PHOENIX (AP) – They posted on social media their participation in the January 6th riots in the U.S. Capitol, then rushed to say they were in a hurry when they apparently realized they were in legal trouble to erase evidence the authorities. Now her attempts to cover up her role in the deadly siege are likely to come back for prosecution.
An Associated Press review of court records found that at least 49 defendants attempted to delete incriminating photos, videos, and texts from phones or social media accounts documenting their behavior as a pro-Donald Trump mob told Congress stormed and certification of election victory for Democrat Joe Biden.
Experts say efforts to clean up social media accounts show a desperate willingness to tamper with evidence once these people realized they were in hot water. And they say it can serve as strong evidence of people’s sense of guilt and make it difficult to negotiate plea deals and indulgence in convictions.
“It makes them look tricky, makes them look sneaky,” says Gabriel J. Chin, who teaches criminal law at the University of California at Davis.
One such accused is James Breheny, a member of the extremist group Oath Keepers, who bragged in texts that he was in the Capitol during the riot, authorities say. An employee instructed Breheny in an encrypted message two days after the riot to “delete all pictures and messages and get a new phone,” according to court records.
On the same day, the FBI said, Breheny closed his Facebook account, on which he had photos taken during the uprising, and complained that the government had become tyrannical. “The people’s duty is to replace this government with one they agree with,” wrote Breheny on Facebook on January 6 in an exchange about the riot. “I’m all ears. What options do we have ???”
Breheney’s attorney, Harley Breite, said his client never interfered with the riot investigation or destroyed evidence, and that Breheny was unaware that its contents would be considered evidence when the account was closed.
Breite rejected the notion that in the days immediately following January 6, when the uprising dominated coverage, Breheny could have realized that the attack was a grave situation that could endanger Breheny’s freedom.
“You cannot delete evidence if you do not know that you are being accused,” said Breite.
Other defendants, who were not accused of destroying evidence, are still in contact with others about the deletion of content, according to court documents.
The FBI said a woman who posted videos and comments showing she was in the Capitol during the attack later decided not to restore her new phone with her iCloud content – a move authorities suspect should prevent them from uncovering the material.
In another case, authorities said screenshots of a North Carolina man’s deleted Facebook posts contradicted his claim during an interview with an FBI agent that he did not intend to disrupt Electoral College certification.
Deleting digital content isn’t as easy as deleting content from phones, removing social media posts, or closing accounts. Investigators were able to get the digital content by requesting it from social media companies even after accounts were closed.
Posts on Facebook, Instagram, and other social media platforms are recoverable for a period of time, and authorities routinely urge these companies to keep the records until they receive orders to view the posts, said Adam Scott Wandt, professor of public order at John Jay College of Criminal Justice, which trains law enforcement agencies in cyber-based investigations.
Authorities also have other options to investigate whether someone has tried to delete evidence.
Even if a person removes content from an account, authorities can still access it if it was backed up on a cloud server. People who have not been involved in a crime have been sent incriminating videos or photos that they may forward to investigators. Metadata embedded in digital content can also indicate whether it has been changed or deleted.
“You can’t do it,” said Joel Hirschhorn, a Miami criminal defense attorney not involved in Capitol riot cases. “The metadata will do it every time.”
Only a handful of the more than 500 people in the United States arrested in the riot have actually been charged with tampering for deleting incriminating material from their phones or Facebook accounts.
Among them are several defendants in the extensive trial against members and employees of the extremist group Oath Keepers, who are accused of conspiring to block the confirmation of the vote. In one case, a defendant instructed another to “ensure that all signal communications about the operation were cleared and incinerated,” authorities say.
But even if it doesn’t lead to more charges, clearing evidence will make it difficult for these defendants to derive much benefit from the conviction because they took responsibility for their actions, said Laurie Levenson, a professor at Loyola Law School .
Some lawyers could argue that their clients removed the content in order to lessen the social impact of the attack on their families and to show that they did not support the events during the riot. But she said arguments have limits.
“The words ‘selfishness’ will come to mind,” Levenson said. “That is what the prosecutors will argue – you removed it because you suddenly have to face the consequences of your actions.”
Matthew Mark Wood, who admitted to deleting content from his phone and Facebook account that showed presence at the Capitol during the riot, told an FBI agent he had no plans to disrupt Electoral College certification.
But investigators say screenshots of two of his deleted Facebook posts tell a different story.
In the posts, Wood reveled in rioters who “sent these politicians running” and said he stood against a tyrannical government in the face of a stolen election, FBI court records read. “If diplomacy is not working and your message has not been delivered, you shouldn’t be surprised if we revolt,” wrote Wood. His lawyer did not respond to a call asking for comment.
Although she is not accused of deleting content that showed she was in the Capitol during the riot, one defendant told her father that she would not restore her new phone using her iCloud backup about three weeks after the riot, announced the FBI.
“Stay away from the clouds!” According to the authorities, the father warned his daughter. “They are how they fuck us.”