UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE 31 May 2020 (U//FOUO) Mitigation Efforts to Combat Ongoing Violent Activities at Protests Continuing (U//FOUO) Scope. This Intelligence Note (IN) provides information regarding violence threatening homeland security at lawful protests related to recent officer-involved deaths and examines the effect that ongoing law enforcement efforts may have on curtailing future incidents of violence. The information in this IN is current as of 31 May 2020. (U//FOUO) As violent protests continue over the coming days, we expect that state and local partners will be increasingly prepared to handle anticipated violent opportunist attacks from a broad array of actors, including by deploying National Guard assets, implementing curfews, and bolstering ongoing state and local government activities. While we assess the strengthened state and local force posture will deter some violent opportunists from participating in unlawful activities, more organized groups are likely to continue to incite and conduct violence and use social media to amplify media coverage of law enforcement reactions to violent protests and coordinate further illicit violent activities. (U//FOUO) Feedback from our state and local partners indicates that the high volume of online activity calling for individuals to engage in targeted violence during protests continues to challenge local law enforcement planning and coordination response efforts, particularly should violent protest activities transition to smaller jurisdictions. DHS has identified four potential factors that reporting indicates may impact potential law enforcement operational activities over the next 24 hours: » (U//FOUO) Calls for Exploitation of Legitimate Protests will Continue: Open source reporting indicates that lawful protests are likely to continue in locations which we have seen activity over the last two nights, as citizens continue to organize lawful protests and potential illicit actors identify ongoing activities to potentially infiltrate and exploit. Online social media posts indicate that calls for broader nationwide protests are being met with both pro- and anti-violence responses. Posts related to the sentiment around violence continue to be divided, with actors largely calling on individuals to target law enforcement officials or their establishments using simple tactics and weapons, including firearms, simple incendiary devices, and household objects to be thrown at law enforcement officers. We have also noted several incidents of potential violent opportunists traveling to protests with milk or other liquids in anticipation of mitigating the effects of pepper spray or other crowd control agents. While I&A is aware of media reporting indicating that external groups are traveling to infiltrate protests, we have been unable to confirm this activity. We do note, however, that the organization of protected activities can be easily tracked and organized on social media.1 » (U//LES) Extended Curfews and Continued Major City Response Could Potentially Move Protests Out to Smaller Areas: We assess that effective responses in major cities by larger law enforcement agencies could transition protest activity to smaller jurisdictions who may be less equipped to respond to infiltration by violent groups. As of 31 May, at least 15 major cities across the country imposed curfews, and several declaring States of Emergency, according to field reporting. Multiple states mobilized National Guard units to support infrastructure protection activities. Implemented curfews, reduced protester turnout, improved law IA-05312020-T-2 (U) Warning: This document contains UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO) information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know without prior approval of an authorized DHS official. State and local homeland security officials may not share this document with critical infrastructure and key resource personnel or private sector security officials without further approval from DHS. (U) LAW ENFORCEMENT SENSITIVE: The information marked (U//LES) in this document is the property of DHS and may be distributed within the Federal Government (and its contractors), US intelligence, law enforcement, public safety or protection officials, and individuals with a need to know. Distribution beyond these entities without DHS authorization is prohibited. Precautions should be taken to ensure this information is stored and/or destroyed in a manner that precludes unauthorized access. Information bearing the LES caveat may not be used in legal proceedings without first receiving authorization from the originating agency. Recipients are prohibited from subsequently posting the information marked LES on a website on an unclassified network. (U) All US person information has been minimized. Should you require US person information on weekends or after normal weekday hours during exigent and time sensitive circumstances, contact the Current and Emerging Threat Watch Office at 202-447-3688, CETC.OSCO@HQ.DHS.GOV. For all other inquiries, please contact the Homeland Security Single Point of Service, Request for Information Office at DHS-SPS-RFI@hq.dhs.gov, DHS-SPS-RFI@dhs.sgov.gov, DHS-SPS-RFI@dhs.ic.gov UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE enforcement tactics, and National Guard deployments will likely deescalate violent opportunistic conduct, compared to the last two days, in most locations that experienced violence, according to field assessments from I&A field personnel.2,3,4,5,6,7,8 In Minneapolis, New York City, Oklahoma, and Philadelphia, social media posts inciting violence may prompt an escalation of violence to levels seen this weekend, according to the field assessments. Potential targets discussed continue to emphasize the need to target law enforcement officials or establishments; these are interspersed with general calls to conduct criminal activity, such as looting; state and local officials express concern that widespread replication of these tactics in smaller jurisdictions could challenge law enforcement response.a,9,10 » (U//FOUO) Scale of Monitoring of Social Media and Calls to Violence Will Continue to Challenge Partners: I&A engagements with senior state and local law enforcement and first responder leaders indicate that our local law enforcement partners are struggling to identify, report, and follow up on the large numbers of online social media threats. Officials noted that they have also seen a trend for protests beginning peacefully but then devolving to violence due to violent opportunists, and noted that continued support from US Government open source collection, as well as local Fusion Center and LE monitoring efforts, to identify threats of violent activity can help them identify potential violent activities before they begin or as non-violent protests may become violent.11,12 » (U//FOUO) Cyber Activities Related to the Protests Will Continue to Escalate: Daily since 28 May, multiple cyber incidents targeting state and local government networks across the country—with some claims of responsibility from criminal hackers—have demonstrated that some cyber actors have the intent and capability to conduct short-term disruptive attacks against public-facing websites and vulnerable internetconnected systems. Currently, those incidents include confirmed distributed denial-of-service (DDoS) attacks targeting government websites, potential telephony denial-of-service attacks against the Emergency Services Sector, and potential targeting of inadvertently internet-connected local government systems, although we are not aware of any confirmed compromises of state and local networks. Anonymous, a collective of cyber actors that engages in criminal hacking activity, claimed credit for a DDoS attack against Minnesota networks on 30 May; however, we cannot confirm they were responsible, and we have not attributed any of the recent cyber activity to nation-states. We expect to see politically-motivated and opportunistic cyber actors to engage in more of these types of disruptive cyber operations against federal, state, and local government networks, which frequently use common tactics and known vulnerabilities to target these networks—with the potential use of ransomware as a possible escalation in severity within the capability of numerous actors (U//FOUO) Violent Opportunist Definitions (U//FOUO) DHS I&A defines violent opportunists as: Illicit actors who may or may not hold violent extremist ideological beliefs, but seek to exploit opportunities in non-violent protests to engage in unlawful violence against federal, state, or local government and law enforcement personnel or facilities, as well as other critical infrastructure, that either poses a danger to human life, threat of potential destruction of the critical infrastructure, or would be so disruptive as to endanger the minimal operations of state and local governments to respond. These actors may capitalize on violent extremist narratives often espoused by organized DVE movements, such as anarchist extremists or racially motivated violent extremists, to justify violent activities that may potentially destroy government critical infrastructure at the state, local and federal levels, and may attempt to incite others to violence to provide cover for their own illicit activities. Their primary motivations may be influenced by a variety of criminal objectives and goals. (U//LES); For more information on Minneapolis, see the 31 March 2020 FBI Operational Update, entitled, “(U//LES) FBI Minneapolis AOR Has a Roughly Even Chance of Experiencing Further Property Damage and Attempts of Violence against Citizens and Law Enforcement (LE) from 31 May -1 June 2020,” to which DHS contributed. a UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE Page 2 of 4 UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE (U) Report Suspicious Activity (U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency managers should follow established protocols; all other personnel should call 911 or contact local law enforcement. Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism Task Force for further action. For more information on the Nationwide SAR Initiative, visit http://nsi.ncirc.gov/resources.aspx. (U) Tracked by: HSEC-8.1, HSEC-8.5, HSEC-8.6, HSEC-8.8, HSEC-8.10 UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE Page 3 of 4 UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE (U) Source Summary Statement (U//FOUO) This IN is based on media reporting, DHS open source reporting and DHS field reporting. We have medium confidence in the underlying information obtained from DHS due to evolving situations on the ground and the press reporting given the evolving nature of these events. We have high confidence that material received from our state and local partners represents their best information at time of dissemination. (U); DHS; Background and Analysis from Current and Emerging Threats Center analysts; 31 May 2020. (U); DHS I&A Regional Director to Regional Intelligence Analysts; Email; “#1 Tasker Input from RMR”; 31 May 2020; DOI 31 May 2020; Extracted information is U//FOUO; Overall document classification is U//FOUO. 3 (U); DHS I&A Regional Director to Deputy Directors; Email; “Tasker Required This Morning CR Rollup”; 31 May 2020; DOI 31 May 2020; Extracted information is U//FOUO; Overall document classification is U//FOUO. 4 (U); DHS I&A Intelligence Officer to Regional Intelligence Analysts; Email; “CTMC Product Response: Central Pacific Region’; 31 May 2020; DOI 31 May 2020; Extracted information is U//FOUO; Overall document classification is U//FOUO. 5 (U); DHS I&A Regional Director to Regional Intelligence Analysts; Email; “#1 ACTION-ACTIONTASK Analytical with CTMC suspense 1500 to DUSIEO”; 31 May 2020; DOI 31 May 2020; Extracted information is U//FOUO; Overall document classification is U//FOUO. 6 (U); DHS I&A Regional Director to Regional Intelligence Analysts; Email; “FW: #1 ACTION-ACTIONTASK Analytical with CTMC suspense 1500 to DUSIEO”; 31 May 2020; DOI 31 May 2020; Extracted information is U//FOUO; Overall document classification is U//FOUO. 7 (U); DHS I&A Intelligence Officer to Regional Intelligence Analysts; Email; “Re: !!!!FW: #1 ACTION-ACTIONTASK Analytical with CTMC suspense 1500 to DUSIEO”; 31 May 2020; DOI 31 May 2020; Extracted information is U//FOUO; Overall document classification is U//FOUO. 8 (U); DHS I&A Regional Director to Regional Intelligence Analysts; Email; “SCR RFI Input”; 31 May 2020; DOI 31 May 2020; Extracted information is U//FOUO; Overall document classification is U//FOUO. 9 (U); DHS I&A Regional Director to Deputy Directors; Email; “NORTHEAST REGION: #1 ACTION-ACTIONTASK Analytical with CTMC suspense 1500 to DUSIEO”; 31 May 2020; DOI 31 May 2020; Extracted information is U//FOUO; Overall document classification is U//FOUO. 10 (U); DHS I&A Intelligence Officer to Regional Intelligence Analysts; Email; “RE: SHORT TURN TASKER!”; 31 May 2020; DOI 31 May 2020; Extracted information is U//FOUO; Overall document classification is U//FOUO. 11 (U); DHS; Read-out of Feedback Received from Engagement with Major State and Local Law Enforcement and First Responder Organizations; 31 May 2020. 1 2 UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE Page 4 of 4 CLASSIFICATION: UNCLASSIFIED//FOR OFFICIAL USE ONLY Office of Intelligence and Analysis Customer Feedback Form Product Title: (U//FOUO) Mitigation Efforts to Combat Ongoing Violent Activities at Protests Continuing All survey responses are completely anonymous. No personally identifiable information is captured unless you voluntarily offer personal or contact information in any of the comment fields. Additionally, your responses are combined with those of many others and summarized in a report to further protect your anonymity. 1. Please select partner type: Select One and function: Select One Select One 2. What is the highest level of intelligence information that you receive? 3. Please complete the following sentence: “I focus most of my time on:” Select One 4. Please rate your satisfaction with each of the following: Very Satisfied Somewhat Satisfied Neither Satisfied nor Dissatisfied Somewhat Dissatisfied Very Dissatisfied N/A Product’s overall usefulness Product’s relevance to your mission Product’s timeliness Product’s responsiveness to your intelligence needs 5. How do you plan to use this product in support of your mission? Drive planning and preparedness efforts, training, and/or emergency response operations (Check all that apply.) Initiate a law enforcement investigation Intiate your own regional-specific analysis Intiate your own topic-specific analysis Develop long-term homeland security strategies Do not plan to use Other: Observe, identify, and/or disrupt threats Share with partners Allocate resources (e.g. equipment and personnel) Reprioritize organizational focus Author or adjust policies and guidelines 6. To further understand your response to question #5, please provide specific details about situations in which you might use this product. (Please Use Manuscript in the space provided.) 7. What did this product not address that you anticipated it would? (Please Use Manuscript in the space provided.) 8. To what extent do you agree with the following two statements? Strongly Agree Agree Neither Agree nor Disagree Disagree Strongly Disgree N/A This product will enable me to make better decisions regarding this topic. This product provided me with intelligence information I did not find elsewhere. 9. How did you obtain this product? Select One 10. Would you be willing to participate in a follow-up conversation about your feedback? To help us understand more about your organization so we can better tailor future products, please provide: Name: Position: Organization: State: Contact Number: Email: Yes Submit Feedback Privacy Act Statement CLASSIFICATION: Product Serial Number: UNCLASSIFIED//FOR OFFICIAL USE ONLY IA-05312020-T-2 REV: 01 August 2017