Federal prosecutors have charged a former government employee with submitting fake tips accusing several of his former co-workers of being involved in the unrest at the U.S. Capitol on Jan. 6, 2021.
The alleged false tips were submitted on Feb. 10, Feb. 16, Feb. 17, and April 11, 2021, as federal law enforcement officials began ramping up efforts to identify and arrest people who entered the capitol, and called on the general public to assist in identifying individuals in the crowd.
“None of the seven government employees and contractors were in Washington, D.C., on January 6 or attacked the Capitol,” the complaint states.
A pair of tips submitted on Feb. 10 state two of the individuals falsely identified as Jan. 6 participants “espouse ... conspiracy theories” and the first victim “actively retaliates against colleagues that do not share [his/her] political views” while the second victim “aligns with colleagues that share similar views.”
In the Feb. 16 tips submitted against two additional victims, identified in the complaint as Victims 3 and 5 (references to Victim 4 are inexplicably omitted in the complaint), the anonymous tipster described Victims 3 and 5 each as a “colleague.”
A Feb. 17 tip also identifies an apparent victim, described in the complaint as Victim 6, as a “colleague.”
April 11 tips submitted against another two apparent victims, identified as Victims 7 and 8, also identify each victim as a “colleague.”
Web Anonymizer Service Used to Make Tips: Feds
Investigators looking into these seven anonymous tips noted similarities across the wording of the tips, the grouping of the dates when the tips were submitted, and the “technical tradecraft” used to submit the tips. These similarities led investigators to suspect the seven tips were all submitted by the same individual.Investigators learned the seven tips were submitted from four different internet protocol (IP) addresses. The complaint alleges Mr. Zapata used a web anonymizer service to submit the false tips.
The complaint states investigators identified the four IP addresses used in the tips as being serviced by the same service provider, referred to in the complaint as “Company A.”
“Company A provides a service that allows its users to access the Internet via an isolated web browser to help protect users from security threats and for other purposes,” the complaint states.
Company A maintains records of its users, including their name, username, email, phone number, address, and payment data. The company also stores user logs, including logs detailing the actual IP addresses of its users and other data elements.
“According to Company A’s logs and records, a single user accessed the FBI’s tips portal on each of the dates and at around the times the tips were submitted. Moreover, Company A’s logs recorded the user visiting the page that displays the § 1001 banner for each of the seven tips at issue. Based on the design of this page, as shown above, the user must click the “I agree” button to proceed to the tip form,” the complaint states. “Beyond just the FBI tips portal, the logs recorded some of the web addresses the user visited just before submitting certain tips, including websites related to the government employee or contractor named in the tip that immediately followed.”
The FBI was able to obtain user information from Company A, identifying a “Mike Zapata” as the user associated with the web traffic surrounding the Jan. 6 tip submissions.
Suspect’s Relationships With Victims
The court records do not specify where Mr. Zapata worked in the federal government, or who employed his alleged victims.The complaint states Mr. Zapata worked at the same workplace as Victims 1 and 2, from around March 2020 until early 2021.
Mr. Zapata worked with Victim 3 from 2014 to 2015, and with Victim 5 from 2017 to 2019.
Mr. Zapata worked with Victim 6 from 2017 to 2018, during which Victim 6 served as Mr. Zapata’s program manager.
The complaint states Victim 7 and Mr. Zapata had some level of workplace interaction at some point in 2020.
Mr. Zapata worked with Victim 8 from approximately December 2019 to February 2020.
Investigators determined Victims 1, 2, and 3 were present at their respective employer’s offices in Virginia during the events of Jan. 6, 2021.
According to Victim 5 and supporting documentation obtained by investigators, Victim 5 was working somewhere in Virginia at the time of the Capitol breach.
Victim 6 was reportedly working from home in Virginia during the events at the Capitol, and Victim 6’s employer provided information confirming he was actively working at the time.
Victim 7 was at their Virginia home during the events at the Capitol, according to both Victim 7 and another individual present at the residence at the time.
Victim 8 told FBI agents he too was working from home in Virginia during the events at the Capitol, and investigators concluded “Victim 8 did not participate in the attack at the Capitol, did not coordinate groups such as the Oath Keepers or Proud Boys, and has never provided classified information to members of these groups.”
The complaint did not offer any specific theories as to why Mr. Zapata might have tried to falsely implicate these seven victims in the events at the Capitol on Jan. 6, 2021.
NTD News reached out to a public defender representing Mr. Zapata in the case but did not receive a response by press time.
