‘Sedition Hunters’: Meet The Online Sleuths Aiding The FBI’s Capitol Manhunt

There’s a mother and former teacher in south central Pennsylvania, a woman I’ll call Joan, who has what she calls a “weird hobby.” She’s a Facebook detective.

“Some people crochet. Some people paint. I look up people,” Joan told me. “I’m the go-to person for all my friends if they meet a new man. They’re like ‘Hey, look him up, give me all the details.’”

When an enraged mob stormed the U.S. Capitol on Jan. 6, Joan was at home watching it unfold. She was deeply upset, finding herself in tears about the violent scene transpiring over 100 miles away in the nation’s capital, which she’d visited as a kid and later on field trips with her own children. “This is not who we are as a country,” she said, before pausing and adding, “Or it’s not who we’re supposed to be.”

So just over a week after the Capitol attack, Joan was thrilled to have a new opportunity for online investigative work opportunity land in her inbox. This time, she wasn’t vetting a potential romantic interest for one of her friends. She was hunting down an insurrectionist.

It’s been nearly six months since a violent mob invaded the U.S. Capitol because they believed then-President Donald Trump’s lies about mass voter fraud and supported his efforts to toss out millions of votes and Joe Biden’s electoral victory. The feds were woefully unprepared for what Trump supporters had in store for lawmakers at the Capitol that day; shell-shocked and outnumbered law enforcement officers were overwhelmed by rioters and made only a handful of arrests. The U.S. Capitol — the closely guarded building where a cardboard protest sign or ill-timed laugh could get you led out of a congressional hearing in cuffs — had been overrun by an unruly mob. Hundreds of criminals were on the loose, spread out all across the country. 

The feds have spent the first half of 2021 playing catch-up, churning out Capitol attack cases on a near-daily basis that cover behavior ranging from basic misdemeanor trespassing to brutal felony assaults on police officers. As the unprecedented probe reshapes the federal government’s approach to domestic terrorism, Justice Department officials announced last week they had cleared the benchmark of 500 arrests. Hundreds more are in the works, and Attorney General Merrick Garland said federal authorities would “continue to follow the facts in this case and charge what the evidence supports to hold all January 6th perpetrators accountable.”

Garland, the former Oklahoma City bombing prosecutor and federal appellate judge whom Biden formally named as his nominee for the Justice Department’s top position just hours after the insurrection, said DOJ’s efforts were “not possible without the continued assistance of the American public.”

Much of that assistance has come from people who personally knew Capitol suspects, including family members, coworkers, neighbors, Facebook frenemies, and old classmates who tipped off the FBI about the actions of someone they knew in real life. 

But there’s a whole other batch of Capitol defendants who ended up on the FBI’s radar thanks to the work of someone they’d never met: anonymous online sleuths who tracked down the digital breadcrumbs that Capitol suspects had often unknowingly sprinkled across the internet.

They call themselves sedition hunters, and they have receipts. They’re members of a loosely affiliated network of motivated individuals and pop-up volunteer organizations with names like Deep State Dogs and Capitol Terrorist Exposers that developed after the Jan. 6 attack to identify the Trump supporters who organized the Capitol riot and brutalized the law enforcement officers protecting the building. 

The sedition hunters scour the web for any and all photographs, videos and posts from people at the Capitol during the Jan. 6 attack across well-known websites like Facebook, YouTube and Twitter along with lesser-used sites and apps like Rumble, Gab and Telegram. They’ve got spreadsheets, Google Docs, links, bookmarks, unlisted YouTube backups, group chats and screenshots, as Joan puts it, “coming out the rear end.” They can uncover new evidence of conduct that’ll elevate a misdemeanor trespassing case into something much more serious; find the highest-quality image of a suspect that could generate new leads through facial recognition; and compile multimedia databases that turn the Jan. 6 attack into an interactive, high-stakes and soul-crushing edition of Where’s Waldo. 

Some of the early Jan. 6 online sleuthing efforts, much like the early stages of the FBI investigation itself, were a bit chaotic. Some social media users started tossing out names without doing due diligence. But as the weeks and months went on, the online investigators rather swiftly professionalized, taking cues from open-source research experts like John Scott-Railton of the Citizen Lab at the University of Toronto and the open-source research organization Bellingcat. (Rule no. 1: No naming suspects on social media; read up on the Boston Marathon bombing.) The community came together on Twitter, but now much of the more sensitive work takes place in non-public spaces ― chat rooms, DM groups, shared Google documents ― where members of the community collaborate and vet tips before they send them to the feds and, in some cases, share them with reporters.

Some of the investigations, like the one that helped take down Trump fanatic Daniel Rodriguez for electroshocking D.C. Metropolitan Police Officer Mike Fanone, are the work of trained researchers who prefer terms like OSINT to refer to their open-source intelligence techniques. Others, like the online sleuths who identified the man who assaulted officers with a fire extinguisher while wearing in an American flag jacket emblazoned with Trump’s name as Robert Scott Palmer, are self-described amateurs bringing their preexisting skills to the table and pick up techniques as they go along. 

There are regional-focused sedition hunters like Joan, who collect evidence on Capitol rioters in their own backyards, and then there are groups that zero in on specific organizations like the Oath Keepers. There are archivists with the encyclopedic knowledge of the timeline, locations and key players in the Jan. 6 attack. There are hashtaggers who generate catchy, memorable nicknames to help the community track the actions of suspects still at large. There are the computer whizzes who create slick websites that let you explore evidence in a user-friendly format. There are the diplomats who serve as liaisons between break off groups in the larger sedition hunters network, working to ease tensions and keep everyone working together in pursuit of a common goal. 

Since the Capitol attack, I’ve been in touch with dozens of investigators digging into the Capitol attack. They span the country ― from progressive enclaves to deep-red Trump territory ― and even the globe. Some of them have shared their names, others have disclosed personal details, and still others are fully anonymous sleuths I know only by their usernames, icons and investigative track records.

There’s the academic tracking down Capitol seditionists in the heart of Trump country; the woman who perfected her detective skills as she recovered from cancer surgery; the online researcher desperately trying to get someone at the FBI to accept gigabytes of Capitol videos they have scraped from the depths of the internet; the sedition hunter known by their thumbs-up emoji who’s “just helping out” because they felt a duty to their country to archive as much Jan. 6 material as possible, and is still seeing “mountains” of new material every day; the meme-making sleuth from the Hague who enjoys both hunting down insurrectionists and filming TikToks with her grandkids.  

Even the spouse of a Capitol Police officer has joined in, leaning on their familiarity with the Capitol grounds and trying to channel their frustration into something productive.

Since Jan. 6, this pop-up probe launched by a ragtag group of volunteer investigators has developed into a well-oiled machine churning out leads faster than feds can pick them up. Sedition hunters are happy to help. They’d just like a little feedback.

Sammy is a sedition hunter who started hunting for insurrectionists as she recovered from cancer surgery. Sammy, which is a pseudonym, found herself “immersed” in the work, which she found to be a wonderful escape from reality. “It’s a great distraction from my own worries,” she told me. “I feel like I’m doing something useful when I can’t do much of anything else.”

Yet Sammy was also growing flustered not knowing whether the tips she submitted actually ended up in the right hands. She jokingly suggested the FBI take a page from the Domino’s Tracker app, imagining getting alerts assuring her that her tips weren’t just buried in an inbox somewhere. ”1 p.m.: Agent Smith has received your tip,” she imagined they’d say. ”3:45 p.m.: Agent Smith is cross-referencing your tip.”

“Then when they actually go and get the guy, they show, like, a Google Map in real time,” she said, laughing.

There are very valid reasons that the FBI can’t go into that much detail about an unfolding investigation, of course, but tipsters still sometimes feel like the feds aren’t paying attention. The bureau has to sort through hundreds of thousands of tips, and solid leads on violent insurrectionists have been overlooked. With no feedback loop, frustrated sedition hunters have no clue what is happening behind the scenes, and are sometimes left thinking that the information they submitted to the bureau is just buried in a database somewhere.

The process between tip intake and arrest can easily stretch into weeks and months, especially given the massive backlog of tips that the FBI received in the immediate aftermath of the Capitol attack, when there was a 750% increase in calls and electronic tips to the FBI’s National Threat Operations Center. Anonymous tips can take longer to verify than tips from those who know a suspect personally. But the feds appreciate the public’s help, and want to reassure Capitol tipsters frustrated by what those operating at internet speed see as the slow-churn of federal prosecutions and bureaucracy.

“As we have seen with dozens of cases so far, the tips matter. While it may appear that no overt law enforcement action is being taken on some tips that have been submitted, tipsters should rest assured that the FBI is working diligently behind the scenes to follow all investigative leads to verify tips from the public and bring these criminals to justice,” the FBI said in a statement to HuffPost.

Members of the public, the FBI statement said, have “provided tremendous assistance to this investigation, and we are asking for continued help to identify other individuals for their role in the violence at the U.S. Capitol.”

While the term “sedition hunters” continues to pop up in FBI affidavits, the full impact of their work often flies under the radar. Take the network’s efforts to publicize images of wanted suspects. The FBI’s Capitol Violence wanted page, which has now featured images of more than 410 suspects, has evolved past the PDF compilations the bureau was posting in the immediate aftermath of Jan. 6. But the websites and easily shareable social media cards generated by the sedition hunters, which aren’t subject to the FBI’s constraints, often feature better images, more direct evidence of violence, and catchy nicknames that can generate social media discussion. 

Often, witnesses have contacted the FBI about someone they know not because they saw something on the FBI’s website or social media accounts, but because they saw info generated by sedition hunters. 

The FBI has long generated nicknames to increase publicity and get tips from the public, particularly for bank robbers. So far, they’ve refrained from doing so in the Capitol manhunt. (Republican trust in the FBI had plummeted even before the bureau started arresting hundreds of Trump supporters and plastering images of MAGA-hatted assailants on its website, and nicknames poking fun at Trump-loving rioters probably aren’t going to build any bridges.) Sedition hunters have no such qualms, and are happy to step into the void. 

A sleuth who goes by Erica started working on hashtags after she’d begun her sedition hunting by watching video recordings of the violent attacks on police and reporters at the Capitol. That can be a disturbing exercise, she said, and some sleuths will only watch videos with the sound off. “The reality is that people did terrible, unprecedented things, and there’s a deep responsibility in trying to hold them accountable,” she said. Generating hashtags, Erica found, was a welcome break.

“It’s hard and depressing to watch these videos,” Erica said. “The hashtags, if they’re funny, help add a bit of levity.”

There was “Bald Eagle,” the guy wearing an American flag suit and an eagle mask who, when he took the mask off after joining the mob trying to push through a police line, revealed his bald head; “Tricorn Traitor” for the guy in the colonial hat; “Pippi Long Scarf” for the guy with the long scarf; “Pinky N The Brainless” for a woman with pink hair and her partner. One of the Proud Boys was designated “Ray Ban Terrorist.” (Erica ― noting his slicked back curly light brown hair ― would’ve preferred “Amber Waves Of Lame.”) The guy jumping around with friends and yelling “fuck antifa” was a group effort: He had a beard that looked like a lawn ornament, so he became “Party Pants Gnome.” FBI Capitol Violence suspect no. 405 ― the woman in the red outfit wanted for assaulting officers ― became “Trumpy Valentine.”

The sedition hunters don’t have to worry much about upsetting any Trump supporters with nicknames like “Bubba Two Hat” or “Bullhorn Karen;” they may come from different backgrounds, but there aren’t many Trump fans in the mix.

The sleuths say their primary motivation is to their country, and want to bring those who participated in the riot to justice. They may take a bit of glee in how easy some of the Trump supporters made their work in some cases: Making social media posts about your commission of a federal crime probably isn’t the smartest move in the world, nor is committing crimes with your uncovered face when there was a perfectly valid reason — a mandate, in fact — to wear a mask. But they say their primary motivation and focus is getting justice for the victims of the Capitol attack and trying to ensure the violence of Jan. 6 is not repeated. 

“This is not a hit job,” said a sedition hunter who goes by Dianna. “I can’t say what I’d’ve done if it had been a million women marching in pussy hats who attacked the Capitol. But guess what? That didn’t happen. We don’t live in that world.”

Joan, the mom from Pennsylvania, stumbled into the sedition hunters world by chance. Someone in the budding community reached out through a political Facebook group she runs, hoping for publicity. The internet detectives were trying to identify the man who stormed onto the floor of the U.S. Senate wearing a “Hershey Christian Academy” sweatshirt, and they thought she could help spread the word.

Joan got to work. She went to Hershey Christian Academy’s Facebook page and started digging, learning everything she could about the small school with barely a dozen staff members. It had only opened in 2019, and now ― because someone had the bright idea of breaking into the Capitol while wearing school swag ― it was at the center of the insurrection.

“I went and started looking at all the likes, all the comments. Then on every single like and comment I would go look on their profile and snoop around and say, ‘Oh, that guy’s too fat, that guy’s too bald, that guy’s too bearded, it’s not him,’” she said.

Soon she stumbled on a “pretty vanilla” Facebook profile of a man named Zeeker whose main photo was of a snowman. When she plugged Zeeker’s name into Facebook’s search bar, she turned up photos that he’d been tagged in. She realized she might just have a match. She took some screenshots, poked around his Instagram, and did a bit of Googling.

“Zeeker Bozell,” she learned, was Brent Bozell IV — as in the son of Brent Bozell III, the high-profile conservative activist and founder of the Media Research Center, and grandson of Brent Bozell Jr., the ghostwriter for Barry Goldwater and supporter of Joseph McCarthy.

“Whoa,” she thought as she went down a Google rabbit hole and read his grandfather’s Wikipedia page, which laid out the family’s ties to William F. Buckley, who founded the National Review and is considered the intellectual godfather of the conservative movement. “I’ve really stumbled on something.”

“I mean, I’m just, like, a mom,” Joan later told me. “It was kind of a holy shit moment.”

The FBI enlisting the public’s help to hunt down criminals is not a new phenomenon. Even back in its early days, when it was still called the Bureau of Investigation, it crowdsourced the hunt for the people who kidnapped Charles Lindbergh’s baby by distributing pamphlets across New York banks that listed the serial numbers for the expiring gold certificates that had been used in the ransom payoff, and eventually got a hit after a sharp gas station attendant thought to jot down a license plate number on the margin of the certificate. 

By 1950, former FBI Director J. Edgar Hoover had launched the FBI’s Most Wanted list in an effort to have the public help hunt down dangerous fugitives. During the hunt for the Unabomber in the 1990s, investigators deployed a media strategy that bumped up against internal FBI rules about how much information could be shared about an ongoing investigation, and former Attorney General Janet Reno eventually approved the task force’s decision to publish Ted Kaczynski’s manifesto in hopes of enlisting the public’s help in identifying him.

Twenty-five years after The Washington Post and New York Times published the Unabomber manifesto, Kaczynski’s worst nightmares about technology are reality. The Capitol defendants have been sucked into a digital dragnet: They’ve been captured on surveillance footage, caught on countless cell phone photos, nabbed on police body camera footage. The cell phones in their pockets, in addition to pinging towers that would allow the feds to easily pinpoint their location with a search warrant, also spewed location data to various apps like Facebook, which was not only a forum for Capitol insurrections to document their criminal activity, but also the place where they were radicalized in the first place. 

The problem for the FBI isn’t a lack of leads. It’s that they’re drowning in information, and the federal bureaucracy isn’t equipped for this kind of workflow. Hundreds of thousands of tips is a lot to work through, even for a world premier law enforcement organization.

Many sleuths have adapted to the pace of federal investigations, but there are still a lot of the decisions that leave them scratching their heads. The semi-famous QAnon supporters ― previously featured on Vice News and in a HBO documentary ― who were arrested by the FBI last week? Sleuths had the husband pegged back in April after the FBI posted his photo, and wondered why the feds didn’t just Google the names in the article that featured the image. When the FBI raided the home of an Alaska woman the bureau had mistaken for another Trump supporter who’d entered the Capitol and grabbed a laptop in Nancy Pelosi’s office, online investigators didn’t get why the FBI hadn’t taken a closer look at her husband’s public Instagram page, which was cited in the search warrant and made it clear they had the wrong woman.

It’s a bit exhilarating to be a few steps ahead of an FBI investigation, to know what’s coming weeks or even months before the feds arrive at the door of a Capitol rioter. Chris Sigurdson knows the feeling better than most. The Canadian man has submitted at least half a dozen tips to the FBI, but hadn’t heard anything back from the bureau when I spoke to him in April. But his Twitter handle did pop up in an FBI affidavit without warning in February, an experience he described as “surreal.” 

“If someone tried to design the whole system in which all of these sedition hunters are operating, you couldn’t create it,” Sigurdson said. “It emerged organically, not just out of this event, but from Charlottesville and that whole experience of trying to identify people involved with that.” 

Sigurdson, like a lot of sedition hunters, found the initial days exhilarating. Over time, he said, the work transformed from less of a side hobby to more of an obligation. “Once I had to open up a spreadsheet so I could keep track of everything, suddenly it felt less like an online adventure game and more like an occupation,” Sigurdson said.

Joan dialed in her tip to the FBI’s National Threat Operations Center in mid-January, just after midnight. The bureau was completely overwhelmed in the aftermath of Jan. 6, so she was stuck on hold for about 45 minutes. She gave her info, and waited for the FBI to get in touch.

Ten days later, an FBI agent gave her a call. Joan laid everything out. What Joan called her “weird little detective hobby” had left the FBI special agent impressed. ”How did you get all of this just from seeing his picture?” she said he asked her. ”You got his whole life story!”

But the FBI was swamped. Thousands of tips were pouring in everyday, and sorting through the chaos was a logistical nightmare. The charges against Bozell wouldn’t come through for weeks. Joan had at least gotten a call back ― a real, live FBI special agent was on the case. Still, like thousands of other FBI tipsters, Joan grew a bit impatient as time dragged on. ”Come on,” she thought, ”I handed this guy to you on a silver platter! Where is his arrest?”

Finally, it happened: Leo Brent Bozell IV ― aka “Zeeker” ― was arrested, and the charges against him unsealed. 

Joan kept going, taking to the broader hunt for insurrectionists with zeal as she scoured videos and followed suspects known only by a hashtag as part of the crowdsourced efforts. She kept an eye out for Bozell too, and she eventually spotted that sweatshirt again. Twice, in fact. In one video, Bozell is on the front line of the battle with police officers, attempting to rip down a tarp and let the mob through. In another, he’s smashing a Capitol window. So weeks after she helped the FBI identify Bozell, she pointed federal authorities to evidence they seem to have overlooked.

“Thank you very much for this new information,” the FBI special agent wrote in an email after Joan passed along links. “I will make sure I share this with the prosecutors in the case.”

The next day, prosecutors presented their evidence before a federal grand jury in Washington, which indicted Bozell on seven counts. Among the new felony charges: destruction of government property for breaking a window.

Joan was blown away — and a bit intimidated — by the role she’d played in identifying a member of a conservative political dynasty as a Capitol insurrectionist and helping the FBI build the case against him. A hobby Joan snuck in while taking care of her kids could land Bozell — the namesake of men who were at the forefront of America’s conservative movement for the better part of a century — in federal prison.

Joan is now all-in on her sedition hunters work. She’s got her files organized and continues sending information to the FBI, and uses an anonymous Twitter account to keep the world informed about the activities of Capitol rioters who have been charged (or who will soon be arrested). She’s mapping out the networks of Jan. 6 riot participants, including many of whom traveled to D.C. on buses paid for by Pennsylvania state Sen. Doug Mastriano, a right-wing Republican with a big Facebook following who gained notoriety by promoting Trump’s big lie about the election and is now weighing a run for governor. 

“You can get really deep in there and addicted,” Joan said. “You can spend hours going down this rabbit hole.”

And she remains astonished that Bozell wore a sweatshirt bearing the name of a tiny school his child attended as he stormed the U.S. Capitol, smashed out a window, and took over the floor of the U.S. Senate in an attempt to overturn the election on behalf of Donald Trump. 

“He probably would’ve gotten away with it,” Joan joked, “if it weren’t for these meddling sleuths.”