They came prepared for war. Leroy Coffman parked his Red GMC Sierra pickup truck a stone’s throw from the US Capitol Building at 9:15 on January 6. Inside the truck, legal documents allege, were 11 Molotov cocktails containing a napalm substance, a handgun, shotgun, rifle, crossbow with bolts, several machetes, camouflage smoke devices and a stun gun. Coffman also reportedly had two other guns on his person.
Also in his car, the documents claim, were handwritten notes about elected officials and what was believed to be contact information for talk show hosts and other politicians. “The handwritten messages in the defendant’s pickup truck raise grave concerns about his intentions, and suggest that these weapons were intended to be used in an effort to violently attack our elected representatives,” the legal document states. It adds law enforcement officials believe there could have been intent to share the weapons with others.
Coffman was not alone on January 6. Amongst the mob that stormed the US Capitol were individuals who were armed and ready for violence. In the days that followed the attack, open-source intelligence researchers, journalists and law enforcement have begun the painstaking task of trying to track down these individuals. Amongst the steadfast Republicans, QAnon conspiracy theorists and elected officials, one group stood out: highly organised, armed and seemingly specially trained to not just storm the Capitol but also to commit acts of violence. Their behaviour has sparked fears that extreme right-wing groups and others intent on causing violence may target the inauguration of Joe Biden and Kamala Harris on January 20. Or even before. As time runs out, the race is on to identify and disrupt those who may take action.
Early legal documents and charge sheets collated by George Washington University’s Program on Extremism give a glimpse of what could have unfolded at the Capitol. So far there are 20 charges related to firearms and a handful of others for theft, assault, threats and civil disorder, according to the Program on Extremism. Cleveland Grower Meredith Jr who travelled to Washington DC but was too late for the protests is alleged
The legal documents made publicly available so far do not reveal any co-ordination between those they name and, of course, all are innocent until proven guilty. (In early legal proceedings Coffman did not enter a plea and his attorney argued he had no previous criminal record. Legal representatives did not return a request for comment). At the time of writing the FBI has charged more than 70 people, has more than 170 open case files, and has been sent more than 100,000 photos, videos and other digital media. More arrests will inevitably follow.
In the days following the attack, evidence has emerged on social media showing some of those inside the Capitol building talking about the building’s layout and how to move around its labyrinth of corridors. Another video shows an organised line of individuals dressed in camo gear passing through crowds and heading up the steps to the Capitol. Individuals alleged to be carrying zip-tie handcuffs have also been identified, while another person is said to have packed a military ready-meal.
Many were surprised by what happened on January 6 – but nobody should now be in any doubt that follow-up attacks are not just possible but may be likely. Capitol Police have told lawmakers that they are monitoring three sets of plans that could pose threats to members of Congress, the Huffington Post reported. While AP learned the FBI is warning of potential armed protests in all 50 state capitals as well as Washington DC and has told police chiefs to be on alert.
“The discussions around future action, demonstrations, and possible future violence have been very scattered, very decentralised,” says Alex Newhouse, the research lead at the Center on Terrorism, Extremism, and Counterterrorism at the Middlebury Institute of International Studies in Monterey, California. He has mostly been monitoring privacy-focused messaging app Telegram. “There’s very little serious chatter among the wide swathes of the American right. But then some small but very concerning chatter among the very extreme wings.” Such chatter, he adds, should be taken seriously.
Since the Capitol Hill attack, the wider online network of Trump supporters has been uprooted. Twitter, Facebook, and YouTube bans have sent his followers in search of new platforms to share their views. After Parler was taken offline – with a alarmingly basic security flaw allowing all its public posts and GPS location data to be captured
Pro-Trump public Telegram channels – groups where admins share content to everyone who joins – have grown quickly. One chat for ex-Parler users has around 16,000 members, with almost one thousand messages being sent every hour. “If we’re looking at the groups that we can find on Gab, they have increased their membership by quite a bit,” says Greta Jasser, a researcher from the University of Lüneburg in Lower Saxony, Germany, who has been studying public posts on the app for two years alongside London School of Hygiene and Tropical Medicine’s Ed Pertwee. “Some groups have doubled their membership, especially those related to QAnon and Trump.”
Groups on the far-right, with links to the Proud Boys and the boogaloo movement that advocate white supremacy, have also grown in the last week. “The events of January 6 were seen as a success, a triumph, among really radical far-right, white supremacist channels,” says Newhouse. “Those channels are still talking about potentially having some sort of presence on the ground across the country.”
Newhouse adds that he has seen people saying they will not participate in any future protests. He has also not seen much to suggest large groups of people are organising future protests in the coming days. That’s in contrast to January 6, when the mob used a Trump rally as a springboard for their attack.
Researchers studying radical groups online are often only able to see comments and posts in public groups and channels – private and secret groups are likely to contain other information. Public groups seen by WIRED are encouraging people not to post their real names or photographs as they believe they are being watched.
Rita Katz, the executive director of the SITE Intelligence Group, which tracks and monitors terrorism and provides reports to governments, says the “prevailing message” of those on the most extreme fringes has changed. “Essentially, they are no less convinced that the election was ‘stolen’ from them and intend to keep the fight going, regardless of if Trump stays at the helm,” she says. “They believe that they are at war and will continue to fight even if they are, as some militia members have suggested, ‘on our own.’” A message in one group says “the real and important purge will be on the streets… coming to a neighborhood near you very soon”.
Intelligence reports from SITE claim neo-Nazi groups have encouraged attacks against politicians and a militia group forum has discussed possible inauguration day protests. Meanwhile, the US Secret Service has issued a warning stating the boogaloo movement is planning armed protests around inauguration day. An FBI memo obtained by the New York Times says what happened at the Capitol would be a ”significant driver of violence” for some extreme groups.
Ahead of inauguration day, technology companies and law enforcement are acting to reduce the chances of disruption. Calls have been made for people not to travel to Washington DC and up to 20,000 National Guard members are in the process of being deployed to the area – photos have shown guard members resting in the corridors of the Capitol Building. A two-metre high metal fence has been installed around the Capitol Building itself and Trump has issued a statement calling for calm. “There must be no violence, no lawbreaking and no vandalism of any kind,” he said on January 13, hours after he was impeached for the second time.
Technology companies fearing further links to any potential violence have moved to crack down on far-right material since the Capitol Hill attack. Twitter said it had seen plans for “future armed protests” on and off its platform and banned 70,000 accounts with links to QAnon. Facebook banned the phrase ‘Stop the Steal’ and related hashtags. And Airbnb planned to check and review all bookings made for Washington DC around the inauguration date but has since tightened its stance and will block and cancel all bookings.
Changes are also takling place on Telegram, a platform that has long been criticised for being a home to white supremacist propaganda. “The most hardcore neo-Nazis alt-right figures, a lot of them have already been banned by main platforms,” says Pertwee. “And they’ve been in these alternative spaces for some time.” In recent days Telegram has started banning more channels where it has seen threats of violence. On January 13, Telegram said it had removed “dozens” of channels that threatened violence. (A spokesperson did not respond to WIRED’s request for comment).
One of the lasting impacts of the shift away from Facebook and Twitter and towards Gab, Telegram and other alternative platforms, is that more people could be exposed to extreme ideologies. Those within some Telegram channels are hatching plans to recruit more people to their cause. Katz says SITE has seen messages from people describing it as an “opportunity” to direct people towards their extreme ideologies. “White supremacists and neo-Nazis see this moment as ripe for recruiting and radicalising angry Trump supporters,” Katz explains. “This is all the more likely to take place given that many of the die-hard Trump supporters getting kicked off of other venues are now heading onto Telegram, where Neo-Nazis and white supremacists eagerly await their arrival.”
Matt Burgess is WIRED’s deputy digital editor. He tweets from @mattburgess1
More great stories from WIRED
🧮 The UK can’t even keep track of its spiralling Covid-19 case numbers
💉 Inside the race to stop the next pandemic
🏋️ Gyms are closed so which workout app is better? Apple Fitness+ vs Peloton vs Fiit