A series of attacks on a mosque, an abortion clinic, and a railroad line looked like the work of a three-man militia, but newly unsealed court documents suggest the alleged bombers might have been following orders from “higher ups” in a network of extremist groups.
In March, feds arrested Michael Hari, Michael McWhorter, and Joe Morris for allegedly bombing a Minnesota mosque, attempting to bomb a women’s health clinic, attempting to ransom a stretch of Illinois railroad, owning a machine gun, and carrying out a series of robberies. The trio appeared to be the principal members of a tiny right-wing group calling itself the “Illinois Patriot Freedom Fighters 3% Militia” or the “White Rabbits.” The group was a small-time anti-government militia that dabbled in a number of extreme causes, from “armed rebellion” against Illinois to encouraging neighbors to buy into “White Rabbit Money,” a fake currency.
But the White Rabbits might not have been as isolated as their separatist platform made them appear.
ADVERTISEMENT
Hari, the suspected ringleader, was in communication with other militia groups, and took orders for “missions” from “higher-ups,” according to a May search warrant, the unsealing of which was first reported by Champaign, Illinois’ News-Gazette.
Shortly after the trio’s arrest in March, McWhorter and Morris turned on Hari, offering investigators information on Hari’s communications, according to a search warrant for the contents of an email account with Protonmail, an encrypted email service.
McWhorter “told agents that Hari talked about ‘higher ups’ and identified two people Hari identified as ‘Ben Lewis’ and ‘Congo Joe,’” according to an affidavit in support of the search warrant.
Morris told investigators that Hari used the ProtonMail account to communicate with those “higher ups,” as well as approximately 13 other similar militia groups. The White Rabbits’ “higher ups” gave them orders for “missions,” McWhorter and Morris said.
One of those alleged “missions” was a January 17 attack on a stretch of rural Illinois railroad track, McWhorter said. Allegedly while following orders from superiors, the trio used jumper cables and explosive to damage the tracks and a crossing gate. Hari then allegedly used the ProtonMail email account to contact the railroad company and threaten to blow up more tracks unless the company paid a ransom.
The railroad attack came shortly after the White Rabbits publicly attempted to make contact with other militias in a militia forum on January 8.
The group’s public communications in the militia forum reveal the White Rabbits urging other militias toward more overt violence.
“Our fathers would have rebelled years and years ago. If it keeps going the way it is, there won't be anyone left to rebel by the time our addled offspring—ruined by the lawyers and government schools—finally meekly give up the last of their liberty and the means of fighting for it,” the group wrote in January. “It really doesn't matter if your unit is composed of fat guys with cigarettes in mismatched 80's woodland BDU's if they are only willing to pull the damn trigger and purge this country clean of socialism. Democracy is dead, there is no republic. The President isn't in charge, and the militias are sitting on their butts and preening themselves.”
The contents of the White Rabbits’ ProtonMail account, but might become public during the group’s trial, which is slated to begin in November.
But feds might not have been able to access the account, had Morris not turned on his former leader. ProtonMail, a Switzerland-based encrypted email service, is highly protective of user data.
“Under Swiss law, ProtonMail can only turn over user data if we receive a request from a Swiss court that is approved by the judge,” the company says on its website. “ProtonMail can only hand over encrypted messages as we do not have the ability to decrypt user messages … As a result, we frequently answer requests by stating that we have no useful information.”
After a May court document revealed that feds had accessed 45.5 mb of the Illinois Patriot Protonmail account, ProtonMail’s privacy-minded fans demanded to know whether the email service turned over the account to authorities. On Twitter and Reddit, ProtonMail stated that it had never received a data request for the account, and had never surrendered any of its contents.
The unsealed warrant reveals that investigators didn’t need to subpoena ProtonMail, because Morris told investigators the password as part of a cooperation agreement.
“Hari told Morris that if Hari ever got arrested, Morris should assume control over the illinoispatriot@protonmaiI.com account,” according to the affidavit.
In interviews with investigators, the group cited extreme anti-Muslim views as the motivation for the alleged mosque bombing. Hari also portrayed himself as a national security expert. In a bizarre design proposal to President Donald Trump’s wall on the Mexican border, Hari expressed white nationalist views, calling the wall a chance for “American people to defend their nation and its Anglo-Saxon heritage, Western culture and English language.”
But in the final days before their arrests, the White Rabbits appeared to have been without allies or “higher ups”.
“We have sent requests for help to various militia groups, so far very little response,” the group wrote in the militia forum, encouraging other militias to “please email us at illinoispatriot@protonmail.com for more information several of us have gone underground and desperately need support.
“We are not kooks or liars.”
