‘We in This Bitch’: Snapchat Maps Used to Bust Alleged Capitol Rioter

"We in this bitch. We in this bitch," Matthew Buckler said in one video saved to his phone. The video showed Buckler inside the Crypt, a part of the basement of the U.S. Capitol. Judging by the videos and other evidence, Buckler was deep inside the Capitol during the January 6 insurrection and was part of the illegal mob.

What led the FBI to Buckler and eventually these photos stored on his phone was his use of Snapchat, and in particular the Snapchat heatmap feature which shows the location someone is posting from, according to recently unsealed court records.

Initially, a tipster provided the FBI with a screen capture of what appeared to be one of Buckler's private Snapchat stories, according to an affidavit written by Ian P. Montijo, a Special Agent with the FBI. That screen capture showed someone wearing a black jacket, a white hoodie, and a black baseball cap with "TRUMP'' emblazoned across it. The username in the top right corner of the video read "matt's priv," and after the video the screen shows the user display name "Matt Buckler," the court records add.

Seamus Hughes, a researcher at George Washington University, first disclosed the existence of the court record.

The same tipster also provided the FBI with a screenshot of the Snapchat profile which shows a heatmap of where the user posted from. That heatmap showed the user posting from the southwest corner of the U.S. Capitol.

The FBI even pointed to the account's "bitmoji," a caricature which Snapchat users make, sometimes representing themselves.

"The bitmoji on this screenshot is labeled 'Matt' and is placed prominently on top of a satellite image of the U.S. Capitol Building and grounds," the document continues.

A second tipster provided the FBI with information on another Snapchat account called "mbuckler5."

"The bitmoji associated with the 'mbuckler5' user name matches the bitmoji in the screenshot provided by Tipster 1," the court record adds, meaning that the private Matt account and this more public one may be run by the same person. Buckler's own phone number was also linked to the mbuckler5 account, the document continues.

After later interviewing Buckler, in which he said he wore the same clothes as the person in the Capitol in one of the Snapchat videos, the FBI obtained a search warrant to seize Buckler's phone.

"In one of those videos, which is a selfie, Buckler joins with the crowd outside the Senate Wing Door chanting 'Stop the Steal' repeatedly," the court record adds.

Social media has become a major component in the identification of people present at the January 6 insurrection. Archivists grabbed livestreams before they were taken down; independent investigators have also turned to controversial facial recognition technologies available to anyone.

Subscribe to our cybersecurity podcast, CYBER.