The digital sleuths take to their computers in the moments when they can peel away from their real-world responsibilities — jobs, school, families — with a singular mission: finding the rioters who brought violence to the nation’s capital last week.
Behind computer screens on the West Coast, in the Midwest, and as far away as Australia they scour the depths of the internet in search of photos and videos of the insurrection, hoping to identify the most violent protesters, amass digital dossiers on them and pass the evidence on to authorities.
In the days following the Jan. 6 riot, which left five people dead and injured dozens of police officers, some amateur detectives have joined massive crowdsourcing or “open-source intelligence” efforts on social media aimed at piecing together clues that rioters — and journalists — left via live streams, photographs and videos taken at the scene.
They are searching, they say, for justice.
“What really motivated me was the photo of the officer face down being beaten by an American flag,” said Donna Lisenby, who has spent hours looking at photos and videos of Capitol rioters in an effort to gather information on the most violent among them.
A self-proclaimed “gray-haired grandma from North Carolina,” Lisenby started cobbling together composite images of people she found to be the worst offenders, drawing on her job as an environmental investigator. For her, tracking people she views as seditionists isn’t partisan payback. It’s an “urgent necessity to save the American democracy.”
“This grandmother just believes in the rule of law, and I think people who break the law should be held accountable,” the 55-year-old said.
Some amateur sleuths simply amplify the information others have unearthed, using the hashtag #SeditionHunters, among others. More ambitious investigators create collages filled with photos of each violent protester as well as an analysis of the type of gear or clothing that person was wearing and any weaponry they were wielding. The most organized set — like Lisenby — might assign an individual a moniker, such as #Scallops or #BaldEagle, to keep information in one place.
Novice detectives interviewed by The Times said that they perform their work carefully, taking measures aimed at protecting suspects’ identities — including not posting someone’s name online — while passing information to the FBI and other authorities.
But criminal justice scholars say there is a danger that suspects could be misidentified by other digital investigators, doxxed or otherwise named in harmful, public ways before law enforcement officials can verify an alleged perpetrator’s identity.
Reached by The Times, the individual who runs the Twitter account “Sedition Hunters” and declined to give their name for fear of retaliation, said that they advise others not to post names online.
“Online witch hunts can be bad or dangerous, and could lead me to shutting down the site earlier if we can’t do this in a way where we are not accidentally doxxing people,” the 30-year-old said, adding that they joined the effort to “make things safer than they have been.” “I don’t see social media as the platform where justice is delivered.”
The account isn’t attempting to do the work of the FBI or other law enforcement, they added. Rather, its purpose is simply to collect useful, credible information and supply it to the appropriate authorities — much as any anonymous tipster might. What the professionals do with that information is up to them. The account operator often spends eight hours each day tracing protesters, sometimes until midnight.
“If you’re explicitly being violent, if you’re damaging the building — people who have reached this threshold, I do think they should be jailed or tried and convicted,” they said.
In the days since the riot, Washington, D.C.’s Metropolitan Police Department has received tens of thousands of tips about suspected participants, including links to tweets or messages asserting personal knowledge about a specific attendee, said spokesperson Alaina Gertz.
On Jan. 7, the department posted photos of suspected rioters and asked the public for help in identifying them. Within a day, they received about 17,000 tips. Ideally, Gertz said, those who suspect someone of being a person of interest should contact the D.C. police or FBI, but all tips are welcomed.
And some tips have led to arrests, she said. So far, at least 90 people have been arrested in connection with the riot.
“We understand there’s social media chatter, but we would verify that someone was involved before making an arrest,” she said.
Still, experts in tracking hate groups and extremists caution against the growing trend, and potential dangers, of Americans using social media and other surveillance to publicly target the actions of their fellow citizens.
John Scott-Railton, a senior researcher at the Citizen Lab at the University of Toronto, began to piece together details about some of the rioters who committed the most serious crimes by crowdsourcing images and videos on Twitter in the days following the riot. He would tweet confirmation once he believed he could verify a person’s identity.
Such efforts may have aided the FBI’s quest to find rioters. In a tweet sent Wednesday, Scott-Railton said that details surfaced by other online sleuths had led “to high-confidence ID’ing of more troubling characters” and were referred to the FBI.
But part of Scott-Railton’s work appears to have led to some open speculation about suspected rioters. He frequently sends messages to his followers to dissuade them from publicly naming suspects or amplifying unverified and unvetted information. Not all heed his warnings.
“I wince each time I see a name fly by like, ‘It looks like XYZ of here,’ based on a hunch or guess,” wrote Scott-Railton, who specializes in cybersecurity and online disinformation. “Much more of that, and this will become something you won’t be proud of anymore. Please, if you have that kind of guess, DM, submit to a tip form, email a reporter.”
On Thursday, Scott-Railton announced a partnership with Bellingcat, an international collective of investigators, researchers and citizen journalists who use open-source data and social media to investigate events.
“I feel this approach better balances the *many* reasonable concerns about a participatory & crowdsourced model done on Twitter,” he tweeted.
One of the first major instances of crowdsourced misinformation spinning out from a violent incident came after the Boston Marathon bombing in 2013, in which three people were killed and another 260 were injured. Citizen investigators on the online forum Reddit were quick to identify possible suspects, and the New York Post published a photo of two men as the suspected bombers. But that information was false.
Amateur detectives also took it upon themselves to analyze online photos and video after the 2017 “Unite the Right” rally in Charlottesville, Va., at which one woman was killed and others injured after a car plowed into counter-protesters. People on social media used photos to identify white nationalists who organized and attended the rally, leading to public shaming and some getting fired from their jobs.
“The intent for many people may be good, but the unintentional consequences give me pause,” said Oren Segal, vice president for the Anti-Defamation League’s Center on Extremism. “When the tensions are high this way, verification is so important.”
Increasingly sophisticated technology has enabled practitioners of DIY CSI to identify suspects by tattoos, insignia and other formerly hard-to-spot markers. Such technology can help bring people to justice, said Rabbi Abraham Cooper, who oversees the Simon Wiesenthal Center’s Digital Terrorism & Hate Project, which tracks extremist groups.
“We’re not looking for vigilante justice, but the average citizen can help by funneling their images” or other useful tips, he said. In the case of people identifying Capitol rioters, “people are doing their civic duty.”
It’s a “jigsaw puzzle” for intelligence officials and authorities to piece together information, and any aid citizens can give helps, Cooper said.
Lucas Cooter’s contribution to #SeditionHunters has been finding the clearest photos of suspects and trying to put them in a single place by using a standardized hashtag, signal boosting others’ findings.
Like Scott-Railton, he worries that some online detectives might not “understand the gravity” of naming people on the internet.
“That can be an unruly mob as well,” said Cooter, a hardware engineer in San Francisco. “That’s an open problem, and I don’t know how to address it. But there’s a point at which when someone follows a lead, they need to hand it to somebody who is a professional, either a journalist or law enforcement.”
Otherwise, he said, an innocent person’s name could be “forever on Twitter, associated with the crime they did not commit.”
Zofia, a 26-year-old graduate student pursuing her doctorate in marine ecology, adores the “Squad” — Democratic Reps. Alexandria Ocasio-Cortez of New York, Ilhan Omar of Minnesota, Ayanna Pressley of Massachusetts and Rashida Tlaib of Michigan. Part of her reasoning for tracking rioters down online was born out of a sense of wanting to protect the women she admires, who felt unsafe doing their jobs in Congress that day, she said.
As someone interested in data visualization, she has been working to organize visual information by creating composite profiles of people. She doesn’t have an interest in tracking people down on Facebook or Instagram to out their names, she said, because she remembers the pitfalls of misidentification during the Boston bombing aftermath.
To her, the insurrection at the Capitol can easily be explained in ecological terms. And the remedy for that chaotic event will require more than an online scavenger hunt.
“To get rid of root rot on a plant, you have to change the soil and disinfect the roots,” she said. “If you just transplant it, the rot is still on the root and it’s just going to come back.
“If we don’t have that disinfectant — the accountability — I don’t think there is a tenable way forward for democracy.”
