100 days of warning: inside the Boogaloo killings of US security personnel

One hundred days before Dave Patrick Underwood was murdered on 29 May, a group of analysts who monitor online extremism concluded that an attack like the one that killed him was coming.

An anti-government movement intent on killing law enforcement officers had been growing rapidly on social media, the analysts at the Network Contagion Research Institute warned.

Related: How Facebook and the White House let the 'boogaloo' movement grow

Building on the work of other analysts, the researchers had identified Facebook groups where thousands of members obsessed over the idea of an imminent American civil war called “the Boogaloo”, displaying photographs of rifles and combat equipment, sharing advice for making weapons and posting memes about killing police and federal officials. The Facebook groups were particularly dangerous, the researchers concluded, because they were helping to build local connections between nascent domestic extremists. The movement appeared to be successfully recruiting members of the US military.

Facebook responded to findings that it was “studying trends” around the use of the word “Boogaloo” on its platforms, and that it would remove any content that violated its rules against inciting hatred or violence. Over the next few months, a spokesperson said, it would remove 800 individual Boogaloo-related posts that violated its policies. But it did not ban the Boogaloo movement from its platform, or take the majority of the Boogaloo groups down.

Two months later, another report warned of the Boogaloo movement’s “explicit threats of violence to government authorities”. There were now at least 125 Boogaloo groups on Facebook, the Tech Transparency Project said. The groups had added tens of thousands of members in the last 30 days alone, as coronavirus lockdown measures made some Americans furious about what they perceived as government “tyranny”. More than half of these Facebook groups had been created since February.

This time, Facebook said it had removed some groups and pages that used Boogaloo-related terms for violating Facebook policies. But none of the Facebook groups explicitly mentioned in the Tech Transparency report had been taken down, HuffPost reported, even though the online rhetoric was already translating into action: earlier in April, Texas police arrested Aaron Swenson, a man who had reportedly “liked” more than a dozen Boogaloo-related pages, and who police said had been livestreaming himself on Facebook as he drove around looking for a cop to execute.

‘Show them the real targets’

It was just after 7am on 28 May, and Steven Carrillo, a US air force sergeant, was already awake, posting on Facebook about a “great opportunity” to attack federal agents, according to federal prosecutors.

Carrillo, 32, was an active duty member of the air force, assigned to Travis air force base in California. Two years before, he had taken part in an intensive training session to become part of an elite air force security unit, the Phoenix Ravens, who were prepared to protect aircraft from attacks in volatile situations.

But three days after George Floyd was killed in Minneapolis, as protests against police violence spread across the country, prosecutors allege, Carrillo was preparing to put his military training to use not in protecting fellow service members, but in staging attacks against government officers.

“It’s our coast now this needs to be nationwide. It’s a great opportunity to target the specialty soup bois. Keep that energy going,” Carrillo allegedly wrote on Facebook, sharing a link to a video of a crowd attacking California highway patrol officers, with two flame emojis.

The “specialty soup bois”, according to the complaint, was a phrase Boogaloo groups used to refer to federal law enforcement agents who work for agencies such as the ATF and the FBI – agencies with names that are an “alphabet soup” of acronyms. Less than 20 minutes later, another Facebook user responded. “Let’s boogie,” Robert Alvin Justus, a 30-year-old from Millbrae, California, wrote, according to prosecutors.

The next morning, prosecutors allege, Carrillo posted more calls to action on Facebook. He was interested in the unfolding protests against killings of civilians by police, but he did not consider himself one of the protesters.

“Go to the riots and support our own cause. Show them the real targets,” Carrillo allegedly wrote. “Use their anger to fuel our fire. Think outside the box. We have mobs of angry people to use to our advantage.”

That night, 29 May, prosecutors allege, Justus met Carrillo at a Bay Area metro station, with the plan of driving together to an anti-police violence protest in Oakland.

The two men parked across from a guard post outside the federal courthouse downtown. Just two blocks away, thousands of protesters were marching and chanting on the street that led to Oakland’s police headquarters in a furious demonstration that would last until late in the night. But the guard outpost itself was modest, a nondescript structure next to a driveway in a neighborhood full of office buildings. Surveillance footage would later show Justus emerging from the van for a smoke break, then going back inside, prosecutors say.

Dave Patrick Underwood was working as one of the security officers at the federal courthouse that night, as a contractor for the Department of Homeland Security. Underwood, 53, had grown up in the Bay Area. He was a former star high school athlete, with a corny sense of humor and a sharp sense of style. As an adult, he had moved in with his ageing parents to care for them. His older sister would later describe how Underwood had been with their mother as she was dying, and when she fell to the ground, he picked her up, and carried her to her bed, because he knew that was where she had wanted to die.

“Patrick was a good man, who only wanted to help others and keep his community safe,” his sister, Angela Underwood Jacobs, said later.

Just before 9.45pm, according to federal prosecutors, as the white van pulled away from the guard post, its side door opened, and Carrillo opened fire on the security officers outside the courthouse. Underwood, shot multiple times, was killed. Another officer was seriously injured.

Carrillo, Justus would allegedly tell investigators, had been thrilled by the shooting. “Did you see how they fucking fell?” Justus allegedly recalled him saying.

Calls for action

The targeted attack on two federal officers in the middle of a protest against police violence sparked nationwide headlines. Underwood, who was black, was mourned. His death was also seized on as a political talking point: a black law enforcement officer had apparently become the victim of nationwide protests against law enforcement killings of black civilians.

As politicians talked about Underwood’s murder and debated what it said about the Black Lives Matter movement, Justus went home, prosecutors allege. But Carrillo’s killing spree, prosecutors allege, was not finished. And he remained in contact with at least one other “Boogaloo boi”, sending him money and boasting about what he had already accomplished.

Across the country, prosecutors allege, Boogaloo boys were plotting how to use the George Floyd protests to sow chaos, and posting on Facebook encouraging each other to take action.

Prosecutors say that Ivan Hunter, a 26-year-old who allegedly described himself as “the leader of the Boogaloo Bois in south Texas”, responded to calls for action in Boogaloo Facebook discussions by driving 1,200 miles to Minneapolis and then firing an assault-style rifle into a burning police precinct on 28 May.

Later, Hunter allegedly messaged Carrillo encouraging him to target police buildings during the protests, and Carrillo allegedly responded “I did better, lol,” referencing his shooting of two federal officers.

In Nevada on 30 May, the day after Underwood’s killing, authorities arrested three alleged Boogaloo supporters and later alleged they had been plotting to set off molotov cocktails at a Black Lives Matter protest in Las Vegas, hoping to spark broader violence. Like Carrillo, all three men had US military experience: one was an army reservist, one a navy veteran, and one an air force veteran.

The day after prosecutors announced charges against the alleged Boogaloo boys in Nevada, Facebook announced that it was making it harder for users to search for the term Boogaloo and would no longer recommend new Boogaloo groups to users who might be interested in them, something the company had been doing previously. It still did not take the entire network of groups down.

Two days after Facebook announced it would limit, but not ban, the Boogaloo movement, Carrillo would allegedly kill again.

‘They came to kill cops’

On 6 June, at 2pm in the afternoon, deputies from the Santa Cruz county sheriff’s department approached a home in Ben Lomond after a tipster had reported seeing a van filled with weapons and explosives.

One of the deputies responding was Damon Gutzwiller, 38, a father of a young toddler whose wife was pregnant with their second child. Gutzwiller had worked for the sheriff’s department since he was 24. Jim Hart, the county sheriff, would later call him the “picture of community policing”, a deputy who was patient and kind, and “would rather communicate his way through any problem in front of him”, instead of using force.

“It wasn’t just a job. He wanted to take care of the community,” the same community where he was raising his own family, his wife, Faviola del Real, would say later.

The question of what to do when law enforcement came for you at your home had been a major subject of Boogaloo discussions on Facebook. There were multiple memes inspired by “the fantasy of a lone Boogaloo holding off hordes of cops”, Alex Friedfeld, an analyst with the Anti-Defamation League’s Center on Extremism who has been monitoring the Boogaloo movement online since late 2019, said. Boogaloo Facebook groups regularly featured jokes about men filling their lawn sprinklers with gasoline to light the police on fire, he said, or stuffing a fake dog with explosives, so if police shot it as they arrived, they would trigger their own destruction.

As the local deputies approached the house in Ben Lomond, prosecutors allege, Carrillo opened fire, shooting two of them. One deputy was also injured in an explosion. Gutzwiller was killed.

Carrillo was shot himself, but escaped, and went on to hijack one car, then attempt to hijack another, before being arrested later that afternoon, prosecutors allege.

The criminal complaint against him included a photo of the white car he had hijacked, which had slogans written on the hood, apparently with Carrillo’s own blood. One of the scrawled phrases was “BOOG”. In another van on the property where Carrillo had been hiding, investigators said they found body armor with a Boogaloo patch on it: a flag with an Igloo and Hawaiian patterned stripes, the kind of Boogaloo merchandise that had been advertised on Facebook for months.

Federal prosecutors and FBI agents announced charges against Carrillo and Justus for Underwood’s murder on 16 June. “There is no evidence that these men had any intention to join the demonstration in Oakland,” the FBI special agent in charge Jack Bennett said, CBS News reported. “They came to Oakland to kill cops.”

Later that month, on 30 June, Facebook announced a full ban on a network of Boogaloo groups, because of their association with real-world violence, designating them as a “dangerous organization” like white supremacist organizations or the Islamic State, which the company has also banned from its platform.

The company said it had removed 220 Facebook accounts, 95 Instagram accounts, 28 pages and 106 groups that made up what it called the “violent” “Boogaloo”-affiliated network. It also said it took down 400 other groups and 100 pages that hosted similar content as the violent network but were maintained by accounts outside it, and that it was banning praise and support of the group on Facebook, as well as the group itself.

Facebook’s takedown only happened “after there were already bodies”, Friedfeld, the Anti Defamation League analyst, said.

“There were people warning them, ‘You have a huge problem,’ but it wasn’t until bodies actually dropped that they did something about it.”

What could have been done?

The Boogaloo movement is part of a broader rise in far-right extremism in the US, one that was predicted, and furiously denied by Republicans, in the early years of the Obama presidency. Local and federal law enforcement agencies and the US military have faced criticism in recent months for doing too little to monitor and prevent the radicalization of American citizens by violent white supremacists and other domestic rightwing extremists.

Social media companies, too, have faced scrutiny for allowing different strands of rightwing extremism – from the neo-Nazi and white nationalist groups that rebranded themselves as the “alt-right”, to followers of the antisemitic QAnon conspiracy theory – to flourish on their platforms, despite years of repeated warnings from researchers and journalists.

Now, in the wake of a deadly insurrection at the US Capitol, when mobs of Trump supporters, including known extremists, invaded the building and forced terrorized lawmakers to flee, the full cost of all those choices is still being counted.

But several analysts who monitor extremism say that, when it comes to the growth of the Boogaloo movement, the single organization that could have made the most difference was Facebook, because Facebook was the primary platform where the Boogaloo movement was organizing in early 2020, often in plain sight.

Within weeks of publication, the lead author of the Network Contagion Research Institute Boogaloo report, Alex Goldenberg, said he had personally briefed the International Association of Chiefs of Police, as well as more than 400 military officers attending a counter-terrorism conference organized by the US army.

Facebook, he said, made no contact with him at all.

By the time the social media company finally disrupted the networks of Boogaloo pages and groups on its platform in late June, some experts said, it was too late: the scattered men drawn to the idea of being soldiers in an insurgency against the American government had already connected with each other directly.

“There was a moment in time where you could have nipped this in the bud,” Friedfeld said. “Would it have stopped it entirely? No. But it would have made it harder for these networks to cohere.”

In a statement, Facebook defended its policy banning dangerous organizations as “the most aggressive in the industry” and said that, as a result, it had a “high standard” for classifying groups as dangerous and banning them.

Even before it banned a network of Boogaloo groups in late June, “we did a lot of disrupting work,” Facebook said, including removing individual violent posts from Boogaloo pages and groups, and proactively reporting several alleged Boogaloo Bois to law enforcement, including Ivan Hunter, the alleged Texas Boogaloo Boi, and people linked to the Michigan militia plot to kidnap the Democratic governor, Gretchen Whitmer.

The company’s Dangerous Organizations Team includes several hundred people who focus on countering dangerous organizations and studying new evolutions in threats of violence as their core responsibility, a spokesperson said, including former academics who are experts on counter-terrorism, former prosecutors and law enforcement officers, investigators, analysts and engineers.

Facebook’s analysts had been closely monitoring Boogaloo activity since 2019, long before the NCRI research report came out in February, a spokesperson said. The company was already on high alert in January 2020, when a rally against gun control in Virginia drew more than 20,000 armed protesters, including some wearing Boogaloo-themed patches, and prompted widespread discussion of “the Boogaloo” on social media, a spokesperson said. Facebook employees worked to identify the groups in attendance at the rally, and noted that some of those participating were already wearing the outfit that would later become recognized as the typical Boogaloo uniform.

By February, Facebook had already taken down one Boogaloo Facebook group, the “Patriot Wave”, that appeared to have members in attendance at the Virginia rally.

In addition to its own research, Facebook said it also reviewed the public reports on Boogaloo activity released in February and April, and removed some of the content mentioned in the reports.

Lawyers for Carrillo and Justus declined to comment, with Justus’s lawyer noting the legal team was particularly reluctant to say anything about a pending case in which the government may seek the death penalty. Carrillo pleaded not guilty to the murders of both Underwood and Gutzwiller.

This summer, despite the pandemic, hundreds of people, including law enforcement leaders and politicians, showed up to mourn both Underwood and Gutzwiller at their funerals.

Now, the family and friends of both men have faced the first holiday seasons suddenly without them. Underwood’s family did not respond to requests for comment. One childhood friend raised more than $10,000 on a now-concluded GoFundMe to set up a basketball court in his memory in Pinole, where Underwood grew up.

“We are all traumatized by the way Patrick lost his life,” one longtime friend said at his memorial service in June.

Gutzwiller’s family did not respond to a request for comment through the sheriff’s department. Current and former local law enforcement officials and friends of the family launched an education fund for the deputy’s two children that is still accepting donations.

Gutzwiller’s wife, Faviola del Real, a neonatal intensive care unit nurse, was reportedly weeks away from giving birth to their second child when he was killed this summer, and she spoke at his funeral in June about what a loving father he had been.

“I pray for the strength to raise the amazing children he would have raised,” she said.

Abené Clayton contributed reporting

• This article was amended on 15 January 2021. An earlier version of the headline referred to killings of law enforcement. Dave Patrick Underwood, the DHS-contracted security guard, was not a sworn member of law enforcement.