UNCLASSIFIED//FOR OFFICIAL USE ONLY 29 June 2018 (U) Counterterrorism (U//FOUO) Incidents of Doxing of DHS Officials May Lead to Extremist Violence (U//FOUO) Scope. This Intelligence Note highlights the recent surge in social media activity advocating for violence against DHS personnel and facilities. It is provided by DHS to assist Department personnel and law enforcement and private sector partners with identifying, preventing, or disrupting potential threats from domestic terrorists.a (U//FOUO) Prepared by the Office of Intelligence and Analysis (I&A), Counterterrorism Mission Center. Coordinated with CBP and ICE. (U//FOUO) Threat Overview (U//FOUO) Over the past week, DHS has observed an increase in doxing incidents involving the release of DHS officials’ personally identifiable information (PII) and the locations of DHS facilities.b Multiple incidents of doxing of DHS personnel and facilities could result in actualized violence against DHS employees by violent extremist actors. DHS reports on doxing incidents where there is a reasonable belief doxed information could lead to violent extremist activity. (U//FOUO) Individuals Most Likely to Engage in Violent Extremism against DHS Personnel and Infrastructure (U//FOUO) Based on a body of open source reporting, I&A assesses that incidents of doxing of DHS officials may lead to extremist violence by individuals vehemently opposed to purported or perceived DHS actions regarding immigration policy. (U//FOUO) I&A assesses with medium confidence that domestic terrorists pose a low-level threat of lethal and physical violence during otherwise lawful protests based on available open source and related law enforcement reporting. We judge that the current publicity surrounding federal immigration policy most likely will resonate with anarchist extremists or individuals who self-identify or subscribe to anti-fascist (ANTIFA) anarchist extremist ideology. c Based on limited open source reporting and historical trends of criminal activity and violence by anarchist extremists, I&A further judges with medium confidence that if any criminal acts were to be conducted by these domestic terrorists, these acts would most likely be limited to destruction of critical infrastructure. (U//FOUO) DHS defines domestic terrorism as any act of unlawful violence that is dangerous to human life or potentially destructive to critical infrastructure or key resources committed by a group or individual based and operating entirely within the United States or its territories without direction or inspiration from a foreign terrorist group. This act is a violation of the criminal laws of the United States or of any state or other subdivision of the United States and appears to be intended to intimidate or coerce a civilian population, to influence the policy of a government by intimidation or coercion, or to affect the conduct of a government by mass destruction, assassination, or kidnapping. A domestic terrorist differs from a homegrown violent extremist in that the former is not inspired by and does not take direction from a foreign terrorist group or other foreign power. b (U) Doxing, which by itself may be constitutionally protected, is considered an activity by which cyber actors gain access to and make public an individual’s PII or other sensitive information. Cyber actors obtain such information through a variety of means, including compromises of personal and professional accounts, inquiries of public databases, and surveying social media sites. c (U//FOUO) ANTIFA ideology can be part of anarchist ideology, with some anarchists identifying as ANTIFA and some ANTIFA identifying as anarchists. a IA-28956-18 (U) Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO). It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know without prior approval of an authorized DHS official. State and local homeland security officials may share this document with authorized critical infrastructure and key resource personnel and private sector security officials without further approval from DHS. UNCLASSIFIED//FOR OFFICIAL USE ONLY UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO) Threats to Federal Government Officials (U//FOUO) Typical domestic terrorism threats against government officials have historically been non-specific and aspirational in nature, and thus do not necessarily result in actualized physical violence. Various individuals and groups associated with various domestic terrorism movements have periodically threatened violence against federal law enforcement officials, including DHS specifically over the last decade. (U//FOUO) Due to the volume of threat reporting and highly publicized media reporting on current DHS immigration policy, I&A assesses an increased likelihood of public demonstrations against DHS personnel and facilities. Based on available open source reporting and historical trends of criminal activity and violence at public events, I&A further assesses that some domestic terrorists may likely attempt to use constitutionally protected protests or unplanned demonstrations at government facilities associated with DHS as an opportunity to engage in violent activity. (U//FOUO) If domestic terrorists were to exploit lawful public demonstrations for the purpose of criminal activity, I&A assesses it would likely be conducted by individuals who self-describe as anarchist extremists or by individuals who self-identify or subscribe to ANTIFA anarchist extremist ideology using similar tactics used by “black bloc” anarchist extremists—dressing in black and wearing masks to avoid law enforcement detection—in the past. Common tactics observed in these incidents include assault, arson, the use of improvised incendiary devices, such as Molotov cocktails, and the use of bricks, rocks, and other common items to assault law enforcement officers and damage both private property and law enforcement vehicles and property.1–6 (U//FOUO) Historically, one of the most common cyber tactics used by anarchist extremists has involved doxing to post PII online about individuals or entities perceived to be racist or fascist. Although the postings generally do not promote criminal activity, the information could provide the means for—and implicitly encourage—domestic terrorists to target these individuals or entities for criminal activity or violence. (U) Outlook (U//FOUO) I&A assesses that a heightened potential for violence against DHS personnel from nonideological actors will remain, absent any changes or alterations in current immigration policy, or until some new social or political issue supplants immigration policy in publicity and resonance. I&A further assesses that most controversial social or political issues that animate domestic terrorists have a relatively short shelf life, and, eventually, threats of criminality and violence will be directed elsewhere. (U) Report Suspicious Activity (U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency managers should follow established protocols; all other personnel should call 911 or contact local law enforcement. Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism Task Force for further action. For more information on the Nationwide SAR Initiative, visit http://nsi.ncirc.gov/resources.aspx. (U) Tracked by: HSEC-8.2, HSEC-8.3, HSEC-8.5, HSEC-8.8 UNCLASSIFIED//FOR OFFICIAL USE ONLY Page 2 of 3 UNCLASSIFIED//FOR OFFICIAL USE ONLY (U); Jim Ryan; The Oregonian; “Portland May Day march erupts into fiery riot; 25 arrested”; 02 MAY 2017; https://www.oregonlive.com/portland/index.ssf/2017/05/portland_may_day_demonstration.html; accessed on 21 JUN 2018. 2 (U); Keith L Alexander; The Washington Post; “Black Bloc’ style tactics seen as chaos erupts in downtown D.C.”; 20 JAN 2017; https://www.washingtonpost.com/local/2017/live-updates/politics/live-coverage-of-trumps-inauguration/black-bloc-style-tacticsseen-as-chaos-erupts-in-downtown-d-c/?utm_term=.aa322fc60857; accessed on 18 MAY 2017. 3 (U); Dori Olmos and Arielle Buchmann; WUSA-TV; “Vandalism, fires, & dozens of arrests in DC inauguration protests”; 20 JAN 2017; http://www.wusa9.com/news/local/protesters-rolling-into-dc-inauguration-day/388634528; accessed 28 JUN 2018. 4 (U); Keith Alexander; The Washington Post; “Prosecutors file additional charges against inauguration protestors”; 28 APR 2017; https://www.washingtonpost.com/local/public-safety/prosecutors-file-additional-charges-against-inaugurationprotesters/2017/04/27/2c7eca62-2b96-11e7-a616-d7c8a68c1a66_story.html?utm_term=.745a9ef5c506; accessed on 18 MAY 2017. 5 (U); KPTV; “Portland Police Arrest 25 People After Post-election Protest Turns into Riot”; 11 NOV 2016; http://www.kptv.com/story/33689103/portland-police-arrest-25-people-after-post-election-protest-turns-into-riot; accessed on 28 JUN 2018. 6 (U); Brent Weisberg; KOIN-TV; “Charges Dismissed against Portland Protesters”; 14 NOV 2016; http://koin.com/2016/11/14/charges-dismissed-against-portland-protesters/t; accessed on 09 FEB 2017. 1 UNCLASSIFIED//FOR OFFICIAL USE ONLY Page 3 of 3 CLASSIFICATION: UNCLASSIFIED//FOR OFFICIAL USE ONLY Office of Intelligence and Analysis Customer Feedback Form Product Title: (U//FOUO) Incidents of Doxing of DHS Officials May Lead to Extremist Violence All survey responses are completely anonymous. No personally identifiable information is captured unless you voluntarily offer personal or contact information in any of the comment fields. Additionally, your responses are combined with those of many others and summarized in a report to further protect your anonymity. 1. Please select partner type: Select One and function: Select One Select One 2. What is the highest level of intelligence information that you receive? 3. Please complete the following sentence: “I focus most of my time on:” Select One 4. Please rate your satisfaction with each of the following: Very Satisfied Somewhat Satisfied Neither Satisfied nor Dissatisfied Somewhat Dissatisfied Very Dissatisfied N/A Product’s overall usefulness Product’s relevance to your mission Product’s timeliness Product’s responsiveness to your intelligence needs 5. How do you plan to use this product in support of your mission? Drive planning and preparedness efforts, training, and/or emergency response operations (Check all that apply.) Initiate a law enforcement investigation Intiate your own regional-specific analysis Intiate your own topic-specific analysis Develop long-term homeland security strategies Do not plan to use Other: Observe, identify, and/or disrupt threats Share with partners Allocate resources (e.g. equipment and personnel) Reprioritize organizational focus Author or adjust policies and guidelines 6. To further understand your response to question #5, please provide specific details about situations in which you might use this product. (Please Use Manuscript in the space provided.) 7. What did this product not address that you anticipated it would? (Please Use Manuscript in the space provided.) 8. To what extent do you agree with the following two statements? Strongly Agree Agree Neither Agree nor Disagree Disagree Strongly Disgree N/A This product will enable me to make better decisions regarding this topic. This product provided me with intelligence information I did not find elsewhere. 9. How did you obtain this product? Select One 10. Would you be willing to participate in a follow-up conversation about your feedback? To help us understand more about your organization so we can better tailor future products, please provide: Name: Position: Organization: State: Contact Number: Email: Yes Submit Feedback Privacy Act Statement CLASSIFICATION: Product Serial Number: UNCLASSIFIED//FOR OFFICIAL USE ONLY IA-28956-18 REV: 01 August 2017