UNCLASSIFIED//FOR OFFICIAL USE ONLY 30 May 2020 (U//FOUO) Ongoing Violence, Information Narratives Nationwide Poses Continued Threat to Law Enforcement (U//FOUO) Scope. This Intelligence Note (IN) provides information regarding violence threatening homeland security at protests related to recent officer-involved deaths and highlights the concern for potential additional violence from domestic terrorist actors and other ideologically motivated individuals who seek to violently respond. The information in this IN is current as of 30 May 2020. (U//FOUO) In the last 24 hours the types of people or groups seeking to carry out violence in response to the death of George Floyd in Minneapolis has shifted in many cities. The initial violent looters and protestors were believed to be organic members of the local communities. However, domestic violent extremists are attempting to structure the protests to target specific symbols of state, local, and federal authority. We anticipate armed individuals will continue to infiltrate the protest movement. We assess with high confidence during the period of darkness from 30 to 31 May the violent protest movements will grow and DVEs and others will seek to take over government facilities and attack law enforcement. We further assess protest activities following incidents involving law enforcement’s use of lethal force pose a high risk of escalating to both premeditated and random attacks targeting law enforcement officers nationwide. Since 2017, domestic violent extremists (DVEs) have conducted reprisal attacks against law enforcement officers following incidents of officer-involved shootings, which could inspire others to attempt similar acts. DVEs who subscribe to opposing ideologies have also conducted lethal attacks against one another at public protests, suggesting that DVEs could seek to exploit otherwise lawful protesting of law enforcement’s use of lethal force to advance their movement’s goals. » (U//FOUO) As of 30 May, reporting has indicated several incidents of violence at otherwise lawful protests that have targeted law enforcement and critical infrastructure. A Federal Protective Service contract officer in Oakland, California has been killed as a result of this violence, according to official reporting. 1 » (U) On 7 July 2016, a black supremacist extremist acting in response to officer-involved shootings ambushed law enforcement officers, killing five, during a planned non-violent First Amendment-protected rally in Dallas, Texas. Police engaged and killed the attacker during a stand-off following the ambush. 2 » (U//FOUO) On 12 August 2017, a white supremacist extremist drove a vehicle into a crowd of counterprotestors at Charlottesville, Virginia rally, killing one, according to a Department of Justice press release. 3 Other white supremacist extremists allegedly engaged in less than lethal violence against counter protestors at this and other rallies in 2017, according to the criminal complaint. 4 » (U//FOUO) Separately, on 27 May, users of a white supremacist extremist Telegram channel attempted to incite followers to engage in violence and start the “boogaloo”—a term used by some violent extremists to refer to the start of a second Civil War—by shooting in a crowd, according to DHS reporting. 5 (U//FOUO) As of publication of this IN, DHS is also aware of cyber actors’ use of disruptive tactics against at least one public-facing government website, which we assess, is tied to recent events in Minnesota. It is common for politically or ideologically-motivated criminal hackers—as well as other opportunistic cyber actors—to engage in short-term disruptions against government and symbolic targets in the midst or aftermath of a major event. We IA-05302020-T (U) Warning: This document contains UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO) information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know without prior approval of an authorized DHS official. State and local homeland security officials may share this document with critical infrastructure and key resource personnel or private sector security officials without further approval from DHS. (U) All US person information has been minimized. Should you require US person information on weekends or after normal weekday hours during exigent and time sensitive circumstances, contact the Current and Emerging Threat Watch Office at 202-447-3688, CETC.OSCO@HQ.DHS.GOV. For all other inquiries, please contact the Homeland Security Single Point of Service, Request for Information Office at DHS-SPS-RFI@hq.dhs.gov, DHS-SPS-RFI@dhs.sgov.gov, DHS-SPS-RFI@dhs.ic.gov UNCLASSIFIED//FOR OFFICIAL USE ONLY UNCLASSIFIED//FOR OFFICIAL USE ONLY expect to see more of these types of cyber operations against federal, state, and local government networks, which frequently use common tactics and known vulnerabilities to target these networks. » (U) Unidentified cyber actors on 29 May 2020 conducted a distributed denial of service (DDoS) attack against the governmental network of Minnesota state. The attack caused a temporary disruption in services on its public-facing website for just over an hour and is currently under active investigation to determine its attribution. It was confirmed that during this attack, no data was compromised and there was minimal impact to operations, according to CISA and DHS reporting. 6 (U//FOUO) Foreign adversaries, such as Russia and China, have used state-controlled media to discuss recent events in Minnesota and the subsequent response, including First Amendment protected protest activity. Beyond overt efforts to depict these events—depictions that paint the US government or the socio-political cohesion of the Unites States in a negative light— we assess covert proxies and social media accounts are doing the same. Russian influence actors, in particular, have a history of using online tools to covertly amplify content concerning protest activity in the United States, including rhetoric that may seek to incite violence at such events. a » (U//FOUO) As of 2018, Russian influence actors allegedly planned to attempt to incite unrest and violence in the United States by targeting the African American community using its social media trolls to spread false and incendiary stories. Russian influence actors also planned to recruit radical movement members to participate in civil disobedience actions, according to 2019 press reporting. 7 (U//FOUO) Domestic Terrorism Definitions (U//FOUO) DHS defines domestic terrorism as any act of unlawful violence that is dangerous to human life or potentially destructive of critical infrastructure or key resources committed by a group or individual based and operating entirely within the United States or its territories without direction or inspiration from a foreign terrorist group. This act is a violation of the criminal laws of the United States or of any state or other subdivision of the United States and appears to be intended to intimidate or coerce a civilian population, to influence the policy of a government by intimidation or coercion, or to affect the conduct of a government by mass destruction, assassination, or kidnapping. A domestic terrorist differs from a homegrown violent extremist in that the former is not inspired by and does not take direction from a foreign terrorist group or other foreign power. (U//FOUO) DHS defines white supremacist extremists as groups or individuals who facilitate or engage in acts of unlawful violence directed at the federal government, ethnic minorities, or Jewish persons in support of their belief that Caucasians are intellectually and morally superior to other races and their perception that the government is controlled by Jewish persons. (U//FOUO) DHS defines black supremacist extremists as groups or individuals who facilitate or engage in acts of unlawful violence as a means to oppose racial integration and/or to eliminate non-black people and Jewish people. (U) Report Suspicious Activity (U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency managers should follow established protocols; all other personnel should call 911 or contact local law enforcement. Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism Task Force for further action. For more information on the Nationwide SAR Initiative, visit http://nsi.ncirc.gov/resources.aspx. (U) Tracked by: HSEC-8.1, HSEC-8.5, HSEC-8.6, HSEC-8.8, HSEC-8.10 a (U//FOUO) US persons linking, citing, quoting, or voicing the same arguments raised by these influence activities likely are engaging in First Amendmentprotected activity, unless they are acting in concert with a threat actor. Furthermore, variants of the topics covered in this product, even those that include divisive terms, should not be assumed to reflect foreign influence or malign activity absent information specifically attributing the content to malign foreign actors. This information should be considered in the context of all applicable legal and policy authorities to use open source information while protecting privacy, civil rights, and civil liberties. UNCLASSIFIED//FOR OFFICIAL USE ONLY Page 2 of 3 UNCLASSIFIED//FOR OFFICIAL USE ONLY (U) Source Summary Statement (U//FOUO) This IN is based on DHS open source reporting, court documents, government press releases and press reporting. We have medium confidence in the information obtained from DHS, and press reporting given the evolving nature of these events. We have high confidence in the information obtained from court documents and government press releases as this information results from law enforcement investigations. (U); Josh Edelson; NBC News; “Federal Protective Service officer killed, another injured in Oakland shooting amid George Floyd protests”; 30 MAY 2020; https://www.nbcnews.com/news/us-news/federal-protective-service-officerkilled-another-injured-oakland-shooting-amid-n1219561; accessed on 30 MAY 2020; (U); Online News Source. 2 U); NBC 5 DFW; “Sniper Ambush Kills 5 Officers, Injures 7 in Dallas Following Peaceful Protest”; 15 AUG 2017; https://www.nbcdfw.com/news/local/protests-in-dallas-over-alton-sterling-death/88950/; accessed on 28 FEB 2020; (U); Online News Source. 3 (U); DOJ; “Ohio Man Pleads Guilty To 29 Federal Hate Crimes For August 2017 Car Attack at Rally In Charlottesville”; 27 MAR 2019; https://www.justice.gov/usao-wdva/pr/ohio-man-pleads-guilty-29-federal-hate-crimes-august-2017car-attack-rally; accessed on 29 MAY 2020; (U); Government Press Release. 4 (U); Criminal Complaint, United States District Court for the Central District of California, United States of America v Robert Rundo, Robert Boman, Tyler Laube, and Aaron Eason, Case No. 18MJ02791, 20 October 2018 5 (U//FOUO); DHS, OSIR-04001-0654-20; 27 MAY 2020; (U//FOUO); Extremist encrypted instant messaging channel incites violence in Minneapolis and encourages others to 'frame the crowd around you'; Extracted information is U//FOUO; Overall document classification is U//FOUO. 6 (U//FOUO); CETC; DOP 30 MAY 2020; (U//FOUO)/ CETC SITREP: Violence Overnight Across Multiple U.S. Cities, 29-30 May 2020; Extracted information and overall classification of this source is U//FOUO. 7 (U); Richard Engel, Kate Benyon-Tinker, Kennett Werner; NBC News; 20 MAY 2019; “Russian documents reveal desire to sow racial discord-and violence-in the U.S.; https://www.nbcnews.com/news/world/russian-documents-revealdesire-sow-racial-discord-violence-u-s-n1008051; accessed on 30 MAY 2020; Online News Source. 1 UNCLASSIFIED//FOR OFFICIAL USE ONLY Page 3 of 3 CLASSIFICATION: UNCLASSIFIED//FOR OFFICIAL USE ONLY Office of Intelligence and Analysis Customer Feedback Form Product Title: (U//FOUO) Ongoing Violence, Information Narratives Nationwide Poses Continued Threat to Law Enforcement All survey responses are completely anonymous. No personally identifiable information is captured unless you voluntarily offer personal or contact information in any of the comment fields. Additionally, your responses are combined with those of many others and summarized in a report to further protect your anonymity. 1. Please select partner type: Select One and function: Select One Select One 2. What is the highest level of intelligence information that you receive? 3. Please complete the following sentence: “I focus most of my time on:” Select One 4. Please rate your satisfaction with each of the following: Very Satisfied Somewhat Satisfied Neither Satisfied nor Dissatisfied Somewhat Dissatisfied Very Dissatisfied N/A Product’s overall usefulness Product’s relevance to your mission Product’s timeliness Product’s responsiveness to your intelligence needs 5. How do you plan to use this product in support of your mission? Drive planning and preparedness efforts, training, and/or emergency response operations (Check all that apply.) Initiate a law enforcement investigation Intiate your own regional-specific analysis Intiate your own topic-specific analysis Develop long-term homeland security strategies Do not plan to use Other: Observe, identify, and/or disrupt threats Share with partners Allocate resources (e.g. equipment and personnel) Reprioritize organizational focus Author or adjust policies and guidelines 6. To further understand your response to question #5, please provide specific details about situations in which you might use this product. (Please Use Manuscript in the space provided.) 7. What did this product not address that you anticipated it would? (Please Use Manuscript in the space provided.) 8. To what extent do you agree with the following two statements? Strongly Agree Agree Neither Agree nor Disagree Disagree Strongly Disgree N/A This product will enable me to make better decisions regarding this topic. This product provided me with intelligence information I did not find elsewhere. 9. How did you obtain this product? Select One 10. Would you be willing to participate in a follow-up conversation about your feedback? To help us understand more about your organization so we can better tailor future products, please provide: Name: Position: Organization: State: Contact Number: Email: Yes Submit Feedback Privacy Act Statement CLASSIFICATION: Product Serial Number: UNCLASSIFIED//FOR OFFICIAL USE ONLY IA-05302020-T REV: 01 August 2017