Minnesota Fusion Statute ?l3.37 MN Security Information Declaration dated 16 January 2019 Minnesota Fusion Center Hill? Minnesota Metro Area Civil Unrest Situation Report SitRep #1 (05/28/2020) The MNFC is providing the following information to all agencies that may have a stake in the current civil unrest in Minneapolis in response to the in-custody death of George Floyd. The situation in the metro- area is extremely fluid and changes often. As the situation unfolds in your area of responsibility, the MNFC will provide information as timely as possible. Con?rmed Activity The MNFC has received information from fusion centers throughout the country regarding individuals travelling to Minnesota to participate in the demonstrations in the Minneapolis area. Some of the individuals travelling to Minnesota are known to wear body armor/vests and openly carry long guns. Social media users continue to threaten violence against Minneapolis Police and law enforcement throughout the state, examples include: On Wednesday, 05/27/2020, an identi?ed individual replied to a Minneapolis Police post and stated, "i swear to god i will kill all of you [profanity]". 0 Another user mentioned on Twitter kill innocent white people due to the Minneapolis PD incident Additionally, the MNFC has observed individuals claiming to be from Minnesota participating in the demonstrations wearing body armor/vests and openly carrying long guns. At this time, the MNFC has not observed any violent activity from these individuals. On Wednesday, 05/27/2020, what started out as a peaceful protest in Minneapolis, quickly descended into looting, arson, and rioting. The Target store near the Minneapolis 3rd Precinct was looted and vandalized during riot. Multiple other businesses were vandalized or looted throughout the evening. Debris and fireworks were thrown at law enforcement of?cers creating a perimeter around the 3rd precinct. Firefighters attempting to combat the fires started by the demonstrators had debris thrown at them as well, despite the protective perimeter law enforcement provided. On Thursday, 05/28/2020, multiple Target stores and other businesses in the metro-area were looted, vandalized, and also set on fire. Shopping malls, retail centers, and other businesses, to include the Mall of America, preemptively closed their doors in anticipation of rioting in the suburban areas. Individuals Minnesota Fusion Statute ?l3.37 MN Security Information Declaration dated 16 January 2019 Minnesota Fusion Statute ?13.37 MN Security Information Declaration dated 16 January 2019 on social media are currently claiming Target funds the Minneapolis Police Department, and this may be why the stores are being targeted. Metro transit has closed all service, starting at 1600 hours today. Domestic Terrorism Outlook As of 05/28/2020, the Federal Government does not have any intelligence of a domestic terrorism threat impacting Minnesota related to current events in Minneapolis. However, intelligence are monitoring individuals, such as White Supremacist Extremists (WSE), linked to the Boogaloo movement. These individuals may take advantage of these events to promote their ideology. MNFC Analyst Comment: "Boogaloo" is a term used by extremists to refer to a future civil war, and "Boogaloo boys" like/y refers to people supporting Boogaloo and armed revolution. Based on information found online, Boogaloo boys are likely on ground, but there is no intelligence to know specific locations or actions. Cyber Security Outlook 0 On 05/25/2020, a City of Minneapolis Police website (insideMPD.com) was targeted with a Distributed Denial of Service (0005) attack that overloaded the site making it appear to be of?ine. This event was claimed by actors self-reporting ties to the hacker group Anonymous. 0 On 05/28/2020, a Telephony Denial of Service attack targeted the Minneapolis Public Safety Answering Point (PSAP) phone lines with high volumes of calls to exceed capacity. This impacted the ability for legitimate calls to get through. 0 On 05/28/2020, 3 State of Minnesota IP address was published with information on exposed vulnerabilities. This address belongs to a non-state partner entity that has been contacted and is working to protect their systems. Cyber events often follow highly visible public events as a means of hacktivism or public protest. The most commonly reported activity in these events are: 0 Distributed Denial of Service events that target public websites or other services hosted by or for the targeted organization. These events are often precipitated by public calls to action through public posts on social media or other sites and may originate from actors around the globe. In most cases, the attacks targeted the primary organizations involved in the event or responding to the event, but may include additional organizations seen as af?liated by geographic location, name, or similar entity. 0 Doxing events that collect and publish personal information on targeted victims viewed as involved or associated with the events. 0 Website Defacements exploitation of vulnerable web servers to post or publish unauthorized content publicly. Vulnerability scans and exploits - actors will scan public data sources such as Shodan.io or scan targeted networks looking for easy to target vulnerabilities that can be used to exploit systems, gain unauthorized access, or deface web servers. Minnesota Fusion Statute ?13.37 MN Security Information Declaration dated 16 January 2019 Minnesota Fusion Statute ?13.37 MN Security Information Declaration dated 16 January 2019 Upcoming Events There are multiple events scheduled to take place across the metro area over the next several days. The following are events the MNFC is aware of. This is likely not an all-encompassing list and there will likely be ad-hoc events over the next several days: Date Time Location Ongoing 1730 100 Church St. SE, Minneapolis, MN 55455 05/28/2020 1400 Hennepin County Attorney?s Home 5/28/2020 1400 10 Lake Street, Minneapolis, MN 55408 5/28/2020 1700 Hennepin County Government Center 05/28/2020 1700 1200 East Lake St., Minneapolis, MN 55406 05/28/2020 1700 Plaza Centenario Lake Street, Minneapolis 5/28/2020 1730 Brainerd, MN - Washington and 6th St 5/28/2020 2000 2610 Lake St., Minneapolis, MN 55406 5/28/2020 2100 Burnsville Target 5/28/2020 Target in Minneapolis 5/29/2020 1400 Hennepin County Attorney?s Home 05/29/2020 1730 Morill Hall, University of Minnesota 05/30/2020 1230 Bryant Square Park 05/30/2020 1400 10 Lake St, Minneapolis, MN 55408 05/30/2020 1700 Hennepin County Government Center Final Thoughts Activity across the metro is changing rapidly. It is highly probable that activity demonstrated over the past few days will continue to occur. While there are currently planned events over the upcoming days, we will likely see unplanned events arise. Additionally, the MNFC expects significantly larger crowds to gather at the weekend?s events. The MNFC is actively monitoring the situation. Should information/activity relevant to specific jurisdictions emerge, the MNFC will work to provide that information as expeditiously as possible. Should you have any information about current activity/threat/protest, please contact the MNFC at MN.FC@state.mn.us. Minnesota Fusion Statute ?13.37 MN Security Information Declaration dated 16 January 2019 Minnesota Fusion Statute ?13.37 MN Security Information Declaration dated 16 January 2019 (U) Appendix: Potential Indicators of Violent Activity There are a number of behaviors and potential indicators of domestic terrorist actors planning to engage in criminal or violent activities during legal protest events. Some of these behavioral indicators may involve constitutionally protected activities, and should be supported by additional facts before increased suspicions are justified. Most single behavioral indicators should not be the sole basis for law enforcement action. These indicators, therefore, only support a reasonable suspicion of violent activity when considered in conjunction with additional supporting facts. Independently, each indicator may represent legitimate recreational or commercial activities; however, the presence of multiple indicators could suggest a heightened threat. (U) Event Build-up Planning of criminal or violent activities related to protest activity or events often occurs through internet chat rooms, social networking sites, message boards, phone apps, and poster campaigns covering areas near the event. Potential indicators of planned violence at an event could include: Public ?calls to arms? or attempts to recruit members through social media, coupled with more explicit calls for violence via messaging applications; 0 Posts on social media sites by groups for carpooling from other regions to violently confront opponents at public events; 0 Solicitation of funds for legal fees and/or medical costs associated with upcoming public events because of anticipated violence; 0 Individuals conducting surveillance of areas around planned events, such as parking areas, marching routes, or rallying points, with the aim of identifying places to hide weapons and/or supplies, or the best possible locations for rapid egress and/or hiding from law enforcement; Reports of pilfered construction sites for potential projectiles, such as rocks, batteries, canned food, and pipes; Recovery of weapons caches comprised of projectiles like rocks, bricks, or other easily thrown debris near event or protest routes. (U) Weaponry Participants intending to engage in violence and criminal activity may employ rudimentary improvised incendiary devices, edged weapons, blunt objects, rocks, poles, and other self-fashioned weapons or re-purposed items. Potential indicators of planned violence by individuals at an event could include: Possession of rocks, sharpened objects, martial-arts-type weapons, bottles, or heavy objects that could be used as projectiles; Possession of balloons, which have been used to throw feces, urine, chemicals, and other unidentified substances at law enforcement and other individuals at events; Minnesota Fusion Statute ?13.37 MN Security Information Declaration dated 16 January 2019 Minnesota Fusion Statute ?13.37 MN Security Information Declaration dated 16 January 2019 Possession of home-made shields in preparation for engaging in criminal or violent activity against law enforcement; Possession of chemical sprays like pepper spray or ?bear repellent" spray; Possession of fireworks, flares, or smoke devices; Possession of bike locks, sling shots, or flag poles (including modified poles containing sharp objects like nails affixed to the ends) are other miscellaneous items potentially indicating violence. (U) Attire Potential observable indicators could include: Clothing covering most of a person?s head or body to mask their identity, such as masks, helmets, ski or gas masks, or bandanas; Participants wearing layers of clothing when weather conditions make such behavior unusuak Individuals wearing insignia indicating affiliation with violent groups; and Participants covering faces with scarves, homemade gas masks, or wearing ?Guy Fawkes? type masks. Minnesota Fusion Statute ?13.37 MN Security Information Declaration dated 16 January 2019