The FBI is working to name the Capitol rioters. So are thousands of online sleuths

The public accounting began soon after the first images of the U.S. Capitol siege started to unfurl on social media.

Activist groups and journalists long familiar with the extremist communities in their hometowns quickly began to put names to unmasked faces in the pro-Trump mob.

Their efforts have expanded into a massive online crowdsourcing campaign that has helped identify numerous attendees of the “Stop the Steal” rally, with a focus on those who later marched to the Capitol and either witnessed the breach or participated in it more directly.

In San Diego, much of that work has been displayed on a handful of anonymous anti-fascist Twitter accounts, which have become unofficial clearinghouses for exposing locals in attendance.

Many of the San Diegans who’ve been identified so far are part of a recognizable cast of regulars at pro-Trump rallies, civil defense group gatherings and counter-protests opposing Black Lives Matter. Many of these prior events have devolved into violence.

Politics

The Capitol siege was far from San Diego. Its fringe ideologies were right at home

The Ocean Beach woman fatally shot in the Capitol breach reflects a broader community in San Diego

Jan. 9, 2021

“We believe there is significant public benefit to exposing racist, hateful, violent attitudes and actions in our local communities — San Diegans deserve an outlet that provides them with information about extremists living among them,” a representative of the Twitter account SDAgainstFash wrote in an email response to questions posed by the Union-Tribune.

The people affiliated with SDAgainstFash and another account, decsucks, declined to be identified in this story for fear of retribution by area extremists.

For the most part, the San Diegans appearing on the activists’ Twitter accounts had already acknowledged their attendance at either the rally or Capitol siege on their own social media feeds, often with photos or videos.

What the activists did was amplify their participation to a much larger audience.

Naming names

Justin Haskins, leader of Defend East County, heckles Black Lives Matter activists during a Caravan for Justice San Diego rally in downtown Lakeside on Oct. 4, 2020.

(Sandy Huffaker / For The San Diego Union-Tribune)

Various accountability social media accounts claim to have identified at least two San Diegans who were involved in the Capitol breach, including a person of interest captured in a photo circulated by the Metropolitan Police Department in Washington, D.C. However, neither the FBI in San Diego nor MPD would say if the identity of either man had been confirmed or if either had been interviewed.

One of the named men did not responded to requests from the Union-Tribune for comment, while the other could not be located.

The local figures who are named on SDAgainstFash and decsucks are a cross-section of Trump supporters.

On Instagram, Justin Haskins, the founder of the civil defense group Defend East County, or DEC, acknowledged he was at the Capitol and defended the “constitutional duty to overthrow a tyrannical government.”

DEC’s Instagram account also livestreamed a video from the Capitol as it was under attack, filming amid a crush of people near one of the entrances as the crowd tried to breach it. One woman can be heard yelling, “We need more men up there to storm!” The video has since been removed but it is archived on YouTube by Brooke Binkowski, the San Diego-based managing editor of fact-checking website TruthorFiction.com.

Blake Marnell, a San Diegan who frequently travels to Trump rallies, filmed the agitated crowd from what appeared to be the steps of the Capitol, according to his own videos on Twitter. While he is known to often wear a suit made to look like a red brick wall, at the Capitol he was dressed in a navy suit, a tie and a red “Stop the Steal” hat.

Blake Marnell, aka “Brick Suit” guy, talks with media in downtown San Diego, where he was showing support for Donald Trump during a presidential visit on Sept. 18, 2019.

(Andrew Dyer / The San Diego Union-Tribune)

Three MAGA supporters from the Los Angeles area with large social media followings appear to have been in Washington, D.C., for the event, then days later showed up in Pacific Beach for a Patriot March that turned violent. Some have been at prior San Diego demonstrations.

Social media was quick to amplify the rally attendance of Escondido coffee shop owner David Chiddick, whose Koffie Co. has openly defied COVID-19 restrictions. Chiddick posted on his own social media account from the Lincoln Memorial that Americans should not “not stand by” and to “fight the good fight.”

In a later video, he said he was part of the “peaceful rally” but was not “one of those idiots who took it too far,” adding that they should be prosecuted.

He said he, his family and employees have since been the target of intense backlash from the public, even receiving death threats. “The amount of hate we received for something that isn’t even true is unbelievable,” he said. He could not be reached for comment.

A Reddit thread discussing Chiddick’s presence has garnered more than 200 comments, some of them debating whether to report him to the FBI based on his videos alone, which don’t place him at Capitol during the siege.

The most high-profile San Diegan to be identified, albeit through official government channels, is Ashli Babbitt, the Ocean Beach woman who was shot dead by a Capitol Police officer as she tried to breach the Speaker’s Lobby. Her social media feed illustrated a fervent support of Trump and the belief that the election was stolen from him, as well as Qanon conspiracy theories. Her accounts have since been hidden or removed.

Similarly, many of the people identified as traveling to D.C. have since removed images and videos from the web or have made their social media accounts private in the fallout. Some appear to have abandoned more mainstream apps such as Facebook and Twitter for less restrictive platforms such as Parler and Gab.

But many pieces of documentation remain archived by activists.

Citizen investigators

Torch-bearing White nationalists rally around a statue of Thomas Jefferson near the University of Virginia campus in Charlottesville, Va., on Aug. 11, 2017.

(Edu Bayer / The New York Times)

The effort to publicly expose those viewed as right-wing extremists widely took root after the deadly 2017 Unite the Right rally in Charlottesville, Va. The event was a shockingly open display of White supremacy, and online amateur sleuths doled out their own vigilante justice by unmasking participants — an effort less about aiding law enforcement than it was about public shaming.

That same drive is on display now as many anti-fascists seek accountability for the Capitol takeover.

However, many other citizen investigators are motivated by the FBI’s unprecedented call for public’s help.

Both the agency and D.C. police have put out dozens of images of persons of interest taken during the melee, both inside and outside the Capitol, and ask the public to submit tips. About 140,000 digital media tips have been received by the FBI so far.

“Notably, many of the tips are coming from friends, co-workers and other acquaintances of those allegedly involved in the attack,” according to the Department of Justice.

The FBI said on Friday it has identified more than 270 suspects involved in criminal activity, and that more than 100 people have been taken into custody across the country.

“What the FBI is doing now is unprecedented, there’s no question about it,” Thomas Martin, president of Martin Investigative Services in Newport Beach and a former federal agent, said of the call for public assistance. “They are getting so many tips they can hardly keep up with it.”

But many citizen online sleuths are working from a broader landscape of social media evidence and news footage to identify participants. They are using not only the reach of social media networking to elicit tips, but also turning to geolocation data from apps such as Parler and simple yet unreliable web-based facial recognition software, such as Google’s reverse face search.

Distinctive emblems on clothing and hats have become a key focus in several in-depth citizen investigations, such as the red-and-white scarf first spotted in the debris at the Capitol.

Someone recognized it as the distinct scarf distributed to former residents of the Swedish city of Skellefteå in 2017, according to media reports. A search by the newspaper Dagens Nyheter of photos from the siege turned up an image of a helmeted man wearing the scarf, but efforts to identify him have been unsuccessful thus far.

Misidentification is a risk.

In 2013, internet sleuths incorrectly named several possible suspects in the search for the Boston Marathon bombing suspects, including a missing college student and innocent bystanders.

In the wake of the assault on the U.S. Capitol, a retired Chicago firefighter was wrongly named as a person shown on video throwing a fire extinguisher at the heads of police officers.

The man was, in fact, in Chicago shopping for groceries at the time of the attack, he told news website Patch. A different retired firefighter — Robert Sanford, 55, from Chester, Pa. — was arrested Thursday on four federal charges connected to the alleged assault and conduct at the Capitol.

Chad Loder, a computer security specialist based in Los Angeles, also researches and publishes the names of extremists on his Twitter account. Loder said that while amateur sleuths might have good intentions, people with no experience can make dangerous mistakes in naming people.

“The folks who have a lot of experience with this know the risks of public speculation about these things,” Loder said when reached by phone Friday. “I think what we’re seeing now is folks who have no experience with this process … and they’re making mistakes. The moment you mention a name publicly, it’s going to get picked up, and that’s dangerous.”

Loder said many people involved in this type of work are academics — Ph.D students and research librarians — who understand how to vet sources for accuracy.

“People need to be extraordinarily careful and not publicly speculate,” Loder said. “Pulling pictures from Facebook is incredibly dangerous — (these) things experienced folks know to avoid.”

Known entity

A crowd control fence surrounds Capitol Hill a day after a pro-Trump mob broke into the U.S. Capitol.

(Brendan Smialowski / AFP via Getty Images)

In San Diego, anti-fascist activist groups were well poised for this moment. They’d been keeping close tabs on antagonizers of social justice demonstrations for several months already, tracking specific social media accounts, archiving video of clashes at protests and exposing hate speech from discussions in online group chats.

The Twitter account decsucks sprang up over the summer to track Defend East County, which had formed as a civil defense response to the La Mesa riot. DEC’s members became fixtures at social justice demonstrations, heckling Black Lives Matter supporters and at times fighting protesters.

The decision to start the decsucks account came after an altercation at a protest in La Mesa. Other groups, such as the Exiled Patriots, an offshoot of Defend East County, and the American Guard, which the Anti-defamation League describes as “hardcore White supremacists,” were also present in La Mesa that day, photos and video show.

The account is managed by a three-person team that collects information shared online by members of Defend East County and other affiliated groups, said one account manager in emailed response to questions. They also rely on people in the San Diego community to come forward with information.

“I felt the larger community needed to be on the lookout for Defend East County,” the account’s administrator said.

SDAgainstFash also tweets about Defend East County, as well as highlighting other Southern California-based extremists who have traveled to San Diego to demonstrate, including those who attended the Pacific Beach Trump rally last weekend.

A representative of the account said its work is the result of several people’s contributions but declined to say how many people are behind it.

Loder has been tracking several of the same people who he says seek out pro-Trump rallies to provide cover for their violent intentions.

“These extremists, they use these rallies as cover in the way a predator uses undergrowth and grass to hide in,” Loder said. “They go to these rallies and they’ll attack and swarm folks.”

In conversations on Facebook and Twitter, members of Defend East County have complained of being “doxed” — the wide publicizing of personal information such as address, phone number and other data — by activists on Twitter, including one who had her criminal record shared.

Asked about doxing, a representative of the SDAgainstFash account said they don’t consider their work to be doxing because they don’t publish private information such as people’s home addresses.

“We perform open-source intelligence gathering (OSINT) which is a fancy way of saying we collect information that is already publicly available,” the account representative wrote in an email. “Those of us who do research work are simply good at using Google.”