UNCLASSIFIED//FOR OFFICIAL USE ONLY 21 February 2017 (U) North Carolina: Recent Spike in Election-related Physical and Cyber Incidents Against Political Institutions Likely to Decrease In the Short Term, but Threat Environment Remain Unpredictable (U//FOUO) Prepared jointly by the North Carolina Information Sharing and Analysis Center (ISAAC) and the DHS Office of Intelligence & Analysis (I&A). (U) Scope: This Field Analysis Report (FAR) provides situational awareness to state and local partners in North Carolina concerning criminal activities, physical violence, and cyber activity directed at government organizations following the conclusion of the 2016 election and political transition. It was written in response to a spike in violence and criminal acts—including an arson attack—targeting political party offices and staff that occurred prior to of and immediately following the election. In this context, this assessment provides an overall threat forecast for the first half of 2017 concerning like activities in the state. (U) Key Judgments (U//FOUO) We assess that the number of incidents of low level physical violence directed toward political institutions in North Carolina—a short-term spike represented by such incidents as the 16 October arson attack targeting a political headquarters—will likely decrease through the first half of 2017 as compared to the last half of 2016. We base this conclusion on the lack of threat reporting and the completion of the Presidential election and the near completion of political transitions in federal and state governments which may have served as a drivng catalyst for the violence. We also cannot rule out that the spike in violence may have inspired others to conduct similar acts. (U//FOUO) We assess malicious cyber activities directed at government networks will likely continue at a rate consistent to what has been observed in previous years; but will revert back to the criminal focus seen in the state previously, as opposed to the more politically-motivated activity seen in the end of the year duethe end of the election cycle. (U//FOUO) Likely Decrease of Violent Incidents in North Carolina Targeting Political Institutions in Early 2017 Due to Close of the Election Period (U//FOUO) In the final months of the 2016 election cycle, specifically the beginning of September through the beginning of November 2016, North Carolina public political institutions and figures experienced a spike of both threats and violent activity that involved targeting of campaign office facilities. In the year prior to the first incident, there appears to have been limitied to no reporting of similar activity. The ISAAC assesses that criminal and violent incidents targeting those institutions are likely to decrease in first half of 2017 as compared to the last half of 2016, due namely to the conclusion of the election and peaceful transitions of government and state and federal levels as well as the cessation in violent acts. IA-0085-17 (U) Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO). It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know without prior approval of an authorized DHS official. State and local homeland security officials may share this document with authorized critical infrastructure and key resource personnel and private sector security officials without further approval from DHS. UNCLASSIFIED//FOR OFFICIAL USE ONLY UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO) Threats of violence and acts that may have been intended to intimidate individuals associated with party offices took place in several parts of the state during the last quarter of 2016, according to corroborated media and reliable law enforcement reporting. Tactics used in recent criminal activities targeting political institutions in North Carolina have been mostly simple, using readily available materials, requiring little expertise or training. Examples of some of the violent incidents that occurred in the state include: (U) An unidentified individual or individuals shot and damaged the windows of a headquarters office for a major political party in Pamlico County on at least two occasions during September and October 2016, according to a statement released by party county chairman.1,2 (U) On 20 October 2016, an individual was arrested on state charges related to terrorism and filing false reports after he allegedly called in a bomb threat to a political party headquarters in Henderson County according to media reporting.3 (U//FOUO) During the night of 17 October 2016, an unidentified actor fired a non-lethal weapon at the state headquarters for a political party in downtown Raleigh, damaging some of the signage infrastructure according to law enforcement reporting.4 (U) In the early morning of 16 October in Orange Country, unidentified individuals threw improvised incendiary devices (IIDs)—Molotov cocktails—through the large picture window of the local political party office. At least one of the devices broke and ignited inside the office, causing extensive damage before self-extinguishing. The office was empty at the time of the attack and no one was injured, but the attack caused significant property damage. Additionally, the perpetrator(s) spray-painted "Nazi Republicans leave town or else" on a nearby building, according to media and law enforcement reporting.5,6 (U//FOUO) In the two months leading up to the 2016 election, North Carolina experienced several incidents of individuals targeting campaign offices—in many cases damaging property. Limited to no reporting has been received by the ISAAC indicated the targeting or attempted disruption of similar offices prior to September 2016 through the time of publication for this product. In spite of the increased violence/as in past election years, the ISAAC lacks credible indications of near-term domestic terrorism threats against political entities such as campaign offices, party headquarters, associated facilities, or in North Carolina now that the Presidential and Gubanotorial campaign has ended. The conclusion of the campaign and election process will result in the cessasation of the daily barrage of negative campaign ads and political rhetoric, which likely contributed to incitement of at least some of the violent and/or criminal incidents. Traditional government institutions involved in the implementation of what may be perceived, by some extremists, as controversial policies are likely to be viewed by those individuals as high value targeting during the non-election cycle years. Lower rates of incident reporting following the election also supports this assessement. (U//FOUO) North Carolina Government Institutions Also Target of Politically-Motivated Cyber ActivityExperience (U//FOUO) The ISAAC assesses that some malicious cyber activity targeting public sector—particularly government—entities in the last half of 2016 may have been politically-motivated. This assessment is based on the same reasons mentioned in the physical threats section, including diminished political rhetoric and associated negative publicity. The activities specifically pursued political aims and/or intended to intimidate, harass, disrupt and/or steal data from information technology networks, according to DHS reporting. (U//FOUO) During early October 2016, a criminal hacker defaced a North Carolina law enforcement website by gaining access and posting pro-Turkey messaging.7 (U//FOUO) In late September 2016, a criminal hacker group attempted to influence a North Carolina city government’s law enforcement response decisions by threatening to leak government personnel records. It UNCLASSIFIED//FOR OFFICIAL USE ONLY Page 2 of 5 UNCLASSIFIED//FOR OFFICIAL USE ONLY was determined that the criminal actor was not able to successfully exfiltrate any data and thereby did not possess any sensitive records.8 (U//FOUO) A distributed denial of service (DDoS) attack against a website associated with a city in southwestern North Carolina on 21-22 September significantly degraded the website’s functionality and impacted connectivity. The time frame of this incident coincided with nationally-publicized civil unrest taking place in the area that resulted in veiled and open threats to government institutions. 9 (U//FOUO) Outlook and Implications (U//FOUO) In the lead up to and immediately following the 2016 election, North Carolina experienced incidents that included the targeting of political campaign offices and government organizations highlight their attractiveness as targets for domestic terrorists and various cyber actors seeking to advance political aims and/or influence government operations. In spite of this, we assess that political campaign offices in North Carolina are likely to see a decrease in targeting against their facilities in the first half of 2017. While ISAAC has no evidence at this time indicating that past attacks will inspire further violence in North Carolina, we urge law enforcement to remain vigilant and report indicators of suspicious activity at locations and events deemed likely targets for attacks. Malicious cyber activities directed against government institutions are likely to occur at consistent levels that have been observed over the last few years. (U//FOUO) DHS I&A Perspective (U//FOUO) DHS assesses that anger over the results of the 2016 Presidential election continues to be a driver of domestic terrorist violence throughout the United States—as evidenced by rioting in Portland, Oregon following the election and violence and destruction of property in Washington during the Inauguration.10,11 While we agree that the campaign cycle likely was a driving influence of the rash of incidents in NC in the lead up to the election, we cannot discount the possibility that some such individuals could be spurred to violence against a variety of political targets in the state in the coming year. While criticism and dissenting views of the government is protected activity, some individuals have engaged in violent or unlawful action to express these views. We assess there may be other factors or occurrences that could foment further criminal acts and violence against political entities in North Carolina: – – – – (U//FOUO) Negative publicity surrounding perceived political scandal involving North Carolina political entities; (U//FOUO) Passage of new state or federal legislation that is unpopular with violent extremists— such as legislation concerning: abortion rights, LGBT rights, environment al concerns, gun control, or federal health insurance among others; (U//FOUO) Perceived success in violent activity during the 2017 Presidential inauguration that energized local and regional violent extremists; and (U//FOUO) Negative publicity surrounding voting registration in North Carolina during the previous 2016 Presidention election. (U) DHS and the North Carolina ISAAC are interested in receiving tips and information on activities related to threats to homeland security, malicious cyber activity, and foreign-inspired or domestic terrorism. Comments, requests, or shareable intelligence should be directed to the ISAAC (for North Carolina activities 888-NCISAAC) or DHS. UNCLASSIFIED//FOR OFFICIAL USE ONLY Page 3 of 5 UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO) Source Summary Statement (U//FOUO) The information used in this FAR is drawn from DHS, open source information, state and local law enforcement police reports, and press releases. We have high confidence in the information obtained from intelligence community, DHS, and other US Government and law enforcement agencies. We have medium confidence in the information obtained from open sources includes media reports and websites whose information is credibly sourced and plausible, but may contain biases or unintentional inaccuracies. When possible, open source information has been corroborated through other reliable law enforcement and judicial sources. (U//FOUO) The judgments are guided by the following parameters: (U) High confidence includes high-quality information from multiple sources or from a single, highly reliable source, and the nature of the issue makes it possible to render a strong judgment. (U) Medium confidence includes information that is credibly sourced and plausible but can be interpreted in various ways, or information that is not sufficient quality or corroborated sufficiently to warrant a higher level of confidence. (U) Low confidence includes information that lacks credibility and/or whose plausibility is questionable, information that is too fragmented or poorly corroborated to make strong analytic judgments, or significant concerns or problems exist with the sources of the information. (U//FOUO) We have medium confidence in our assessment that physical violence against political organizations is likely to decrease in the first half of 2017 as it is based on a lack of threat recent threat reporting and our judgments about domestic terrorists targeting preferences as SMEs on the topic. We acknowledge that this lack of threat reporting could also partially be the result of the inherent difficulties in obtaining comprehensive domestic terrorism reporting as a result of privacy and civil rights restrictions on USPER data. (U//FOUO) We have medium confidence in our assessment that malicious cyber activities in the first half of 2017 directed at government networks will likely continue at a similar rate but will be more focused on criminal rather than political aims as it is based largely onon our judgments regarding the goals of cyber actors as SMEs on the topic; these judgments have been corroborated by DHS IIR reporting that is deemed credible by other cyber experts. (U) Report Suspicious Activity (U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency managers should follow established protocols; all other personnel should call 911 or contact local law enforcement. Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism Task Force for further action. For more information on the Nationwide SAR Initiative, visit http://nsi.ncirc.gov/resources.aspx. (U) Tracked by: HSEC-8.1, HSEC-8.6, HSEC-8.8, HSEC-8.10 UNCLASSIFIED//FOR OFFICIAL USE ONLY Page 4 of 5 UNCLASSIFIED//FOR OFFICIAL USE ONLY 1 (U); Chris Dyches; WBTV.com; “Shots Fired at Republican Headquarters in Pamlico County”; 19 OCT 2016; http://www.wbtv.com/story/33428361/ncgop-shots-fired-at-republican-headquarters-in-pamlico-county; accessed on 11 JAN 2017; (U); Online news article from local news blog. 2 (U); Caryn Little; WCCB-TV; “Officials Say Shots Fired into Pamlico County Republican Party Headquarters”; 19 OCT 2016; http://www.wccbcharlotte.com/2016/10/19/officials-say-shots-fired-pamlicocounty-republican-party-headquarters/; accessed on 11 JAN 2017; (U); Online news article from local news source. 3 (U); Kristy Steward; WLOS TV; “Police: Arrest made after Henderson County GOP office bomb threat”; 20 OCT 2016; http://wlos.com/news/local/henderson-county-gop-office-evacuated-after-threat; accessed on 11 JAN 2017; (U); Online news article from local news source. 4 (U//FOUO); Raleigh Police Department; 18 OCT 2016; (U//FOUO) Report # LRP161018381897; Extracted information is U//FOUO; Overall document classification is U//FOUO. 5 (U); Eric Bradner; CNN, “Local GOP office in North Carolina firebombed,” 17 OCT 2016; http://www.cnn.com/2016/10/16/politics/north-carolina-gop-office-vandalized/; accessed on 11 JAN 2017; (U); Online news article from national news source. 6 (U); FBI, Arson and Graffiti Investigation – Hillsborough, North Carolina; n.d.; https://www.fbi.gov/wanted/seeking-info/arson-and-graffiti-investigation; accessed on 11 JAN 2017; (U); Official government website. 7 (U//FOUO); DHS; IIR 4 015 0040 17; 062001Z DEC 2016; DOI 03 OCT 2016; (U//FOUO); Defacement of North Carolina Law Enforcement Training Academy Website in October 2016; Extracted information is U//FOUO; Overall document classification is U//FOUO. 8 (U//FOUO); DHS; IIR 4 015 0036 17; 021802Z DEC 2016; DOI 27 SEP 2016; (U//FOUO); Attempted Exfiltration of Personal Information from a North Carolina City’s Computer Network to Use for Extortion; Extracted information is U//FOUO; Overall document classification is U//FOUO. 9 (U//FOUO); DHS; IIR 4 015 0035 17; 021725Z DEC 2016; DOI 03 OCT 2016; (U//FOUO); Distributed Denial of Service Attack Directed Against a City in Southwestern North Carolina During a Period of Unrest in September 2016; Extracted information is U//FOUO; Overall document classification is U//FOUO. 10 (U); Unknown Author; CBS News, “Riot Declared in Portland, Oregon Amid New Wave of Anti-Trump Demos,” 11 NOV 2016; http://www.cbsnews.com/news/riot-declared-in-portland-oregon-amid-new-wave-ofanti-trump-demos/; accessed on 11 JAN 2017; (U); Online news article from national news source. 11 (U); Chris York; Huffington Post, “Donald Trump Protests See Anarchists Smash Windowns in Washington” 20 JAN 2016; http://www.huffingtonpost.co.uk/entry/donald-trump-inaugurationprotests_uk_58822fd9e4b0f94bb303c845; accessed on 01 JAN 2017; (U); National news blog. UNCLASSIFIED//FOR OFFICIAL USE ONLY Page 5 of 5 CLASSIFICATION: UNCLASSIFIED//FOR OFFICIAL USE ONLY Office of Intelligence and Analysis Customer Feedback Form Product Title: (U//FOUO) North Carolina: Recent Spike in Election-related Physical and Cyber Incidents All survey responses are completely anonymous. No personally identifiable information is captured unless you voluntarily offer personal or contact information in any of the comment fields. Additionally, your responses are combined with those of many others and summarized in a report to further protect your anonymity. 1. Please select partner type: Select One and function: Select One Select One 2. What is the highest level of intelligence information that you receive? 3. Please complete the following sentence: “I focus most of my time on:” Select One 4. Please rate your satisfaction with each of the following: Very Satisfied Somewhat Satisfied Neither Satisfied nor Dissatisfied Somewhat Dissatisfied Very Dissatisfied N/A Product’s overall usefulness Product’s relevance to your mission Product’s timeliness Product’s responsiveness to your intelligence needs 5. How do you plan to use this product in support of your mission? (Check all that apply.) Drive planning and preparedness efforts, training, and/or emergency response operations Initiate a law enforcement investigation Intiate your own regional-specific analysis Intiate your own topic-specific analysis Develop long-term homeland security strategies Do not plan to use Other: Observe, identify, and/or disrupt threats Share with partners Allocate resources (e.g. equipment and personnel) Reprioritize organizational focus Author or adjust policies and guidelines 6. To further understand your response to question #5, please provide specific details about situations in which you might use this product. (Please Use Manuscript in the space provided.) 7. What did this product not address that you anticipated it would? (Please Use Manuscript in the space provided.) 8. To what extent do you agree with the following two statements? Strongly Agree Agree Neither Agree nor Disagree Disagree Strongly Disgree N/A This product will enable me to make better decisions regarding this topic. This product provided me with intelligence information I did not find elsewhere. 9. How did you obtain this product? Select One 10. Would you be willing to participate in a follow-up conversation about your feedback? To help us understand more about your organization so we can better tailor future products, please provide: Name: Position: Organization: Contact Number: State: Email: Yes Submit Feedback Privacy Act Statement CLASSIFICATION: Product Serial Number: IA-0085-17 UNCLASSIFIED//FOR OFFICIAL USE ONLY REV: 10 November 2016