Zello, Operator II: Severed networks and those that remain

---

This article follows up a previous MilitiaWatch article on the use of Zello, a free walkie-talkie app, by the US-based armed far-right, including aggressive activists working in support of former president Donald Trump. That article with visualizations is available here:

Zello, Operator: Recruitment, right-wing ecosystems, and semi-clandestine organization

Since that article, further investigation of right-wing militant groups’ use of Zello resulted in the direct recording of it being used at the 6 January storming of the US Capitol Building. This was then published in The Guardian. As references in that article, a list of over 800 channels was sent to Zello with a request for comment. Zello subsequently announced that they had banned 2000 militia-related channels, though they described groups’ use of the platform as “social media vanity messaging”. An On the media podcast covering this can be listened to at this link.

There has been only a cursory explanation of what was in this spreadsheet beyond that it was full of far-right organizing. So here’s a breakdown of what the ‘group character’ of the spreadsheet looked like:

Over 50% of all channels in the list were explicitly III% groups. The overall percentage of groups that claimed III% character is also slightly larger, as some “Patriot Emergency Response” channels and even some Oath Keepers channels claimed a dual status as both III% and some other character. Despite their high numbers in this network, it is unsurprising just how represented the III% groups are within this network. It’s a brand of militia that has multiple competing splinters and most of those splinters started on Zello years ago. The “Militia” item in the legend is just a stand-in for unaffiliated militia groups, including both non-descript “patriot” militia groups and local groups not describing themselves as Oath Keepers or III% or otherwise.

Zello claims to have banned 2000 militia channels, which is over double the amount of channels sent to them as part of this investigation. Firstly, this indicates that they were likely already gathering channel affiliation with the potential plan of monitoring or banning these channels. However, of the channels sent to them, the status is detailed below:

83.6% of these channels now return a ‘410’ error, which appears to be a Zello-induced ban of the channel. 10% of the channels also returned a ‘404’ error, which is usually indicative that the channel has been deleted by its owner. Some groups rushed to delete their channels when news of militia involvement in the 6 January storming started to reach a fever pitch. Yet 6.4% of the overall channels remain online. More on which channels these are later.

Zello provides highly networked voice communication, even if the app claimed not to be social media previously. Even just exploring the owners of the channels sent to Zello, there’s some obvious coalescence around several influential Zello users. Full chart, weighted by the number of channels owned here:

The above is likely a bit overwhelming, especially given that the text hardly fits in most of the squares, so it’s good to focus on the higher end of the visualization, these top 12 channel owners:

“steele001” and “1%Watchdog” were both directly referenced in the earlier MW piece on Zello, the former for their centrality within the III% Defense Militia environment and the latter for the USCF network. The 1%Watchdog network, as one may recall, was also connected to some troubling content and is actually one of the channels that Ohio Oath Keeper Jessica Watkins was participating on during the US Capitol Building storming.

It’s hard to verify if all of these accounts are still active and it doesn’t appear that Zello is pursuing major account or device bans beyond a few recorded instances (notably the leader of the III% Security Force and the admin of the MyMilitia forum seemingly lost their accounts), but 1%Watchdog is still highly active and creating new channels each week. 1%Watchdog was also the voice heard egging on the Oath Keepers now facing conspiracy charges in J6, telling Jess Watkins and others involved in the storming that “You are executing citizen’s arrest. Arrest this assembly. We have probable cause, acts of treason, election fraud.” in tape published in an On the Media podcast accompanying some of the work you’re reading here.

Here’s a visualization of the full map of far-right actors sent to Zello:

It’s an admittedly fairly unwieldy visualization, which begs for more specificity. One of the things that is an easy indication of tighter networks or more group overlap is if the channels share executive teams. Just looking at the “Owner” of the channels results in the following visualization, another way to show the grey squares “top owners” visualization:

Finally, another focus here is those channels that have remained online. Those channels with ownership overlap are labeled in the next visualization:

One may notice that these three online networks all share one thing in common: they’re all MAGA Drag channels, something Zello didn’t deem particularly threatening (or otherwise just not fitting underneath their bannable designation of “militia”).

---

On the MAGA Drag

“MAGA Drag” refers to a public demonstration modality not invented by Trump adherents but often engaged in by his followers. It usually involves hitching American and Trump flags to the back of pickup trucks and then driving up highways and through towns and cities. These are events not done alone, either, and often involve dozens of hyped Trump fans driving large trucks through and around communities that are not their own. Some who engage in MAGA Drag events turn up as vigilante militia in highly politicized moments, others attempt drive-bys or discuss running over counter-demonstrators when they appear, and most joke extensively about the numerous car-ramming events engaged in by anti-BLM or anti-‘antifa’ actors over this past summer.

These convoys have a very clear meaning with their public presence. They’re meant to intimidate onlookers while keeping participants safe in their large vehicles. A New York MAGA Drag group blocked the Mario Cuomo Bridge, with at least one participant showing off his hood decoration of an effigy of “ANTIFA” splattered across the front of his Chevy, fake blood included. A member of a “Trump Train” in Kentucky jumped out of his vehicle with a gun and carried it in front of himself while directing traffic around a counter-protest. In California, a convoy involved participants shouting racial slurs at children in a predominantly minority community they drove through. In Texas, a caravan drove around a polling location used mostly by non-white voters. Ahead of the shooting death of Aaron J. Danielson, a MAGA Drag event brought dozens of large trucks full of aggressive pro-Trump demonstrators who shot paintballs and sprayed mace at others in downtown Portland (the event was shared by Jack Posobiec and then quote-tweeted by Trump himself).

Near Austin, Texas, a now-viral video showed Trump-flag adorned trucks attempting to intimidate a bus with a Biden campaign logo on the side. One of those allegedly involved, Eliazar Cisneros, admitted to doing so in what appears to be Facebook comments after the fact. This wasn’t Cisneros’ first car-related violence, either. According to an on-the-record phone interview with KENS5, Cisneros admitted to driving his car through a crowd of protesters on 12 September 2020 in San Antonio. He also apparently said to the journalist who called him, “I didn’t want to hurt anybody.” Even before what might be deemed ‘election season’ of the late summer and fall, Cisneros was plenty involved in public intimidation of demonstrators. On 4 June 2020, he and another man walked around San Antonio with weapons saying they were there as a “deterrent” to the protests that had happened the night before. Cisneros is seen wearing the fairly common right-wing shirt that says “LGBT”, which the letters meaning not queer community identity labels but “Liberty Guns Beer Trump”.

So Cisneros indicates on an individual level what MAGA Drag-associated violence may look like: from patrolling an empty street armed with a friend to driving a car through a crowd, to attempting to push a vehicle off the road in a small band of large trucks.

These groups rely heavily on social media and online communications for recruitment and turnout. This could mean, for example, creating a banner for sharing across platforms that gives information about where to meet. In some cases, these flyers included Zello channels in the event details:

The above flyer is one for events organized by the “MAGA CC” network in a visualization further above. The group is still active on Facebook organizing similar events.

---

The Zello Channel Owners

There are three profiles that have taken an ownership role over multiple MAGA Drag channels. These are:

• MAGA CC
• shannonlatrisha
• erinforct110

Each of these accounts and their Zello social environment are analyzed here below:

MAGA CC

“MAGA CC” is just a broad account without a clear personality attached to it yet. The “MAGA” stands for Donald Trump’s well-known campaign slogan “Make America Great Again”, and the “CC” stands for California’s Central Coast. This account is therefore concerned primarily with organizing events in western central CA.

Here’s a map of all the locations mentioned by these channels run by “MAGA CC”:

Which, when mapped across the rest of CA, does not appear to actually cover the totality of California’s Central Coast, but instead a portion of the San Luis Obispo County region of Central Coast:

The MAGA CC movement connected to this cohort of Zello channels is still quite active on Facebook, attempting to organize events in the area even after Trump’s loss and exit from the White House. Recently, the group has been pushing towards the Recall Newsome campaign, attempting to draw from MAGA Drag momentum to pressure the Democrat governor of the state. Some of this is under the guise of their newest rally naming convention: “America First”.

While it’s unlikely that this is connected to Nick Fuentes’ Groyper movement of the same name, it does indicate how mainstream the phrase has become even among more traditional GOP types. A future event under this name organized by the MAGA CC group includes a Turning Point USA representative, a local elected official, and a candidate for the California State Assembly.

---

shannonlatrisha

“shannonlatrisha”, however, is one of the leaders of the “MAGA Drag the Interstate” movement popular over much of late 2020. Her name is the same as her profile, Shannon Latrisha. Shannon’s Twitter account is now suspended, but a search reveals her interactions with Donald Trump’s Tweets and a mid-sized Q account that has dodged Twitter’s bans.

There was also a profile for a “shannonlatrisha” on the now-defunct MAGA Drag the Interstate website, though the only archive of the page is largely empty:

Shannon Latrisha posted a YouTube video compilation featuring footage from a late 2020 pro-Trump rally in DC that featured the Proud Boys and several militia members (including some who were arrested for concealed carry). The video, set to Twisted Sister’s “We’re Not Gonna Take It”, starts with this quote that is quite popular with the pro-Trump right-wing right now, despite its original context being opposite to how they’re seeking to deploy it. Here’s that quote in the video:

So this Shannon has a comment on their video by one account, Transformative Visions:

Anyway, an archive of the @ShannonLatrisha Twitter account was available for a partial scan, for which the following error came forward:

This showed a redirect notice from a @shannonlatricia to a @QTheSoundsofWar account within their archive, which is something that can happen when an account is renamed. Here are two more tweets from the QTheSoundsofWar:

These tweets show the @QTheSoundsofWar account sharing MAGA Drag the Interstate weblinks and saying they are affiliated with the Missouri chapter of the MAGA Drag the Interstate milieu.

Thankfully, the account has blessed ID seekers with a hit of a tweet for trying to contest Google’s assertion of Biden’s electoral video:

It’s pretty plain of a claim for the user to claim directly “yes, that’s me Shannon”, however, more verification is yet available. Thankfully, there is a “Missouri MAGA Drag the Interstate” group on Mewe, which has 6 administrators.

Among those administrators in the screenshot above are the commenter on Shannon Latrisha’s YouTube video, Transformative Visions. However, there is also an account named “Merit Anon”.

Finally, MARIT ANON included a profile photo with a III% Roman numeral over it, enlarged below. She’s also wearing a Space Force hat:

Their Gab account, also under @QTheSoundsofWar, includes another name, “Shannon Cox”:

An Etsy review for Trump ornaments left after the 2020 election then provides the name “Shannon Latrisha Cox”:

This name appears several places online, including as a comment in celebration of a SpaceX Launch in 2018, some discussion over losing a parent [redacted here for privacy, and please do not seek it to reshare], and a few other local news reports. With all of this information, we are able to conclude that QtheSoundsofWar and the person leading the Missouri MAGA Drag events is Shannon Cox of Ballwin, Missouri (just outside of St. Louis).

---

erinforct110

“erinforct110” is likely Erin Domenech, who ran for election to the Connecticut House of Representatives for District 110. She lost her run to Democrat Bob Godfrey.

Erin’s connection to MAGA Drag the Interstate organizations is also reported elsewhere. Jessica Schulberg, Nick Robins-Early, and Jesselyn Cook all included in their reporting for Huffington Post the following back in November 2020:

Erin Domenech’s listed email address on her campaign site generates a email for verification when selecting ‘forgotten password’ through Zello’s site (this doesn’t work unless someone has signed up with that email):

And the “erinforct110” account that is presumably attached to this email address is still online and available for adding to contacts within the Zello app’s Contact Wizard tool:

One thing that’s interesting about the “erinforct110” MAGA Drag network is how geographically dispersed it is compared to the Central California example. Here’s a Google Earth map showing the locations of these supposed chapters/events:

Danbury is marked here because it’s technically the location of Erin’s home. It’s also the center of the Connecticut House of Representatives District 110. Danbury and Stamford (a MAGA Drag Zello channel in the dataset) are both in Fairfield County, but Norwich is in New London County and Willington is in Tolland County.

On 1 November 2020, there was a substantially-sized MAGA Drag event in Hartford CT just ahead of the election. It’s unclear if Erin was there in person, but it would make sense that she was at least likely involved in the planning, given that she ran the Zello channel “MAGADragCT – Main”. She did post this strange message on 1 November. There is no other context:

The 1 November Hartford Drag event was perhaps like many other similar events in that militia members were among the participants. Footage from a sympathetic photographer on the day of the drag presented this troop transport vehicle with an Oath Keepers flag and an Oath Keeper hanging out the passenger door in a parking lot.

The 1 November Hartford Drag event was part of a nationwide call by the MAGA Drag the Interstate organization, which referred to 31 October and 1 November as “MAGA Weekend” on their site:

Just after the election, Erin posted on Parler a message of support for the “CT MAGADRAG team” after she was banned on Facebook, which she reposted on her Twitter account as well:

The sole retweet of this post was the MAGA Drag the Interstate Connecticut Twitter account.

---

MAGA Drag Significance to J6

Ahead of the storming of the US Capitol Building on 6 January 2021, militia groups, QAnon channels, and other general MAGA communication networks had been talking about the certification of the vote to happen that day. Donald Trump previously tweeted that the 6th would be a “wild” protest. A prominent MAGA Drag Zello channel, the “MAGA Caravan” had gone so far as to create a map of rally points for those coming through routes as north as Maine, as west as Kentucky, and as south as South Carolina.

This poster, visible above, was also the channel’s profile picture. It gave names to each of these rally points relevant to patriotic symbols of rugged men ready for combat: Cowboy for the West, Rebel for the South (as in Confederate Rebels), and Minuteman for New England. Each of these routes carried at least one other rally point before reaching DC on the 5th at 6PM local time.

This graphic circulated through the dense networks that these groups enjoy – from and through Zello and onto numerous other platforms. To illustrate this is the following image:

To illustrate the growth of this image to the Frankenstein’s monster it became, here’s each social media frame in order, from left to right:

Note that the final date on Chester’s VK post is 23 December 2020, meaning this image had been circulated around far-right social media spaces well before the storming itself, something that clearly runs counter to the notion that “there was no intel” about the events of the day. (This claim has also been disproven by other internal documents, too.)

The MAGA Cavalry banner was at one point included in a Washington Post article about Zello (though the source is uncredited). The article is available to read here, though they have now removed the image and instead described it in text — still without credit.

This wasn’t the only MAGA Drag-style advert posted on social media by these types of groups, though. In fact, the corresponding Twitters of some of the channels detailed above even interacted over a banner emblazoned with “Operation Occupy the Capitol” in late December. See below, a screenshot of the MAGA Drag the Interstate Connecticut account retweeting Shannon Cox posting to her Missouri audience that they should head to DC or show up at their own state capitol building.

The same account also posted encouragement for their followers to go to DC for the Million MAGA March on 14 November 2020, which Shannon Cox posted her own video and comments from as well.

---

MAGA Drag, What’s Ahead?

MAGA Drag events remained quite popular throughout last summer and into the election period and beyond. There is still room to interrogate their connection to militant groups and violence, and this post serves to further this only inches. Many of these Zello channels remain engaged and active, still sharing information about actions related to anti-mask demonstrations, campaigns like the one to recall the CA governor, and more.

There are now at least a few examples of MAGA Drag events after J6 not pulling the crowds that they previously used to, such as one in Connecticut just ahead of Biden’s inauguration that largely “fizzled out“.

These channels have evaded bans but have been involved in organizing events that have led to targeted political threats and deadly violence before and may do so again in the future. It’s not too difficult of a stretch to think that it’s a good idea for researchers and journalists to monitor these groups from here.

---

Edit (4 May 2021): Amended an inaccurate region description to reflect that MAGA CC is in San Luis Obispo County, not Ventura.

---