A Tattoo and an Etsy Shirt Led Cops to Arrest Woman Accused of Burning Cop Cars

Protests over the police killing of George Floyd have swept the country for weeks. Thousands of people have filled the streets of cities all over the U.S. to protest systematic police brutality and racism, ignited by the video of a Minneapolis police officer kneeling over Floyd’s neck for more than eight minutes.

A small minority of the people in the streets have vandalized property, and the police are finding novel ways to use social media and other internet breadcrumbs to find and arrest them, highlighting how some people can be identified and arrested via scant, obscure information on the internet.

On Wednesday, prosecutors announced that they charged a woman for allegedly burning down two Philadelphia police cars on May 30, accusing her of arson. FBI agents were able to identify her thanks to an investigation that largely relied on data freely available online, based on an aerial video taken the day of the protests, an Instagram picture, photos taken by an amateur photographer, and—crucially—a forearm tattoo and an Etsy t-shirt.

This case highlights how law enforcement is getting better at using open source intelligence—or OSINT—on the internet, how hard it is to blend in and protect your identity when protesting in public, and how videos and photos posted of protests can help amplify them, but also come with risks for people who are there.

“FBI investigations are adapting with the changing times as people increasingly put themselves out there online in ways they don’t fully appreciate at the moment or even remember later on. You pull one thread in the morning and you got it figured out by lunchtime,” Seamus Hughes, the Deputy Director of the Program on Extremism at George Washington University, who was among the first to spot the case before it was announced, told Motherboard. “Cameras are everywhere, whether it’s protestors’ iPhones, news organizations covering the crowds, or the surrounding buildings’ CCTVs. If you set two cop cars on fire, they’ll eventually find you, it’s just a question of how quickly.”

In this case, it only took a few days.

The FBI agents analyzed an aerial video recorded by local news and posted to Vimeo that showed the scene: people breaking windows in Philadelphia on May 30, and a woman burning down two cop cars, according to an affidavit signed by one of the FBI agents investigating the case.

The FBI, as well as the Department of Justice, declined to comment on the case.

Paul Hetznecker, Blumenthal’s lawyer, said in a phone call that he’s concerned about prosecutors charging her in a federal court, instead of leaving local authorities to handle the case as they have done in other similar cases after the incidents in Philadelphia.

"The techniques utilized by the FBI are gonna be scrutinized during the course of my pre-trial investigation of this case," he said, declining to comment further on the case.

The agents were able to find a few Instagram pictures of the incident (seen above), and then obtained more than 500 photos from an amateur photographer who was at the protests that day. One of the pictures showed the writing on the woman’s t-shirt: “KEEP THE IMMIGRANTS, DEPORT THE RACISTS,” the FBI agent explained in his affidavit.

As it turned out, that was a custom made t-shirt sold on Etsy.

The FBI agents saw that an Etsy user named Xx Mv, whose personal Etsy URL was “alleycatlore,” which described herself as living in Philadelphia, had posted a review after apparently purchasing the shirt.

The FBI then Googled “alleycatlore” and found a user named “Lore-Elisabeth” on the mobile fashion store Poshmark. Another search for “Lore Elisabeth Philadelphia” led the agents to a LinkedIn page for a woman who works as a massage therapist for a company in Philadelphia.

On that company’s website, there are videos of massages hosted on Vimeo. One of the videos shows the tattoo that is visible on the woman’s forearm in one of the Instagram pictures that the feds found.

The agents also found a phone number for the woman, which they used to find a home address through the DHS Electronic System for Travel Authorization, a government system to screen foreign individuals traveling to the U.S. This then led them to find her DMV photo, according to the court document.

At the same time, the Etsy seller provided purchasing records following a subpoena, which confirmed the Xx Mv user had purchased two KEEP THE IMMIGRANTS, DEPORT THE RACISTS t-shirts, one of the in the same color as the shirt that appeared in the photos. The subpoena also revealed the shirts had been sent to a Lore Elisabeth in Philadelphia, according to the FBI agent. The Etsy seller did not respond to a request for comment.

At that point, the feds had enough evidence to arrest the woman, who is now in jail and appeared in federal court on Tuesday.

This investigation is a great—and scary—example of just how much one can find out with just an internet connection. In the past, news organizations such as Bellingcat or The New York Times Visual investigations team have used similar techniques to break major news stories such as the identity of several Russian spies, or to reconstruct the murder of journalist Jamal Khashoggi.

This is also a great reminder that any image of protests users share on social media could help inform law enforcement investigations, even if that wasn't the user's intention.

Correction: a previous version of this story reported that Etsy provided purchasing records to the FBI. It was actually the Etsy seller who makes the KEEP THE IMMIGRANTS, DEPORT THE RACISTS t-shirt who provided records following a subpoena.

Subscribe to our new cybersecurity podcast, CYBER.