Department of Homeland Security

(U//FOUO) Utah Fusion Center Bulletin on Oregon Wildlife Refuge Occupier LaVoy Finicum’s Funeral

UT-SAIC-LaVoyFinicumFuneral

Recent events surrounding the occupation of the Malheur Wildlife Refuge in Harney County Oregon, have culminated in the fatal confrontation of Northern Arizona rancher, LaVoy Finicum. His funeral services will be held on 05 FEB 2016, in Kanab, UT. Finicum will be buried on 06 FEB 2016, close to his Arizona ranch in Cane Beds, AZ. While no credible threats to law enforcement are present at this time, armed extremists are expected to travel through UT; some of which may see this event as a tipping point, and potentially shift toward more violent action. A number of individuals, several of whom were present at the Burns, OR occupation, are planning caravans from UT and NV to travel to the funeral in show of support.

(U//FOUO) Pennsylvania Fusion Center Alert: Terrorists Impersonating First Responders

PACIC-ImpersonatingLEOs_Page_1

In September 2014, The Islamic State of Iraq and Syria (ISIS) released a propaganda video encouraging its followers to murder “intelligence officers, police officers, soldiers and civilians.” The video was re-released in January 2015 and specifically named the United States, France, Australia and Canada as targets. Now, first responders have an additional threat: Impersonation and misrepresentation by terrorists as first responders. The impersonators main goals are to further their attack plan and do harm to unsuspecting citizens as well as members of the emergency services community.

DHS Aging and Failing Infrastructure Report: Dams

DHS-CollapsingDams

Dam safety incidents can occur at any point during a dam’s lifetime, but the most common period of dam failure is the first 5 years of operation. The United States Society of Dams conducted a study in 2009 of 1,158 national and international dam failures and safety incidents and found that 31 percent of safety incidents occur during construction or within the first 5 years of operation. The most common causes of failure are overtopping, piping, and foundation defects. Overtopping caused by flooding and high-water events accounts for 34 percent of dam failures in the United States. Erosion caused by overtopping can compromise embankments and lead to failure. The risk of overtopping increases if the spillway design is inadequate, debris causes spillway blockage, or the dam crest settles.

DHS Aging and Failing Infrastructure Report: Navigation Locks

DHS-FailingLocks

Most locks are designed to last for 50 years, but 54 percent of IMTS locks are more than 50 years old, and 36 percent are more than 70 years old. Many of these locks are in need of repair and replacement, and some lack basic maintenance. Concrete is crumbling at some locks, and some have not been painted in 25–30 years, increasing the risk of corrosion. Locks lacking maintenance or in need of repair and replacement are more likely to have unscheduled closures. Unscheduled closures are more costly than scheduled closures, because vessel operators and companies are unable to plan to offset the delays from these incidents. The annual number of unscheduled lock closures has steadily increased since 1992. Fewer than 7,000 unscheduled closures occurred every year before 2000, and more than 7,000 occurred every year after 2000, peaking in 2008 with 13,250.

DHS NCCIC Report on the Art of Social Engineering

NCCIC-SocialEngineering

Social engineering, an age old threat, continues to play a significant role in successful attacks against people, enterprises, and agencies. The advent of the Internet, its diverse and increased use, and the reliance on it by almost every element of society, amplifies social engineering opportunities. Cybercriminals enjoy an expansive attack surface, novel attack vectors, and an increasing number of vulnerable points of entry. Threat actors, both cyber and physical, continue to leverage social engineering due in part to its high rate of success. Security experts believe complex social engineering threats will continue across all vectors and attack levels will continue to intensify.

DHS Aging and Failing Infrastructure Report: Highway Bridges

DHS-CollapsingBridges

The Department of Homeland Security Office of Cyber and Infrastructure Analysis (DHS/OCIA) produces Critical Infrastructure Security and Resilience Notes in response to changes in the infrastructure community’s risk environment from terrorist activities, natural hazards, and other events. This product summarizes the findings related to highway bridges that were identified in the National Risk Estimate on Aging and Failing Critical Infrastructure Systems released by DHS/OCIA in December 2014.

(U//LES) DHS Militia Extremist Movement Reference Guide

DHS-MilitiaExtremists_Page_1

The violent militia extremist movement in the United States is comprised of a collection of distinct, but organized, paramilitary groups that have engaged in violent criminal activities and terrorism-related plots to advance their anti-government beliefs. Individual violent militia extremists have been convicted of a range of firearms and explosives violations and criminal conspiracy charges. The violent militia extremist movement is a subset of the larger militia movement; many groups and individuals involved in the overall militia movement do not commit criminal or violent acts.

DHS Reference Aid on Illicit Uses of Drones and Model Aircraft

OCIA-ModelAircraft

Model Aircraft are custom built or commercially produced unmanned aircraft systems (UAS) that meet the statutory definition of Model Aircraft and operate in accordance with the statutory requirements for Model Aircraft. These are sometimes referred to as radio controlled airplanes or aircraft and usually require one individual for operational control. Some Model Aircraft are capable of sustained flight for approximately 2 hours or less depending on the type of Model Aircraft (Rotary or Fixed Wing) and power source (e.g. nitromethane, lithium ion, and lithium polymer batteries). Model Aircraft must be flown within visual line of sight of the operator; however, there is an increasing use of first person view technology that allows operation to occur beyond line of sight and at altitudes in excess of several hundred feet.

DHS Report on Cyber-Physical Infrastructure Risks to Smart Cities

DHS-OCIA-SmartCities

As technology pervades into our everyday lives, once simple devices have become smarter and more interconnected to the world around us. This technology is transforming our cities into what are now referred to as “Smart-Cities”. Smart Cities have been defined as urban centers that integrate cyber-physical technologies and infrastructure to create environmental and economic efficiency while improving the overall quality of life. The goal of these new cities is to create a higher quality of life, a more mobile life and an overall increased efficient use of available resources. Some examples of Smart-City technologies are interconnected power grids reducing power waste, smarter transportation resulting in increased traffic management, and smarter infrastructures that reduce hazards and increase efficiency.

(U//FOUO) DHS-FBI Bulletin: Criminal Hackers Target Police to Protest Perceived Injustices

DHS-FBI-HackersTargetPolice

Disruptive cyber attacks by criminal hackers—primarily distributed-denial-of-service (DDoS) attacks—targeting local law enforcement websites have increased since August 2014. We judge that this is almost certainly a result of the heightened coverage surrounding the alleged use of excessive force by law enforcement and an increased focus on incidents of perceived police brutality. The primary impact from the majority of these attacks has been the temporary disruption of the targeted public-facing websites.

(U//FOUO) DHS-FBI-NCTC Bulletin: Tactics, Techniques, and Procedures Used in November 2015 Paris Attacks

DHS-FBI-NCTC-ParisAttacks

This Joint Intelligence Bulletin (JIB) is intended to provide a review of the tactics, techniques, and procedures demonstrated by the perpetrators of the 13 November 2015 attacks in Paris, France. This JIB does not provide analysis of any follow-on operations or operations occurring in Europe in the wake of the attacks. It relies on a variety of open source and media reporting for the analysis, which could change as official details of the post-incident investigations come to light. This JIB is intended to support the activities of DHS, FBI and NCTC to assist federal, state, and local government counterterrorism and law enforcement officials, first responders, and private-sector security partners in effectively deterring, preventing, preempting, or responding to terrorist attacks against the United States.

(U//FOUO) New Jersey Fusion Center Special Events List November 2015

NJROIC-SpecialEventsNovember2015

The New Jersey Office of Homeland Security and Preparedness (OHSP) compiles a statewide list of special events that provides situational awareness to law enforcement, as well as to assist in local planning requirements. Special events include any events that attracts large numbers of participants. Examples include concerts, marathons, parades, sporting events, holiday gatherings, etc.

(U//FOUO) DHS-FBI-NCTC Bulletin: Terrorist Impersonation of First Responders Overseas

DHS-FBI-NCTC-ImpersonatingResponders

(U//FOUO) Two disrupted plots in Europe earlier this year highlight terrorists possible interest in impersonating first responders through the acquisition of authentic or fraudulent uniforms, equipment, vehicles, and other items which may be associated with government, military, law enforcement, fire,…

(U//FOUO) DHS-FBI-NCTC Bulletin: Risks for U.S. Persons Traveling to Fight ISIS

DHS-FBI-NCTC-FightingISIS_Page_1

This Joint Intelligence Bulletin highlights the potential risks for US persons traveling to Syria or Iraq to combat the Islamic State of Iraq and the Levant (ISIL) or expressing online a desire to do so. The FBI, DHS, and NCTC remain concerned that US persons traveling to combat ISIL are at risk of being killed, wounded, or captured. Further, ISIL members or supporters could attempt disingenuously to identify and target US persons so as to harm them before or upon their arrival in Syria or Iraq. The State Department has issued travel warnings for both Iraq and Syria and the US Government does not support US persons traveling overseas to combat ISIL.

(U//FOUO) Ohio Fusion Center Network: Swatting Incidents at Schools

OH-SchoolSwatting

SWATTING is the act of sending a SWAT team or some type of law enforcement response to a location by convincing law enforcement that an incident has occurred or is about to occur that requires immediate law enforcement response. Characteristics of swatting include, but are not limited to: Callers using internet-based phones such as Skype USBUS and Magic Jack USBUS, or callers using a legal Caller Identification (ID) masking service. Caller ID spoofing/masking services permit cell phones and landline phones to spoof the call’s origins through a service fee based software. Reports of bomb-threats and SWATTING incidents are coming from area elementary, middle, and high schools, along with universities as well. Federal, state, and local partners are working to identify where the calls are originating from.

(U//FOUO) DHS-FBI-NCTC Bulletin: ISIL Supporters Targeting Uniformed Personnel for Weapons and Equipment

DHS-FBI-NCTC-UniformsEquipmentISIL

In the first half of 2015 there were at least two instances of Islamic State of Iraq and the Levant (ISIL) inspired individuals in the West expressing interest in targeting law enforcement (LE) to obtain weapons and other specialized gear through theft. As ISIL continues to exhort its individuals in the West to carry out attacks, the potential exists that some terrorists may use this tactic and attempt to steal weapons or issued items, such as credentials, badges, uniforms, radios, ballistic vests, vehicles, and other equipment, which could be used in furtherance of an attack. We note that laws governing the purchase of firearms differ widely among Western nations making this tactic more likely to occur in countries where laws are most restrictive and firearms are harder to obtain through legitimate means.

DHS Guide: Improving Survivability in Improvised Explosive Device and Active Shooter Incidents

DHS-SurvivingActiveShooterIEDs

Recent improvised explosive device (IED) and active shooter incidents reveal that some traditional practices of first responders need to be realigned and enhanced to improve survivability of victims and the safety of first responders caring for them. This Federal, multi-disciplinary first responder guidance translates evidence-based response strategies from the U.S. military’s vast experience in responding to and managing casualties from IED and/or active shooter incidents and from its significant investment in combat casualty care research into the civilian first responder environment. Additionally, civilian best practices and lessons learned from similar incidents, both in the United States and abroad, are incorporated into this guidance. Recommendations developed in this paper fall into three general categories: hemorrhage control, protective equipment (which includes, but is not limited to, ballistic vests, helmets, and eyewear), and response and incident management.

(U//FOUO) DHS Assessment: Future ISIL Operations in the West Could Resemble Disrupted Belgian Plot

DHS-FutureOperationsISIL

I&A assesses that the plot disrupted by Belgian authorities in January 2015 is the first instance in which a large group of terrorists possibly operating under ISIL direction has been discovered and may indicate the group has developed the capability to launch more complex operations in the West. We differentiate the complex, centrally planned plotting in Belgium from other, more-simplistic attacks by ISIL-inspired or directed individuals, which could occur with littleto no warning.

(U//FOUO/LES) DHS Report: Assessing ISIL’s lnfluence and Perceived Legitimacy in the Homeland

DHS-AssessingLegitimacyISIL

This Field Analysis Report (FAR) is designed to support awareness and inform enforcement and collection operations of federal, state, and local partners involved in homeland security and counterterrorism efforts. Some of the activities described in the FAR may be constitutionally protected activities and should be supported by additional facts to justify increased suspicion. The totality of relevant circumstances should be evaluated when considering any law enforcement response or action. Our assessment of the level of the Islamic State of Iraq and the Levant’s (ISIL) name recognition since its declaration of a caliphate in June 2014 is based on a review of suspicious activity reporting (SAR) across the United States between 1 January and 30 December 2014, criminal complaints of US persons charged with supporting or seeking to support ISIL, Bureau of Prisons (BOP) intelligence reporting, and DHS I&A open source reporting to assess the influence of ISIL’s messaging campaign within the United States and ISIL’s perceived legitimacy among homegrown violent extremists (HVEs).

DHS Privacy and Civil Liberties Assessment Report on Executive Order 13636

DHS-ExecutiveOrder13636

Section 5 of Executive Order 13636 (Executive Order) requires the DHS Chief Privacy Officer and Officer for Civil Rights and Civil Liberties to assess the privacy and civil liberties impacts of the activities the Department of Homeland Security (DHS, or Department) undertakes pursuant to the Executive Order and to provide those assessments, together with recommendations for mitigating identified privacy risks, in an annual public report. In addition, the DHS Privacy Office and the Office for Civil Rights and Civil Liberties (CRCL) are charged with coordinating and compiling the Privacy and Civil Liberties assessments conducted by Privacy and Civil Liberties officials from other Executive Branch departments and agencies with reporting responsibilities under the Executive Order.

(U//FOUO) DHS Infrastructure Protection Note: Most Significant Tactics Against the Electricity Subsector

DHS-ElectricGridAttacks

This IP Note is a joint publication of OCIA and the DHS Office of Intelligence and Analysis (I&A) Homeland Counterterrorism Division. It is intended to identify high- consequence tactics, techniques, and procedures (TTPs) used during attacks and incidents that occurred at electrical substations, facilities, and associated electrical infrastructure from 2002 to 2013. The incidents identified in this report have no known nexus to terrorism.