Cyber Brief: Cyber and the Insurrection, One Year Later

Washington, D.C., January 6, 2022 - On the first anniversary of the January 6, 2021, attack on the United States Capitol, a review of government materials by the National Security Archive’s Cyber Vault project shows the double-edged impact of social media during the episode.  While the Internet played a large role in the planning and execution of the riot, as well as creating various cybersecurity risks, it also enormously facilitated subsequent investigations.  At the same time, its use in surveillance by government agencies has been ringing alarm bells for privacy advocates.

A Congressional Research Service (CRS) Insight, entitled “Cybersecurity Concerns Related to the Recent Breach of U.S. Capitol Security,” (Document 1), was produced within a week of the attack, and discusses “issues related to how the event unfolded” and “summarizes concerns raised among the cybersecurity community” (p.1). The Insight’s author, Chris Jaikaran, highlights the following core issues:

• the role of social media platforms in enabling violent groups to organize and carry out their objectives, and the role of government in monitoring that speech;
• the use of public communications networks for alerting congressional building occupants; and
• the risk to information and technology from unauthorized and unscreened persons’ access to the U.S. Capitol (Ibid.)

Jaikaran cautions that while the report discusses and summarizes the concerns above, “it does not discuss related issues, such as internet regulation, violent extremism, law enforcement responsibilities or U.S. Capitol Security.” (Ibid.)

Perhaps the most immediate concern following the January 6 events was the cybersecurity risk introduced by the loss of physical security during the breach. During the incident, unauthorized individuals illegally entered Capitol offices, stole laptops belonging to Sen. Jeff Merkley and House Speaker Nancy Pelosi, and may have had access to privileged information. In the days following, cybersecurity experts warned of the increased risk of “lost data; corrupted devices; the introduction of unauthorized devices or applications; and compromised networks” (Document 1, p.2). Aside from the gap in secure possession of various devices, experts also cautioned that rioters may have illegally obtained computer or network credentials, such as usernames and passwords, which are often written down and stored in offices for easy (if not secure) access.

In a statement before the House Appropriations Subcommittee on the Legislative Branch at a hearing on the “Health and Wellness of Employees and State of Damage and Preservation as a Result of the January 6 Insurrection” (Document 2), Catherine L. Szpindor, the Chief Administrative Officer of the House of Representatives, recounts the actions taken to secure House technology infrastructure both during and after the attack. In her statement, Szpindor affirms that during the breach the CAO’s Office of Cybersecurity “issu[ed] commands to lock computers and laptops and [shut] down wired network access to prevent unauthorized access to House data” (p.3). After the incident, the Office of Cybersecurity provided further guidance through several e-Dear Colleague letters, asking offices of the House to “(1) account for all IT equipment; (2) contact the cybersecurity team if anything is missing or if a possible breach occurred; and (3) change passwords on any equipment that may have been inadvertently exposed to unauthorized access.” (Ibid.)

Peter G. Berris and Michael A. Foster, legal contributors to the Congressional Research Service, speculated in a CRS Legal Sidebar, “Federal Criminal Law: January 6, 2021, Unrest at the Capitol” (Document 3), that trespassers who accessed government computers or email accounts during the riot could potentially be prosecuted under the Computer Fraud and Abuse Act (CFAA). A prior CRS product written by Berris, “Cybercrime and the Law: Computer Fraud and Abuse Act (CFAA) and the 116th Congress,” (Document 4) sheds further light on CFAA’s application to the January 6 attack. Berris notes that CFAA (18 U.S.C. § 1030) “prohibits seven categories of conduct including … obtaining national security information through unauthorized computer access and sharing or retaining it; obtaining certain types of information through unauthorized computer access;” and “trespassing in a government computer” (Document 4, Summary). To date, no participants in the breach of the Capitol have been prosecuted for crimes under CFAA; however, this may be due to prosecutorial concerns over CFAA’s oft-critiqued vagueness and outdated language, rather than the relevance of the charges.

Facilitating Insurrection: the Role of the Internet

Prior to January 6, 2021, cybersecurity, technology, and national security experts have long warned of the use of social media platforms to recruit, indoctrinate, and coordinate members of both foreign and domestic violent extremist groups. Government efforts to combat extremism, particularly on the Internet, are often debated and constrained by the constitutionally guaranteed rights of freedom of speech and association. Some of the earliest reporting on the attack emphasized the role of social media platforms in both the advanced planning of action to disrupt the certification of the 2020 presidential election and day-of guidance on how to circumvent the enhanced police presence around the Capitol. New York Times cybersecurity reporter Sheera Frenkel noted “as Facebook and Twitter began to crack down [on] groups like QAnon and the Proud Boys over the summer, they slowly migrated to other sites that allowed them to openly call for violence.” Those sites included Gab and Parler. After the smoke cleared, however, many riot participants attempted to erase their digital footprints, expunging online records of their illicit activities. In response, Sen. Mark Warner “urged mobile carriers AT&T, T-Mobile, and Verizon and technology companies Apple, Facebook, Gab, Google, Parler, Signal, Telegram, and Twitter to immediately preserve content and associated meta-data connected to Wednesday’s insurrectionist attack on the United States Capitol.” Sen. Warner’s  January 8 letter to Jack Dorsey, CEO of Twitter, Inc, which Jaikaran argues “rais[es] competing issues of free speech and national security” (Document 1, p.2), is available below for review (Document 5), and is similar in content to the other 10 letters. 

Facilitating Investigation: the Role of the Internet

Other documents in this compendium illuminate how intelligence and law enforcement entities utilized data from social media platforms, even without the platforms’ direct cooperation. While social media facilitated the January 6 attack, it also allowed civilian sleuths (some called themselves “Sedition Hunters”) to collect and share data to identify riot participants and present the information to the relevant authorities. Many tipsters credited the work of Twitter user @donk_enby with providing a tremendous amount of data, scraped from Parler, critical to the search.

This trove of scraped data also caught the attention of U.S. law enforcement and intelligence entities, as evidenced by a January 11, 2021, Situational Awareness Bulletin produced by the U.S. Postal Inspection Service’s (USPIS) Internet Covert Operations Program (iCOP). The bulletin, entitled “Intelligence Summary: United States Capitol Riot Data Archives” (Document 6), notes that although Parler shut down its site on January 10 (due to Amazon suspending their web hosting services), @donk_enby “provided a URL to access the archived data which includes raw files of images/videos posted on Parler with metadata,” enabling users to “identify individuals on the platform, check internal moderators/admins user interfaces, view influencer network status, etc. (p.1). Additionally, the bulletin reports that “the search engine and data archive company Intelligence X, tweeted that they set up a secure public media server for users to submit pictures and videos for archive and public sharing from the Capitol Protest,” and “as of January 10, 2021, the media server has over 200 Gigabytes of data and has surpassed 10 Terabytes of download traffic” (p.2). The bulletin’s authors conclude that while Parler itself is inaccessible for the foreseeable future, “the efforts fronted by … public contributions of data can assist law enforcement in the analysis and identification of parties involved in the US Capitol Protests. The archived information can assist in the possible mitigation of future violent protests.” Exactly how “future violent protests” are to be mitigated remains to be seen.