Why Didn’t the FBI Review Social Media Posts Announcing Plans for the Capitol Riot?

Half a year after the failed insurrection at the Capitol, a swath of crucial questions remains about what happened on that day and in the weeks and months leading up to it. Central among those mysteries is why law enforcement failed to anticipate the riot. And chief among the law enforcement institutions that failed on that day is the Federal Bureau of Investigation. 

According to reporters’ accounts of what happened on Jan. 6 and congressional testimony by high-ranking FBI officials, the FBI largely did not anticipate that the certification of the Electoral College vote that day might spark violence in Washington, D.C. The only document the FBI produced warning about Jan. 6 was a single bulletin issued by the bureau’s Norfolk, Virginia, field office. This absence of warning is particularly striking given that a significant amount of the planning for the Jan. 6 riot took place in public on social media platforms like Facebook, Gab and Parler. Anyone with a Twitter account and an hour of time to kill could have warned about the potential for violence on Jan. 6—and many did. 

So how did the bureau miss all this? In testimony before Congress, FBI Director Christopher Wray and then-Assistant Director for Counterterrorism Jill Sanborn have explained that the problem stems from the FBI’s internal guidelines, which prevent FBI employees from examining social media except when certain conditions are met. “We’re not allowed to ... just sit and monitor social media and look at one person’s posts … just in case,” Wray told the House Judiciary Committee recently. 

But there’s a problem with this explanation of the FBI’s failure: It’s deeply misleading. 

A close look at the internal Justice Department and FBI documents that constrain the bureau’s domestic operations suggests that nothing in the FBI’s guidelines prevented the organization from reviewing public social media posts by would-be insurrectionists. Whether or not agents and analysts did so is a different question—and as far as the public record shows, they didn’t. But unless a significant change has been made to those guidelines since they were last made public, in 2016, FBI policy wasn’t what was holding the bureau back from looking. 

The fact that Jan. 6 might be chaotic wasn’t exactly a secret. NBC reports that one person posting on the pro-Trump site TheDonald.win wrote in December, “If we occupy the Capitol building, there will be no vote.” Others posted suggesting blocking off the tunnels that connect the Capitol building to surrounding House and Senate offices and shared a map marking entrances and exits to the building. The New York Times describes how some Trump supporters posted pictures on Facebook of the weapons they planned to bring to Washington, D.C., for that day. And as Rohini Kurup and Benjamin Wittes noted on Lawfare, “prominent supporters of Trump … used metaphors of war to describe what would happen on Jan. 6.”

The FBI’s failure to pick up on any of these very obvious warnings has prompted some awkward questions for Wray and Sanborn in their appearances before Congress. Asked during testimony before the Senate Rules Committee and the Senate Homeland Security and Governmental Affairs Committee whether the bureau had been been keeping tabs on these posts, Sanborn responded,

To my knowledge, no … we cannot collect First Amendment-protected activities without sort of the next step, which is the intent. And so we would have to have an already predicated investigation that allowed us access to those comms and/or a lead or a tip or a report from a community citizen or a fellow law enforcement partner for us to gather that information. 

Wray has given slightly different answers as to the FBI’s ability to look at social media. In a hearing before the House Oversight and Reform Committee on June 15, Rep. Alexandria Ocasio-Cortez asked about the bureau’s social media policy. Wray answered:

We have very specific policies that have been at the department for a long time that govern our ability to use social media, and when we have an authorized purpose and proper predication, there are a lot of things that we do at social media and we do do, but [what] we cannot do on social media is, without proper predication and authorized purpose, just monitor just in case on social media. Now [maybe] the policy should be changed to reflect that, that might be one of the important lessons learned coming out of this whole experience, but that is not something currently that the FBI has either the authority or the resources to do[.]

The director had given a similar response to the House Judiciary Committee the week before, when he had the following exchange with Rep. Eric Swalwell: 

Swalwell: Do you believe the Bureau has the authority to monitor publicly available social media, or open source intelligence collection?

Wray: The answer to that is … complicated. There are AG guidelines as implemented through the so-called DIOG … all of which are geared towards protecting the First Amendment. With proper predication and authorized purpose, there are a lot of things we can do. But what we’re not allowed to do is just sit and monitor social media and look at one person’s posts just looking to see if maybe something would happen just in case. That we’re not allowed to do.

Here, Wray is referring to the Attorney General’s Guidelines for Domestic FBI Operations and the FBI Domestic Investigations and Operations Guide (DIOG). The first document was, as the name suggests, issued by the attorney general to guide the bureau’s activities; the second is an internal FBI document developed to implement the attorney general’s guidelines in greater detail. To understand what Wray and Sanborn are saying, it’s useful to take a look at both. 

Let’s start with the attorney general’s guidelines. As Ryan Goodman and Andrew Weissmann note in the Washington Post, the guidelines explicitly state that the bureau may “engage in ‘proactively surfing the Internet to find publicly accessible websites and services’ through which the ‘promotion of terrorist crimes is openly taking place.’” The relevant section of the guidelines reads in full:

More broadly, detecting and interrupting criminal activities at their early stages, and preventing crimes from occurring in the first place, is preferable to allowing criminal plots and activities to come to fruition. Hence, assessments may be undertaken proactively with such objectives as detecting criminal activities; obtaining information on individuals, groups, or organizations of possible investigative interest, either because they may be involved in criminal or national security-threatening activities or because they may be targeted for attack or victimization by such activities; and identifying and assessing individuals who may have value as human sources. For example, assessment activities may involve proactively surfing the Internet to find publicly accessible websites and services through which recruitment by terrorist organizations and promotion of terrorist crimes is openly taking place; through which child pornography is advertised and traded; through which efforts are made by sexual predators to lure children for purposes of sexual abuse; or through which fraudulent schemes are perpetrated against the public. 

This certainly reads as if the bureau would have had the authority to look at tweets and Facebook posts promoting violence on Jan. 6. 

In the language of the FBI, “assessments” and “predication” have to do with the different levels of investigatory activity. This is what Sanborn and Wray were referring to when they referenced “proper predication” (Wray) and “an already predicated investigation” (Sanborn). The bureau has the least investigatory authority before an assessment is opened. After an assessment is opened, its authority increases; and its authority grows even more after the opening of a predicated investigation. At each stage, an increasingly high standard of evidence is required. Broadly speaking, the more invasive the investigatory techniques used, the more basis the FBI needs to have for using those techniques. 

Under Section 5 of the DIOG, an assessment “require[s] an authorized purpose and clearly defined objective[s]”; it “may be carried out to detect, obtain information about, or prevent or protect against Federal crimes or threats to the national security or to collect foreign intelligence.” A predicated investigation, meanwhile, requires higher standards still. A “preliminary investigation” may be opened “on the basis of ‘information or allegation’ indicating” that “[a]n activity constituting a federal crime or a threat to the national security has or may have occurred, is or may be occurring, or will or may occur[.]” A “full investigation,” the next step up with enhanced investigative authorities to match, can require (among other things) an “articulable factual basis” of that same circumstance. (Sean Joyce and David Kris provide a more detailed overview of this system in their analysis of how the FBI could have investigated in advance of Jan. 6.)

According to Sanborn, the FBI must have a preliminary or full investigation already open before it can look at social media—that is, it must have relatively reliable information already on the table before it can boot up Twitter. But per the DIOG, this is either very garbled or just not accurate. Appendix L of the DIOG addresses how the bureau can use “publicly available information” found online. Section 3.1 of the appendix states: “FBI employees are permitted to conduct proactive Internet searches of ‘publicly available information’ to process observations or other information for authorized purposes”—even “prior to the initiation of an assessment or a predication” (emphasis added). 

To be fair, the DIOG does state that bureau employees can record the information such a search might return only if an assessment or a predication has been opened. So perhaps that’s what Sanborn had in mind. But the DIOG doesn’t prevent FBI analysts and agents from looking at social media in the absence of an assessment.

Wray’s comments are perhaps a little more accurate, in that he doesn’t explicitly say that the bureau needs a predicated investigation to review online posts. Recall his comment that “without proper predication and authorized purpose” the FBI cannot “just monitor just in case on social media.” For the reasons just described, the public record indicates that the bureau doesn’t need predication to “monitor … social media.” But what about the role of “authorized purpose”?

Under Section 4 of the DIOG, an “authorized purpose” is “a national security, criminal, or foreign intelligence collection purpose” that must be “well-founded and well-documented.” Wray is not wrong that the First Amendment plays a role here: The DIOG states that an authorized purpose “may not be solely to monitor the exercise of constitutional rights, such as the free exercise of speech …[.] For example, individuals or groups who communicate with each other or with members of the public in any form in pursuit of social and political causes … have a First Amendment right to do so.” 

It’s a good thing for the DIOG to incorporate these First Amendment constraints: The FBI is still shadowed by its history of investigating political activists under J. Edgar Hoover. But the DIOG also explicitly states that First Amendment considerations—for example, those raised by extremist Trump supporters discussing their plans to storm the Capitol on Facebook—don’t obviate the bureau’s ability to peek at social media. Here’s more from the portion of the guidelines on what constitutes an authorized purpose, with emphasis added.

Despite the high standard for interfering with free speech or punishing those engaged in it, the law does not preclude FBI employees from observing and collecting any of the forms of protected speech and considering its content—as long as those activities are done for a valid law enforcement or national security purpose and are conducted in a manner that does not unduly infringe upon the ability of the speaker to deliver his or her message. … FBI employees should not, therefore, avoid collecting First Amendment protected speech if it is relevant to an authorized AGG-Dom purpose[.]

The DIOG goes on to further clarify that “during the course of lawful investigative activities, the FBI may lawfully collect, retain, and consider the content of constitutionally protected speech, so long as (i) the collection is logically related to an authorized investigative purpose; (ii) the collection does not actually infringe on the ability of the speaker to deliver his or her message and (iii) the method of collection complies with the least intrusive method policy.” (This last point refers to an FBI policy aimed at “mitigating potential negative impact on the privacy and civil liberties of all people encompassed within the investigation.”)

In other words, Wray is correct that the bureau needs an authorized purpose to review social media, and that First Amendment considerations are involved. But his testimony leaves out the fact that the DIOG specifically authorizes FBI employees to review social media posts potentially protected by the First Amendment under certain circumstances—circumstances that could well have been met in the case of the soon-to-be Capitol rioters. After all, wouldn’t Facebook posts announcing plans to invade a government building raise criminal or national security concerns under the FBI’s definition of “authorized purpose”?

What’s more, both Wray’s and Sanborn’s comments ascribe a level of difficulty to meeting the standard for an authorized purpose, assessment, or predicated investigation that just isn’t there. The guidelines aren’t nothing—they were developed to prevent the FBI from beginning investigations based on air. And the First Amendment protections are there for a very good reason. But the bar for opening a preliminary investigation—“‘information or allegation’ indicating” that “[a]n activity constituting a federal crime or a threat to the national security has or may have occurred, is or may be occurring, or will or may occur…”—is not high; the bar for an assessment is even lower. 

Was there really no material available to the bureau that met that standard—given that the FBI can review social media posts without a preexisting assessment or investigation? Were there really no preexisting assessments or investigations, anywhere in the entire country, that would have allowed FBI employees to monitor and record these posts? As Tia Sewell and Benjamin Wittes noted, during one of the same hearings in which Wray pointed to the DIOG as responsible for the bureau’s failure on Jan. 6, he also proudly announced that the FBI had about 1,400 domestic terrorism investigations “as of the end of last year”—that is, just before the Capitol riot. Can it truly be the case that not one of those 1,400 investigations offered a hook for taking a look at some Facebook posts?

If somehow the FBI’s guidelines really did prevent it from monitoring social media posts by Trump supporters in advance of the riot, it would be reasonable to ask—as Wray suggested to Swalwell—whether the guidelines should be changed. But despite what Wray and Sanborn say, the attorney general’s guidelines and the DIOG do not explain why the FBI didn’t monitor the threats posted by those planning to storm the Capitol or take those threats seriously. To the extent that senior FBI officials are pointing to the guidelines as the reason for the bureau’s lack of action in advance of Jan. 6, it’s because the guidelines make for a useful scapegoat. Arguing that the rules prevented the FBI from looking on social media draws attention away from the other factors that led to the bureau’s failure.

So what were those factors? Do Wray’s and Sanborn’s comments reflect more widespread confusion within the FBI regarding what restrictions are and aren’t present on browsing social media and First Amendment-protected speech? The line is not necessarily clear between a protected expression of political speech and an announcement of intent to riot—or, say, an invitation to protest outside the Capitol as opposed to an invitation to break into the building. But there is a line, and some of the rioters’ posts surely crossed it. 

To what extent did the bureau’s lack of action stem from a cultural unwillingness within the organization to recognize the potential danger of extremism among a politically right-wing group that is largely white? How much did it stem from a desire within the FBI, on both individual and institutional levels, to avoid angering the president by investigating his supporters—especially when the president had made very clear how far he was willing to go to punish those in the FBI who had led the Russia investigation in its earliest stages? Was the FBI simply unprepared for, or unwilling to countenance, a potential riot egged on by the chief executive himself?

So far, Christopher Wray has gotten off relatively easily in his appearances before Congress. He’s faced questions about the FBI’s performance, but as Sewell and Wittes have noted, most of the members of Congress questioning the director haven’t seemed interested in pushing back on Wray’s story about how the bureau handled the events of Jan. 6—according to which the FBI did its best in collecting and sharing intelligence in advance of the event. Given how often the question has come up, senators and representatives are clearly interested in the question of whether the FBI really is barred from reviewing social evidence as Wray and Sanborn testified, but neither official faced clear follow-up questions about whether their answers were consistent with the attorney general’s guidelines and the DIOG. In fact, the Senate Rules and Homeland Security and Governmental Affairs committees memorialized Sanborn’s garbled answer in its initial report on Jan. 6 without noting these inconsistencies.

The new House select committee on Jan. 6, which Speaker of the House Nancy Pelosi has announced she plans to convene, may be able to dig more into the FBI’s self-justifications and answer what actually happened in the run-up to the Capitol riot. There’s also the ongoing investigation by the Justice Department Inspector General’s Office of “the role and activity of DOJ and its components in preparing for and responding to the events at the U.S. Capitol on January 6, 2021.” Hopefully, these investigations will be able to move beyond the shallow answers that bureau officials have provided thus far. To the extent that Wray is placing the fault for the FBI’s catastrophic absence of preparation on the social media guidelines, he’s deflecting blame from where it should really lie.