UNCLASSIFIED//FOR OFFICIAL USE ONLY 30 May 2020 (U//FOUO) Ongoing Violence, Information Narratives Nationwide Poses Continued Threat to Law Enforcement (U//FOUO) Scope. This Intelligence Note (IN) provides information regarding violence at protests related to recent officer-involved deaths and highlights the concern for additional violence from domestic terrorist actors and other ideologically motivated individuals who seek to violently respond. The information in this IN is current as of 30 May 2020. (U//FOUO) In the last 24 hours the types of people or groups seeking to carry out violence in response to the death of George Floyd in Minneapolis has shifted in many cities. The initial violent looters and protestors were believed to be organic members of the local communities. However, domestic violent extremists are attempting to structure the protests to target specific symbols of state, local, and federal authority. We anticipate armed individuals will continue to infiltrate the protest movement. We assess with high confidence during the period of darkness from 30 to 31 May the violent protest movements will grow and DVEs and others will seek to take over government facilities and attack law enforcement. We further assess civil unrest following incidents involving law enforcement’s use of lethal force pose a high risk of escalating to both premeditated and random attacks targeting law enforcement officers nationwide. Since 2017, domestic violent extremists (DVEs) have conducted reprisal attacks against law enforcement officers following incidents of officer-involved shootings, which could inspire others to attempt similar acts. DVEs who subscribe to opposing ideologies have also conducted lethal attacks against one another at public protests, suggesting that DVEs could seek to exploit events protesting law enforcement’s use of lethal force to advance their movement’s goals. » » » (U//FOUO) As of 30 May, reporting has indicated several incidents of violence at otherwise lawful protests that have targeted law enforcement and critical infrastructure. A Federal Protective Service contract officer in Oakland, California has been killed as a result of this violence, according to official reporting. (U) On 7 July 2016, a black supremacist extremist acting in response to officer-involved shootings ambushed law enforcement officers, killing five, during a planned non-violent First Amendment-protected rally in Dallas, Texas. Police engaged and killed the attacker during a stand-off following the ambush.1 » (U//FOUO) On 12 August 2017, a white supremacist extremist drove a vehicle into a crowd of counterprotestors at Charlottesville, Virginia rally, killing one, according to a Department of Justice press release.2 Other white supremacist extremists allegedly engaged in less than lethal violence against counter protestors at this and other rallies in 2017, according to the criminal complaint.3 » (U//FOUO) Separately, on 27 May, a white supremacist extremist Telegram channel incited followers to engage in violence and start the “boogaloo”—a term used by some violent extremists to refer to the start of a second Civil War—by shooting in a crowd, according to DHS reporting.4 (U//FOUO) As of publication of this IN, DHS is also aware of cyber actors’ use of disruptive tactics against at least one public-facing government website, which we assess, is tied to recent events in Minnesota. It is common for politically or ideologically-motivated criminal hackers—as well as other opportunistic cyber actors—to engage in short-term disruptions against government and symbolic targets in the midst or aftermath of a major event. We IA-05302020-T (U) Warning: This document contains UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO) information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know without prior approval of an authorized DHS official. State and local homeland security officials may not share this document with critical infrastructure and key resource personnel or private sector security officials without further approval from DHS. (U) All US person information has been minimized. Should you require US person information on weekends or after normal weekday hours during exigent and time sensitive circumstances, contact the Current and Emerging Threat Watch Office at 202-447-3688, CETC.OSCO@HQ.DHS.GOV. For all other inquiries, please contact the Homeland Security Single Point of Service, Request for Information Office at DHS-SPS-RFI@hq.dhs.gov, DHS-SPS-RFI@dhs.sgov.gov, DHS-SPS-RFI@dhs.ic.gov UNCLASSIFIED//FOR OFFICIAL USE ONLY UNCLASSIFIED// FOR OFFICIAL USE ONLY expect to see more of these types of cyber operations against federal, state, and local government networks, which frequently use common tactics and known vulnerabilities to target these networks. » (U) Unidentified cyber actors on 29 May 2020 conducted a distributed denial of service (DDoS) attack against the governmental network of Minnesota state. The attack caused a temporary disruption in services on its public-facing website for just over an hour and is currently under active investigation to determine its attribution. It was confirmed that during this attack, no data was compromised and there was minimal impact to operations, according to CISA and DHS reporting.5 (U//FOUO) Foreign adversaries, such as Russia and China, have used state-controlled media to discuss recent events in Minnesota and the subsequent response, including first-amendment protest activity. Beyond overt efforts to depict these events—depictions that paint the US government or the socio-political cohesion of the Unites States in a negative light— we assess covert proxies and social media accounts are doing the same. Russian influence actors, in particular, have a history of using online tools to covertly amplify content concerning protest activity in the United States, including rhetoric that may seek to incite violence at such events. » (U//FOUO) As of 2018, Russian influence actors allegedly planned to incite unrest and violence in the United States by targeting the African American community using its social media trolls to spread false and incendiary stories. Russian influence actors also planned to recruit radical movement members to participate in civil disobedience actions, according to 2019 press reporting.6 (U//FOUO) Domestic Terrorism Definitions (U//FOUO) DHS defines domestic terrorism as any act of unlawful violence that is dangerous to human life or potentially destructive of critical infrastructure or key resources committed by a group or individual based and operating entirely within the United States or its territories without direction or inspiration from a foreign terrorist group. This act is a violation of the criminal laws of the United States or of any state or other subdivision of the United States and appears to be intended to intimidate or coerce a civilian population, to influence the policy of a government by intimidation or coercion, or to affect the conduct of a government by mass destruction, assassination, or kidnapping. A domestic terrorist differs from a homegrown violent extremist in that the former is not inspired by and does not take direction from a foreign terrorist group or other foreign power. (U//FOUO) DHS defines white supremacist extremists as groups or individuals who facilitate or engage in acts of unlawful violence directed at the federal government, ethnic minorities, or Jewish persons in support of their belief that Caucasians are intellectually and morally superior to other races and their perception that the government is controlled by Jewish persons. (U//FOUO) DHS defines militia extremists as groups or individuals who facilitate or engage in acts of unlawful violence directed at federal, state, or local government officials or infrastructure in response to their belief that the government deliberately is stripping Americans of their freedoms and is attempting to establish a totalitarian regime. These individuals consequently oppose many federal and state authorities’ laws and regulations, (particularly those related to firearms ownership), and often belong to armed paramilitary groups. They often conduct paramilitary training designed to violently resist perceived government oppression or to violently overthrow the US Government. (U//FOUO) DHS defines black supremacist extremists as groups or individuals who facilitate or engage in acts of unlawful violence as a means to oppose racial integration and/or to eliminate non-black people and Jewish people. (U//FOUO) DHS defines anarchist extremists as groups or individuals who facilitate or engage in acts of unlawful violence as a means of changing the government and society in support of the belief that all forms of capitalism and corporate globalization should be opposed and that governing institutions are unnecessary and harmful to society. (U) Report Suspicious Activity UNCLASSIFIED// FOR OFFICIAL USE ONLY Page 2 of 4 UNCLASSIFIED// FOR OFFICIAL USE ONLY (U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency managers should follow established protocols; all other personnel should call 911 or contact local law enforcement. Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism Task Force for further action. For more information on the Nationwide SAR Initiative, visit http://nsi.ncirc.gov/resources.aspx. (U) Tracked by: HSEC-8.1, HSEC-8.5, HSEC-8.6, HSEC-8.8, HSEC-8.10 UNCLASSIFIED// FOR OFFICIAL USE ONLY Page 3 of 4 UNCLASSIFIED// FOR OFFICIAL USE ONLY (U) Source Summary Statement (U//FOUO) This IN is based on DHS open source reporting and press reporting. We have medium confidence in the information obtained from FBI, DHS, and press reporting given the evolving nature of these events. We have high confidence in the information obtained from court documents and government press releases as this information results from law enforcement investigations. U); NBC 5 DFW; “Sniper Ambush Kills 5 Officers, Injures 7 in Dallas Following Peaceful Protest”; 15 AUG 2017; https://www.nbcdfw.com/news/local/protests-in-dallas-over-alton-sterling-death/88950/; accessed on 28 FEB 2020; (U); Online News Source. 2 (U); DOJ; “Ohio Man Pleads Guilty To 29 Federal Hate Crimes For August 2017 Car Attack at Rally In Charlottesville”; 27 MAR 2019; https://www.justice.gov/usao-wdva/pr/ohio-man-pleads-guilty-29-federal-hate-crimes-august-2017car-attack-rally; accessed on 29 MAY 2020; (U); Government Press Release. 3 (U); Criminal Complaint, United States District Court for the Central District of California, United States of America v Robert Rundo, Robert Boman, Tyler Laube, and Aaron Eason, Case No. 18MJ02791, 20 October 2018 4 (U//FOUO); DHS, OSIR-04001-0654-20; 27 MAY 2020; (U//FOUO); Extremist encrypted instant messaging channel incites violence in Minneapolis and encourages others to 'frame the crowd around you'; Extracted information is U//FOUO; Overall document classification is U//FOUO. 5 (U//FOUO); CETC; DOP 30 MAY 2020; (U//FOUO)/ CETC SITREP: Violence Overnight Across Multiple U.S. Cities, 29-30 May 2020; Extracted information and overall classification of this source is U//FOUO. 6 (U); Richard Engel, Kate Benyon-Tinker, Kennett Werner; NBC News; 20 MAY 2019; “Russian documents reveal desire to sow racial discord-and violence-in the U.S.; https://www.nbcnews.com/news/world/russian-documents-revealdesire-sow-racial-discord-violence-u-s-n1008051; accessed on 30 MAY 2020; Online News Source. 1 UNCLASSIFIED// FOR OFFICIAL USE ONLY Page 4 of 4