How to verify right-wing group affiliation with open-source intelligence
What happened last week in Washington, D.C. shows there is a need for journalists to be able to recognize who belongs to right-wing domestic terrorist groups. Below some OSINT tools that aid along the way and how to use them.
This week was overshadowed by the events at Capitol Hill. What happened? By now well documented, on the west side of the building an angry mob gathered and overpowered a police barrier and scaffolding that were put up for the upcoming inauguration. They entered the building and a number of people died. Members of the mob waved the confederate flag after breaching US capitol security and committed other acts of violence and intrusion.
What stood out was the debate by many online media users about who these people are and who they belong to. On the question of who some of the key people wore and who they are, citizen journalist John Scott-Railton (from CitizenLab) covered in some impressive Twitter threads (here, here with famous investigative reporter @RonanFarrow):
News articles quickly spread analysing the affiliation of the people involved. BBC and others reported the identification of QAnon members, a group that signed up to the idea of a disproven and discredited far-right theory.
The surge of right-wing groups and their membership during the Trump administration is well studied. It is also not hard to see how the right-wing media uses the Capito Hill incident to their benefit. It quickly picked up on it and used the death of Ashli Babbitt, who was shot, as a means to turn her into a political martyr, Jason Wilson wrote in an opinion article for the Guardian.
Reading the signs
There are catalogues of signs and relevant databases journalists can use in their reporting process. The rioters — or rather domestic terrorists as president-elect Biden calls them — involved in this chaos expressed their allegiance to Trump via symbols such as with flags — one reading “Trump is my president” — and other means. In this post, we will try to scratch the surface on how to use various ways how individuals might swear allegiance to right-wing groups.
There are a number of databases that you can check. One is ADL which features a great list of hate symbols. It’s a database that you can use to cross-check what you see on images. The database contains a variety of items, such as images of simple signs, flags, clothing, graffiti, jewelry, hand sings, amulets and tattoos. The non-for-profit organization condemned Trump in 2020 for incitement of anti-Asian American hate. Trump labeled Covid-19 as the “China plague”. ADL says it’s being used by law enforcement, schools, and individuals, so a sufficient credible source of reference for us journalists.
A quick word on why symbols matter among these groups. A symbol is a visual image or sign representing an idea, according to the definition by the North West Counter Terrorism Unit and their report. “Human cultures use symbols to express specific ideologies and social structures and to represent aspects of their culture”. The report has a few examples relevant to right-wing national extremist groups in the UK, so worth a look. But it lacks comprehensiveness and a reverse image search is probably more useful if you are after a specific symbol.
Fonts
There is also writing that can reveal details about their owners. One way that helps identifying affination can be fonts. It’s not a definite give-away but it does sometimes help to be a piece of a larger puzzle.
There are ways to search fonts by image input. One such online tool is called WhatTheFont (myfonts.com). We can try it by cropping out the writing from a Trump supporter flag waved during the Capitol Hill incident.
There is some research on how typefaces agree with fonts’ ideological rating (link it by Hunter Schwarz, a reporter previously with WaPo and CNN). According to the analysis the font ‘blackletter Cloister Black Light’ is viewed as the most conservative. In our results for the flag, we also find blackletter examples.
Some investigative reporters used the decryption of right-wing symbolism and images, before. One excellent example worth checking out is the BR investigation from last June which applied machine learning methods to Facebook posts. Armed with a keyword search reporters quickly dug up more than ten thousand insults, many of a racist nature (also I found similar fonts in the examples posted by the reporters, such as Cloister Black, perhaps something to further explore).
Another obvious OSINT method is to look for symbols and signs via a reverse image search. Often recommended is the InVid-WeVerify plugin (here recommended by the Citizenevidence Lab) which helps to search across various search engine operators, including Yandex Bing or Baidu, at the same time — a separate guide for this is available here.
Tineye is uniquely placed as it is the only search engine in the list that is solely concentrating on reverse image searches.
Among other things, this kind of analysis allowed identifying rioters such as Aaron Mostofsky. A connection to his family is quickly made. One connection is Shlomo Mostofsky, a prominent modern Orthodox figure in Brooklyn.
A bit more on the actual rioters at Capitol Hill and their affiliation to, what has been reported as affiliates to extreme factions of the republican party as well as the right-wing groups including Proud Boys and QAnon.
Reporters at one outlet found specific references to the Holocaust on garments worn during the protest, like in the image below showing a man wearing what I believe is a hoody that says “Camp Auschwitz”. If we reverse image search it on TinEye, we find a Twitter post by one user that shows the piece of clothing more clearly.
A bit more research into the piece of clothing reveals where the wearer could have bought it. One online sales outlet calling itself Ibworm, with the tag line “the best loving fashion, loving t-shirts in the USA” sells it on discount. One review gives the buyer of the item even a five stars review, saying ‘we are absolutely chuffed with the service!’.
There are a number of other disturbing references we can analyse. We encountered a “6MWE” shirt worn during the riots. Neo-nazi fraternal organization Proud Boys and other alt-right groups use 6MWE (or 6 million wasn’t enough), a vile reference to the Holocaust.
Then there were the neo-nazi chants, some pointed out (there was the “Jews will not replace us” chants). One congresswoman was reported to have quoted Hitler during a speech in front of the US Capitol building in Washington. One simple way to cross-check this with OSINT is writing down the quote, translating via google translate and cross-checking across search engines.
The quote the person used (“Whoever has the youth has the future”) in this video can be compared with the direct quote. Beware that before referencing and making claims you make sure the video is genuine — it’s becoming ever easier to deep fake speeches and sound recording (in this case, we have several recordings confirming the vile statement).
Hand signals are also a way to identify affliction to groups. The proud boys specifically use a hand sign, a symbol formed by connecting thumb and forefinger in a circle and raising the three remaining fingers — it forms the letter “W” and the other hand forms the letter “P,” which forms the abbreviation of WP or “White Power”, according to the ADL database, which we mentioned already is very useful for pattern recognition.
Perhaps an OSINT concept for the future: a hand tracking algorithm like this one could be used across online social media images to spot potential members of White Supremacy groups like Proud Boys.
Back to Washington DC where some members of the far rights group proud boys pose for a photo with the hand signs and orange hats. I am unsure if the colored hats have any special meaning. If you know, let us know.
What we do know about the Proud Boys’ attire is that they prefer wearing Fred Perry polo shirts on Gavin McInnes’ suggestion, who founded the group — in addition to MAGA hats. On a side note, late last year, the Fred Perry company announced that it won’t sell polo shirts in the US until the group disassociates with them.
QAnon affiliates were also identified, one via a front cover image showing the person with a black hat wearing a QAnon shirt. We can reverse image search it but it’s pretty obvious what signal this individual wanted to send.
We can do more reverse image search research on the topic and find an Ebay sales pages for the same shirt here, for a seller located in Martin, Kentucky.
I am aware that this isn't a complete review of what we can do with symbol and sign recognition but it’s only a start and a beginners guide for OSINT journalists. More will likely follow in another post as we see the events in the US further unfold.
Some final words on investigating right-wing groups and their activities. A useful dataset on riots across the US is the ACLED US Crisis Monitor database, for which the next batch of data (for the end of Dec and early January) will drop on January 11. Until then and beyond, happy OSINTing.
Update: As I found the public work and the intelligence gathering by John Scott Railton so impressive, it’s worth stating his conclusions on how he and the other citizens of supporters collaborated, on the identification of Eric Munchel left, and Lt. Col Brock, right.
