WEBVTT - Ziptie Guy: OSINT Case Study 0:00:04.960 --> 0:00:07.840 Welcome to It could happen here the podcast we already 0:00:07.840 --> 0:00:11.400 recorded and I messed up UM or something happened with 0:00:11.400 --> 0:00:13.239 the zoom and we lost the audio. So now we're 0:00:13.280 --> 0:00:18.120 recording it again as is, as is the cycle of life. UM. 0:00:18.120 --> 0:00:21.279 Thankfully I can. I'm now on my tenth shot of 0:00:21.360 --> 0:00:23.680 Espresso of the day and it is eight pm, so 0:00:23.760 --> 0:00:26.840 I'm I'm ready, I'm I'm ready this time. Today, we're 0:00:26.840 --> 0:00:31.080 gonna be doing another one of our chronicles into open 0:00:31.160 --> 0:00:35.280 source and O SENT style research or open source verification 0:00:35.640 --> 0:00:38.760 and this kind of side of of generally, you know, 0:00:38.800 --> 0:00:40.479 this is kind of a field of like anti fascist 0:00:40.479 --> 0:00:44.519 research UM and journalism. So we're looking at one of 0:00:44.560 --> 0:00:49.199 these case studies UM. But today I have someone with me, 0:00:50.040 --> 0:00:54.960 Alistair from Opossum Press is here to talk about SENT 0:00:55.640 --> 0:01:00.480 and UH and this type of research. Hello, Hey, thank 0:01:00.520 --> 0:01:03.640 you for being with me again on this on this call, 0:01:03.680 --> 0:01:10.920 on the very experience for us. I would actually first 0:01:10.959 --> 0:01:15.679 like to talk about how Opossum Press got started as 0:01:15.720 --> 0:01:18.759 like a collective of of people dedicated towards this goal 0:01:18.800 --> 0:01:24.679 of you know, surveying the fascist creep. UM. I had 0:01:24.720 --> 0:01:29.399 an interest in UM and journalism. I have no experience 0:01:29.640 --> 0:01:32.199 in it. But I have other friends that are into 0:01:32.240 --> 0:01:36.080 writing and stuff, and I just kind of reached out 0:01:36.120 --> 0:01:38.440 to friends and like, Hey, would anybody be interested in 0:01:38.520 --> 0:01:43.240 doing this? And um, there are several friends that were like, hell, yeah, 0:01:43.400 --> 0:01:46.160 let's do this. And that's pretty much it. After we 0:01:46.200 --> 0:01:50.560 got it all formed. Um, we set up some open 0:01:50.600 --> 0:01:56.040 source intel like workshops and we've about every other week 0:01:56.080 --> 0:01:58.840 we get together for two or three hours and learned 0:01:58.920 --> 0:02:02.840 stuff that sounds that sounds lovely actually, Um, most of 0:02:02.880 --> 0:02:06.280 my stuff is usually done alone in my computer dark 0:02:06.960 --> 0:02:09.040 when I'm on my again tenth cup of coffee of 0:02:09.040 --> 0:02:11.200 the day. Doing O sent in a group of people 0:02:11.240 --> 0:02:12.760 like that sounds like it could be actually kind of fun. 0:02:13.280 --> 0:02:16.040 So yeah, we're gonna In our last episode, we talked 0:02:16.080 --> 0:02:20.079 about how I tracked down and found out who written 0:02:20.120 --> 0:02:25.359 House was the night of of that happening in Kenosha. Um, 0:02:25.440 --> 0:02:28.680 and today we're gonna be talking about someone related to 0:02:28.760 --> 0:02:33.120 January six, um, the infamous zip tie guy, as he 0:02:34.040 --> 0:02:37.720 became known for like two days on the internet before 0:02:37.720 --> 0:02:40.760 he got his actual day. Um. First, I I guess 0:02:40.800 --> 0:02:42.880 I probably I probably In case you haven't listened to 0:02:42.919 --> 0:02:45.600 the previous episode, I did on written house, so probably 0:02:45.720 --> 0:02:48.640 kind of explain what open source stuff is and what 0:02:48.800 --> 0:02:52.679 like O sent is and verification. So it's about trying 0:02:52.720 --> 0:02:57.640 to track down information using open sources UM on the Internet. 0:02:57.680 --> 0:02:59.880 So in terms of like nothing is it's it's all. 0:03:00.400 --> 0:03:02.840 It's it's it's it's it's already sitting there. Nothing requires 0:03:02.880 --> 0:03:06.560 like special access, nothing requires you know, you're to hack 0:03:06.680 --> 0:03:10.840 into anyone system. UM, it's it's stuff is just the 0:03:10.840 --> 0:03:13.080 stuff that's already sitting there. The data, whether that be 0:03:13.120 --> 0:03:17.240 you know, geographical data, personal data, data from social media accounts, 0:03:17.560 --> 0:03:20.720 data from every time you've entered your email into a 0:03:20.800 --> 0:03:23.400 random website that you maybe didn't know quite what's going on, 0:03:23.440 --> 0:03:26.160 but you did it. Some that's that gets stored somewhere 0:03:26.160 --> 0:03:29.200 as data and someone can probably find it. UM. So 0:03:29.280 --> 0:03:31.720 it's all the stuff about you on the Internet that 0:03:31.840 --> 0:03:35.440 is all open if you do the digging. UM. Often 0:03:35.560 --> 0:03:39.080 cases this results in going through social media profiles UM. 0:03:39.120 --> 0:03:42.960 That is a good portion of Osan's work is learning 0:03:42.960 --> 0:03:45.680 how to use Google really well and how to how 0:03:45.720 --> 0:03:48.720 to how to go through social media UM. Start using 0:03:48.760 --> 0:03:52.480 like Google search operators, start using social media tools that 0:03:52.560 --> 0:03:55.240 help you sort through information. Because the information is there, 0:03:55.560 --> 0:03:57.080 You just have to learn how to sort through it, right, 0:03:57.080 --> 0:04:00.360 because there's just so much of it. Um. So that's 0:04:00.400 --> 0:04:02.160 kind of just to what open source stuff is. You mean, 0:04:02.160 --> 0:04:04.280 eventually you can get into the stuff like using like Python, 0:04:04.480 --> 0:04:07.680 using code and scrapers, like all that stuff is there too, 0:04:07.720 --> 0:04:09.400 but for our purposes, we're gonna stick to the more 0:04:09.440 --> 0:04:12.760 simplistic stuff because this is an audio format and I'm 0:04:12.920 --> 0:04:19.440 I'm not going to start explaining Python code on a podcast, right. Um, 0:04:19.520 --> 0:04:23.920 So let's let's let's turn back the clocks a year, um, 0:04:24.200 --> 0:04:27.480 a little over a year, and it's January six. What's 0:04:27.560 --> 0:04:30.160 kind of you or your collective's reaction just to kind 0:04:30.200 --> 0:04:33.280 of watching things unfold? You know, Like as a researcher, 0:04:33.320 --> 0:04:36.720 every every time I look at these types of you know, protests, 0:04:36.760 --> 0:04:38.640 you know, whether they be big or small, always part 0:04:38.680 --> 0:04:40.400 of my brains, like trying to make connections and do 0:04:40.440 --> 0:04:43.560 stuff right. So, as January six is unfolding, what's what's 0:04:43.640 --> 0:04:45.880 kind of going through? Everyone at a post and press 0:04:45.920 --> 0:04:49.560 his head. The first thing that seemed to be collective 0:04:49.600 --> 0:04:52.640 in everybody's mind was, oh my god, none of these 0:04:52.640 --> 0:04:58.360 people are wearing face masks. Yea, like the immediate thing 0:04:58.440 --> 0:05:00.599 is this is probably going to be re really easy 0:05:00.760 --> 0:05:04.120 for a lot of people. There's nobody. Nobody is in 0:05:04.240 --> 0:05:06.640 any type of like block or trying to hide their 0:05:06.680 --> 0:05:10.080 identity in at all, something you see the European fascist 0:05:10.120 --> 0:05:12.280 actually doing more often. There was a I think of 0:05:12.279 --> 0:05:14.240 a video from Germany of a whole bunch of far 0:05:14.360 --> 0:05:16.320 right dudees just to eat in black block because black 0:05:16.320 --> 0:05:20.440 blocks a tactic. Um. So yeah, but in the States 0:05:20.480 --> 0:05:24.200 they're specifically January six, it was Yeah, no one was 0:05:24.240 --> 0:05:27.000 really worried about keeping their identity secret. They really did 0:05:27.040 --> 0:05:30.560 not think what they were doing was wrong. I think 0:05:30.600 --> 0:05:33.920 the other thing we were a lot of us were 0:05:33.960 --> 0:05:40.080 really angry. Um, just like we had been like yelling 0:05:40.200 --> 0:05:43.320 that this was gonna happen, screaming it out, like trying 0:05:43.360 --> 0:05:46.719 to get people to pay attention, and we got blown 0:05:46.800 --> 0:05:50.039 off so much. I remember, just like a few days before, 0:05:50.560 --> 0:05:52.880 I got in an argument with a Facebook friend and 0:05:53.040 --> 0:05:56.720 like people need to be paying attention, like they're planning something. 0:05:56.760 --> 0:05:59.919 They're like, oh, it's fine, it's fine, and then you know, 0:06:00.160 --> 0:06:02.200 just a few days later, I'm like, oh, is it fine? 0:06:02.760 --> 0:06:05.640 Like that is kind of always the curse of surveilling 0:06:05.720 --> 0:06:08.120 all of these things, whether they be like a specific 0:06:08.160 --> 0:06:11.320 event or some movement in general. Right, people who are 0:06:11.360 --> 0:06:13.640 really into q and on before the Libs knew what 0:06:13.720 --> 0:06:16.480 Qunan was and we're warning about it for years before 0:06:16.880 --> 0:06:21.640 you know it resulted in people dying. Um. Right, That's 0:06:21.640 --> 0:06:24.040 that's kind of always the curse of these things is 0:06:24.080 --> 0:06:26.200 that it's it's you get. You get the mix of 0:06:26.240 --> 0:06:29.760 the shock and horder of the thing finally happening and 0:06:29.839 --> 0:06:32.840 a weird relief. It's it's, it's, it's it's it's a 0:06:32.920 --> 0:06:36.719 very bizarre feeling to watch these things unfold because you're like, oh, 0:06:36.760 --> 0:06:40.960 I'm vindicated, but it sucks that I'm vindicated. Right. I remember, 0:06:41.040 --> 0:06:45.159 like the December watching all these groups, like I was 0:06:45.279 --> 0:06:49.159 just it was just filled with dread. Yea. I knew 0:06:49.240 --> 0:06:52.160 something was gonna happen. I didn't know what was gonna happen, 0:06:52.640 --> 0:06:55.360 and it was just so much anxiety. And then like 0:06:55.800 --> 0:06:58.560 it's funny, January six after it happened, like it all 0:06:58.640 --> 0:07:00.320 went away. I was able to get a dec at 0:07:00.440 --> 0:07:04.320 night sleep. Um, just because there was I didn't have 0:07:04.400 --> 0:07:07.719 that build up of suspense of what what is it 0:07:07.760 --> 0:07:10.040 going to be? What's it gonna look like? How bad 0:07:10.160 --> 0:07:14.559 is it going to be? Kind of had that release. Yeah, 0:07:14.720 --> 0:07:18.320 Unfortunately they were all like amateur, didn't know what they 0:07:18.320 --> 0:07:20.200 were doing, and it wasn't as bad as it could 0:07:20.240 --> 0:07:24.520 have been. Yeah. Well, I think as for the open 0:07:24.560 --> 0:07:26.320 source stuff, I'm going to kind of walk us through 0:07:26.400 --> 0:07:31.320 chronologically and of in terms of the journey of zip 0:07:31.320 --> 0:07:35.200 tie Guy because I was doing like archiving on January six, 0:07:35.640 --> 0:07:38.160 But zip Tike I was really the only dude I 0:07:38.240 --> 0:07:41.160 was interested in identifying. There was there was a lot 0:07:41.200 --> 0:07:44.920 of other people doing really great identification work. I was 0:07:45.600 --> 0:07:47.760 also generous six. I was going through all the social 0:07:47.800 --> 0:07:51.600 media history of Ashley Babbitt, archiving all of her Twitter 0:07:51.640 --> 0:07:55.560 and Facebook like years of stuff. I was to chronicle 0:07:55.760 --> 0:07:58.480 how she went from like an Obama voter to a 0:07:58.560 --> 0:08:01.000 Q and on from proponent. So that was what I 0:08:01.040 --> 0:08:02.920 was doing, and I was writing an article with Belling 0:08:02.960 --> 0:08:05.840 Cat about that. Um. But the only only other guy 0:08:05.840 --> 0:08:08.520 I wanted to identify was zip tie Guy because he 0:08:08.600 --> 0:08:10.400 was really interesting. He was one of the few guys 0:08:10.440 --> 0:08:13.520 that was masked up. UM. He had what he had 0:08:13.560 --> 0:08:16.200 visible weapons on him. He was obviously carrying zip ties. 0:08:16.360 --> 0:08:18.840 You know it gives you images of like, oh yeah, 0:08:18.920 --> 0:08:21.720 it's like they're planning to capture and execute people. That 0:08:21.800 --> 0:08:24.960 was like the general kind of vibe um of that. 0:08:25.480 --> 0:08:27.600 So he was the only person that I I was actually 0:08:27.600 --> 0:08:30.080 put work into identifying, and I put a decent amount 0:08:30.080 --> 0:08:33.280 of work in. Now I I failed where other people succeeded, 0:08:33.480 --> 0:08:35.240 and we can talk about like why in a sec 0:08:35.720 --> 0:08:39.160 But for like a day at least, all we had 0:08:39.160 --> 0:08:43.280 to go on was the picture of the guy holding 0:08:43.280 --> 0:08:47.120 the zip ties in a mask. Um. There's a few 0:08:47.120 --> 0:08:48.839 other pictures of him around from that day, but it's 0:08:48.880 --> 0:08:52.760 mostly mostly one picture and the biggest clue that we 0:08:52.800 --> 0:08:56.160 had to start with, Um, what what what? Why? Why 0:08:56.160 --> 0:08:57.920 don't you explain what the what the first clue is 0:08:57.960 --> 0:09:00.959 and how that maybe piqued your interest. He had two 0:09:01.000 --> 0:09:04.720 patches on his vest, and one of them was a 0:09:04.760 --> 0:09:07.679 thin blue line patch, but it was in this uh 0:09:07.840 --> 0:09:12.679 shape of the state of Tennessee. So so yeah, in 0:09:12.800 --> 0:09:16.600 terms of having a decent lead, that is like, okay, 0:09:16.679 --> 0:09:18.880 well that that narrows it down to one of fifties 0:09:18.880 --> 0:09:22.720 states probably right, Yeah, I should say I'm from Knoxville, 0:09:22.920 --> 0:09:26.080 so like it be in Tennessee that I picked up 0:09:26.080 --> 0:09:28.480 on that because that's my state. Yeah, that it becomes 0:09:28.480 --> 0:09:30.880 a local problem. I And as someone in Oregon, I 0:09:30.920 --> 0:09:35.160 definitely understand that feeling of of yeah, when fascism becomes 0:09:35.160 --> 0:09:39.959 a local problem of yeah. So that definitely piqued your 0:09:40.000 --> 0:09:42.880 interest specifically, but then also gives a really good lead 0:09:42.960 --> 0:09:46.880 for like where to look because Ozar, he's not trying 0:09:46.920 --> 0:09:50.280 to do a meta thing by tricking us into giving 0:09:50.320 --> 0:09:53.439 us a false lead. Generally people don't do that as 0:09:53.480 --> 0:09:57.760 often in real life as they do in television. Um 0:09:57.800 --> 0:09:59.720 but there's still has plenty of other ways to detect. 0:09:59.760 --> 0:10:03.120 I mean, I love I love detecting, and there's there's enough, 0:10:03.160 --> 0:10:06.160 there's enough stuff to do otherwise that making it needlessly 0:10:06.200 --> 0:10:09.599 complicated as Honestly, I'm fine with it not being that. 0:10:10.400 --> 0:10:14.839 Um So, yeah, we had we had that to go 0:10:14.920 --> 0:10:20.360 off initially, So starting looking for like far right activity 0:10:20.400 --> 0:10:22.480 in Tennessee. You know, I was an outsiders. I didn't 0:10:22.480 --> 0:10:25.439 really know where to start in terms of specific rallies, 0:10:25.760 --> 0:10:28.360 but I know, used, Uh, at what point did you 0:10:28.360 --> 0:10:30.800 start looking trying to like go through pictures of specific 0:10:30.840 --> 0:10:34.440 rallies to try to like match clothing or stuff. I 0:10:34.480 --> 0:10:36.880 think it was probably it may have been that day 0:10:37.000 --> 0:10:40.120 or the day after when I started going through the 0:10:40.200 --> 0:10:45.320 notebooks that I had, like names of just people we 0:10:45.440 --> 0:10:50.280 suspected may become problems, um, and I started looking at 0:10:50.320 --> 0:10:56.319 their profiles again and you know, didn't find anything. And 0:10:56.320 --> 0:10:58.920 in our research that we had already done, we didn't 0:10:58.920 --> 0:11:02.200 see anything on Yeah, I mean that was kind of 0:11:02.200 --> 0:11:03.960 the case for me as well. With just the picture 0:11:04.000 --> 0:11:07.160 of the zip tie, a guy with the patch, I mean, 0:11:07.240 --> 0:11:09.280 it's it's a lead, but there wasn't tons to go on. 0:11:09.600 --> 0:11:14.640 But thankfully, thankfully are are good friends. At January six, 0:11:15.000 --> 0:11:19.360 we're giving us more clues as because as the Simpsons 0:11:19.360 --> 0:11:22.240 meme goes, videotaping this crime scene was the best idea 0:11:22.320 --> 0:11:27.040 we ever had. Um. So, like January I think seventh, 0:11:27.120 --> 0:11:30.080 there was a live stream video that was kind of 0:11:30.120 --> 0:11:33.240 circulating through like anti fascist group chats um. It was. 0:11:33.280 --> 0:11:35.360 It was posted like publicly to get everyone's attention on 0:11:35.400 --> 0:11:38.079 it on January eight, um, but for like a day 0:11:38.080 --> 0:11:41.560 it was kind of passing through back channels and throughout 0:11:41.640 --> 0:11:44.240 in this live stream, which is yeah, there was so 0:11:44.280 --> 0:11:46.720 many people were live streaming that night and it is 0:11:46.960 --> 0:11:50.000 a kind of surreal thing to watch of them. This 0:11:50.000 --> 0:11:52.160 this this live stream in particular, it is the zip 0:11:52.200 --> 0:11:54.760 Ti guy if you was friends, um, I think his 0:11:54.880 --> 0:11:56.920 mom and a few and just ranting the people from 0:11:56.960 --> 0:11:59.800 January six all hanging out at a hotel room, um 0:12:00.080 --> 0:12:02.120 towards like it's it is. It is the night of 0:12:02.160 --> 0:12:05.440 the sixth, and they're all just hanging out again totally 0:12:05.480 --> 0:12:08.800 like no masks, they're they're they're in a hotel lobby, 0:12:08.960 --> 0:12:11.160 no masks, um, and they're just like hanging out on 0:12:11.240 --> 0:12:13.200 chilly like sitting on the couch and chatting for like 0:12:13.240 --> 0:12:16.280 half an hour. It's one of the weirdest videos to watch. 0:12:16.400 --> 0:12:18.440 All all of the live streams from that night are 0:12:18.480 --> 0:12:22.160 so surreal because it is like this transitionary period of 0:12:22.240 --> 0:12:25.120 like after the capital attack but before every before like 0:12:25.720 --> 0:12:27.960 people like go down on them, so they don't really 0:12:27.960 --> 0:12:30.040 know how to behave They still think what they did 0:12:30.080 --> 0:12:32.120 was kind of fine, even though at this point, like 0:12:32.120 --> 0:12:34.959 I think like four or five people are dead. Um. 0:12:35.000 --> 0:12:37.320 But it's so weird just watch them just interact like 0:12:37.360 --> 0:12:40.079 such normal people in this moment like after they did 0:12:40.120 --> 0:12:42.439 this thing, then they go in this hotel room and 0:12:42.440 --> 0:12:44.880 they are acting completely normal. So it's it's just a 0:12:44.880 --> 0:12:48.880 weird video in general. But what it does have is 0:12:48.920 --> 0:12:51.840 someone in the same outfit as Zip Tie guy with 0:12:51.880 --> 0:12:55.160 no mask on. You actually actually can see his full face. Ye. 0:12:56.120 --> 0:12:59.800 Getting to see his full face was a big make 0:12:59.840 --> 0:13:03.000 it big help, big help, because we ever, everyone was 0:13:03.040 --> 0:13:05.120 looking for pictures of this guy without his mask all 0:13:05.160 --> 0:13:07.440 like for the entirety of the day. So now having 0:13:07.480 --> 0:13:09.880 a whole video where we gonna see like all of 0:13:09.920 --> 0:13:13.200 the angles of him was great. It was perfect. The 0:13:13.240 --> 0:13:15.800 best the best thing that was really the beauty of 0:13:15.800 --> 0:13:18.560 of all of of all of all the January six 0:13:18.600 --> 0:13:21.760 documentation is how many people were live streaming themselves doing 0:13:21.800 --> 0:13:24.559 crimes and their friends. Um it did. It did make 0:13:24.600 --> 0:13:27.760 the archiving and uh well not the archiving part. Archiving 0:13:27.800 --> 0:13:30.800 is always painful and tedious, but it made the actual 0:13:30.800 --> 0:13:33.240 research afterwards a lot easier because there was so much 0:13:33.240 --> 0:13:36.200 the documentation of it. So yeah, we we got we 0:13:36.200 --> 0:13:38.840 got this video. I'm gonna explain how I kind of 0:13:38.880 --> 0:13:42.600 took this video and failed to reach the conclusion, and 0:13:42.640 --> 0:13:45.440 then we can talk about how you succeeded. But first, 0:13:45.960 --> 0:13:49.080 but first we're gonna hear some ads from our lovely 0:13:49.480 --> 0:13:53.600 products and services. Robert was here for our previous recording, 0:13:54.040 --> 0:13:57.200 uh that we tried to end I failed, and he 0:13:57.280 --> 0:13:59.920 made some very good jokes uh and very good segways 0:14:00.080 --> 0:14:03.959 about how all of our sponsors support insurrection, just like 0:14:04.040 --> 0:14:06.520 January six, And if I tried to repeat the jokes, 0:14:06.520 --> 0:14:08.400 it will be stupid. So I'm just gonna I'm just 0:14:08.440 --> 0:14:10.439 gonna give you the sense there was a joke, and 0:14:10.440 --> 0:14:14.560 now you're gonna be left with that dissatisfaction. So bye, goodbye. 0:14:14.679 --> 0:14:27.760 Here's some ads. Okay, we're back, and I'm going to 0:14:27.840 --> 0:14:30.560 give an extremely brief rundown and how I failed to 0:14:30.600 --> 0:14:33.160 do uh well, I didn't fail to do research. I 0:14:33.160 --> 0:14:35.840 did research. I just didn't reach a proper conclusion. Um 0:14:35.840 --> 0:14:39.080 and I knew that. So the the the other the 0:14:39.120 --> 0:14:42.480 other thing about Zip Tie Guy he had he had 0:14:42.520 --> 0:14:44.640 the patch of like the thin blue line in Tennessee 0:14:45.000 --> 0:14:48.360 and then that's at Then I soon after got the 0:14:48.880 --> 0:14:52.480 video of his face and uh interacting with people. And 0:14:52.560 --> 0:14:55.560 the the other thing is I think, um we the 0:14:55.760 --> 0:14:58.400 hat he was wearing in the Zip Tie Guy photo 0:14:59.120 --> 0:15:02.880 was I think was tracked back to be um our 0:15:02.960 --> 0:15:07.400 favorite coffee company, Black Rifle Coffee merchandise. It was it 0:15:07.440 --> 0:15:08.960 was like what was what was one of the hats 0:15:09.040 --> 0:15:13.280 they sell. So me, being clever, I'm like, Okay, here's 0:15:13.280 --> 0:15:16.520 this Black Raffer Coffee hat, this patch in Tennessee. I 0:15:16.600 --> 0:15:19.040 know Black Ripe of Coffee is based out of Tennessee. 0:15:19.320 --> 0:15:21.320 I'm gonna go look through everyone who works for Black 0:15:21.360 --> 0:15:23.480 Raff of Coffee, which you mean isn't a bad instinct 0:15:23.480 --> 0:15:27.240 as an outsider. But it did not. It did not succeed. 0:15:27.360 --> 0:15:30.200 But the funny thing is is that while looking through 0:15:30.240 --> 0:15:32.960 all the employees at Black Apple Coffee, all of them 0:15:32.960 --> 0:15:37.520 do look identical to Zip Tie guy. They all same characteristics. 0:15:37.760 --> 0:15:40.520 They all look exactly the same on their their beards, 0:15:40.600 --> 0:15:44.080 their nose, their forehead, their hair, all of them identical, 0:15:44.280 --> 0:15:45.960 every single one of them, to the point where the 0:15:46.000 --> 0:15:47.960 only way I could tell that it wasn't a Zip 0:15:47.960 --> 0:15:50.000 Tie guy was being like, Okay, no, he has a 0:15:50.040 --> 0:15:53.640 mole here, he has like a birthmark here. This way 0:15:53.720 --> 0:15:56.040 his like his eyes are his eye wrinkles are different. 0:15:56.120 --> 0:15:57.880 So it's like it's going down to the very like 0:15:58.440 --> 0:16:01.640 fine tuned facial features because all of their face shapes 0:16:01.680 --> 0:16:05.560 are like I tentical. I think there's a point that 0:16:05.640 --> 0:16:08.160 I had the same instinct. I think I know there's 0:16:08.200 --> 0:16:12.040 a point that I went through, um the black Coffee Rifle, 0:16:12.280 --> 0:16:16.000 all of their people look, Um, I don't know if 0:16:16.040 --> 0:16:19.640 it was for Eric Wntel or if it was like 0:16:19.680 --> 0:16:24.960 maybe around the written house stuff. I don't know. Uh. Yeah, 0:16:25.120 --> 0:16:27.440 So that that's that's what I spent my time doing, 0:16:27.560 --> 0:16:33.400 is going through everybody who works there of Uh. But 0:16:33.400 --> 0:16:35.320 but by the time I kind of gave up on that, 0:16:36.600 --> 0:16:41.040 the identity was already discovered, um and posted by your 0:16:41.080 --> 0:16:44.480 team at a possum press. So how how did you 0:16:44.560 --> 0:16:48.200 get from you know, this zip Tygi picture than the 0:16:48.560 --> 0:16:52.280 light the archived livestream video of him without without a mask, 0:16:52.400 --> 0:16:54.920 to to the point where you could say, hey, this 0:16:55.000 --> 0:16:59.240 is his name? Well I was, I wasn't even really 0:16:59.360 --> 0:17:03.080 in cont hacked with Like we as a group weren't 0:17:03.280 --> 0:17:06.680 messaging each other trying to figure this out together, but 0:17:06.760 --> 0:17:09.280 we were, like it turns out a few of us 0:17:09.320 --> 0:17:14.080 were working separately. So while I'm going through social media, UM, 0:17:14.119 --> 0:17:18.320 a friend in Nashville was um going through pictures of 0:17:18.320 --> 0:17:22.920 the protests from there over the summer, and they ended 0:17:23.000 --> 0:17:26.320 up finding about five different pictures, I think, and we 0:17:26.440 --> 0:17:29.560 knew we knew most of the people in the pictures 0:17:29.560 --> 0:17:31.400 that are maybe like one or two that we did 0:17:31.440 --> 0:17:35.080 not know, and one was always Eric Munchell and he's 0:17:35.119 --> 0:17:39.840 wearing the exact same gear he wore January six. Um, 0:17:39.840 --> 0:17:42.760 I say, Eric Munchel, we didn't know his name yet then, 0:17:43.520 --> 0:17:47.600 so um, from there, we kind of we went ahead 0:17:47.640 --> 0:17:50.960 and posted what we had to Twitter, and then we 0:17:51.000 --> 0:17:53.720 went back to the social media and I started looking 0:17:53.760 --> 0:17:58.960 through the profiles that were the people we knew, and 0:17:59.040 --> 0:18:03.720 sure enough, one of them, Kurt Dennis, had a live 0:18:03.840 --> 0:18:08.639 stream that was telling the story, um, the same story 0:18:08.680 --> 0:18:11.800 that Eric Mutchell told him, that thirty minute video and 0:18:13.400 --> 0:18:16.720 he actually while telling it, he's like, yeah, my buddy Eric. 0:18:17.960 --> 0:18:22.200 So at that point we go to his friend's list 0:18:22.280 --> 0:18:25.159 and sure enough, he only has one Eric there and 0:18:25.320 --> 0:18:28.359 it's Eric Mutchell. And there we go to that page 0:18:28.400 --> 0:18:30.560 and find some of the same gear in the background 0:18:30.560 --> 0:18:33.520 of the pictures that he has publicly posted. Yeah, he 0:18:33.600 --> 0:18:35.320 like puts the pictures of him and his gear with 0:18:35.359 --> 0:18:38.080 like guns, and yeah, you can you can track all 0:18:38.080 --> 0:18:41.160 of his like facial like like like like birthmarks and stuff. 0:18:41.160 --> 0:18:45.119 They're all the same. So yeah, you and that that's you. 0:18:45.119 --> 0:18:50.400 You definitely got him of Yeah, their own mistakes Yeah, 0:18:50.440 --> 0:18:53.320 that's that's my favorite part. Like they they gave us 0:18:53.880 --> 0:18:57.480 his identity. They often, if not handing themselves to you 0:18:57.520 --> 0:19:00.600 on a silver pilatter, they at least have a platter. Um. 0:19:01.000 --> 0:19:03.320 They they often there's often enough bread, right. The reason 0:19:03.400 --> 0:19:05.359 why these things are solved because there are enough bread 0:19:05.359 --> 0:19:07.919 comes to follow and often they kind of leave pretty 0:19:07.960 --> 0:19:11.760 big chunks of bread. Um. Just the fact that again 0:19:12.040 --> 0:19:14.960 added to the surreal aspect of that whole live stream video, 0:19:15.960 --> 0:19:18.399 the fact that he's like you matched it by telling 0:19:18.440 --> 0:19:21.119 the same You can hear them someone tell the same story. 0:19:21.119 --> 0:19:25.159 It's just such a weird, weird, surreal thing. Yeah. So 0:19:25.280 --> 0:19:27.520 I think in terms of like oas and stuff, what 0:19:27.800 --> 0:19:33.000 this case study in particular really highlights is the importance 0:19:33.119 --> 0:19:36.400 of archival stuff. Right. The reason why you were able 0:19:36.440 --> 0:19:39.119 to solve this and not me because I wasn't. I mean, 0:19:39.160 --> 0:19:43.359 I did my own archival thing for archiving, like the video. 0:19:43.880 --> 0:19:46.720 But um, the way that you were able to really 0:19:47.200 --> 0:19:50.040 crack this open and everyone else who worked on it 0:19:50.080 --> 0:19:53.720 is because you had like those lists of connections of 0:19:53.960 --> 0:19:56.480 people who are already kind of active in this like 0:19:57.359 --> 0:20:00.280 al right far right scene within your local community, Like 0:20:00.280 --> 0:20:03.679 you already had documentation of the major players who they 0:20:03.720 --> 0:20:06.240 interact with, or you already had pictures of this guy 0:20:06.359 --> 0:20:10.359 in gear with other known people. So the fact that 0:20:10.400 --> 0:20:14.840 there was already previously work archived really made the success 0:20:14.840 --> 0:20:19.639 of this so much more possible. That's what they uh 0:20:19.960 --> 0:20:23.000 People's Plaza and Nashville during their protests, they were really 0:20:23.040 --> 0:20:26.960 big on documenting. Um they documented everything with the police 0:20:27.280 --> 0:20:31.200 and um any counter protesters they would. They had professional 0:20:31.240 --> 0:20:35.640 photographers out there making sure we had good, clear quality 0:20:35.720 --> 0:20:40.200 pictures of like everybody on the other side as well, 0:20:40.240 --> 0:20:44.800 and that definitely helped us a lot. Yeah, because especially 0:20:44.840 --> 0:20:49.560 before January six, they there was they did a decent 0:20:49.680 --> 0:20:53.720 job of archiving themselves, well not not archiving, but like 0:20:53.800 --> 0:20:57.159 filming themselves and documenting themselves. And then you know, it 0:20:57.200 --> 0:21:00.320 takes takes other research to then archive that. So not 0:21:00.440 --> 0:21:04.040 only important just to like look at the research and 0:21:04.080 --> 0:21:06.320 look at like the documentation of the that people do 0:21:06.359 --> 0:21:08.280 of themselves, but then make sure that you have a 0:21:08.320 --> 0:21:12.200 source for that that's not their own uploading of it. Right. So, 0:21:12.280 --> 0:21:15.080 like a great example is like all of the live 0:21:15.119 --> 0:21:17.080 streams from January six, including like this one from this 0:21:17.119 --> 0:21:19.680 hotel room. Pretty soon it was deleted by the person 0:21:19.680 --> 0:21:22.240 who posted it because they realized, oh maybe I shouldn't 0:21:22.240 --> 0:21:25.640 have this living record of my crimes. Um. But at 0:21:25.640 --> 0:21:28.439 that point people already saved the video. They already like, 0:21:28.680 --> 0:21:31.600 I already ran it through a video of saving program 0:21:31.840 --> 0:21:35.600 that I had. UM. So it's it's important not only 0:21:35.640 --> 0:21:40.560 to get archiving, having having having previous documentation of people 0:21:40.560 --> 0:21:43.560 and known players, but then as new information is coming out, 0:21:43.800 --> 0:21:45.880 make sure you make separate copies of that for your 0:21:45.880 --> 0:21:48.560 own sake so that you actually have it and then 0:21:48.600 --> 0:21:51.439 you're not gonna be stuck looking for something that's gone. Right. 0:21:51.600 --> 0:21:54.320 The worst case scenarios to like you know that there 0:21:54.359 --> 0:21:56.920 was an important thing, but you just don't have access 0:21:56.960 --> 0:21:59.240 to it anymore. It's like you you remember seeing it, 0:21:59.359 --> 0:22:01.679 you didn't say it, and now it's gone. That's a 0:22:01.680 --> 0:22:03.680 horrible feeling to do when you're trying to get this 0:22:03.760 --> 0:22:07.040 kind of research done. UM. And like it happens, we all, 0:22:07.119 --> 0:22:09.840 we all make mistakes like this. UM, I definitely have 0:22:09.960 --> 0:22:12.920 it happened to me actually this week. Yeah, it happens 0:22:12.960 --> 0:22:15.200 all the time, and it happens to be. It happens 0:22:15.240 --> 0:22:16.840 to be all the time. I'll look at something to 0:22:16.880 --> 0:22:19.240