Snitches & Sleuths: An Update From Puget Sound Prisoner Support

No Trace Project > Ressources > Snitches & Sleuths: An Update From Puget Sound Prisoner Support

A note from Puget Sound Prisoner Support:

This information was compiled from public arrest documents regarding incidents in the Seattle area and does not involve sensitive or personal information beyond names already made public by the state. We provide our observations of these cases to highlight the dangers of not following security practices, as well as to inform the community that one of the defendants has cooperated with the authorities.

We're presenting this information so that people may understand the severity of recent cases as well as how the state builds cases against people involved in social justice movements. We do not intend to shame anyone for bad security practices, outside of direct cooperation with the state. We are simply presenting ways to keep communities better informed and guidelines to protect each other from state repression.

---

Snitches and Sleuths

This situation involves 3 criminal investigations, which took place at both the state and the federal level. The known defendants are: Jacob Greenberg, Danielle McMillan, and Justin Moore. There are several other people mentioned in the documents who are identified as Suspects 3-5; Conspirators 3 and 4 in the state and federal documents respectively. We do not know, and do not want to know, the identities of these individuals and have nothing to add to this write-up besides what was available in law enforcement compiled documents.

It is impossible for us to know how widespread this investigation is. We became aware of it in September 2020 with the arrests of Jacob Greenberg and Danielle McMillan. Neither of these individuals have gone to trial at this point, so all accusations made by the state are unproven allegations. We discuss Greenberg's case because it allows us to identify McMillan as the cooperating defendant in Moore's case, as we have detailed below.

On October 16th 2020, the King County Prosecutor filed charges against Greenberg and McMillan. Greenberg was charged with:

• Reckless Burning in the First Degree for an alleged barricade fire on 11th and Pine on September 26th;
• Assault in the First Degree for an alleged baseball bat attack on a police officer outside the East Precinct on September 23rd;
• Attempted Arson in the First Degree for an alleged Molotov cocktail attack on the East Precinct on September 1st.

McMillan was charged with:

• Attempted Arson in the First Degree for the September 1st attack.

The charging documents against Greenberg and McMillan detail exact movements of a black bloc that formed during a protest on the night of Sept 1st. The document specifically notes the amount of time that officers were able to surveil the crowd while it grew in size. It notes that S1 (suspect 1) was wearing distinctive black clothing and describes in detail what this individual was wearing, it does the same for S2. S1 is later identified as Jacob Greenberg and S2 as Danielle McMillan. Throughout the description of the event, identifying clothing is used to track the suspects (S1 through S5) through the crowd for the duration of the event. S3, S4, and S5 are never identified by name but are addressed as being in connection to the events that led to the criminal charges for Greenberg/S1 and McMillan/S2.

From the charging documents:

Identifying the Suspects

Before diving into this, a word about social media rumors that the state is lying about all/most of this: It's important to know that the police lie, and the prosecutor's office lies too. They make up stuff all the time, and they have each other's back when they do. When we have encountered and could prove that the state was lying, it was never to this degree or this amount of fabricated evidence. It is an unfortunate reality that after reading possibly hundreds of charging documents from the 2020 uprising cases around the country, the conversations detailed in these documents do not seem outlandish or inconceivable. That being said, it's impossible to know if any of the evidence they are bringing against these individuals is false, and if it is, which specific parts. So, we are presenting it to you here as it was presented by the state. Speculation and rumors about the veracity of individual claims is generally an unsafe and ill-advised practice.

According to public documents, on the night of September 23rd a phone was recovered by SPD after an attack on an SPD officer outside the East Precinct. On September 26th, Jacob Greenberg was arrested at 11th and Pine for allegedly pouring lighter fluid on a burning barricade. Another phone was recovered from Greenberg during that arrest. Search warrants obtained by SPD for both of those phones showed they had the same phone number. Much, if not all of the following investigation is based on what was found on those two phones.

On one of these phones there are lengthy Signal and Facebook messenger conversations with S2, later identified as Danielle McMillan. According to SPD, the phone records go back only until August 31st, which could mean that Greenberg and McMillan were newly acquainted. This is an inference, but one that is backed up by some of the banter between them shown in the charging documents.

In these conversations Greenberg and McMillan discuss at length the events for which they were later arrested. While McMillan's name is not recorded in her Signal profile, a picture of her wearing a black mask is. According to the document, SPD was able to single out McMillan in surveillance footage of a Molotov attack on the East Precinct because she detailed her actions in text messages with Greenberg. In these messages the two discuss alleged attacks on SPOG for a planned Labor Day march.

SPD used a few different angles to identify McMillan. One was the explicitness with which she detailed her movements with Greenberg both on that night and other nights. One of the first things that SPD used (according to them) was a few messages that indicated what McMillan might do for work and then a facebook messenger conversation between the two from Sept 21st-25th. The FB messenger conversation is with an account for “Danielle McMillan” where they discuss McMillan not being able to go to demos for a little bit because of being sick. The two also openly discuss the first phone that Greenberg lost on September 23rd and how to “lock down” accounts to stay safe.

By using information from McMillan's FB profile, SPD was able to request her information from Department of Licensing as to her last registered address and vehicle. That vehicle, which was registered to McMillan, was seen in the neighborhood on the night of the Molotov attack, according to SPD. They were able to locate and surveil her vehicle while in the area of Cal Anderson Park, even documenting when and to where the vehicle was moved over the evening. These movements aligned with a conversation between McMillan and Greenberg where she discusses moving the car because of police presence. This information verifies that SPD is using sophisticated yet increasingly common surveillance tools to monitor the movements of individuals and vehicles. We have articulated how your phone can be used against you if you are participating in protest culture, this is a good moment to understand that your car can be as well.

The final piece of information regarding the identity of S2 as McMillan is a public Instagram account located by SPD in October last year that is the professional account of a real estate agent named Danielle McMillan with the phone number posted. That number is the same as the one being used to communicate with Greenberg over Signal.

Take-Aways

A large amount has already been written about phone security, so we can link to separate articles here and here. Phone security has nothing to do with supposed illegal activity; phone security is something that everyone should be practicing at all times. This investigation shows that easily obtained search warrants for phones allow the police, state and federal, access to your vast amounts of private information. While there are ways to “lock your phone down”, our advice is to, on top of technical security methods, always live under the adage “if you don't want it read back to you in court, do not send it in a text message”. Leave your phone at home if you're participating in demonstrations and don't discuss things that could seem sensitive or private over the phone even if you're using a secure messaging application like Signal.

We have no reason to believe that the Signal messaging that was being used on Greenberg's phones failed, or in some way did not grant the security it says it provides. Signal is only as useful as you are careful; when a state or federal law enforcement agency physically has a phone it is easy for them to gain access to everything that is on that phone, including unsecured browsing and app history. If the messages are still on your phone, sending them through Signal means nothing. The alleged text discussions that the government documents cite may not have been available if disappearing messages were utilized. This is why we stress the importance of your personal privacy and security being looked at as a holistic entity. No single action will keep you “safe” and your information private. Rather we want to encourage the cultivation of a security culture where we support each other in using safer practices all the time.

Security is not a retroactive act, whether you are trying to stop your messages about protest activity being read by the government, or a fascist from exposing your identity. Social media and phone security cannot be fully achieved after a breach has happened-it is a preemptive and consistent activity. There are security lessons here for everyone, whether or not you are taking direct action. We are not celebrating or encouraging anyone to break the law. Rather, we want the community to be safe and smart. It is often impossible to know what the state will consider to be incriminating, either of you or of someone you know.

Federal Case

On November 23rd 2021, the US Attorney's office for the Federal District of Western Washington filed a criminal charge against Justin Moore of Renton, WA. He was charged with 1 count of Unlawful Possession of Destructive Devices stemming from his alleged involvement with bringing a case of Molotov cocktails to a demonstration at Seattle Police Officers' Guild (SPOG), on Labor day (Sept 7th) 2020.

The charging document for Justin Moore involves several “conspirators” (Listed in the document as Conspirators 1–4). C1 is Jacob Greenberg and C2 is Danielle McMillan. There are multiple conversations found through the subpoenaed phones where C1 and C2 discuss possible actions with 2 other people who are identified as being known to C1/Greenberg and C2/McMillan through Instagram accounts. Two accounts in particular are highlighted and enter into the document as C3 and C4. They are not identified in the document, but almost certainly the identity of these individuals is known to investigators, or soon will be.

Social media is one of the easiest and most common ways for a host of bad actors to access your identification. Whether it is the police or fascists, social media is a weak link in almost everyone's privacy plans. No matter how well you think your accounts are “locked down,” there are a myriad of ways for investigators to ascertain your identity. The best way for someone to keep their information private from those who would wish to harm them is to not use social media at all. For some this may feel like an impossible task. But we ask that you consider the consequences when deciding to engage in online banter about your politics or activities both personal and professional.

Although identified in federal charging documents only as C1, we know C1 is Greenberg because C1 is identified as being arrested on September 26th for setting a dumpster on fire and losing a phone on September 23rd while allegedly assaulting an SPD officer. C2 is easily identified as McMillan because the conversations detailed in the federal document directly match those from the state case against Greenberg, which explicitly name McMillan. This is a good example of how investigations can and do overlap.

According to the federal documents, before the Labor Day demonstration, C1/Greenberg, C2/McMillan along with C3 and C4 discussed detailed plans via text message for the event, including procuring supplies and information. C3 and C4 have not been identified in the documents (we do not know, and we do not want to know who they are, or who anyone suspects they are). On the day of the demonstration, SPD and federal investigators used a few different surveillance methods to gather information on the crowd. They specifically mention that livestreams were important to their investigation and name RebellionBaby and Malcontent Tango in the document. Malcontent Tango screenshots reoccur in the document many times. Besides these photos, SPD and FBI agents were monitoring the crowd using audio and video surveillance recorded by undercover officers. Officers were among the crowd, and observing the crowd from remote locations.

The federal charging document states that SPD found the container of Molotov cocktails on the ground after the event and used their own documentation and livestream footage to follow the person carrying the container throughout the event. Two notable moments were a picture obtained by what we suspect was an undercover SPD officer in the crowd of someone alleged to be Moore, identified by a piece of red clothing sticking out from under his sweatshirt. This is later used in the document to match with Malcontent News' livestream of people in Judkins Park after the event had concluded. The livestream footage is watermarked with Malcontent News' logo, and allegedly shows protest participants hanging out after the conclusion of the event.

Theoretically, none of this specific surveillance had led to the identification of Moore. But it still ended up being deeply important to the criminal case once the feds had identified Moore. That identification came from someone in the charging document referred to as Witness 1, Moore's roommate in late 2020, possibly into 2021. Witness 1 and Moore had a domestic dispute on May 28th 2021, and Renton PD was called to the residence. It was then that Witness1 informed responding police that Moore was involved in the SPOG demo and many other events. Witness1 also identifies Moore as “Potato.” Nicknames have become popular in the protest scene since the beginning of the 2020 uprising, but we want to remind people that nicknames provide zero security when someone also knows your legal/dead name, or when everyone knows you by the same nickname. After the Renton police got this information from Witness1, they alerted the FBI.

The FBI served a search warrant on the residence and a vehicle alleged to belong to Moore a month later in June 2021. As far as we are aware, neither Moore nor Witness1 attempted to make this raid known to the broader community. Failing to alert the community of attempts to investigate people in the movement, or those formerly in the movement, leaves those people isolated and the bigger community in the dark. We implore everyone to make any and all attempts to investigate a crime, by either state or federal law enforcement, known to the broader radical community. This means doing more than vague social media posts or twitter threads, and is one of the things that we as an anti-repression group aim to facilitate. Even if someone has fallen out of favor with the bigger scene, knowing they are being investigated is a safety precaution for everyone involved, currently or previously. Silence and isolation are our enemies in the fight against state repression.

Bad-Jacketing

In the days following the Labor Day SPOG rally, social media was full of people attempting to identify someone seen in footage wearing brown gloves and carrying alleged incendiary devices, claiming they were a cop. Now, Justin Moore is accused by the state of having worn brown gloves and bringing Molotovs to the Labor Day SPOG demonstration. The theory that this person was a cop was offered with little to no basis outside of supposed actions the person with brown gloves did, or the way they looked in a photo, and resulted in heightened attention to this individual and their possible identity. While it is unlikely this was decisive in helping the authorities build a case against Justin Moore, we think it is important to make a note about these types of accusations. Accusing someone of being a cop, informant or snitch is a grave declaration and should be done with the utmost sincerity and seriousness. When significant proof exists that someone is working with the authorities against social movements it is important to come forward with the evidence, as we have attempted to do here. Calling out dangerous or predatory behavior is very important, especially in the moment, but we can and should address those behavioral issues without resorting to accusations of state involvement. We would also like to point out that there is substantial and detailed undercover surveillance from inside the demonstration in this charging document, so the after-the-fact accusations of the person in the video being a plant or a cop were not successful in keeping anyone safer that day, today, or any day in between.

This does not mean that the actions of others inside the movement do not have the capacity to harm both individuals or communities at large, but that labeling those actions as being committed by snitches or cops without serious and well-documented proof is harmful to protest communities. Many with experience in radical movements call this type of accusatory behavior “bad jacketing” and recognize that it can help the police and FBI repress us by sowing distrust and suspicion. The FBI used unsubstantiated accusations about participants in social movements as a way to sow distrust as part of its COINTELPRO campaign. A safer tool for dealing with suspicious or inappropriate behavior is to name the behavior rather than make an accusation that the suspicious person is a cop. For more information about the history of “bad jacketing” we encourage you to read this piece.

Snitching

The federal document goes on to say that C2/McMillan met with federal investigators three separate times over the course of Fall 2021. It states that “Conspirator 2 provided information in hopes of obtaining consideration as to a pending charge of Attempted Arson in the First Degree in King County Superior Court and/or as to potential federal charges.” This backs up the assertion that C2 is McMillan, as this is the state charge she is facing from the alleged Molotov attack on the East Precinct mentioned above. C2/McMillan identified herself, as well as C1, C3, C4 and Moore at the demonstration at SPOG in photos shown to her at meetings with federal investigators.

When McMillan was arrested in 2020, we at PSPS reached out and offered our (non-legal) resources to help her through her court battle, as we do with all defendants that we can establish contact with. We never did any public support for McMillan, but we internally gathered funds and resources for her after she outlined the costs of losing her job, having to move, and finding legal counsel. After that our interactions with McMillan were brief, and we never provided more direct support besides an encouraging email as she moved through her legal process. When we read the federal charging document for Moore we believed that C2 was McMillan, but reached out to her in an effort to show good faith and the possibility that we were wrong, or that the prosecution had misconstrued her involvement. Accusing someone of cooperation, especially of this magnitude is a very big deal and we wanted to reach out to her before making a public statement. McMillan responded to our request to talk by directing all further communication through her lawyer.

Snitching, or cooperation, is one of the biggest threats to radical and revolutionary communities. It tears at the very fabric of one of the core tenets that holds us all together — trust. For this reason we as an anti-repression collective and as part of a larger ecology of anti-state movements stand by the decision to never offer support or comfort for those who decide to turn on their friends and comrades to save themselves. The forces that can be brought down on someone as the state closes in can be overwhelming, and that is one of the reasons we try to contact all defendants before that pressure has come to pass and offer support and solidarity. It is our hope that knowing that people have your back will help those wavering under the weight of federal and state investigators, that targets of state repression will be buoyed by that support and stick to the ethics that keep the broader community safe. But, once someone has made the decision to cooperate, they must live with that decision and be cut off from our support. It is a heartbreaking reality of the upper hand that law enforcement can gain when investigating resistance communities and we hope to continue to fight against it with all our might.

Thank you for continuing to support us through the years so that we may support you all if and when the time comes that you need it, let's hope you never do.

In solidarity, the Puget Sound Prisoner Support Collective.