The FBI has warned about the potential for violence through Wednesday’s inauguration in capitals across the country, saying that domestic violent extremists “pose the most likely threat . . . particularly those who believe the incoming administration is illegitimate.”
The targeted accounts and platforms have increasingly seethed with rage over perceived but unfounded grievances and conspiracy theories: criminal immigrants invading the country; an election stolen from President Trump; and Satan-worshiping Democrats trafficking in child sex. Communications on these platforms provided law enforcement with insights into disparate groups or movements — some paramilitary, some avowedly white supremacist — and which might be planning violent attacks.
But when the toxic online discourse coincided with an unprecedented assault on the Capitol that left one police officer and four rioters dead, U.S. tech firms shut accounts and kicked Parler off the Web, forcing thousands of users to migrate to encrypted apps and less-moderated platforms such as Telegram, which is based overseas.
“It’s good news and bad news,” said John Miller, deputy commissioner of intelligence and counterterrorism for the New York Police Department, the largest metropolitan police force in the nation. “The good news is for a moment it interrupts the conversation to a mass audience that seems to be growing. The bad news is they’re going to have to find another platform. And you’re going to have to find that platform to follow them.”
The shift to fringe platforms also concentrates the users into smaller forums, where “they will be met by others just as angry and disaffected as they are without any moderating influence from a broader public,” said Rita Katz, founder of the SITE Intelligence Group, which tracks online extremism.
The violent discourse is not entirely muzzled. One site, TheDonald, which was instrumental in mobilizing Trump supporters to participate in the Jan. 6 attack on the Capitol, is still up and running and still trafficking in violent ideas, said Katz.
On Jan. 10, for instance, a thread posted on TheDonald discussed arresting and executing House Speaker Nancy Pelosi and other political leaders for “sedition and treason,” according to SITE.
TheDonald is registered with Washington state-based Epik, which provides domain name services and is protected against cyber attacks by Cloudflare, a San Francisco-based company. Cloudflare did not reply to a request for comment.
Epik spokesman Robert Davis said the company has “24-hour-a-day” teams that “remove thousands of posts” that incite violence. Asked why Epik did not drop TheDonald, he said it would be futile because “they would move their domain within six seconds, and we would no longer have the ability to run oversight and make sure they pull down critical comment.”
Parler CEO John Matze indicated Saturday he intends to find a way to restore his site.
At the end of the day, Katz said, the advantage to the public safety outweighs the disadvantage to law enforcement of losing a surveillance window. “When these extremists are on mainstream media, they spread blatant disinformation,” she said. “Pushing them off is one of the most crucial steps in curbing far-right radicalization and conspiracy theories online.”
State and local law enforcement have used social media to anticipate the size of protests and whether they might turn violent. It “helps us track the flow of protest interest and track the interest of those who had, in the past, been known to be unlawful at a protest,” said Nick Street, a spokesman for the Utah Highway Patrol, which is charged with protecting the state capitol. “It just means we can better do our job by knowing who is coming and the amount of people who are coming.”
The smartest and most ardent violent extremists have always used more secure, encrypted channels. And, Street noted, many protesters were aware that law enforcement agents might be watching public forums. “You’d see comments . . . like ‘Hey, stop talking about it here, the cops are watching,’ ” Street said. “Well, like, yeah, we’re watching. No kidding. Why wouldn’t we be?”
Even if law enforcement is not monitoring all comment, said one former federal agent, there is no harm with extremists thinking so, if it subdues their activity. “Let ’em think everybody’s a fed,” said the former agent, speaking on the condition of anonymity to be candid.
Some agencies rely on the public and researchers to alert them to potential violent acts being discussed online rather than devote scarce resources to monitoring social media. And the recent crackdown has eliminated a tip channel.
Mass attackers, for instance, often have expressed desires to carry out violence in online postings or to acquaintances, a phenomenon that researchers call “leakage.”
“There are many things that are reported to us by the community that they see on Twitter and Facebook,” said Andrew Walsh, deputy chief of the Las Vegas Metropolitan Police Department. “The trade-off is these platforms are used by people to discuss the plotting and planning of violence, so [their] loss is problematic. But it’s also problematic that people have a forum to promote and advertise violence.”
Open-source social media is not an infallible tool for law enforcement. Even when content is accessible, it’s often not detailed enough to enable authorities to act swiftly. Robert Bowers, who is charged with killing 11 people at a Pittsburgh synagogue in 2018, is believed to have made a series of anti-Semitic statements on a far-right site. “I can’t sit by and watch my people get slaughtered. Screw your optics, I’m going in,” he posted on Gab, officials said, less than two hours before police say he entered the synagogue and opened fire. He didn’t say the name of a particular synagogue.
Most planning of violent criminal activity is done in closed chats and on encrypted platforms, officials said. Last fall the FBI said it thwarted an anti-government group’s plan to kidnap Michigan Gov. Gretchen Whitmer (D) by infiltrating discussions over several months that the plotters thought were shielded in a private Facebook group and encrypted chats.
But the bureau said a member worried about the group’s plans to kill police officers had agreed to become an informant. In October, state and federal officials announced charges against more than a dozen people it said were involved in plots, among them members of the Wolverine Watchmen, a self-described militia group, and their associates.
“The FBI with a warrant can spy on closed, non-encrypted chats, but having informants or undercover sources inside these closed virtual networks is important to understanding the nature of the threat,” said Javed Ali, a former senior FBI counterterrorism analyst who now teaches at the University of Michigan.
The crackdown on domestic violent extremists recalls in some ways Silicon Valley’s gradual push several years ago to remove foreign terrorism content — particularly related to the Islamic State — under pressure, at times, from the federal government, though some officials urged that content be retained for intelligence purposes. But it differs in one important respect: Domestic voices enjoy far more protection under federal law. And the tech firms, though they are not bound by the First and Fourth amendments, have been loath until recently to take down even clearly misleading and dangerous statements.
For social media companies, the decision to remove foreign terrorist content was easier, said Clint Watts, distinguished research fellow at the Foreign Policy Research Institute and a former FBI special agent. He noted that “it’s international. Everybody hates [the Islamic State]. They are not voters, and they are not donors,” he said.
But domestic far-right voices range the gamut from gun-toting, camouflage-clad groups to suburban moms. “They are voters and donors. They are American citizens,” Watts said. Also, foreign terrorist groups are illegal. The extremist ideology QAnon and far-right groups like the Proud Boys and the “boogaloo boys” are not.
Deciding when a violent extremist’s posts cross the line from aspirational to operational and merits taking action is also difficult, said Tom O’Connor, a former FBI special agent who worked domestic terrorism cases for 23 years.
“When a horrendous event takes place like this at the Capitol, people want the FBI to start monitoring everything,’’ he said, “whereas just weeks ago, the same people would have criticized the FBI for reviewing the postings of U.S. citizens.”
Monitoring encrypted venues may be beyond the reach of most state and local law enforcement agencies. But for organizations like the FBI, the NYPD and expert groups like SITE, that is less of a concern.
“Wherever they end up,” said Miller, “we’ll find them.”