The Capitol Bomber: Stride, Gait, & Timeline Analysis (OSINT)
Immediately after the Capitol riots, the FBI issued the following “Be on the Lookout” or “BOLO” poster seeking information on the individual suspected of placing pipe bombs in the Capitol.
The FBI’s Request for Public Assistance
By March 9, 2021, however, more than two months after the Capitol riots, the identity of the pipe bomb suspect (the “Suspect”) was still unknown. That day, the FBI released additional information, photos, and surveillance video of the Suspect.
According to the FBI, between 7:30 p.m. and 8:30 p.m. Eastern Standard Time (EST) on January 5, 2021 (the day before the Capitol riots), the Suspect placed two pipe bombs in the Capitol Hill neighborhood of Washington, D.C.
1. One pipe bomb was placed next to a park bench near the Democratic National Committee (“DNC”) Headquarters, located at 430 South Capitol Street Southeast, #3; and
2. The second bomb was placed in an alley behind the Republican National Committee (“RNC”) Headquarters, located at 310 First Street Southeast.
3. The unknown individual wore a face mask, a grey hooded sweatshirt, and black and light grey Nike Air Max Speed Turf shoes with a yellow logo. The individual carried a backpack in their hand.
4. Components of the devices include 1x8-inch threaded galvanized pipes, a kitchen timer, and homemade black powder.
The FBI stated in their March 9, 2021 update, “Identifying the person responsible for placing these pipe bombs is a priority for the FBI’s Washington Field Office and our partners at the Bureau of Alcohol, Tobacco, Firearms and Explosives; U.S. Capitol Police; and D.C. Metropolitan Police Department.”
FBI Assistant Director in Charge Steven M. D’Antuono was quoted in the press announcement stating, “We still believe there is someone out there who has information they may not have realized was significant until now. We know it can be a difficult decision to report information about family or friends — but this is about protecting human life. These pipe bombs were viable devices that could have been detonated, resulting in serious injury or death. We need the public’s help to identify the individual responsible for placing these pipe bombs to ensure they will not harm themselves or anyone else.”
The FBI had previously released photos of the individual, including the individual’s shoes, the devices, and the kitchen timers used, in hopes that someone would recognize something familiar about them.
D’Antuono further elaborated, “You may recognize their gait, body language, or mannerisms. We are asking the public to come forward with any information that could assist us, including any odd or out-of-character behavior you noticed in a family member, friend, or coworker, leading up to or after January 5. Regarding the evening of January 5, we are asking for information about an individual who you may have observed matching this description in the vicinity of North Carolina Avenue SE and Folger Park between 6:30 p.m. and 9:00 p.m. This person may have entered a vehicle or taken an item from a vehicle and placed it into the backpack.”
Along with the release of new information, D’Antuono issued a video message prompting the public to recall any potential suspects. He stated:
“Leading up to January 5th, you may have observed behaviors that indicate someone was involved. This could include making travel plans to Capitol Hill or researching the locations of the DNC and RNC. They may have shown an increased fixation on the current political climate.
“Specific to the devices, you may have noticed this person purchased 1x8-inch threaded galvanized pipe. This person may have had unexplained possession of multiple kitchen timers. They may have an interest in explosives, making black powder, or researched these topics. This person may have talked about their aspirations to place the pipe bombs. You may have noticed that they were distracted from their normal activities, work, their relationships, or holiday activities. Since January 5th, you may have noticed changes in someone you know. This may include recently discarding or having stopped wearing the Nike Air Max Speed Turf shoes.”
“It could be bragging about what they did while on Capitol Hill, following this story very closely, or exhibiting an unusual emotional response to the reporting of this story. This may range from excitement to frustration with the outcome and press coverage. They may have increased anxiety about being identified. Any emotion you feel is inappropriate is worth reporting.”
The FBI released the below images to the public.
Images of the Suspect
Several images from video footage of the Suspect walking in the Capitol Hill area.
Bomb-Making Materials
A photo of one of the pipe bombs placed in the Capitol Hill area of Washington, D.C., along with a photo of the kitchen timer used in the device.
Backpack Used to Transport the Bombs
Images of the Suspect’s backpack.
Suspect’s Distinctive Footwear
Images of the Suspect’s black and light gray Nike Air Max Speed Turf shoes with a yellow logo compared to product photos of the sneakers.
Surveillance Videos
In the FBI-released video on March 9, 2021, video footage from four different surveillance cameras were provided. The videos were compiled into a single 2 minute and 22 second video and shared on the FBI website as well as YouTube.
In Video #1, the Suspect is seen at 7:40 p.m., walking south on South Capitol Street, NE toward the direction of the Democratic National Committee Headquarters.
In Video #2, 12 minutes later, according to the FBI timestamp, the Suspect is seen at the DNC Headquarters, walking north toward and then sitting on a park bench (and then stretching their arms). The FBI stated the DNC pipe bomb was placed next to a park bench. The subject then heads possibly north or northeast.
In Video #3, at 8:14 p.m., the Suspect is recorded walking west through the alley between the Republican National Committee Headquarters and the Capitol Hill Club next door. The subject walked through the alley with their right shoulder appearing raised.
In Video #4, at 8:14:21 p.m., according to FBI timestamps, the Suspect can be seen walking north (and stretching their arms) in front of the Capitol Hill Club, which is next door to the RNC Headquarters.
Stride Observations
By taking screen captures of the South Capitol Street video and then using Adobe Photoshop, I layered the screenshots to illustrate the Suspect’s stride and body movements, and compiled the following sequence.
We are also able to observe the Suspect’s gait and walking pattern in the footage in front of the Capitol Club. Toward the end of the frame, the Suspect also stretches their arms backward and up in a circular pattern, indicating perhaps they are experience pain or fatigue.
At the DNC Headquarters, the Suspect sits on a park bench and pauses to stretche their left arm up and backwards…
…followed by their right arm up and backwards. With both stretches, it appears the Suspect is also reaching across their body with their opposite hand and holding their trapezoid. This may indicate the Suspect might have either trapezoid, shoulder, or shoulder blade pain or injury.
The Suspect can also be observed standing and walking with their right shoulder raised higher than their left shoulder.
Surveillance Video Observations
Below is a timeline of information I observed in the videos and questions raised or additional possible leads to explore, assuming the FBI’s timestamp information is accurate.
Video #1
Time: 7:40 p.m.
Location: South Capitol Street, SE
Observations
The Subject is recorded walking south.
At the end of the video, the Suspect places the backpack on ground, looks up for several seconds, adjusts their eyeglasses with both hands, and loiters in that spot for a few moments. A man walking a dog walks past the Suspect on the sidewalk, passing just inches away.
Questions raised:
- Why did the Suspect place their backpack on the ground?
- What was the Suspect looking up at after placing their backpack on the ground?
- Presumably the FBI has explored locating the dog walker as a possible witness. Did the man walking the dog live nearby? Was he taking his dog for a regular evening walk? What would a reasonable search radius be to find a local man who walks a dog of that size?
Video #2
Time: 7:52 p.m.
Location: DNC Headquarters, corner of S. Canal Street and S. Capitol Street
Observations:
The Subject is recorded walking north.
Looking at Google Maps, the distance between the location in Video #1 and Video #2 is approximately only 300 feet, however, the Suspect is recorded on Video #2 at 7:52 p.m., which is 12 minutes after being recorded on Video #1.
In Video #1, the Suspect is walking south toward DNC Headquarters. In Video #2, the Suspect is coming from the south, headed north. At some point the Suspect must have gone past the location of the surveillance camera in Video #2 and then turned around headed north.
When the subject sits on the park bench, they appear to pause to stretch each arm, as if they had been under strain. The subject appears to raise and stretch their right elbow and arm higher than when they stretched out their left arm, however, the low resolution of the video makes that observation inconclusive.
Question raised:
- What was the Suspect doing for 12 minutes in the vicinity of the DNC Headquarters?
Video #3
Time: 8:14 p.m.
Location: Alley behind RNC Headquarters
Observations:
The Subject is recorded walking west.
The FBI stated a pipe bomb was placed in the alley behind the Republican National Convention Headquarters. Video #3 shows the Suspect exiting that alley.
Video #3 records the Suspect at 8:14 p.m., 22 minutes after Video #2 recorded the Suspect. According to the walking directions in Google Maps, it takes approximately 10 minutes to walk between those two locations.
The area lighting in the alley allows for a clearer image of the Suspect, who walks holding their backpack in their right hand. The Suspect walks with a noticeably raised right shoulder, which appears to overcompensate in their stride.
Questions raised:
- What did the Suspect do during the 22 minutes between locations?
- Did the Suspect know there was an alley accessible behind the RNC Headquarters? Did the Suspect plan in advance on placing the pipe bomb in the alley or was that decided spontaneously?
- Did the subject surveil the location in advance to find the alley location? Is there earlier surveillance video from either earlier that same day or a prior day that may have recorded the Suspect surveilling the target location?
Video #4
Time: 8:14 p.m.
Location: Capitol Hill Club, 300 First Street SE
Observations:
The Subject is recorded walking north.
In Video #4, the Suspect walks past the front doors of the Capitol Hill Club, which is around the building corner of the alley in Video #3.
After walking past the building’s front awning, the Suspect can be observed stretching both arms out at the same time. The Suspect reaches their left arm back and then up above their head, in a circular stretching motion. They are still holding the backpack in their right hand and lifting their arm back and up, but only raising their arm to approximately shoulder height. As the Suspect exits the frame, they begin what appears to be a second stretch of both arms.
Questions raised:
- Where did the Suspect go after placing the pipe bombs?
- What other video footage in the surrounding area both before Video #1 and after Video #4 may exist for analysis?
Cumulative Video Observations
In all four videos the Suspect appears to be struggling with their backpack or their upper body.
1. In Video #1, the Suspect places their backpack on the ground for a few moments;
2. In Video #2, while sitting on the park bench outside DNC Headquarters the Suspect appears to pause to stretch both arms;
3. In Video #3, the subject appears to walk with a noticeably raised right shoulder; and
4. In Video #4, the subject appears to be stretching their arms backwards in a pronounced manner, twice.
Location Observations
Online mapping tools such as Google Maps can help provide additional information, context and perspective to investigations. Conducting open source research on the four locations where the Suspect was recorded may reveal more details. (Obviously, the FBI knows exactly where these videos came from, but for the purposes of investigation techniques we will seek to identify where it was recorded.)
Video #1 – South Capitol Street SE.
The Suspect is walking in front of what appear to be residential brownstones, which are common in Washington residential neighborhoods.
Looking at a satellite photo of the area near the DNC Headquarters reveals that many of the surrounding blocks have office buildings. The block north of the DNC Headquarters shows narrow rooftops (noted below with an arrow) typically associated with brownstone residences. That is a reasonable place to start looking to locate where the video might have been captured.
Navigating that location in Google Street View mode reveals a row of brownstones, and we see a light-colored building façade with curved, black door and window trim next to a red brick building similar to the buildings in Video #1. This is a possible location match but warrants further inspection.
Zooming in closer to the building provides additional details, which appear to match those in Video 1. The birdbath (noted with the arrow) in both images along with the other matching details provide solid confirmation of a location match.
The video appears to have been recorded from an elevated location across the street from the brownstones, as we can see both a car and the blacktop of the street in the image. Rotating the direction in Street View Maps reveals an open air parking lot across the street.
Comparing the angle of view in Video #1 to the raised structures across the street, it is possible that a surveillance camera was mounted on the light post noted with the arrow. The light post in this image does not appear to have an overt surveillance camera mounted on it. If this is, in fact, where the video camera was placed, there are a few possible explanations as to why a camera is not visible here. The camera may be covert, hidden from view. Alternatively, according to the date information provided by Google Street View, the most recent image was taken in June 2019, approximately 19 months before the January 5, 2021 video was recorded. It is possible a camera was installed after June 2019.
Video #2 – DNC Headquarters
In addition to the two park benches, which are positioned perpendicular to each other, we notice several bushes on both sides in planting areas. Further out we can see large round shapes, approximately 2 feet tall, which appear to be security barriers to protect the building from vehicles. Vehicle barriers in different designs are fairly common throughout Washington, D.C. We also can see painted lines for crosswalks on the street. The street corner itself is obscured by tree branches so details are more difficult to discern.
By viewing the location from different angles, we are able to identify the park benches (noted below with an arrow), the vehicle barriers, and we see the street corner is curved rather than square. The curve of the street corner makes it somewhat ambiguous which direction the Suspect walked toward the RNC Headquarters, it could have been either north or east.
Video #3 – RNC Headquarters Alley
The FBI stated the Suspect placed a pipe bomb in the alley behind the Republican National Convention Headquarters.
Google Maps Satellite View shows an opening between the RNC Headquarters and the Capitol Hill Club building.
If closer inspection was necessary, zooming in on Google Street View provides a closer look at a portion of that alley. Notably, the staircase with the dark handrail can be seen from the street (noted below with an arrow). Also, the contour of the alley shows liquid running down the center, similar to that shown in Video #3, even though the images were captured at different points in time.
Video #4 – Capitol Hill Club
The façade of the Capitol Hill Club and additional details may be viewed upon further inspection using a variety of mapping tools.
Google Street View provides a clear view of the location. The awning shown in Video #4 is noted below with an arrow.
Mapping Observations
The FBI released the below map showing the location of where the pipe bombs were placed at the DNC and RNC headquarters.
Taking the threads of information we accumulated above, we can piece together possible scenarios of what occurred, which may also lead to additional questions to explore. Here is a possible path the Suspect may have taken to travel from South Capitol Street to the DNC Headquarters to the RNC Headquarters and then past the Capitol Hill Club. This path may be one of several possibilities, however, it appears to be the most direct route between the 4 locations captured on video.
By organizing available breadcrumbs in a logical manner, a picture of the Suspect’s actions can begin to be compiled. Disparate and tangential threads of information may lead to additional threads or leads that can be explored. It is important to bear in mind that some breadcrumbs or clues may potentially be valuable, but others may be incorrect or unrelated to the investigation at hand. Approaching open source investigation without pre-set biases is important.
Daniel Farber Huang is author of “NOWHERE TO HIDE: Open Source Intelligence Gathering” about how the FBI, Media, and public identified the January 6, 2021 U.S. Capitol rioters and also author of “Practical Cyber Security for Extremely Busy People.” He is a strategic consultant helping a wide range of companies in different industries reduce risks at all levels of their organizations, including their cyber security.
