “This many patriots would storm the capitol if President Trump orders it on January 6th.” User 1 replied, “This is the only reason I’m going. Honestly.”

Following the events of Jan. 6, User 1 implied that he was among those who forced doors open to allow individuals to enter the Capitol, and indicated he assaulted a guard (“knocked out an armored motherf*cker”). The user also indicated that he had no remorse over his actions and that he was ready to engage in such actions again. Posting on Jan. 22, he wrote:

“It was a great day, I was there as well, and I’ll f*ckin do it again.” (emphasis added)

User 2

An apparent outright racist – referring to “a real racial genocide being committed against white people,” and claiming that communism was started by “Radical Jews,” – after Jan. 6 User 2 posted that he had joined the National Guard and was due to report in late February. Two days after President Trump tweeted to come to DC on Jan. 6 and “will be wild,” the user posted that he hoped for a “MIRACLE” which would be “a million plus angry, armed americans fighting to take back their country.” User 2 indicated that he was in the group that entered House Speaker Nancy Pelosi’s office during the insurrection.

User 3

User 3 said he planned to go with the Proud Boys to Jan. 6 (“Find me in DC… I’ll probably tagging along with PB. Not a member. But a supporter.”). On Jan. 3, 5, and the morning of the 6th, he discussed meetups with others headed to the Capitol. He has repeatedly described being involved in breaching the Capitol. After Jan. 6, he explained he thought this was part of the plan following Trump’s messages:

“Trump’s behavior from the 6th on. It made no sense to call all of us there and say it will be wild. I was there and it was the only reason I went inside. …

I thought Trump was going to cross the Rubicon that day with all of us around him. .. I then realized that we or I was the one crossing the Rubicon that day.”

Following Jan. 6, User 3 continues to express interest in using violence and Jan. 6 tactics against government authorities. These statements include:

“I have a pile of guns …. I am ready for war. We all are.” (Feb. 5, 2021)

“I say we pull a Jan 6th in every liberal city and state capitol.” (late February)

“Sign me up for 1776. … I teach my kids how to deal with bullies. We tried to talk it out, we went to the principal, so now it’s time to fing punch them in the face. Government CAnNOT function without the expressed consent of it’s Citizens to participate. It’s time to go ham. Our children’s childrens future is on the line. All it takes is millions to agree to one day of Jan 6ing every liberal City and state capitol.” (Feb. 23, 2021)

User 4

User 4 said he traveled to DC by a charter bus organized by the “Berks County Patriots,” and posted a photo of passengers inside a bus with a statement, “6 buses full of Patriots coming in hot! Let’s do this!” He later posted that he was part of the “group that first stormed the building.” He reported witnessing first-hand “teams” of individuals, unlike other rioters, who were engaged in “a military op taking place inside the Capitol,” and he points others to a publicly available video of “one of the teams” that he says shows “they’re not exhibiting any excitement about being there. They’re on a mission,” and “they move toward Pelosi’s office with intent.”

In terms of premeditation before the assault on the Capitol: On Dec, 28, 2020, in comments to an original post apparently about what supplies to bring to DC for Jan. 6, User 4 writes, “Ammo and body armor.” Two days later, User 4 writes, “We will literally drag them out of the Capitol and shove broom sticks up their a**es. Don’t f*cking push us.” He also makes multiple references to gallows and hanging named elected officials.

Additional costs: Higher ups and additional leads

The base of information on The Donald could lead investigators to identify individuals with greater responsibility for the attack on the Capitol. On Jan. 7, 2021, the Washington Post published a report which opened with the following two paragraphs:

“Men wearing camouflage shirts began building a makeshift defensive camp outside the Capitol on Wednesday afternoon. They moved barricades and green fencing into a circle, and then pulled helmets from a crate and donned goggles in preparation for a clash that had been brewing for weeks and, arguably, for years on far-right forums devoted to President Trump.

‘TheDonald.win, that’s where it’s at,’ said one of the men, referring to the website where defiant talk, conspiracy theories and tips on how best to lay siege to Washington have grown since Trump lost the Nov. 3 election.”

Daniel J. Jones, a former FBI analyst and former Senate investigator who is now president of Advance Democracy, told Just Security: “Advance Democracy’s research over the last year indicates that The Donald was central to the events of January 6, 2021. Weeks before the insurrection there were tens of thousands of posts and comments detailing plans to travel to Washington, engage in violence, and invade the U.S. Capitol.”

“In my experience working with researchers in the lead-up to January 6, TheDonald.win was a source of a substantial amount of disinformation about the 2020 election, violent rhetoric, and insurrection planning,” former acting assistant attorney general Mary McCord told Just Security.

“If these defendants had premeditated plans augmented by maps and other information about the Capitol, where did that information come from? Who provided it to them?” posed former United States Attorney Joyce Vance in an email with Just Security. “If DOJ is not already using these cases to move up the chain to determine whether there were staffers/congresspeople involved that this information could be used to help prosecutors decide which of these defendants should be approached about cooperation in an effort to build cases against those responsible at a higher level.”

Jones expressed concerns that the FBI is failing to properly examine the site. He added, “As our justice system and congressional oversight committees work to understand and hold accountable those responsible for the events of January 6, 2021, it is vital that the role of TheDonald.win and its users be better understood.”

* * *

In April of this year, an important report by NBC News drawing from Advance Democracy’s work also noted the absence of communications on The Donald in charging documents. At the time, NBC explained, “what’s not clear is whether any of those who posted specific plans or threats of violence against the Capitol are among the defendants who have been charged.” Three of the four cases discussed above and identified by Advance Democracy in its recent report have been charged or indicted since then. Advance Democracy also provides attributions for some of the users who have not been charged, and enough information about others that an organization with the legal authorities of the FBI would presumably be able to identify as well.

McCord described the potential significance of this information:

“The incriminating content of posts on TheDonald.win, with attribution, unquestionably is a useful source of relevant information for investigators, prosecutors, and judges. Prosecutors could use attributed content, along with other evidence, to determine what charges to bring, advocate for pre-trial detention in cases where it is warranted, make plea decisions, prove the charged crimes at trial, and make sentencing recommendations. Similarly, the posts would be useful to judges making pre-trial detention determinations and sentencing decisions. In addition to providing proof of individuals’ presence and activities on January 6, incriminating posts on social media often can help establish motive and intent, conspiracies with others, and future dangerousness.”

What Explains the Absence?

What might explain the government’s failure to include any reference in any court filings (with the singular exception) to defendants’ communications on The Donald? Possible explanations include:

  1. A lack of understanding of the importance of a seemingly fringe site;
  2. The perceived costs of obtaining information from the site compared to Facebook, Twitter, and other social media platforms that have been more cooperative with the FBI;
  3. The perceived transaction costs of determining attribution for anonymous users;
  4. A perception of First Amendment-related concerns that somehow do not apply to other social media platforms;
  5. A decision to favor intelligence collection over public use of the information for criminal prosecutions;
  6. A tactic as part of a confidential ongoing criminal investigation of The Donald/its owners/operators.

McCord also explained the different reasons the government might choose not to include information from the site in charging documents. “The government does not always put all known information in its charging documents, and connecting the accounts of charged individuals with posts on more mainstream platforms like Facebook and Twitter is likely easier due to the established procedures for obtaining non-content subscriber information from those platforms.”

One reason to suspect the FBI is not adequately collecting, analyzing, or sharing information from The Donald is the example described above of an indictment that includes allegations prosecutors would likely omit if they were aware of the defendant’s contradictory communications on The Donald.

There is some evidence that the FBI has accessed and reviewed information associated with The Donald. Dr. Donell Harvin served as Chief of Homeland Security and Intelligence for the Government of the District of Columbia, where he oversaw the Fusion Intelligence Center for the nation’s capital and led its intelligence group before and following the Jan. 6 attack. He told Just Security of efforts by his staff to review The Donald to assist federal authorities as well as reasons why other social media sites appeared more fruitful:

“My analysts were involved in assisting with the subsequent investigation in terms of helping federal authorities ID persons who were physically inside the Capitol and those who were committing acts of violence. To that end, they used a suite of open sources, mostly social media sites that contained actual footage, or 1st person admissions/accounts from those involved. I cannot say that one particular website was more or less useful than the social media sites that my team relied on. And I have no first hand knowledge of how many individuals were identified based on which sites. I do know that we viewed that site [The Donald] in the lead up to the 6th, but as part of the forensic operation, it was one of many that were reviewed, with the social media sites having more information that could be used to identify and prosecute individuals” (emphasis added).

Federal law enforcement agents also reportedly subpoenaed the domain registrar and web hosting company Epik for records related to The Donald, one of Epik’s clients. Based on documents revealed through the group Anonymous’ hack and public dissemination of Epik’s files, the Washington Post reported:

The data includes internal memos describing apparent subpoenas from law-enforcement agencies for information about Epik-registered websites, including two domains, Thedonald.win and Maga.host, in the weeks after the Capitol riot on Jan. 6. The notes do not include details of the subpoenas’ targets, the investigating agencies or any alleged crimes.

One of the internal notes, which appeared to have been written by an Epik employee, mentions a grand jury subpoena, a request to preserve records for 90 days and a nondisclosure order — a court-approved document that law enforcement can secure to prohibit tech companies from telling customers what information they’d shared as part of an investigation. “DO NOT tell Registrant,” read the note, which did not include further details of the investigation.

The Wall Street Journal previously reported that at some point – it is unclear if it was before or after Jan. 6 – the site received “three FBI requests about users because of threatening posts.”

“If the FBI and DOJ have not made full use of incriminating material from a particular social media platform, there could be a number of explanations,” former United States Attorney Barbara McQuade told Just Security. “It may be that they are overwhelmed with evidence and are still working through massive amounts of social media posts. It may be that they have reviewed the information and assess it to be lacking in credibility. Or they may have assessed the information to be credible, but chosen not to disclose it in their public filings because they don’t want to reveal to users that they are monitoring communications there. I would not assume that they are unaware of the material or its significance.”

Conclusion: Potential Blind Spot for Future Criminal Conduct

What if the FBI is unaware of the potential significance of the material on The Donald or has underestimated the risk-reward of plumbing through the information contained on the site? Such a posture could amount to yet another intelligence and law enforcement failure in the making.

With currently available public information, it is impossible for outsiders to know whether the FBI is adequately assessing the site and simply opting not to use the information openly in criminal prosecutions or whether it’s something closer to a blind spot for the Bureau. If the latter, the situation has both sets of repercussions we have discussed: weaknesses in ongoing criminal investigations of Jan. 6 and potentially missing future national security threats in the form of domestic political violence. Recent polls point to such future national security concerns. Thirty percent of Republicans agree with the statement, “Because things have gotten so far off track, true American patriots may have to resort to violence in order to save our country,” according to PRRI. That number climbs to thirty-nine percent for those that believe the election was stolen from Donald Trump. The question is how well federal law enforcement is tracking these potential threats.

At a minimum, there appears to be more the FBI and the House Select Committee could be doing with the database of public information.

“The FBI and CISA should compare notes on detectable patterns of inauthentic behaviors and map the networks of the most prolific accounts on all the .win communities,” said Rondeaux with respect to the Jan. 6 investigations. “Cross-platform analysis—from Twitter to Parler, Rumble, and Gab—will be critical to understanding the breadth of coordinated activity as well as the financial exchanges that enabled those campaigns.”

The House Select Committee is mandated to examine “how technology, including online platforms” such as The Donald “may have factored into the motivation, organization, and execution” of the insurrection, according to the legislation that established the committee. In August, the Select Committee sent out its tranche of letters to 14 major social media companies, and followed up the next day with a letter to Jody Williams, the owner of TheDonald.win. But Williams says he is no longer involved in the site’s operation. After Jan. 6, Williams had a falling out with the site’s moderators, and The Donald migrated to the new domain, Patriots.win. Williams claims he maintains no records or data related to The Donald. Based on records revealed in the hack of Epik, an internet service company, the Washington Post reported that “A man listing an address in Louisville [Kentucky] paid $413 for the Patriots.win domain in January, the invoice records show.”

Finally, Advance Democracy and others have also documented moderators of the current site’s ongoing efforts to remove incriminating evidence by users. “Once it was clear that people were being investigated for participating, The Donald just deleted weeks worth of material from their archives. There’s a huge gap from mid December and up until the immediate days after the Capitol,” said Jared Holt, a resident fellow at the Digital Forensic Research Lab (DFRLab) at the Atlantic Council. There is evidence such removals continue today.

McCord, who headed the Justice Department’s National Security Division, told Just Security, “To the extent that its moderators have played or continue to play any role in deliberately removing content that incriminates charged individuals, there may be a basis for investigating them for obstruction of justice.”

Photo credit: Charles Ommanney/Getty Images