By the time social media companies took action against users and groups spurring on the siege of Capitol Hill this week, culminating in the suspension of US President Donald Trump's accounts, it was too little too late.
For weeks, content on big tech platforms Facebook Inc, Twitter Inc and Alphabet Inc's YouTube as well as upstart fringe social networks foretold the storming of the US Capitol on Wednesday that led to five deaths.
In one Facebook post identified by online advocacy group Avaaz, an illustration of Trump holding a machine gun in front of the White House is accompanied by the words "Come and Take it." Another depicted Trump as Uncle Sam with text paraphrasing the president: "I want you in Washington DC January 6. It's going to be WILD."
After the violence, right-wing social users on smaller platforms were retelling the story with videos from the siege to bigger, new audiences, while the major sites showed users sharing false claims about the unrest and groups dedicated to "Stop the Steal." The slogan refers to pro-Trump followers belief, encouraged by him without providing evidence, that the November 3 election was fraudulent in favor of Democrat Joe Biden.
Facebook said it "removed content and accounts that violated our policies against inciting violence and dangerous organizations in the lead-up to January 6" and was continuing to monitor and remove dangerous content.
A Twitter spokeswoman said the company had "taken enforcement action on thousands of accounts that were attempting to undermine the public conversation and cause real-world harm."
On Friday, Twitter permanently suspended Trump's account and also suspended accounts belonging to vitriolic Trump fans including Ron Watkins, who helped run little-regulated image board 8kun, home of many recent posts calling for violence.
YouTube said it removes content that violates its community guidelines.
'Like ISIS Does It'
Disinformation experts said that while big platforms allowed radical racists, violence enthusiasts and conspiracy theorists to amass large audience, leading influencers learned what they could get away with.
"You end up with a very diluted form of the content on the large platform, and the more radical stuff is elsewhere, like ISIS does it," said Alex Stamos, the former Facebook chief security officer who runs a Stanford program exposing disinformation. He was referring to Islamic state militants.
The mainstream content "is difficult to claim is inappropriate, because it says `come to a rally.' Bring this and bring that, `get ready to rumble,' is on 8kun and Parler, and operational stuff is on Telegram," Stamos said.
Even after major purges of accounts and groups, it has been easy for the operators to reemerge with slight tweaks, such as swapping "cue" for "Q," said Daniel Jones, a former FBI analyst and Senate staffer who leads nonprofit research firm Advance Democracy Inc.
On Wednesday, a tweet that turned one of the earliest posts by the anonymous "Q" three years ago into the call to action, "My fellow Americans, the Storm is upon us," got 16,000 retweets.
Before Facebook took down its page late Tuesday, Red-State Secession had urged its nearly 8,000 followers to find the home addresses of officials who "helped steal the election."
It linked to a website which declared last week a "second American revolution" would start on Jan. 6 and urged supporters to follow its accounts on more permissive social-media platforms Gab and Parler "before we get deleted."
The group said by email that its Facebook page and blog "promote the peaceful separation of blue states and red states" and that Facebook had overreacted.
Far-right groups that appeared at the riot maintain a vigorous online presence on digital platforms like Parler, Gab, MeWe, Zello, and Telegram, and in some cases discussed using overwhelming crowds to enter the Capitol, said Jared Holt, a disinformation researcher at the Atlantic Council.
MeWe said "violence inciters" were not welcome on its platform. It declined to disclose actions it had taken around the protest.
Gab CEO Andrew Torba said by email: "None of the platforms you listed, Gab included, are useful for organization of any type."
Zello, Telegram and Parler did not reply to requests for comment.
The selfies snapped on the Senate floor and livestreams broadcast from inside lawmakers' offices served as marketing to recruit new followers and in some cases earn money.
"While extremists on the ground livestreamed and bragged about the chaos they created minute-to-minute, far-right online communities aggregated their content and cheered on their efforts," said Holt.
The Southern Poverty Law Center documented at least five accounts on blockchain-based video platform DLive that livestreamed Wednesday's protest, including two who participated in the white supremacist-led "Unite the Right" rally in Charlottesville, Virginia, in 2017.
One of them, a provocateur named Tim Gionet and known onlne as Baked Alaska, livestreamed from inside a Capitol office. He pulled in at minimum $222 in tips from viewers via DLive during the afternoon, according to the report.
He promoted his content to followers on Instagram and Facebook until the company disabled his accounts Wednesday.
DLive said on Thursday it had suspended three accounts, banned two others and permanently removed over 100 broadcasts. Donations and paid subscriptions will be refunded, it added.
Fuentes and Gionet did not respond to requests for comment.