Extremists move to encrypted apps, complicating law enforcers' tracking

In the days after a pro-Trump mob rioted at the U.S. Capitol, Twitter suspended more than 70,000 accounts, Facebook purged an undisclosed number, and Amazon Web Services booted Parler - one of the more popular platforms among far-right domestic extremists - entirely offline.

The FBI has warned about the potential for violence through Wednesday's inauguration in capitols across the country, saying domestic violent extremists "pose the most likely threat . . . particularly those who believe the incoming administration is illegitimate."

The targeted accounts and platforms have increasingly seethed with rage over perceived but unfounded grievances and conspiracy theories: criminal immigrants invading the country, an election stolen from President Donald Trump and Satan-worshipping Democrats trafficking in child sex. Communications on these platforms provided law enforcement with insights into disparate groups or movements - some paramilitary, some avowedly white supremacist - and which might be planning violent attacks.

But when the toxic online discourse coincided with an unprecedented assault on the Capitol that left five dead, U.S. tech firms shut accounts and kicked Parler off the Web, leading thousands of users to migrate to encrypted apps and less-moderated platforms such as Telegram, which is based overseas.

"It's good news and bad news," said John Miller, deputy commissioner of intelligence and counterterrorism for the New York Police Department, the largest metropolitan police force in the nation. "The good news is for a moment it interrupts the conversation to a mass audience that seems to be growing. The bad news is they're going to have to find another platform. And you're going to have to find that platform to follow them."

The shift to fringe platforms also concentrates the users into smaller forums, where "they will be met by others just as angry and disaffected as they are without any moderating influence from a broader public" said Rita Katz, founder of the SITE Intelligence Group, which tracks online extremism.

The violent discourse is not entirely muzzled. One site, TheDonald.win, which was instrumental in mobilizing Trump supporters to participate in the Jan. 6 attack on the Capitol, is still up and running, still trafficking in violent ideas, said Katz.

On Jan. 10, for instance, a thread posted on TheDonald discussed arresting and executing House Speaker Nancy Pelosi, D-Calif., and other political leaders for "sedition and treason," according to SITE.

At the end of day, said Katz, the advantage to the public safety outweighs the disadvantage to law enforcement of losing a surveillance window. "When these extremists are on mainstream media, they spread blatant disinformation," she said. "Pushing them off is one of the most crucial steps in curbing far-right radicalization and conspiracy theories online."

State and local law enforcers have used social media to anticipate the size of protests and whether they might turn violent. It "helps us track the flow of protest interest and track the interest of those who had, in the past, been known to be unlawful at a protest," said Nick Street, a spokesman for the Utah Highway Patrol, which is charged with protecting the state Capitol. "It just means we can better do our job by knowing who is coming and the amount of people who are coming."

The smartest and most ardent violent extremists have always used more secure, encrypted channels. And, Street noted, many protesters were aware that law enforcement agents might be watching public forums. "You'd see comments . . . like 'Hey, stop talking about it here, the cops are watching,' " Street said. "Well, like, yeah we're watching. No kidding. Why wouldn't we be?"

Even if law enforcement is not monitoring all comments, said one former federal agent, there is no harm with extremists thinking so, if it subdues their activity. "Let 'em think everybody's a fed," said the former agent, speaking on the condition of anonymity to be candid.

Some agencies rely on the public and researchers to alert them to potential violent acts being discussed online rather than devote scarce resources to monitoring social media. And the recent crackdown has eliminated a tip channel.

Mass attackers, for instance, often have expressed desires to carry out violence in online postings or to acquaintances, a phenomenon that researchers call "leakage."

"There are many things that are reported to us by the community that they see on Twitter and Facebook," said Andrew Walsh, deputy chief of the Las Vegas Metropolitan Police Department. "The trade-off is these platforms are used by people to discuss the plotting and planning of violence, so [their] loss is problematic. But it's also problematic that people have a forum to promote and advertise violence."

Open-source social media is not an infallible tool for law enforcement. Even when content is accessible, it's often not detailed enough to enable authorities to act swiftly. Robert Bowers, who is charged with killing 11 people at a Pittsburgh synagogue in 2018, made a series of anti-Semitic statements on a far-right site. "I can't sit by and watch my people get slaughtered. Screw your optics, I'm going in," he posted on Gab, officials said, less than two hours before entering the synagogue and opening fire. He did not say which synagogue he was attacking.

Most planning of violent criminal activity is done in closed chats and on encrypted platforms, officials said. Last fall the FBI said it thwarted an anti-government group's plan to kidnap Michigan Gov. Gretchen Whitmer, a Democrat, by infiltrating discussions over several months that the plotters thought were shielded in a private Facebook group and encrypted chats.

But the bureau said a member worried about the group's plans to kill police officers had agreed to become an informant. In October, state and federal officials announced charges against more than a dozen people it said were involved in plots, among them members of the Wolverine Watchmen, a self-described militia group, and their associates.

"The FBI with a warrant can spy on closed, nonencrypted chats, but having informants or undercover sources inside these closed virtual networks is important to understanding the nature of the threat," said Javed Ali, a former senior FBI counterterrorism analyst who now teaches at the University of Michigan.

The crackdown on domestic violent extremists resembles in some ways Silicon Valley's gradual push several years ago to remove foreign terrorism content - particularly related to the Islamic State - under pressure, at times, from the federal government, though some officials said content can be retained for intelligence purposes. But it differs in one important respect: Domestic voices have far more protection under federal law. And the tech firms, though they are not bound by the First and Fourth amendments, have been loath until recently to take down even clearly misleading and dangerous statements.

For social media companies, the decision to remove foreign terrorist content was easier, said Clint Watts, distinguished research fellow at the Foreign Policy Research Institute and a former FBI special agent. He noted that "it's international. Everybody hates [the Islamic State]. They are not voters, and they are not donors," he said.

But domestic far-right voices range the gamut from gun-toting, camouflage-clad paramilitaries to suburban moms. "They are voters and donors. They are American citizens," Watts said. Also, foreign terrorist groups are illegal. The extremist ideology QAnon and far-right groups including the Proud Boys and the "boogaloo boys" are not.

Deciding when a violent extremist's posts cross the line from aspirational to operational and merits taking action is also difficult, said Tom O'Connor, a former FBI special agent who worked on domestic terrorism cases for 23 years.

"When a horrendous event takes place like this at the Capitol, people want the FBI to start monitoring everything," he said, "whereas just weeks ago, the same people would have criticized the FBI for reviewing the postings of U.S. citizens."

Monitoring encrypted venues may be beyond the reach of most state and local law enforcement agencies. But that is less of a concern for organizations such as the FBI and the NYPD, and expert groups such as SITE.

"Wherever they end up," said Miller, "we'll find them."