Biometrics , Forensics , Fraud Management & Cybercrime

Capitol Riot: Self-Surveillance Feeds Investigation

Archiving, Crowdsourcing and Facial Recognition Help Identify Suspects for FBI
Capitol Riot: Self-Surveillance Feeds Investigation
Source: FBI

Investigators probing the violent storming of the U.S. Capitol by a mob on Wednesday have been seeking images and help in identifying suspects.

See Also: OnDemand | Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication Methods

The FBI, which is leading the investigation, has a range of investigative tools and technologies to help, including facial recognition software. Potential evidence abounds, thanks in no small part to self-surveillance - namely, many members of the mob livestreamed their breach of the Capitol, took copious photographs or posted images or intentions on social media.

“Some people were being very blatant and flippant about it, smiling for the camera - those people are going to be very easy to find,” Doug Kouns, a retired FBI special agent and founder of the Indiana-based private-investigation firm Veracity IIR, tells The Washington Post.

Five people have died due to the storming of the Capitol, including U.S. Capitol Police Officer Brian D. Sicknick, who was attacked by the mob.

The FBI's Washington field office has issued a public appeal, saying it "is seeking the public's assistance in identifying individuals who made unlawful entry into the U.S. Capitol on Jan. 6."

The FBI is also seeking information, backed by a reward of up to $50,000, on whoever deployed two suspected pipe bombs - one placed at the city's National Republican Club and the other at the headquarters of the Democratic National Committee.

FBI "most wanted" poster (click to enlarge)

“This investigation has the highest priority of the Department of Justice," Kenneth C. Kohl, the acting principal assistant U.S. attorney for the District of Columbia, told The Washington Post. "We have literally hundreds of prosecutors and agents working from three command centers on what is really a 24-hour-a-day operation. It is active; it is fluid; it is evolving."

The bureau's "most wanted" listing includes a hotline phone number. Individuals can also use an online form - accessible via - "to submit any images, videos or other multimedia files you have related to possible violations of federal law committed."

The FBI notes: "Our goal is to preserve the public’s constitutional right to protest by protecting everyone from violence and other criminal activity." The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives; U.S. Marshals Service; U.S. Capitol Police Department; and the Metropolitan Police Department are also investigating Wednesday's events.

“Just because you’ve left the D.C. region, you can still expect a knock on the door if we find out you were part of criminal activity in the Capitol," FBI Washington Field Office Chief Steven M. D’Antuono told the Post.

As of early Monday, 45 individuals had been charged - under federal or local laws in Washington - in connection with Wednesday's events, according to the Program on Extremism at George Washington University.

The most common charge so far is "illegal entry and activity on designated grounds." But in court documents, investigators note that the charges filed so far - none of which have been proven in court - are only to demonstrate probable cause for the purpose of obtaining an arrest warrant. Further charges could be filed against individual suspects as investigations continue.

“The events that happened at and around the U.S. Capitol were unconscionable, and those responsible will be held accountable for their attempts to thwart democracy,” says Metropolitan Police Department Chief of Police Robert J. Contee III. “While these charges represent a positive step, there is still work to be done. Our collective intentions are to work diligently to identify all of the persons responsible for the insurrection at our U.S. Capitol.”

Numerous Suspects Named

Suspects named by authorities include Alabama grandfather Lonnie Coffman, 70, who drove his pickup truck to Washington. Authorities have accused Coffman of arriving with 11 “Molotov cocktail” Mason jars in the back of his pickup truck, filled with an explosive substance that functioned like napalm, as well as multiple unlicensed firearms, including an assault rifle, according to court documents.

Image released by the FBI of suspects it seeks to identify

Other suspects include former Lt. Col. Larry Rendall Brock Jr., a decorated U.S. Air Force veteran, who was photographed in the Senate chamber "wearing a military-style helmet, body armor and holding flex cuffs," according to court documents.

Among the individuals who phoned the FBI's hotline to report Brock was his ex-wife, according to court documents. He was arrested in Texas on Sunday on a federal warrant charging him with accessing a restricted building or grounds, as well as with violent entry or disorderly conduct.

Multiple police departments have said they've placed on administrative leave employees who were present at the Wednesday events, pending a full investigation.

Also being investigated by the U.S. Army's 1st Special Forces Command is Capt. Emily Rainey, 30, who told The Associated Press that she had led a contingent of 100 Trump supporters to Washington to “stand against election fraud” and that neither she nor anyone in her group had broken any laws.

After delivering a speech on Wednesday that incited the mob to violently march on the Capitol, President Donald Trump faces a second impeachment inquiry by the House of Representatives. On Monday, Democratic House lawmakers unveiled an impeachment resolution charging President Trump with "incitement of insurrection," CNN reports. A vote on that resolution could come Wednesday, according to news reports. House Democratic leaders also backed a resolution Monday from Rep. Jamie Raskin of Maryland that urged Vice President Mike Pence to invoke the 25th amendment to strip Trump of his presidential authority, but the resolution was blocked by House Republicans.

Calls to Save 'Incriminating' Footage

Image released by the FBI of a suspect it seeks to identify

Extensive crowdsourced efforts are underway to attempt to identify suspects, and numerous matches have been referred to the FBI.

On Wednesday, investigative journalism website Bellingcat urged people to help save all evidence to assist investigators. "For those who are able to: please try to scrape and save any videos and livestreams of the Capitol storming and occupation," Bellingcat tweeted. "Just like after Charlottesville in 2017" - a Unite the Right white nationalist rally in Charlottesville, Virginia - "many of those who are streaming will delete their streams once they realize how incriminating the footage is."

The FBI has declined to say which tools or technology it might be using in the course of its investigation. But one Alabama police officer tells The Wall Street Journal that he's been running some images through facial recognition software and then forwarding the results to the FBI.

“I was able to develop … some pretty good suspect leads and forwarded those,” Sgt. Jason Webb, a police officer in the town of Oxford, tells the newspaper, noting that he's been using software from Clearview AI. It's one of a number of big data startups that publicly scrapes available images from social networks and other sites and uses them for facial recognition purposes.

To attempt to address privacy concerns being sounded as a result, in October, Clearview implemented compliance features, including requiring police to enter a specific case number and crime, to facilitate better auditing, The Wall Street Journal reported.

Old-School Investigative Techniques

Some masked suspects have been identified not by using the latest software tools, but instead thanks to insignia or expensive gear they were wearing that could be cross-referenced with older photos, John Scott-Railton, a senior researcher at the University of Toronto's Citizen Lab, which investigates digital threats to civil society, tells the Toronto Star.

As journalist John Bull has noted, one of the masked rioters who allegedly entered the Capitol was identified thanks to a photograph of him standing next to another individual outside the building. That individual was his mother.

Crowdsourced investigators say they have been overwhelmed by the number of people willing to help chase down suspects. "The volume of tips and information now is unlike anything I have ever seen,” Scott-Railton told the Star.

Security Concerns Ahead of Inauguration

As investigations continue, officials are bracing for further violence in Washington.

On Friday, Twitter permanently banned Trump for violating its "glorification of violence" policy, warning that groups were actively planning to disrupt Joe Biden's Jan. 20 inauguration.

Facebook has frozen Trump's account until the end of his term.

Outgoing Capitol Police Chief Steven Sund told The Washington Post that he requested that House Sergeant at Arms Paul Irving and Senate Sergeant at Arms Michael Stenger declare a state of emergency ahead of the planned protests and authorize the use of the National Guard. But he said his request was denied. Irving and Stenger were pressured by lawmakers to resign following the Wednesday riot.

Far-right groups and others have reportedly been planning further violence in Washington on Jan. 20, the day of Biden's inauguration.

“My concern is, if they don’t get their act together with physical security, it’s going to happen again,” Sund told the Post.

About the Author

Mathew J. Schwartz

Mathew J. Schwartz

Executive Editor, DataBreachToday & Europe, ISMG

Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing, you agree to our use of cookies.