FBI: Militia leader accused of Minn. mosque bombing took orders from 'higher-ups'

The leader of a rural Illinois militia whose members face federal hate crime charges in the bombing of a Minnesota mosque allegedly used an encrypted messaging service to correspond with other militias and to take orders from "higher-ups," according to newly unsealed court papers.

A federal magistrate judge in Illinois approved a May application by the FBI to search "illinoispatriot@protonmail.com," an encrypted e-mail account that agents said co-defendants linked to militia leader Michael Hari.

Hari allegedly helmed the "White Rabbits 3 Percent Illinois Patriot Freedom Fighters" militia that prosecutors say was behind the Aug. 2017 bombing of the Dar al-Farooq Islamic Center and an attempted bombing of a central Illinois women's health clinic, among other "missions."

Hari, Michael McWhorter and Joe Morris have been in federal custody since their March arrests on charges out of both Illinois and Minnesota. In June, a federal grand jury in Minnesota added new civil rights charges against the men, who are not expected to stand trial here until their Illinois case is resolved.

That will now likely be longer than expected: Last week, a federal judge in Illinois agreed to move a trial scheduled for Aug. 21 back to Nov. 13, citing still ongoing and "voluminous" discovery in the case.

Meanwhile, sworn statements by FBI agents seeking to search the "illinoispatriot" account and cellphones that purportedly belong to the men shed new light on their militia activities and how a Twin Cities mosque came to be targeted.

Two weeks after his arrest in March, an agent said, Morris, 22, told authorities that Hari used the ProtonMail account to talk to members of roughly 13 militia groups "similar to the White Rabbits" and to "the 'higher ups' from whom they would receive their missions."

The FBI said Hari told Morris that he should assume control over the account should Hari ever be arrested. He shared the account's password with Morris, who later turned it over to the FBI.

Morris' remarks came during a "cooperation agreement" on March 28, according to court papers.

Soon after his March 13 arrest, McWhorter, 29, also quickly confessed to carrying out attacks for the group — including tossing a homemade pipe bomb into the imam's office at Dar al-Farooq.

The FBI's search warrant affidavits also reveal that McWhorter told agents that the 47-year-old Hari used his "illinoispatriot" account to demand extortion money after the group bombed a section of railroad tracks in southern Illinois in Dec. 2017.

McWhorter also described steps the men took to avoid law enforcement on their "missions," including leaving their turned-off phones behind in a bag designed to block any cell signals. He said the men would only turn their phones back on once back in Hari's office after a "mission" — which also included robbing area Walmart stores and a wrongly suspected drug trafficker.

But as the FBI closed in on the group earlier this year in the small rural hamlet of Clarence, Ill., McWhorter's wife handed over three cellphones that purportedly belonged to the men. Those devices, and about 45 megabytes of "emails and attachments" seized from the ProtonMail account are now among the evidence in the hands of prosecutors.

Stephen Montemayor • 612-673-1755 Twitter: @smontemayor