Law enforcement scrutiny drives US extremists into internet's dark corners

Shortly after rampaging supporters of US President Donald Trump attacked the US Capitol on 6 January, a fan of the president posted a message on the pro-Donald Trump website, TheDonald.win.

Inspired by the mob's attempt to stop lawmakers from confirming President-elect Joe Biden's electoral win, user CONN_WYNN said in an all-caps message, replete with an expletive, that it was "TIME TO LEAVE THE KEYBOARD" and "FIGHT FOR MY...COUNTRY."

Two days later, agents from the US Federal Bureau of Investigation's San Francisco field office came calling, according to another post by CONN_WYNN on the same website.

"PRO TIP: Think before you post. They are watching. I learned the hard way," wrote the user on Sunday alongside a photograph of a business card from the agents.

A spokesman for the FBI's San Francisco office said he could not provide any details about the reported interaction or confirm whether agents actually paid a visit to the person who posted that message. But "if he has our business card and said he was visited, I'm pretty sure we visited him," the spokesman said.

Before the Capitol attack, such a post may not have elicited a follow-up visit. But in the aftermath of the riot, which left five people dead, federal law enforcement agencies have intensified their scrutiny of extremist chatter online, activity that officials warn could be early warning signals of planned attacks around Biden's inauguration in Washington on 20 January.

"You don't want to be the ones to have FBI agents knocking on your door at 6am," director Christopher Wray said on Thursday during a televised briefing with Vice President Mike Pence.

"Anybody who plots or attempts violence in the coming week should count on a visit."

For months, far-right extremists have been openly posting their threats on public sites. Now, wary of surveillance and amid a crackdown by social media, some are shifting their online communications to private chats or lesser known platforms that could make those threats harder to find.

Several social media websites that are popular havens for far-right views have closed, crashed or cracked down on violent rhetoric over the past week. For example, Apple and suspended the social media site, Parler, from their respective App Store and web hosting service, saying it had not taken adequate measures to prevent the spread of posts inciting violence.

That has pushed some users to more private platforms such as Telegram, the Dubai-based messaging app, and lesser-known social media sites like MeWe.

US downloads of Telegram from Apple's App Store and from Google Play rose to 1.2 million in the week after the Capitol assault, a 259 percent increase over the previous week, according to Sensor Tower, a data analytics firm. Roughly 829,000 US users downloaded MeWe in the week after the attack, a 697 percent increase, the firm found.

David Westreich, a MeWe spokesman, said the company has frequent membership spikes and that "only a small fraction" of the hundreds of thousands of public groups on the platform dealt with politics. Westreich said MeWe's terms of service were "designed to keep out lawbreakers, haters, bullies, harassment [and] violence inciters".

Telegram did not respond to a request for comment.

The FBI received nearly 100,000 "digital media tips" about potential unrest related to the election and Biden's inauguration, an official told reporters on Tuesday, and has pleaded for more information from the American public.

Jared Maples, director of the New Jersey Office of Homeland Security and Preparedness, told Reuters his office was "doubling down" on its work to track possible domestic extremist threats and "making sure we're aware of what the chatter is online".

The FBI warned this week in bulletins and a call with law enforcement agencies nationwide of possible armed protests in Washington and at state capitols in the days leading up to Biden's inauguration.

Extremists seeking a politically motivated civil war and those seeking a race war "may exploit the aftermath of the Capitol breach by conducting attacks to destabilise and force a climactic conflict in the United States", officials wrote in a joint bulletin issued on Wednesday by the National Counterterrorism Centre and the Departments of Justice and Homeland Security and seen by Reuters.

Wray said at the briefing on Thursday that his agency was tracking calls for potential armed protest in the lead-up to Wednesday's inauguration, adding that "one of the real challenges in this space is trying to distinguish what's aspirational versus what's intentional".

Monitoring more difficult

The crackdown on public-facing extremist content is not necessarily all good news for law enforcement trying to combat threats, said Mike Sena, director of the Northern California Regional Intelligence Centre, which monitors threats and facilitates information sharing.

"When you shut down a platform that has public access, you drive people out of the light," Sena said.

"Often times that's our only way to find them because they're having conversation and making statements that are open to see."

The upside of driving extremists underground, Sena said, is that it is harder for them to radicalise others when they do not have access to more mainstream platforms.

Law enforcement is also in the difficult position of determining whether people saying "despicable" things online intend harm or are "just practising keyboard bravado", Steven D'Antuono, assistant director in charge of the FBI's Washington field office, said on Tuesday.

In the United States, freedom of speech is strongly protected under the First Amendment of the Constitution.

In Queens, New York, on Tuesday, federal agents arrested Eduard Florea at his home on a weapons charge after he posted violent threats to Parler on 5-6 January, prior to its suspension by its web host, Amazon.

Florea posted that he had "a bunch of guys all armed and ready to deploy" to Washington, DC, and threatened the life of Democratic Senator-elect Raphael Warnock of Georgia, who is Black, according to a complaint filed in federal court. In court, his lawyer called the posts "blather on the internet".

Shift to new platforms

Days after the Capitol attack, Facebook and Twitter purged some accounts that violated their policies around violence and hate speech, and other companies followed suit.

Chris Hill, leader of the III percent Security Force, a Georgia-based militia group, said his organisation's website had been taken offline on 8 January by its hosting service GoDaddy for violating its terms of service. A GoDaddy spokesman said the site had been removed due to content that "both promoted and encouraged violence", a claim Hill called "laughable."

The moves sent users scrambling to other platforms.

On Telegram, Enrique Tarrio, leader of the right-wing Proud Boys, welcomed new users "to the darkest part of the web" with posts that made light of the Capitol siege and linked to other Proud Boys' channels on the service.

Gab.com, a social media platform popular with right-wing users, said in a Twitter post on Thursday that it had drawn 2.3 million new users in the past week.

Amid the online reshuffling, conflicting messages have surfaced in far-right chatrooms and forums about possible protest actions around the inauguration.

Digital flyers have circulated in those spaces for weeks advertising armed marches in Washington and state capitals around the inauguration, posts that prompted recent warnings from federal law enforcement about potential violence.

But some far-right groups on public platforms have cautioned supporters to avoid such demonstrations, saying, without evidence, that they are traps set by law enforcement to crack down on gun rights.

Devin Burghart, executive director of the Institute for Research and Education on Human Rights, which monitors extremists, said that nearly all of the planned protests his group had been tracking around the inauguration had been cancelled or gone underground.

"That said, we're still receiving lots of anecdotal reports of individuals who were involved in the January 6 insurrection returning to DC on January 20," he said in an email.

Missed signs

A 5 January memo from an FBI office in Virginia underscores the difficulties facing law enforcement agencies now in trying to determine which threats around the inauguration are real and which are bluster.

The memo described possible violence by Trump supporters at the Capitol last week. It was downplayed by many law enforcement agencies, partly because the FBI labelled the material unconfirmed "open source reporting", according to a law enforcement source familiar with the memo.

Extremism experts had also noticed violent rhetoric lighting up online forums including Facebook, Gab and Parler in the days before the 6 January insurrection at the Capitol.

"It was frightening how open folks were being about the violence they wanted to commit," said Melissa Ryan, CEO of Card Strategies, a consulting firm that researches disinformation.

Posters on TheDonald.win, for example, had fantasised about murdering members of Congress and even shared tips on how to tie nooses, Ryan said.

Such posts became unusually frequent in the lead-up to Wednesday, according to Ryan. "We had definitely seen threats on these threads before, but it was just the overall volume - you were seeing it take over the conversation," she said.

With many users now having migrated to harder-to-monitor communication channels like Telegram since last week, those kinds of threats are more difficult to spot now.

Frank Figliuzzi, a former assistant FBI director for counterintelligence, said law enforcement officials will be more active in letting some right-wing online users fomenting violence know they are being watched.

"You bet they're going to be knocking on more doors, letting people know, 'We're here'," he said.

- Reuters