The first waves of arrests in the deadly siege at the U.S. Capitol focused on the easy targets. Dozens in the pro-Trump mob openly bragged about their actions on Jan. 6 on social media and were captured in shocking footage broadcast live by national news outlets.
But six months after the insurrection, the Justice Department is still hunting for scores of rioters, even as the first of more than 500 people already arrested have pleaded guilty. The struggle reflects the massive scale of the investigation and the grueling work still ahead for authorities in the face of an increasing effort by some Republican lawmakers to rewrite what happened that day.
Among those who still haven't been caught: the person who planted two pipe bombs outside the offices of the Republican and Democratic national committees the night before the melee, as well as many people accused of attacks on law enforcement officers or violence and threats against journalists. The FBI website seeking information about those involved in the Capitol violence includes more than 900 pictures of roughly 300 people labeled "unidentified."
Part of the problem is that authorities made very few arrests on Jan. 6. They were focused instead on clearing the building of members of the massive mob that attacked police, damaged historic property and combed the halls for lawmakers they threatened to kill. Federal investigators are forced to go back and hunt down participants.
The FBI has since received countless tips and pieces of digital media from the public. But a tip is only the first step of a painstaking process — involving things like search warrants and interviews — to confirm people's identities and their presence at the insurrection in order to bring a case in court. And authorities have no record of many of the attackers because this was their first run-in with the law.
"Most of these people never showed up on the radar screen before," said Frank Montoya Jr., a retired FBI special agent who led the bureau's field offices in Seattle and Honolulu. "You watch the movies and a name comes up on the radar screen and they know all the aliases and the last place he ate dinner, all with a click of a button. Unfortunately, that's not how it is in reality."
The FBI has been helped by "sedition hunters," or armchair detectives who have teamed up to identify some of the most elusive suspects, using crowdsourcing to pore over the vast trove of videos and photos from the assault.
Forrest Rogers, a business consultant who helped form a group of sedition hunters called "Deep State Dogs," said the group has reported the possible identities of about 100 suspects to the FBI based on evidence it collected.
Sometimes, a distinctive article of clothing helps the group make a match. In one case, a woman carrying a unique iPhone case on Jan. 6 had been photographed with the same case at an earlier protest, Rogers said.
"It's seeking justice," he said. "This is something that's unprecedented in the history of our country." Rogers asked, "Where else have you had several thousands of people who commit a crime and then immediately disperse all over the United States?"
John Scott-Railton is a senior researcher at the Citizen Lab at the University of Toronto who has been collaborating with journalists and others to identify suspects using digital clues. He said that while much is known about the "small fish" who committed crimes that day, a deeper understanding is needed of the actions of organized group leaders.
"We all need to be in a place where we can have conversations about what Jan. 6th was that go beyond a bunch of individuals motivated by a set of ideologies who showed up at the Capitol," he said.
Those being sought include many accused of violent attacks on officers. One video released by the FBI shows an unidentified man attacking officers with a baton. In another, a man is seen ripping the gas mask off an officer who screamed in pain as he was being crushed into a doorway by the angry mob.
In some cases, social media platforms have turned over incriminating posts that defendants tried to delete after their gleeful celebrations of the siege gave way to fears of being arrested. Often, the attackers' own family, friends or acquaintances tipped off authorities.
In one case, the FBI used facial comparison software to find a suspect on his girlfriend's Instagram account. Agents then went undercover, secretly recorded the man at work and got him on tape admitting to being in the crowd, which he described as "fun."
"The more of these people you identify — potentially through search warrants and social media communications — you're going to be able to identify others," said Tom O'Connor, who focused on counterterrorism as a special agent before leaving the bureau in 2019. "Those people who have been arrested will then be given the opportunity to cooperate and identify other persons involved."
The FBI has offered a reward of up to $100,000 for information leading to the arrest of the person responsible for planting the pipe bombs in Washington on Jan. 5. Footage shows a person in a gray hooded sweatshirt, a mask and gloves appearing to place one of the explosives under a bench outside the Democratic National Committee and the person walking in an alley near the Republican National Committee before the bomb was placed there. It remains unclear whether the bombs were related to planning for the insurrection.
Justice Department officials say arresting everyone involved in the insurrection remains a top priority. Authorities recently arrested the 100th person accused of assaulting law enforcement as well as the first person accused of assaulting a member of the press — a man prosecutors say tackled a cameraman.
"They will find them," said Robert Anderson Jr., former executive assistant director of the FBI's Criminal, Cyber, Response, and Services Branch. "I don't care how long it takes. If they are looking for them, they will find them."
More than a dozen Jan. 6 defendants have pleaded guilty, including two members of the Oath Keepers militia group who admitted to conspiring with other extremists to block the certification of President Joe Biden's victory.
Most of the other plea deals reached so far are in cases where defendants were charged only with misdemeanors for illegally entering the Capitol. The only defendant who has been sentenced is an Indiana woman who pleaded guilty to a misdemeanor and was spared any time behind bars.