Rioters accused of erasing content from social media, phones

PHOENIX (AP) — They flaunted their participation in the Jan. 6 riot at the U.S. Capitol on social media and then, apparently realizing they were in legal trouble, rushed to delete evidence of it, authorities say. Now their attempts to cover up their role in the deadly siege are likely to come back to haunt them in court.

An Associated Press review of court records has found that at least 49 defendants are accused of trying to erase incriminating photos, videos and texts from phones or social media accounts documenting their conduct as a pro-Donald Trump mob stormed Congress and briefly interrupted the certification of Democrat Joe Biden’s election victory.

Experts say the efforts to scrub the social media accounts reveal a desperate willingness to manipulate evidence once these people realized they were in hot water. And, they say, it can serve as powerful proof of people’s consciousness of guilt and can make it harder to negotiate plea deals and seek leniency at sentencing.

“It makes them look tricky, makes them look sneaky,” said Gabriel J. Chin, who teaches criminal law at the University of California, Davis.

One such defendant is James Breheny, a member of the Oath Keepers extremist group, who bragged in texts to others about being inside the Capitol during the insurrection, authorities say. An associate instructed Breheny, in an encrypted message two days after the riot, to “delete all pictures, messages and get a new phone,” according to court documents.

That same day, the FBI said, Breheny shut down his Facebook account, where he had photos that he taken during the riot and complained the government had grown tyrannical. “The People’s Duty is to replace that Government with one they agree with,” Breheny wrote on Facebook on Jan. 6 in an exchange about the riot. “I’m all ears. What’s our options???”

Breheney’s lawyer, Harley Breite, said his client never obstructed the riot investigation or destroyed evidence, and that Breheny didn’t know when he shut down account that his content would be considered evidence.

Breite rejected the notion that Breheny might have been able to recognize, in the days immediately after Jan. 6 when the riot dominated news coverage, that the attack was a serious situation that could put Breheny's liberty at risk.

“You can’t delete evidence if you don’t know you are being charged with anything,” Breite said.

Other defendants who have not been accused of destroying evidence still engaged in exchanges with others about deleting content, according to court documents.

The FBI said one woman who posted video and comments showing she was inside the Capitol during the attack later decided not to restore her new phone with her iCloud content — a move that authorities suspect was aimed at preventing them from uncovering the material.

In another case, authorities say screenshots from a North Carolina man’s deleted Facebook posts contradicted his claim during an interview with an FBI agent that he didn’t intend on disrupting the Electoral College certification.

Erasing digital content isn’t as easy as deleting content from phones, removing social media posts or shutting down accounts. Investigators have been able to retrieve the digital content by requesting it from social media companies, even after accounts are shut down.

Posts made on Facebook, Instagram and other social media platforms are recoverable for a certain period of time, and authorities routinely ask those companies to preserve the records until they get court orders to view the posts, said Adam Scott Wandt, a public policy professor at John Jay College of Criminal Justice who trains law enforcement on cyber-based investigations.

Authorities also have other avenues for investigating whether someone has tried to delete evidence.

Even when a person removes content from an account, authorities may still get access to it if it had been backed up on a cloud server. People who aren’t involved in a crime yet were sent incriminating videos or photos may end up forwarding them to investigators. Also, metadata embedded in digital content can show whether it has been modified or deleted.

“You can’t do it,” said Joel Hirschhorn, a criminal defense lawyer in Miami who is not involved in Capitol riot cases. “The metadata will do them in every time.”

Only a handful of the more than 500 people across the U.S. who have been arrested in the riot have actually been charged with tampering for deleting incriminating material from their phones or Facebook accounts.

They include several defendants in the sweeping case against members and associates of the Oath Keepers extremist group, who are accused of conspiring to block the certification of the vote. In one instance, a defendant instructed another to “make sure that all signal comms about the op has been deleted and burned,” authorities say.

But even if it does not result in more charges, deleting evidence will make it difficult for those defendants to get much benefit at sentencing for accepting responsibility for their actions, said Laurie Levenson, a professor at Loyola Law School.

Some lawyers might argue their clients removed the content to lessen the social impact that the attack had on their families and show they do not support what had occurred during the riot. But she said that argument has limits.

“The words ‘self-serving’ will come to mind,” Levenson said. “That’s what the prosecutors will argue — you removed it because all of a sudden, you have to face the consequences of your actions.”

Matthew Mark Wood, who acknowledged deleting content from his phone and Facebook account that showed presence in the Capitol during the riot, told an FBI agent that he did not intend on disrupting the Electoral College certification.

But investigators say screenshots of two of his deleted Facebook posts tell a different story.

In the posts, Wood reveled in rioters sending “those politicians running” and declared that he had stood up against a tyrannical government in the face of a stolen election, the FBI said in court records. “When diplomacy doesn’t work and your message has gone undelivered, it shouldn’t surprise you when we revolt,” Wood wrote. His lawyer did not return a call seeking comment.

Even though she is not accused of deleting content that showed she was inside the Capitol during the riot, one defendant told her father that she was not going to restore her new phone with her iCloud backup about three weeks after the riot, the FBI said.

“Stay off the clouds!" the father warned his daughter, according to authorities. "They are how they are screwing with us.”