The riot at the Capitol appeared to be almost all chaos and anarchy. But as private researchers and ordinary individuals scrutinized online video and photos closer scrutiny, they have identified some of those who took part and assisted law enforcement.

John Scott-Railton from Citizen Lab at the University of Toronto focused on individuals who seemed to have a real purpose amid the mob — like two men who were spotted with with white, plastic handcuffs that could be used to detain people or take them hostage.

"I kept finding footage of men wearing body armor, communicating with each other and moving with purpose," Scott-Railton told NPR. "It made me think there were people in there who had specific ideas of what they wanted to accomplish and had come prepared to execute on them."

As he gathered clues, Scott-Railton put out calls for help to people he already knew as well as strangers, creating a spontaneous army of online sleuths that numbers in the hundreds, if not the thousands.

Crowdsourcing

"This kind of crowdsourcing is not the same thing as a formal investigation. It's certainly not a replacement for the investigations done by the judicial system," he said. But, he added, "it's an excellent mechanism for surfacing clues."

One of the men holding the handcuffs was photographed in the Senate chamber, wearing a combat helmet and body armor, which included a number of military insignias and the Texas state flag.

Scott-Railton and his informal team of volunteers went to work and soon found a stream of social media that identified the man as retired Air Force Lt. Col. Larry Brock, from Texas.

The other man with the handcuffs — as well as an apparent can of mace — turned up in a photo as he was hopping over a rail. He had gone to great lengths to disguise himself, dressed head-to-toe in black camouflage. He had a black face scarf and gloves, as well as a black baseball cap that read Black Rifle Coffee.

Initially, it looked like a challenging case, Scott-Railton said. But he and his helpers found a photo of the man earlier in the day, standing next to a heavyset woman. That led to an even earlier video at the Washington Grand Hyatt Hotel, where the man was in the same gear, with the same woman — but with his face uncovered.

At that point, he was traced to his social media posts and identified as Eric Munchel from Tennessee.

"Some of the pictures were pretty disturbing, including a shot of him holding a short barreled shotgun up in the air mugging in front of a television showing President Trump," Scott-Railton said. "There were some very sharp-eyed people on Twitter who really helped surface that identity."

Two arrests

Scott-Railton, who says he shares his work with law enforcement, used his Twitter feed to disclose the evidence and he identified Brock and Munchel. On Sunday evening, the U.S. attorney's office in Washington announced that both men had been arrested — Brock in Texas and Munchel in Tennessee.

Overall, about 90 people have been arrested in connection with last Wednesday's riot at the Capitol, according to the Associated Press.

Many were charged with violating a D.C. curfew imposed at 6 p.m. on that day. Federal authorities have announced more than 20 arrests and the acting U.S. attorney for the District of Columbia, Michael Sherwin, told NPR that "hundreds" could eventually face charges.

Since many of those involved in the riot have returned home, the FBI has been tracking them down around the country, making arrests in Alabama, Florida, and Arkansas.

Investigators have been aided by the many clues that the rioters, mostly white men, left behind.

Many posted videos and photos of themselves while in the Capitol. Many did not wear masks to protect against COVID, which made it much easier to identify them. Their cell phones left digital traces placing them at the Capitol during the time of the riot.

Five people, including one policeman, died during the riot. Authorities say the toll could have been much worse. One of those arrested was an Alabama man who parked his parked his pickup truck, with guns and Molotov cocktails, just a block from the Capitol.

Calls for armed rally

As law enforcement works through the aftermath of the riot, authorities are also looking ahead for any potential trouble in the runup to President-elect Joe Biden's inauguration on Jan. 20.

The extremist, pro-Trump, ecosystem online is calling for an armed rally this Sunday with more to follow.

Washington Mayor Muriel Bowser as well as federal law enforcement say they are looking at potential security threats, and large gatherings are expected to be banned. In addition, Biden's inauguration will have almost no crowds due to COVID.

However, Jen Golbeck, a professor at the University of Maryland who follows extremists online, said she is most worried about an individual or a small group seeking to cause trouble.

"It's easier to protect against a big group than a few individuals who are really committed to doing violence and who can't be deterred," she said. "That is language that I'm seeing a lot of online, not from thousands of people, but from dozens of them."

She said the inauguration and landmark buildings in Washington will be well protected, and therefore many not be targeted. But plenty of other places have drawn the ire of the far right and need to have strong security in place, she added.

Last week, some of those taking part in the Trump event posted online maps that provided the locations of many leading media organizations in Washington.

And outside Washington, she added, targets could include state capitols. With some tech companies suspending Trump's social media accounts and those of his supporters, Silicon Valley could become a target. Golbeck even worries about Amazon delivery drivers, since the company's web services stopped hosting Parler, the social media site that attracts many on the far-right.

Greg Myre is an NPR national security correspondent. Follow him @gregmyre1.

Copyright 2021 NPR. To see more, visit https://www.npr.org.