(U//FOUO) NCTC Homegrown Violent Extremist Mobilization Indicators for Public Safety Personnel 2017 Edition

(U//FOUO) The indicators of violent extremist mobilization described herein are intended to provide federal, state, local, territorial and tribal law enforcement a roadmap of observable behaviors that could inform whether individuals or groups are preparing to engage in violent extremist activities including potential travel overseas to join a Foreign Terrorist Organization (FTO). The indicators are grouped by their assessed levels of diagnosticity—meaning how clearly we judge the behavior demonstrates an individual’s trajectory towards terrorist activity. The list also includes additional information concerning what the behavior could indicate, identifies likely observers, and provides a probable timeframe between behavior and an ultimate violent act. Some of these activities might be constitutionally protected and may be insignificant on their own, but, when observed in combination with other suspicious behaviors, may constitute a basis for reporting. Law enforcement (LE) action should not be taken based solely on the exercise of constitutionally protected activities or on the apparent race, ethnicity, national origin, or religion of the subject.

BACKGROUND

(U//FOUO) By law, the National Counterterrorism Center (NCTC) focuses on international terrorism. Senior Intelligence Community officials judge that violent extremists inspired or enabled by the self-proclaimed Islamic state in Iraq and the Levant (ISIL) and al-Qa‘ida, including their allies and affiliates, are among the most lethal international terrorist threats to the Homeland. This product focuses on the threat from those actors.

(U//FOUO) In 2014, NCTC’s Office of National Intelligence Management (NIM) formed an Interagency Analytic Focus Group, including experts from DCTC, DHS/I&A, DOE, FBI, NCTC, NSA, and cleared representatives of State and local law enforcement, who collaboratively developed the list of behavioral indicators and ranked them into three tiers of diagnosticity. The focus group created this list with law enforcement, homeland security, and public safety officials in mind. The focus group updated the list for 2017 based on new indicators observed since the publication of the original booklet.

GROUP INDICATORS

(U//FOUO) GROUP A Indicators are very diagnostic on their own.

(U//FOUO) GROUP B Indicators are moderately diagnostic, more so when observed with other indicators.

(U//FOUO) GROUP C Indicators are minimally diagnostic on their own and require the presence of other indicators to gain diagnosticity.

(U//FOUO) Nothing in this list of indicators is intended to confer additional authorities to law enforcement beyond that which is provided by federal, state, and local laws and regulations. Officers who believe individuals are exhibiting significant mobilization indicators are encouraged to immediately contact the local FBI Joint Terrorism Task Force.

…

(U//FOUO) WHAT IS A HOMEGROWN VIOLENT EXTREMIST?

(U//FOUO) A Homegrown Violent Extremist (HVE) is a violent extremist of any citizenship who has lived and/or operated primarily in the United States or its territories, and who is acting independently of the direction of a foreign terrorist organization (FTO). Because HVEs are acting to further the goals of an FTO, they are considered foreign intelligence threats under the authorities of both the Intelligence Community and domestic public safety entities.

(U//FOUO) WHY WAS THIS BOOKLET CREATED?

(U//FOUO) We face a heightened threat environment in the United States as HVEs heed the call to violence from ISIL and other global jihadist groups.

• (U//FOUO) The rise of ISIL and an uptick in extremist travel and unsophisticated attacks—inspired in part by ISIL—prompted us to reexamine a set of violent mobilization indicators originally published in 2011.

• (U//FOUO) Recent HVE attacks in California, Florida, Massachusetts, New Jersey, New York, Ohio, Pennsylvania, Tennessee, and Texas have added urgency to publishing this booklet.

(U//FOUO) We published this booklet to inform our federal, state, local, tribal, and territorial law enforcement (LE) and private sector partners about what signals—or indicators—we judge HVEs, particularly those inspired or enabled by ISIL or al-Qa‘ida, might display that could potentially be detected by first responder personnel and other people. We emphasize that many of these signals or indicators—some of which might involve constitutionally protected activities—may be insignificant on their own. However, when such signals or indicators are observed in combination with other suspicious behaviors, they may constitute a basis for reporting. LE action should not be taken solely based on the exercise of constitutionally protected activities or on the apparent race, ethnicity, national origin or religion of the subject, or on any combination of any such factors.

(U//FOUO) WHO IS THE BOOKLET’S TARGET AUDIENCE?

(U//FOUO) We tailored this booklet specifically for first responders, including LE, homeland security, and public safety officials. These officials are on the front line in their communities, are well positioned to notice suspicious behaviors outlined in the booklet, and have the potential to maintain regular engagement with members of their communities who may also witness indicators mentioned in the booklet.

(U//FOUO) If members of the public suspect—based on these indicators—that an individual is mobilizing to violence, they should contact LE.

(U//FOUO) HOW WAS THIS BOOKLET DEVELOPED?

WHAT DO YOU MEAN BY ‘DIAGNOSTICITY?’

(U//FOUO) NCTC conceptualized this booklet with the help of an interagency focus group, including officers from the FBI, the DHS, cleared representatives of state and local LE agencies, and subject matter experts. We decided to broadly publish it for public safety officials, to address the obvious need to inform those on the front lines of the effort to detect violent extremists in the United States.

(U//FOUO) The group determined that the ideal manner of listing indicators would be by diagnosticity—the extent to which behaviors indicate violent mobilization – instead of by measuring how often the behaviors have been reported in past cases. The highest tier of behaviors would most likely indicate mobilization, behaviors in the middle tier would indicate mobilization when observed with other indicators, while the behaviors in the lowest tier would only likely indicate violent mobilization when combined with multiple other behaviors.

• (U//FOUO) An example of a Group A highest-tier behavior or hard indicator is the potential observation of an individual preparing and posting a last will or martyrdom video or statement to the Internet. The group judged that this behavior would be diagnostic on its own and may be observable if shared with or otherwise discovered by family, friends, and bystanders, and online and social media contacts.

• (U//FOUO) Examples of Group C lowest-tier behaviors or soft indicators would be those that on their own do not suggest mobilization, but when taken together would become more diagnostic. None of those behaviors, by themselves, conclusively signal violent mobilization.

• (U//FOUO) The behaviors noted in the booklet were based on a review of information derived from dozens of FBI terrorism investigations over the past three years and brainstorming sessions by focus group members.