Rioters accused of erasing content from social networks and phones

PHOENIX – They posted their participation in the Jan.6 riot on the U.S. Capitol on social media, then, apparently realizing they had legal issues, rushed to suppress evidence, authorities said. Now their attempts to cover up their role in the murderous siege are likely to come back to haunt them in court.

A review of the Associated Press court records found that at least 49 defendants are accused of attempting to erase offending photos, videos and texts from phones or social media accounts documenting their conduct while a pro-Donald Trump mob stormed Congress and briefly interrupted Democrat Joe Biden’s Election Victory certification.

Experts say efforts to clean up social media accounts reveal a desperate desire to manipulate the evidence once these people realize they are in hot water. And, they say, it can serve as powerful proof of people’s guilt awareness and can make it more difficult to negotiate plea agreements and leniency during sentencing.

“It makes them difficult, makes them sneaky,” said Gabriel J. Chin, who teaches criminal law at the University of California at Davis.

One of the defendants is James Breheny, a member of the extremist group Oath Keepers, who has boasted in texts to others of being inside the Capitol during the insurgency, authorities said. An associate asked Breheny, in an encrypted message two days after the riot, to “delete all photos, all messages and get a new phone,” according to court documents.

On the same day, the FBI said, Breheny shut down his Facebook account, where he had taken photos during the riot and complained that the government had become tyrannical. “The duty of the people is to replace this government with a government with which they agree,” Breheny wrote on Facebook on January 6 in an exchange over the riot. “I’m all ears. What are our options ???”

Breheney’s attorney, Harley Breite, said his client had never obstructed the riot investigation or destroyed evidence, and that Breheny was unaware when he closed his account that its content would be considered a proof.

Breite dismissed the idea that Breheny might have recognized, in the days immediately following January 6, when the riot dominated media coverage, that the attack was a serious situation that could put Breheny’s freedom at risk. .

“You can’t suppress evidence if you don’t know you’re charged with anything,” Breite said.

Other defendants who have not been charged with destroying evidence are still discussing content removal with others, according to court documents.

The FBI said a woman who posted video and comments showing she was inside the Capitol during the attack later decided not to restore her new phone with its iCloud content – a decision that authorities suspect is aimed at preventing them from discovering the material.

In another case, authorities said screenshots of a North Carolina man’s deleted Facebook posts contradicted his claim in an interview with an FBI agent that he had no intention of disrupt the certification of the Electoral College.

Erasing digital content isn’t as easy as removing content from phones, deleting social media posts, or closing accounts. Investigators were able to retrieve the digital content by requesting it from social media companies, even after the accounts were closed.

Posts posted to Facebook, Instagram and other social media platforms are retrievable for a period of time, and authorities routinely ask these companies to keep records until they get a court order to view the posts. said Adam Scott Wandt, a public policy professor at John Jay College of Criminal Justice who trains law enforcement in cyber investigations.

Authorities also have other ways to investigate whether anyone has attempted to suppress evidence.

Even when someone deletes content from an account, authorities can still access it if it has been backed up to a cloud server. People who are not yet involved in a crime have received incriminating videos or photos may end up passing them on to investigators. In addition, metadata embedded in digital content can indicate whether it has been modified or deleted.

“You can’t do it,” said Joel Hirschhorn, a Miami criminal defense attorney who is not involved in the Capitol riot cases. “Metadata will do it every time.”

Only a handful of the more than 500 people across the United States who were arrested in the riot have actually been charged with tampering for removing incriminating material from their phones or Facebook accounts.

They include several defendants in the high-profile case against members and associates of the extremist group Oath Keepers, who are accused of plotting to block certification of the vote. In one case, a defendant asked another to “ensure that all signal communications regarding the operation have been removed and burned,” authorities said.

But even if that doesn’t lead to more charges, suppressing the evidence will make it difficult for those defendants to get much benefit upon conviction for accepting responsibility for their actions, said Laurie Levenson, professor at the Loyola Law School.

Some lawyers could argue that their clients removed the content to reduce the social impact of the attack on their families and show that they do not support what happened during the riot. But she said this argument has limits.

“The words ‘selfish’ will come to mind,” Levenson said. “That’s what prosecutors will say – you took it out because all of a sudden you have to face the consequences of your actions.”

Matthew Mark Wood, who admitted to removing content from his phone and Facebook account that showed his presence on Capitol Hill during the riot, told an FBI agent he had no intention of disrupting the certification of the Electoral College.

But investigators say the screenshots of two of his deleted Facebook posts tell a different story.

In the messages, Wood reveled in rioters sending “these politicians to run” and said he opposed a tyrannical government in the face of a stolen election, the FBI said in court records. “When diplomacy isn’t working and your message hasn’t been delivered, it shouldn’t surprise you when we revolt,” Wood wrote. His lawyer did not respond to a call for comment.

Although she is not accused of removing content that showed she was inside the Capitol during the riot, an accused told her father that she was not going to restore her new phone with its iCloud backup about three weeks after the riot, the FBI said.

“Stay away from the clouds! »Warned the father of his daughter, according to the authorities. “This is how they laugh at us. “