Capitol Attack: Use by Federal Agencies of Open Source Data and Related Threat Products Prior to January 6, 2021


What the GAO found

Federal agencies obtained and shared social media posts and other publicly available information — referred to in this report as “open source data” — about potential criminal activity prior to January 6, 2021. The 10 agencies selected, including the Federal Bureau of Investigation (FBI) and the Department of Homeland Security’s (DHS) Office of Intelligence and Analysis, which play a leading role in countering domestic terrorism and violent extremism, were at the aware of open source data about the events planned for January 6, and seven were aware of the potential violence planned for it. daytime. They obtained the data through manual web searches, sharing with each other and social media platforms. For example, prior to Jan. 6, the FBI reviewed information about an online threat that spoke of calls for violence, including “Congress needs to hear breaking glass, kicking doors, and blood. .. Get violent… Go ready for war.” Additionally, in mid-December 2020, the DHS Office of Intelligence and Analysis received information regarding threats against Congress and elected officials and discussions of the introduction of firearms into DC on the 6th january. Additionally, an agency received data from a social media platform on December 24. 2020, which included a user threatening to kill politicians and coordinate armed forces on January 6.

Number of relevant threat product agencies created before January 6, 2021

Seven of the 10 agencies have developed 38 election-related threat products based in part on open source data to inform security planning (see figure). Twenty-six of them were for events scheduled for January 6. Of these, the FBI prepared one and the DHS prepared two threat products. The 26 products included these threats:

  • Potential for violence between opposing groups. Six agencies identified that violence could occur if opposing groups came into contact.
  • Groups or individuals can be armed. Five agencies identified that individuals or groups planned to attend events while armed.
  • Groups or individuals may use improvised weapons. Three agencies have identified that individuals may use weapons, such as explosives.
  • Extremist groups can commit or incite violence. Seven agencies identified that extremists could incite violence during protests.
  • Groups can attack the Capitol or Congress. Two agencies have identified the Capitol or Congress as targets of violent attacks based on election results.

Why GAO Did This Study

Open source data indicated that the potential for violence at the United States Capitol emerged online months before the January 6, 2021 attack. Law enforcement may use posts on social media platforms and other open source information to identify potential criminal activity, to develop “threat products” and to conduct criminal investigations. Agencies must consider privacy, civil rights and civil liberties protections when collecting and sharing this information.

The GAO has been asked to review information related to the January 6 Capitol attack. This is the fifth in a series of reports on Aspects of Attack. This report discusses the open source data that certain federal agencies have obtained and shared, as well as the threat products they have developed that leveraged that data related to the January 6 events.

To carry out this work, GAO reviewed the open source data that the agencies obtained and shared, as well as the threat products that exploited the data. Agencies reviewed by the GAO included those of DHS; the Ministries of Justice and Interior; Architect of the Capitol; United States Capitol Police; the Sergeants-at-Arms of the House and Senate; and the U.S. Postal Inspection Service, as they had specific roles in preparing for the planned January 6 events. The GAO questioned officials from Facebook, Parler and Twitter about the extent to which they shared information with the agencies. The GAO selected social media platforms based on, for example, their appearance in threatening products.

This report is a public version of a sensitive report published in February 2022. Information deemed sensitive by the agencies has been omitted.

For more information, contact Triana McNeil at (202) 512-8777 or [email protected]


Comments are closed.