For years, the question of who planted pipe bombs outside the Republican
and Democratic National Committee headquarters on the night of Jan.
5, 2021, one day before the rioters stormed the Capitol, was one of Washington’s most persistent mysteries.
Surveillance images captured a figure moving calmly through Capitol Hill, placing devices that forced evacuations and diverted police resources as the Capitol attack unfolded the next day. But the suspect’s identity remained unknown.
A newly unsealed affidavit now describes how investigators say they identified a suspect: 30-year-old Brian J. Cole Jr. of Woodbridge, Virginia.
The breakthrough, they say, came not from a single clue but from several converging streams of evidence. Investigators began with video showing the suspect between 7:34 p.m. and 8:18 p.m. on Jan. 5. The individual wore a gray hoodie, dark pants, gloves, a backpack, Nike Air Max Speed Turf shoes and glasses.
Though their face was covered, FBI photogrammetry estimated the suspect’s height at about 5 feet 7 inches, plus or minus about an inch.
Cole is 5 feet 6 and wears glasses. This was only a starting point, but it helped establish a baseline physical profile.
A purchasing trail that mirrors the bomb components
A key development emerged when investigators reviewed years of Cole’s financial records.
According to the affidavit, he purchased nearly every major component used in the bombs: 1-by-8 galvanized steel pipes with identical manufacturer markings, matching end caps, nine-volt battery connectors, white kitchen timers, 14-gauge wiring and steel wool.
He also bought useful tools for the assembly, such as wire strippers, machinist files and sandpaper.
None of the items are illegal individually. But investigators argue that acquiring nearly every part found in the devices is a central pillar of the case.
Beyond the bomb components, Cole purchased protective equipment and metalworking tools that investigators say indicate fabrication capability — not merely casual ownership of household items. Safety glasses, gloves and machinist files suggest hands-on work consistent with constructing metal devices.
Cell-site data paired with surveillance video
What appears to be the most compelling evidence comes from the FBI’s Cellular Analysis Survey Team. Investigators mapped Cole’s cellphone activity on Jan. 5 against the suspect’s movements.
Between 7:39 p.m. and 8:24 p.m., Cole’s phone connected repeatedly with towers covering the exact streets, alleys and intersections the suspect on the video walked through.
At 7:39 p.m., Cole’s phone hit towers covering D Street SE and South Capitol Street SE — the same location where the suspect appears on camera.
At 7:44 p.m., the phone connected to a tower covering Ivy Street SE as the suspect passed through. Additional pings matched movements on New Jersey Avenue SE, E Street SE and Rumsey Court near the RNC.
The alignment is so precise that it forms a nearly minute-by-minute digital trail matching the suspect’s recorded route. A license plate reader recorded Cole’s Nissan Sentra entering the Capitol Hill area at 7:10 p.m., about half a mile from where the suspect was first spotted on foot 24 minutes later. The timing is consistent with someone parking, then beginning the operation on foot.
Investigators also found a notable earlier purchase. On Dec. 14, 2020, Cole spent money at a restaurant across from Rumsey Court, the narrow alley the suspect used to approach the RNC.
Because Cole had very few transactions in Washington, D.C. during that period, this one stood out. It suggests, investigators argue, a degree of preoperational familiarity with the placement area.
Post-event behavior raises new concerns
Perhaps the most concerning detail, investigators say, stems from Cole’s behavior after the pipe bombs were discovered. In the days and weeks that followed, he bought more galvanized pipes, timers, steel wool, battery connectors and alligator clips — the same categories of materials used in the RNC and DNC devices.
The affidavit does not claim he was preparing another attack. But investigators note that continuing to acquire components during a period of intense national scrutiny raises questions: Were the Jan. 5 bombs the only operation he envisioned, or was he intent on maintaining the capability to build more?
Each evidence stream contributes part of the picture. Surveillance footage provided a physical baseline. Financial records showed access to specific components. Cell-site data placed his phone along the bomber’s precise route. Vehicle records placed him nearby beforehand.
Cole’s limited but conspicuous alleged pre-event activity in D.C. and his continued post-event purchases deepen the concern about a possible motive.
Get breaking news and daily headlines delivered to your email inbox by signing up here.
© 2025 WTOP. All Rights Reserved. This website is not intended for users located within the European Economic Area.
