2019 Terrorism Threat Assessment NEW JERSEY OFFICE OF HOMELAND SECURITY AND PREPAREDNESS UNCLASSIFIED About Us The New Jersey Office of Homeland Security and Preparedness (NJOHSP) is tasked with coordinating counterterrorism, resiliency, and cybersecurity efforts across all levels of government, law enforcement, nonprofit organizations, and the private sector. Created by Executive Order in 2006 when the Office of Counterterrorism (OCT) merged with staff from the Domestic Security Preparedness Task Force (DSPTF), NJOHSP bolsters New Jersey’s resources for counterterrorism, critical infrastructure protection, preparedness, training, and federal grants management. Shortly after the tragic events of September 11, 2001, New Jersey’s legislature and Governor passed and signed the Domestic Security Preparedness Act, which created the DSPTF within the Office of the Attorney General. In 2002, the Governor created the OCT by Executive Order, which remained under the Attorney General. OCT provided New Jersey with a single agency to lead and coordinate New Jersey’s counterterrorism efforts with state, local, and federal authorities and with the private sector. Mission NJOHSP leads and coordinates New Jersey’s counterterrorism, cybersecurity, and preparedness efforts while building resiliency throughout the State. Core Values SERVICE. We put our State and its citizens first, and we put Mission before self. We take pride in being timely, accurate, and relevant. TEAMWORK. We stand with and behind each other. We recognize that partnerships, both internal and external, are critical to achieving success. We cannot fulfill our Mission alone. EXCELLENCE. We take great pride in the quality of our work. We do every task, every project, every initiative, to the best of our ability. DIVERSITY. We strive to build a workforce that is as diverse as New Jersey’s citizenry. We pride ourselves on encouraging diversity of thought, perspective, and problem solving. INTEGRITY. We are committed to holding ourselves accountable to the highest moral and ethical standards in our personal and professional conduct. We can be relied upon to act with honor and truthfulness. Foreword In October, Robert Bowers targeted members of the Jewish community when he entered a Pittsburgh synagogue and opened fire, killing 11 people and injuring six. It was an attack not only toward members of that congregation, but also against all citizens throughout the United States who should be able to go about their daily lives without fearing for their safety at any event or venue. The threat from individuals who similarly wish to do harm has hit home in New Jersey as well. In May, NJOHSP detectives arrested and charged a sovereign citizen extremist for the first time under a new State statute for filing fraudulent liens. In October, an anti-government extremist transported explosive materials through our State with the goal of conducting an attack on Election Day in Washington, DC. That same month, Cesar Sayoc Jr. mailed Cory Booker and 15 other Democratic figureheads packages that contained improvised explosive devices. These incidents further demonstrate the wide-ranging ideologies associated with domestic terrorism and have only further strengthened our Office’s resolve to protect the diversity that makes New Jersey so unique. As an example, membership in the Interfaith Advisory Council increased more than 500 percent from the previous year, and the partnerships developed between faith-based leaders and government representatives have resulted in greater security and preparedness throughout New Jersey. In the year ahead, NJOHSP will move forward in keeping all critical infrastructure across New Jersey secure through trainings, resource availability, and grant opportunities. We will also continue developing our relationships with public- and private-sector partners with intelligence products detailing current threats and briefings relevant to a variety of audiences. At NJOHSP, we remain committed to doing all that is necessary to make certain you and your families are safe and secure. However, this can only be accomplished with your assistance. I ask that all residents and visitors throughout New Jersey remain vigilant and “See Something, Say Something” by reporting suspicious activity at 1-866-4-SAFE-NJ or tips@njohsp.gov. Sincerely, Jared M. Maples Director, NJOHSP January 2019 Table of Contents New Jersey’s Assessed Threat Level in 2019...................................................................................................2 2018 New Jersey Terrorism Timeline................................................................................................................4 Homegrown Violent Extremists (HVEs)..........................................................................................................6 HVEs: A Persistent Threat to New Jersey......................................................................................................7 HVE Attacks in 2018.....................................................................................................................................8 Domestic Terrorism..........................................................................................................................................10 Domestic Extremist Overview ....................................................................................................................11 Domestic Extremist Attacks in 2018............................................................................................................12 Anarchist Extremists Mobilize Against Perceived Injustices......................................................................14 Militia Extremists Organize Against Presumed Threats..............................................................................15 Sovereign Citizen Extremists Largely Target Law Enforcement.................................................................16 White Supremacists Rebranding Image.......................................................................................................17 International Terrorism..................................................................................................................................18 Al-Qa’ida in 2018: A Year in Review..........................................................................................................19 ISIS Enters Its ‘Post-Caliphate’ Strategy.....................................................................................................20 Threats Facing First Responders....................................................................................................................22 Cybersecurity Threats.....................................................................................................................................24 SEE Something, SAY Something......................................................................................................................26 Security Starts with You...............................................................................................................................27 How to Report Suspicious Activity..............................................................................................................28 Eight Signs of Terrorism..............................................................................................................................29 Terrorism Definitions.......................................................................................................................................30 NJOHSP Terrorism-Related Products..........................................................................................................34 Information Cutoff: January 1, 2019 2019 Threat Assessment 1 NEW ASSESSED THREAT LEVEL IN 2019 H. a? . nu Assessed Threat Level High Homegrown Violent Extremists Anarchist Extremists ISIS Moderate Militia Extremists Sovereign Citizen Extremists White Supremacist Extremists Al-Qa’ida o Al-Qa’ida in the Arabian Peninsula o Al-Qa’ida in the Indian Subcontinent Al-Qa’ida in the Islamic Maghreb Al-Shabaab Animal Rights Extremists Low Anti-Abortion Extremists Black Separatist Extremists Boko Haram Environmental Extremists HAMAS Hizballah Lashkar-e-Tayyiba Nusrah Front Tehrik-e-Taliban Pakistan Change from 2018 Al-Qa’ida in the Arabian Peninsula (AQAP) The threat from AQAP decreased from moderate to low in 2019. AQAP continues to focus on local issues within Yemen, and drone strikes have nearly decimated much of the group’s command staff. Propaganda output has declined to nearly half of what it produced last year. AQAP has not successfully executed an attack in the West since the operation in January 2015 against the offices of the satirical newspaper Charlie Hebdo in Paris. 2019 Threat Assessment 3 a a 2018 NEW JERSEY 2018 New Jersey Terrorism Timeline February 14 Anti-Abortion Extremist: Marckles Alcius deliberately crashed a stolen truck into a Planned Parenthood clinic in East Orange (Essex County), injuring three people. Following his arrest, Alcius stated that he intentionally conducted the attack and he was willing to die, according to the Essex County Prosecutor’s Office. Additionally, investigators stated Alcius had conducted preoperational planning and researched several Planned Parenthood locations in New Jersey, Rhode Island, and Massachusetts. May 23 Sovereign Citizen Extremist: NJOHSP detectives arrested and charged Courtney Alexander of Irvington (Essex County) on two counts of second-degree fraudulent filings and one count of third-degree retaliation against a witness for a prior incident. In 2015, Alexander placed fraudulent liens against two police officers who issued him a traffic citation, as well as a local prosecutor and a municipal judge assigned to the case. Alexander is the first New Jersey resident charged under a new law for filing fraudulent liens. July 28 Anti-Government Extremist: Authorities arrested Dereal Finklin of Plainfield (Union County) for posting a picture of New Jersey Rep. Chris Smith accompanied with a threatening message. Finklin posted the picture under a Facebook alias, “Israel Bey,” and made a series of online death threats. On October 19, Finklin pleaded guilty to fourth-degree cyber harassment. October 9 Anti-Government Extremist: Authorities arrested Paul Rosenfeld for plotting to detonate a 200-pound improvised explosive device (IED) on Election Day in Washington, DC, in furtherance of his political views. Rosenfeld ordered large quantities of black powder over the Internet, which he transported from Bergen County in New Jersey to his residence in New York. October 26 Anti-Government Extremist: Federal authorities arrested Cesar Sayoc Jr. for mailing 16 packages containing IEDs to prominent figures and supporters of the Democratic Party, including US Senator Cory Booker from New Jersey. Sayoc’s charges include interstate transportation of an explosive, illegal mailing of explosives, threats against former presidents and certain other persons, threatening interstate communications, and assaulting federal officers. 2019 Threat Assessment 5 2019 Threat Assessment 5 HOMEGROWN VIOLENT EXTREMISTS (HVES) HVEs: A Persistent Threat to New Jersey HVEs will remain the highest threat to New Jersey due to their sustained support to foreign terrorist groups, the unpredictability of attacks, and their susceptibility to online propaganda. In 2018, there were seven individuals involved in attacks and plots nationwide and eight others charged with material support. In December, federal authorities arrested Damon Joseph of Holland, Ohio, for plotting to attack a synagogue in Toledo with two semi-automatic rifles. Additionally, Joseph produced and distributed ISIS propaganda online to show his support for the group. In October, federal authorities charged Ashraf al-Safoo with providing material support to ISIS. Safoo, a content producer and leader of the English-language online media group Khattab Media Foundation, helped to encourage ISIS supporters across the globe to conduct violence in ISIS’s name. In response to the arrest, Khattab Media Foundation called for the beheading of the Special Agent in Charge of the Chicago FBI office. In March, Florida authorities arrested Corey Johnson for stabbing three individuals at an overnight party, killing one and injuring two. According to Johnson, he planned and carried out the stabbings because of his Muslim faith and because one of the victims, a 13-year-old, had offended him with regard to his religious beliefs. Prior to the party, he viewed violent jihadist videos and claimed support for Anwar al-Aulaqi. Authorities began investigating Johnson a year prior for his extremist beliefs and violent tendencies, including causing a bomb scare in the United Kingdom. Understanding the HVE Threat HVE support in the United States for foreign terrorist organizations will remain unremitting, despite a decline in HVE attacks and overall activity since 2015. HVEs are individuals inspired—as opposed to directed—by foreign terrorist organizations and radicalized in the countries in which they are born, raised, or reside. These organizations continue to call for attacks in the West, despite the groups’ inability to execute large-scale attacks in recent years. Identified HVEs by Year* 100 84 80 60 40 43 37 20 15 In June, authorities arrested Wisconsin resident Waheba Dais for facilitating recruitment and maintaining a virtual library of instructions related to bomb-making, 0 2015 2016 2017 2018 biological weapons, poisons, and suicide vests. Dais *Due to the sensitivity of ongoing HVE investigations, this attempted to encourage a person she believed to be data only reflects publicly available information and may an ISIS supporter to conduct an attack, providing be subject to change. instructions on how to make ricin and suggesting targets. In May, authorities arrested Matin Azizi-Yarand of Texas for plotting to conduct an attack at a mall, targeting a police officer and civilians. Azizi-Yarand claimed he read online “ISIS magazine guides for performing operations and making bombs.” 2019 Threat Assessment 7 HVE Attacks in 2018 Wesley Ayers Anderson County, South Carolina Between January 24 and February 24, Wesley Ayers placed seven improvised explosive devices (IEDs)—three of which were hoaxes— around Anderson County, South Carolina, injuring one. The IEDs were affixed and located with various images, including references to attacking the White House and documents pledging allegiance to ISIS. Ayers pleaded guilty in October to multiple charges related to the construction and use of weapons of mass destruction. Martin Farnsworth St. George, Utah On March 5, Martin Farnsworth placed a backpack with an IED constructed using a metal soup can filled with shotgun shells inside his high school. The month prior to the incident, Farnsworth replaced the American flag at the school with an ISIS flag and spray-painted “ISIS is comi- [sic].” Farnsworth told authorities he wanted to join ISIS but did not know how. Authorities charged Farnsworth with attempted murder and use of a weapon of mass destruction. Corey Johnson Palm Beach Gardens, Florida On March 12, Corey Johnson stabbed two juvenile males and a woman, killing one. Johnson claimed that one of the victims made fun of his Muslim faith and the other referred to celebrities as “gods.” According to one of the survivors, Johnson used to watch violent jihadist videos and even viewed some the night of the attack. Johnson’s mother stated he is “obsessed with dictator figures like Hitler, Stalin, and Kim Jung Un.” A year prior to the attack, Johnson claimed support to deceased al-Qa’ida in the Arabian Peninsula cleric Anwar al-Aulaqi. 8 2019 Threat Assessment DOMESTIC TERRORISM Domestic Extremist Overview Domestic extremists’ wide-ranging ideologies pose unique challenges to New Jersey and the surrounding region, as they employ a variety of robust methods to conduct attacks, have varying motivations, and are often willing to engage in violence. An NJOHSP review of domestic extremist incidents shows a decrease in attacks from 23 in 2017 to 16 in 2018. In October, federal authorities arrested and charged Cesar Sayoc Jr. in a 30-count indictment with offenses relating to his mailing of 16 improvised explosive devices that targeted 13 former senior democratic government officials and others, including US Senator Cory Booker from New Jersey. In February, New Jersey authorities arrested and charged Marckles Alcius of Massachusetts with terrorism offenses for intentionally crashing a stolen truck into a Planned Parenthood clinic in East Orange (Essex County), injuring three. Prior to the attack, Alcius conducted pre-operational planning and researched several Planned Parenthood facilities in other states. On October 27, Robert Bowers, who posted online that Jews were bringing in “invaders that kill [white] people” and that he could not “sit by and watch [white] people get slaughtered,” attacked a synagogue in Pittsburgh, killing 11 and injuring at least six. For months before the shooting, Bowers posted anti-Semitic comments online, including ones that referenced white genocide, which is the fear that the white race will become extinct through forced assimilation. In May, Jonathan Oddi walked into the Trump National Doral Miami, unfurled an American flag across the lobby counter, fired shots into the ceiling, and got into a shootout with responding law enforcement. During the attack, he went on a rant about President Donald Trump and former President Barack Obama. In October, authorities arrested members of California-based militant white supremacist group the Rise Above Movement (RAM) a year after attending the Charlottesville “Unite the Right” rally in order to incite a riot and assault counter-protesters. RAM members allegedly traveled to several protests around the United States with the purpose of engaging in violence with counter-protesters. Domestic terrorism is violence committed by individuals or groups—including anti-government, race-based, religious, and single-issue extremist ideologies—associated primarily with US-based movements. 16 Domestic Extremist Attacks domestic extremist attacks in 2018 16 Opportunistic vs. Planned Attacks 2 Race-Based 9 5 Anti-Government Single-Issue 9 7 Opportunistic Planned deaths as a result of these attacks 2019 Threat Assessment 11 Domestic Extremist Attacks in 2018 January 2 White Supremacist Extremist: Ronnie Wilson, an alleged member of the Aryan Nation, opens fire with a shotgun on a police officer in Knoxville, Tennessee, during a traffic stop. February 9 Anti-Abortion Extremist: Marckles Alcius intentionally rams a stolen truck into a Planned Parenthood clinic in East Orange (Essex County), injuring three. March 17 Sovereign Citizen Extremist: David Wolosin shoots at two police officers in Wyoming who attempted to talk to him, injuring one. Officers kill Wolosin in the shootout. May 18 White Supremacist Extremist: Paul Farrow Jr., a selfdescribed member of the Aryan Nation, punches a man after yelling racial slurs at him and telling him to “go back to where he belongs” in Bloomington, Indiana. 12 2019 Threat Assessment White Supremacist Extremist: Samuel Woodward, a member of the Atomwaffen Division, fatally stabs Blaze Bernstein at least 20 times and buries him at a park in California. Following the incident, Atomwaffen Division members praise the attack online, stating that Woodward is a “one man gay Jew wrecking crew.” January 11 Sovereign Citizen Extremist: Tierre Guthrie, an alleged member of the Moorish sovereign citizen movement, fires at officers serving an arrest warrant, killing one and injuring two in Georgia. Officers return fire, resulting in his death. February 16 White Supremacist Extremist: John Carothers burns a black man to death at a veterans’ assisted living home in Murfreesboro, Tennessee. Following his arrest, Carothers writes a letter to a white supremacist organization claiming he conducted the attack for racerelated reasons. May 6 Anti-Government Extremist: Jonathan Oddi opens fire at the Trump National Doral Miami, resulting in a shootout with police. May 31 Domestic Extremist Attacks in 2018 White Supremacist Extremist: Kynan Dutton, the self-described leader of a Tennessee white supremacist group, attacks a man at a pride festival he was protesting in Knoxville. July 7 Sovereign Citizen Extremist: Gregory Rodvelt boobytraps his home with explosives, which injures an FBI agent conducting a search of the residence in Oregon. October 24 Anti-Government Extremist: Authorities arrest Cesar Sayoc Jr. for mailing 16 improvised explosive devices to prominent political figures, celebrities, and a news station across the United States. October 27 Anarchist Extremists: Tom Keenan and others Mace, punch, kick, and rob United States Marine Corps reservists in Philadelphia, calling them Nazis and white supremacists. December 8 June 23 White Supremacist Extremists: Six members of Keystone United attack a black man and his friend at a bar while shouting racial slurs in Pittsburgh. September 7 White Supremacist Extremist: Gregory Bush shoots and kills two black people at a supermarket in Louisville. October 26 White Supremacist Extremist: Robert Bowers kills 11 people and injures at least six at a synagogue in Pittsburgh. November 17 White Supremacist Extremists: Eight members of the Aryan Brotherhood attack a black man at a club while shouting racial slurs and another man who came to his defense in Lynnwood, Washington. 2019 Threat Assessment 13 Anarchist Extremists Mobilize Against Perceived Injustices Anarchist extremists will mobilize in response to issues they believe are unjust, carry out criminal and violent acts during otherwise First Amendment-protected events and protests, and target perceived enemies. Throughout 2018, anarchist extremists were actively engaged in criminal activities in the tri-state region, resulting in at least 20 arrests. In November, several hundred people, including a number of individuals associated with anti-fascist (Antifa) anarchist extremists, mobilized at the “We the People” rally in Philadelphia, which they perceived as a white supremacist event. That same month, an Antifa-related group, Smash Racism DC, vandalized and protested outside the home of the founder of the Daily Caller, stating that he was “promoting hate” and “an ideology that has led to thousands of people dying.” Following the “We the People” rally in Philadelphia in November, a group of individuals, including anarchist A man holds an Antifa flag among counter-protesters extremists, Maced, punched, and kicked US Marine Corps at the “We the People” rally in Philadelphia. reservists not affiliated with the event while calling them “Nazis” and “white supremacists.” In October, anarchist extremists protested outside a Proud Boys event in New York City and engaged in acts of vandalism. After the event, one of the anarchist extremists threw a bottle at the Proud Boys, resulting in a fight. In June, a Nebraska-based anarchist extremist group tweeted a link to the names and photos of nearly 1,600 Immigration and Customs Enforcement (ICE) officials. Following the release, another individual disseminated the names, pictures, and home addresses of seven ICE employees and their spouses in Oregon, stating, “It’s the public’s right to know the faces of the gestapo and who is creating, enforcing, and filling concentration camps in our name.” Antifa Antifa is a movement that focuses on issues involving racism, sexism, and antiSemitism, as well as other perceived injustices. The majority of Antifa members do not promote or endorse violence; however, the movement consists of anarchist extremists and other individuals who seek to carry out acts of violence in order to forward their respective agendas. 14 2019 Threat Assessment The red flag was one of the first anarchist symbols, used until the 1917 October Revolution in Russia when it became primarily associated with communist ideologies. Since the late 19th century, anarchist groups have used the black flag as a rejection of the concept of representation or the idea that an institution can adequately represent a group of individuals. Antifa consists of individuals who adhere to some form of the far-left school of thought, encompassing communists, anarchists, socialist groups, and others. Red and black flags flying together represents coming together against a perceived enemy. Despite the unification of these groups under the banner of Antifa, their ideological motivations will likely cause infighting. Militia Extremists Organize Against Presumed Threats Militia extremists across the United States will oppose unlawful immigration, attempt to intimidate Muslims, and encourage violence at protests, a departure from previous encounters with the federal government. Claiming that the “Deep State” is preparing for “illegitimate power,” one national militia group announced it would organize training sessions across the country aimed at helping militia members prepare for “lethal force” at various events. As of December, several militia groups in Texas claim its members are patrolling the US-Mexico border for people attempting to enter the country unlawfully. Elsewhere, a supporter from Oregon claimed to raise approximately $4,000 for militias to buy supplies, arguing dangerous “unknown Middle Easterners” are heading to the US-Mexico border. In March, federal authorities charged three White Rabbit militia members for bombing a Minnesota mosque in August 2017. One of the members told an FBI agent that he wanted to “scare [Muslims] out of the country.” Upon further investigation, federal authorities found an email account allegedly associated with these members, which they used to receive “missions” from “higher-ups.” The same individuals also attempted to bomb an Illinois abortion clinic in November 2017. In September, members of a Texas militia group protesting an Islamic Society of North America conference in Houston clashed with counter-protesters, including members of the New Black Panther Party, resulting in at least one injury. Prior to the event, members of the militia group openly discussed how to attack counterprotesters online. Michael Hari, Michael McWhorter, and Joe Morris (from left), militia members charged in bombing a Minnesota-based mosque Image on patch of White Rabbit militia According to the US Department of Homeland Security, militia extremists maintain a site on the Dark Web containing hyperlinks to manuals with instructions on how to build various weapons and explosives, army survival handbooks, and hacking guides. 2019 Threat Assessment 15 Sovereign Citizen Extremists Largely Target Law Enforcement Law enforcement remains the primary target of sovereign citizen extremists nationwide, as they threaten to retaliate against those who challenge their ideology, stockpile weapons, and continue to attack police. In 2018, sovereign citizen extremists conducted four attacks throughout the country, three of which targeted law enforcement, using small arms and explosives as methods. Over the past two years in New Jersey, there have been at least five cases of sovereign citizen extremists verbally threatening police. During the same period, sovereigns both filed and threatened to file retaliatory liens against law enforcement. In May, NJOHSP detectives arrested Courtney Alexander after a court indicted him on two counts of second-degree fraudulent filings and one count of third-degree retaliation against a witness. In June, Arizona Department of Public Safety troopers arrested known sovereign citizen extremist Matthew Wright for using an armored vehicle to block traffic near the Hoover Dam in Nevada. Authorities found an AR-15 rifle, a handgun, multiple magazines of ammunition, and an explosive device in the vehicle. In March, local police in Missouri found a weapons cache, including an automatic rifle without a serial number, when issuing a warrant to the home of convicted felon and self-identified sovereign citizen Phillip Guidry, who claimed he “did not have to comply with the US government.” Matthew Wright’s armored vehicle used to block a bridge over the Hoover Dam in Nevada. In September, police charged Gregory Rodvelt, a sovereign citizen extremist involved in an armed standoff with police in Arizona in 2017, with assaulting a federal officer after booby-trapping his home in Oregon with explosives. In May, self-identified sovereign citizen David Wolosin died in a shootout with officers, injuring two, when they responded to a complaint that he was teaching his 3-year-old child to drive in Wyoming. In February, Tierre Guthrie, claiming to be immune from US law, also died in a shootout after killing an officer and injuring two others who were attempting to serve a warrant at his residence in Georgia. Sovereign Citizen Extremists in New Jersey Sovereign citizen extremists in New Jersey have mostly engaged in non-violent activity such as self-identifying in court paperwork and traffic stops and filing liens against public officials. In May 2016, legislation in New Jersey enhanced penalties associated with the filing of fraudulent liens to retaliate against public officials. Sovereign citizens have since adopted new methods to circumvent the law. Examples of sovereign citizen “paper terrorism” Sovereign citizen extremists throughout the United States view federal, state, and local governments as illegitimate, lacking the authority to issue or enforce laws. They also assert they are not subject to law enforcement questioning or arrest, paying taxes and fines, complying with summonses, or possessing official licenses. 16 2019 Threat Assessment White Supremacists Rebranding Image White supremacists nationwide are altering their public image to appear less extreme, leveraging perceived fears, and rebranding in order to conceal their hate-driven ideology. Since late 2017, a new generation of white supremacists has shifted from a national movement to disparate groups that concentrate on the alleged political and social interests of the white race. Formed in 2018, the New Jersey European Heritage Association (NJEHA) claims to host “community clean ups” of local parks and historical monuments, as well as participate in food and clothing drives. NJEHA promotes itself as a “grassroots organization” that is bringing its ideology “into the public mainstream” in order to enable its supporters to take “swift and immediate action . . . against the people who are destroying [the white] race and civilization.” Last year, approximately 65 percent of reported white supremacist propaganda incidents in New Jersey contained references to white genocide, the belief that the white race will become extinct due to forced assimilation, non-European immigration, and interracial marriage. White supremacists use this belief to spread the fear that their race will lose its superiority if supporters do not join them. Flier found in Princeton (Mercer County) Patriot Front, an offshoot of Vanguard America, rebranded in August 2017 from a neo-Nazi organization to one that reflected a skewed version of American white nationalism in order to appeal to a broad range of supporters. Throughout the past year, members of the group blended iconic American symbols with white supremacist imagery to alter the appeal of its website, social media accounts, and written propaganda. Recruitment in New Jersey Over the last year, white supremacist organizations in New Jersey have actively attempted to spread their ideologies and recruit new members throughout the State. Since January 2018, there have been at least 46 reported instances of white supremacist propaganda distribution affiliated with six different groups in nine of New Jersey’s 21 counties. In at least 14 of those instances, white supremacists placed recruitment and propaganda fliers on multiple higher education institutions throughout New Jersey. The fliers included pictures of group activism and statements that either attempted to appeal to one’s European heritage or generate fear of a perceived injustice. The heat map displays 46 reported instances of white supremacist propaganda distribution in 2018. The number of fliers distributed during each instance ranged between one and 30. 2019 Threat Assessment 17 INTERNATIONAL TERRORISM Al-Qa’ida in 2018: A Year in Review Throughout the upcoming year, al-Qa’ida and its affiliates will focus on targeting Western interests abroad, disseminating propaganda to its followers, and attempting to expand its operations in West Africa. Al-Qa’ida has not attempted to attack the United States since an aviation plot in 2012. Al-Qa’ida Core Last year, al-Qa’ida leader Ayman al-Zawahiri called on supporters to conduct attacks against America, specifically targeting its interests in Northwest Africa. On September 11, al-Qa’ida released a 30-minute video speech with English subtitles called “How to Confront America,” marking the 17th anniversary of the attacks on the United States. Al-Qa’ida in the Arabian Peninsula (AQAP) AQAP lost a substantial number of fighters from drone strikes despite a decrease from 125 in 2017 to 35 in 2018. The group exploited the civil war in Yemen while sharing resources with its closest affiliate, alShabaab, despite the declining health of its leader, Al-Qa’ida and its global affiliates Qasim al-Rimi, and the death of chief bomb-maker Ibrahim al-Asiri. This is the first year AQAP has not released its English-language magazine, Inspire, since the publication’s inception, as well as any substantial written propaganda that is the hallmark of the group. Al-Qa’ida in the Islamic Maghreb (AQIM) Following its merge in 2017 with several other factions in the Sahel region, AQIM focused on operations in Mali, Mauritania, Libya, Tunisia, and Niger. Attacks conducted in 2018 mainly involved improvised explosive devices or suicide bombings targeting police and government elections in Mali and Tunisia. In October, a female suicide bomber attacked Tunisia’s capital, injuring nine. In November, two Malian soldiers were killed and another injured in an attack on a checkpoint in the Segou Region of Mali. Al-Qa’ida in the Indian Subcontinent (AQIS) AQIS continues to serve as the hub of jihadist groups in Afghanistan, Pakistan, India, Burma, and Bangladesh. The group fights with its ally, the Taliban in Afghanistan. In May, the US military confirmed that it killed leader Hazrat Abbas and his bodyguard in an airstrike in Afghanistan. Abbas served as a senior commander for both AQIS and Tehrik-e-Taliban Pakistan. Al-Shabaab In 2018, the East African affiliate of al-Qa’ida remained active in Somalia as it sought to keep a foothold in other neighboring countries, such as Kenya, Ethiopia, and Djibouti. The group continued to target government officials, the military, police, journalists, and foreign aid workers in Somalia and Kenya. As a result, the United States remained consistent with the number of strikes in 2017 and 2018, totaling approximately 40. 2019 Threat Assessment 19 ISIS Enters Its ‘Post-Caliphate’ Strategy In 2019, ISIS will maintain its insurgency in Iraq and Syria, support its global affiliates, and attempt to inspire attacks through propaganda dissemination. After almost a year of silence from ISIS’s leader, Abu Bakr al-Baghdadi, the group released an audio message from him attempting to encourage lone acts of violence and urge followers to conduct simple attacks using knives, firearms, bombs, or personal vehicles. Since declaring its purported caliphate in 2014, ISIS has lost the majority of its territory in Iraq and Syria and the US-led coalition has forced the group into the Euphrates River Valley between the two countries where it has historically operated. In order to survive, the group is conducting “guerrilla-style” hit-and-run tactics targeting government forces, local communities, and opposition groups. As of October, ISIS is “trying to disrupt civilian services, like water and electricity, to try to get the people against the government,” according to a spokesperson for the US-led military coalition against the terror group. Amaq News, ISIS’s official news agency, repeatedly claims responsibility for its affiliates’ attacks to encourage sympathizers to support it. Over the last year, ISIS has released videos entitled “Harvests of the Soldiers,” with statistics related to its operations, detailing the casualties and equipment losses of its enemies, attempting to highlight a global reach. In October, ISIS released the eighth iteration of its English-language video series, “Inside the Caliphate.” In the video, ISIS calls on sympathizers to conduct attacks in its name and to assist in the creation and dissemination of its propaganda online. In November, Hassan Khalif Shire Ali stabbed three individuals, killing one, in Melbourne, Australia. Ali previously attempted to travel to join ISIS in Syria in 2015, but Australian authorities revoked his passport. ISIS and Its Global Affiliates 1. ISIS Core (Iraq and Syria) 2. ISIS Sinai (Sinai Peninsula of Egypt) 3. ISIS Egypt 4. ISIS Libya 5. ISIS Tunisia (also referred to as Jund al-Khilafah-Tunisia) 6. ISIS Algeria 7. ISIS West Africa (primarily in Nigeria and the Lake Chad Region) 8. ISIS Somalia 20 2019 Threat Assessment 9. ISIS Yemen 10. ISIS Saudi Arabia 11. ISIS Caucasus (Northern Caucasus region of Russia between the Black and Caspian seas) 12. ISIS Khorasan (Afghanistan and Pakistan) 13. ISIS Bangladesh 14. ISIS Philippines THREATS FACING FIRST RESPONDERS Threats Facing First Responders Individuals carrying out violent attacks often indiscriminately kill and injure as many victims as possible, including first responders, typically targeting specific locations to maximize their damage. On November 7, Ian Long attacked a bar in Thousand Oaks, California, while armed with a handgun, high-capacity magazines, and smoke grenades, resulting in 12 deaths and 10 injuries. During the shooting, Long targeted responding authorities using the laser sight and flashlight attached to his handgun in the smoke-filled room. On October 27, Robert Bowers, a white supremacist extremist, attacked the Tree of Life Congregation Synagogue in Pittsburgh while armed with a semi-automatic rifle and three handguns, killing 11 and injuring two. Upon police arrival, Bowers exited the building and shot one officer before barricading himself inside the synagogue. During the standoff, Bowers injured an additional three officers. In August, Gregory Rodvelt, a sovereign citizen extremist, booby-trapped his house with explosives, spring-loaded animal snares, and spike strips in order to target authorities. An explosive trap detonated during a search of the residence on September 7, injuring one federal agent. On June 25, Thomas Kim deliberately set off an improvised explosive device in his apartment complex in an effort to kill a neighbor he was disputing with in Long Beach, California. Following the explosion, Kim shot at responding firefighters, killing one and injuring another. These incidents serve as a small sample of the attacks first responders encounter. Individuals first on scene are typically patrol officers, emergency services personnel, or investigators rather than tactically trained units. Responses to situations of this caliber require a highly specialized skill set, as the circumstances of the situation and objectives of the attacker are largely unpredictable. The mission of the New Jersey Regional Operations Intelligence Center (ROIC) is to interface with the New Jersey law enforcement community and other law enforcement and homeland security agencies by being a primary point of contact for collection, evaluation, analysis, and dissemination of intelligence data and criminal background information in a timely and effective manner in order to detect and/or prevent criminal or terrorist activity and to solve crimes. In January, the ROIC joined NJOHSP’s podcast, Intelligence. Unclassified., to discuss the mechanisms of a fusion center, a joint interagency intelligence enterprise comprised of 175 personnel from various law enforcement and public safety agencies. The ROIC is the State’s hub for intelligence and includes input and personnel from agencies such as the FBI, US Department of Homeland Security, NJOHSP, and numerous state, county, and municipal agencies. The ROIC is also the home for the Office of Emergency Management and State Emergency Operations Center. For more information on this and other topics related to counterterrorism, cybersecurity, and preparedness, visit www.njohsp.gov/podcast or subscribe to the podcast on iTunes, Google Play, or your preferred podcast application. 2019 Threat Assessment 23 CYBERSECURITY THREATS Cybersecurity Threats Cybersecurity Threat Moderate; Convergence of Networked and Physical Systems Creates Expanding Attack Surface The New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) assesses that cyber threat actors pose a moderate threat to New Jersey. The continued growth of IP-enabled devices for both personal and business uses will result in an increased attack surface for threat actors to target, impacting attached physical systems. While the intent of IP-enabled devices is to provide convenience, add efficiencies, and deliver operational cost savings, inherent and unaddressed security deficiencies will result in cyber attacks that will more frequently impact physical controls, including public- and private-sector critical infrastructure Operational Technologies (OT), Industrial Control Systems (ICS), and Supervisory Control and Data Acquisition (SCADA) systems. The availability of hacking tools and the increasing number of unsecured internet-connected devices reduces the need for extensive technical skills to carry out successful cyber attacks that could disrupt New Jerseybased cyber networks and physical systems. The result of such attacks can span the spectrum from minor inconveniences to moderate disruptions of organizational operations to more severe threats to public health and safety. Phishing Campaigns Targeting Account Credentials Pervasive Over the past year, phishing emails—specifically those with links or attachments containing malware designed to steal the recipients’ credentials and further compromise their systems and networks—remained a prevalent cyber threat across New Jersey. The NJCCIC received numerous reports regarding credential and network-wide compromises resulting from the opening of malicious attachments and links included in unsolicited emails. Such compromises often resulted in impacts to the affected organizations’ operations for weeks or months at a time. Threat actors are constantly devising ways to defeat technical controls such as mail filters. As such, subsequent layers of defense, including user awareness and training, multi-factor authentication, and other security tools and tactics, are necessary to protect users’ credentials and the systems and information they provide access to. The NJCCIC strongly recommends never opening attachments or using links provided in unsolicited emails to visit websites requiring the input of account credentials. Users who receive unexpected or unsolicited email requests from known senders inviting them to click on a link or open an attachment should always verify the sender via another means of communication before taking any action. Interested in membership? The NJCCIC derives its strength from the diversity and breadth of its membership network. Joining is free and carries no obligations. Visit www.cyber.nj.gov to learn more. 2019 Threat Assessment 25 SEE SOMETHING, SAY SOMETHING Security Starts with you NJOHSP’s Hometown Security Initiative is designed to train and educate Main Street owners and operators of facilities like restaurants, nightclubs, cafes, theaters, stores, and entertainment venues. Using the “Connect-Prepare-Train-Report” model, this initiative is intended to inform the public on global intelligence awareness, likely threat scenarios, protective security, and suspicious activity reporting. The program is being implemented statewide to increase community resilience, readiness, and overall security. 1-866-4-SAFE-NJ 2019 Threat Assessment 27 How to Report Suspicious Activity Suspicious Activity Reporting NJOHSP encourages law enforcement, first responders, and private- and public-sector partners to report suspicious activity. The “See Something, Say Something” campaign benefits families, friends, and neighbors by bringing suspicious behavior to the attention of law enforcement. Reporting suspicious behavior could potentially stop the next terrorist incident. Even if you think your observation is not important, it may be a piece of a larger puzzle. Public Engagement Suspicious activity reports (SARs) have led to investigations that thwarted several terrorist plots in the tri-state area. Read the Suspicious Activity Reporting Success Stories to learn how these reports helped detect and deter possible attacks. Information Sharing SARs are shared with law enforcement partners throughout the State. The New Jersey Suspicious Activity Reporting System is also linked to the FBI’s national system known as eGuardian, which partners with the Nationwide SAR Initiative to form a single repository accessible to thousands of law enforcement personnel and analysts nationwide. Report Suspicious Activity 1-866-4-SAFE-NJ (866-472-3365) tips@njohsp.gov njhomelandsecurity.gov/njsars “SAFE-NJ” Mobile SAR app is available on iTunes, Google Play, and Microsoft App Stores. 28 2019 Threat Assessment Eight Signs of Terrorism Suspicious activity is any observed behavior that could indicate terrorism or terrorism-related crime. Surveillance Terrorists will likely observe a target during the planning phase of an operation. Suspicious actions during this phase may include someone photographing or videotaping the target, recording or monitoring activities, drawing diagrams or maps, using visionenhancing devices, or possessing floor plans or blueprints of critical infrastructure, such as high-tech firms, financial institutions, or government facilities— including military installations. Gathering Information Terrorists may also attempt to elicit information about critical infrastructure by making unusual inquiries about operations, staffing, and security protocols. Additionally, they may attempt to place people at key locations to monitor day-to-day activities and gather detailed knowledge in order to make their mission more effective. Dry Run / Rehearsal Before executing the final operation or plan, terrorists may engage in multiple practice sessions or rehearsals to uncover flaws or unanticipated problems. During a rehearsal, terrorists may test their weapons, monitor police radio frequencies, and record emergency response times. People Who Do Not Belong Another pre-incident indicator is observing suspicious people who seemingly “don’t belong” or demonstrate behavior that is out of place. This may include a person at an event or in a workplace, building, or neighborhood who does not fit in because of their demeanor or the unusual questions they ask. This could also include the impersonation of law enforcement, military personnel, or company employees. Remember, we do not profile individuals. We profile behaviors. Acquiring Supplies Terrorists may purchase or steal explosives, weapons, and ammunition, or attempt to store harmful chemical equipment. They might also try to acquire uniforms, equipment, or the identification of first responders and military personnel to gain entrance to secure areas. Other items of interest may be flight passes, passports, or other types of identification. If they are unable to obtain these items, they may attempt to create counterfeits. Testing Security Terrorists may also test a target’s security. They may drive by a target, leave unattended or unusual bags or packages, access sensitive areas, or observe security and law enforcement to assess response times. Terrorists may also attempt to penetrate physical security barriers to determine the strengths and weaknesses of a target. Funding Although difficult to detect, funding is one of the most important signs of terrorism. Some scenarios to look for include credit card fraud, requests for donations to misleading charities, bulk purchases of cigarettes or counterfeit goods, or very large amounts of cash used in business transactions. Deployment Be aware of what looks like people and supplies getting into position to commit an act of violence. There are still viable opportunities to stop an attack before it occurs. Do not attempt to intervene. For emergency situations, call 9-1-1 immediately. 2019 Threat Assessment 29 TERRORISM DEFINITIONS Definitions Al-Qa’ida (AQ) - Al-Qa’ida is an Islamist extremist organization founded in 1988 by Usama bin Ladin and other Arab foreign fighters who fought against the Soviet Union in Afghanistan in the 1980s. It provides religious authority and strategic guidance to its followers and affiliated groups. Al-Qa’ida in the Arabian Peninsula (AQAP) - AQAP is an Islamist extremist organization based in Yemen. It is al-Qa’ida’s most active global affiliate. Al-Qa’ida in the Indian Subcontinent (AQIS) - AQIS is an Islamist extremist group that aims to fight the governments of Pakistan, India, Burma, and Bangladesh to establish an Islamic state. Al-Qa’ida in the Islamic Maghreb (AQIM) – AQIM was formed in 2007 and is al-Qa’ida’s North African affiliate that aims to overthrow regional governments to institute an Islamic state. In March 2017, AQIM merged with several other regional groups to form Jama’at Nasr al-Islam Wal Muslim. Al-Qa’ida Network - The al-Qa’ida Network is a decentralized organization that relies on social ties and local relationships to share resources among the affiliates. Al-Shabaab - Al-Shabaab is an Islamist extremist organization founded in 2006 that seeks to establish an austere version of Islam in Somalia and also operates in Kenya, Ethiopia, Tanzania, and Uganda. Anarchist Extremists - Anarchist extremists advocate violence in furtherance of movements such as antiracism, anti-capitalism, anti-globalism, anti-fascism, and environmental extremism. Animal Rights Extremists - Animal rights extremists believe all animals—human and non-human—have equal rights of life and liberty and are willing to inflict economic damage on individuals or groups to advance this ideology. Anti-Abortion Extremists - Anti-abortion extremists are individuals or groups who believe abortion is unethical and that violence is justified against people and establishments providing abortion services. Anti-Government Extremists - Anti-government extremists believe the US political system is illegitimate and force is justified to bring about change. This includes militia extremists and sovereign citizen extremists. Black Separatist Extremists - Black separatist extremists are individuals or groups that seek to establish an independent nation for people of African descent through violence and other criminal activity. Boko Haram - Boko Haram is an Islamist extremist organization based in northeastern Nigeria, which also conducts operations in Chad, Cameroon, and Niger. Domestic Terrorism - Domestic terrorism is violence committed by individuals or groups—including antigovernment, race-based, religious, and single-issue extremist ideologies—associated primarily with US-based movements. Environmental Extremists - Environmental extremists view manmade threats to the environment as so severe that violence and property damage are justified to prevent further destruction. 2019 Threat Assessment 31 Definitions HAMAS - HAMAS, an acronym for Harakat al-Muqawama al-Islamiyya, or the “Islamic Resistance Movement,” founded in 1987, is an offshoot of the Palestinian Muslim Brotherhood that aims to end the Israeli occupation of Palestinian territory and establish a Palestinian state. Hizballah - Hizballah is an Islamist militant group based in Lebanon and allied with Iran. Homegrown Violent Extremists (HVEs) - HVEs are individuals inspired—as opposed to directed—by foreign terrorist organizations and radicalized in the countries in which they are born, raised, or reside. ISIS - ISIS, also referred to as the Islamic State of Iraq and Syria, the Islamic State of Iraq and the Levant, the Islamic State, or Daesh, is a Salafi-jihadist militant group that split from al-Qa’ida in 2014 and established its self-proclaimed “caliphate,” claiming authority over all Muslims. Lashkar-e-Tayyiba (LeT) - LeT is an Islamist extremist organization focused on attacking and expelling Indians from Kashmir, a northern state in India that borders Pakistan and is home to a Muslim-majority population. Militia Extremists - Militia extremists view the federal government as a threat to the rights and freedoms of Americans. They judge armed resistance to be necessary to preserve these rights. Nusrah Front - Nusrah Front is a member of Hayat Tahrir al-Sham, a Salafi-jihadist militant group in Syria, and is focused on overthrowing Syrian President Bashar al-Assad. In January 2017, the group broke official ties from al-Qa’ida. Race-Based Extremists - Race-based extremists seek to establish the superiority of one racial or ethnic group over others through violence or other criminal activity. This includes white supremacist and black separatist extremists. Salafi-jihadism - Salafi-jihadism is an extreme interpretation of Islam in which individuals draw inspiration from multiple foreign terrorist organizations. Single-Issue Extremists - Single-issue extremists participate in violence stemming from domestic, political, or economic issues. This includes animal rights, environmental, and anti-abortion extremists. Sovereign Citizen Extremists - Sovereign citizen extremists throughout the United States view federal, state, and local governments as illegitimate, justifying their violence and other criminal activity. Tehrik-e-Taliban Pakistan (TTP) - TTP is an Islamist extremist organization seeking to overthrow Pakistan’s government and expel US forces from Afghanistan. Terrorism - Terrorism is the unlawful use of force and violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives. White Supremacist Extremists - White supremacist extremists believe in the inherent superiority of the white race. They seek to establish dominance over non-whites through violence and other criminal activity. 32 2019 Threat Assessment TERRORISM-RELATED PRODUCTS Terrorism-Related Products Domestic Terrorism Anti-Government Extremists Threaten US Officials Online - https://bit.ly/2SUle2P Domestic Terrorism in the US, 2017 - https://bit.ly/2qy1q8B Extremists Exploit Security Positions - https://bit.ly/2Qs3D0I Extremists’ Steadfast Intent to Target US Aviation - https://bit.ly/2JJpr5k Female HVEs Likely to Play Supportive Role for ISIS - https://bit.ly/2DscLje Homegrown Violent Extremists (HVEs) in the US, 2017 - https://bit.ly/2JNForh Online Platforms Provide Refuge for White Supremacist Extremists - https://bit.ly/2PNwxeK Recent White Supremacist Activity in New Jersey - https://bit.ly/2QxNRRO Teen Accused of Plotting School Violence at a Graduation in Ocean County - https://bit.ly/2qAc0w2 White Supremacist Extremists Continue to Leverage Social Media - https://bit.ly/2z05kvw White Supremacists Leveraging Military Expertise - https://bit.ly/2SOQm3Q International Terrorism Al-Qa’ida and ISIS Reference Guide - https://bit.ly/2qzOW04 Al-Qa’ida Leader Calls for Jihad Against America - https://bit.ly/2RIpUb0 Al-Qa’ida Supporters Target Women With Female-Focused Propaganda - https://bit.ly/2ATB86V ISIS: Establishing a Foothold in Southeast Asia – https://bit.ly/2AS5eHK ISIS Modifies Propaganda Strategy to Remain Relevant - https://bit.ly/2AQe8pg ISIS Releases First Statement from Leader in Almost a Year - https://bit.ly/2JLIFr7 ISIS: Shifting Toward Regional Conflict - https://bit.ly/2DpeuWg Nusrah Front Update – https://bit.ly/2ASK1NV Toronto Vehicle-Ramming Attack - https://bit.ly/2JNDsiv US Decision on Jerusalem Fuels Terrorist Groups - https://bit.ly/2DqkSg5 For more information on NJOHSP’s intelligence products, contact the Analysis Bureau at analysis@njohsp.gov. 2019 Threat Assessment 35 Terrorism-Related Products Select Podcasts Overview of the 2019 NJOHSP Terrorism Threat Assessment – https://bit.ly/2PQD0S2 Active Shooter Threats - Response, Resources, and Resiliency – https://bit.ly/2PSj15C Extremists Exploiting Security Positions - https://bit.ly/2EF1zjw #HateHasNoPlaceInNJ - The NJOHSP Interfaith Advisory Council - https://bit.ly/2PLly17 Secure the Shore: Keeping New Jersey’s Beaches and Boardwalks Safe - https://bit.ly/2LpBYMg The Shore Secured: A Discussion with Cape May County CTC Aaron Sykes - https://bit.ly/2LqR6J7 Women and Terrorism: A Review of the Roles of Females in Homegrown Violent Extremism https://bit.ly/2rN7ACx 36 2019 Threat Assessment 0hsp@nj0hsp.g0v