Expressed or implied threats by an individual or a group communicating intent to commit acts of terrorism or violence or advocating violence against a person, population, or to damage or destroy a facility can be an indicator of pre-operational attack planning. For example, in 2010 a Virginia-based US person pled guilty to communicating threats after he posted a video to the Internet encouraging violent extremists to attack the creators of a television show, including highlighting their residence and urging online readers to “pay them a visit.” He also admitted to soliciting others to desensitize law enforcement by placing suspicious looking but innocent packages in public places, which could then be followed up by real explosives.
Department of Homeland Security
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Terrorist Tradecraft: Impersonation Using Stolen, Cloned or Repurposed Vehicles
Stolen, cloned, or repurposed commercial or official vehicles—such as police cars, ambulances, and public utility service trucks—have been used in terrorist attacks. These vehicles could facilitate terrorist access to restricted and hardened targets as well as to emergency scenes. The use of these vehicles can provide individuals the ability to approach targets to conduct pre-operational surveillance or carry out primary attacks or secondary attacks against first responders.
Department of Homeland Security
(U//FOUO) DHS Cybersecurity Executive Order 13636 Critical Infrastructure Presentation
A DHS presentation from March 11, 2013 regarding the implementation of Executive Order 13636 “Improving Critical Infrastructure Cybersecurity” authored by the Cyber-Dependent Infrastructure Identification Working Group (CDIIWG).
Department of Homeland Security
DHS Geospatial Concept of Operations (GeoCONOPS) Version 4
The Homeland Security Geospatial Concept of Operations (GeoCONOPS) provides an understanding of the current landscape for the coordination of disaster response geospatial activities at the Federal level. The document serves the geospatial communities that support emergency management activities of the Federal government under Presidential Policy Directive 8 (PPD-8). This includes individual Emergency Support Functions (ESFs), the Joint Field Offices, FEMA Regional Coordination Centers (RRCC), and the National Response Coordination Center (NRCC). Stakeholders and actors representing the federal geospatial community have been extensively engaged in providing input for the development of the GeoCONOPS document. The GeoCONOPS serves as a guide to the Federal departments and agencies providing geospatial support under the Stafford Act which defines the programs and processes by which the Federal Government provides disaster and emergency assistance to state and local governments, tribal nations, eligible private nonprofit organizations, and individuals affected by a declared major disaster or emergency.
Department of Homeland Security
(U//FOUO) DHS Intelligence and Analysis Suspicious Activity Reporting (SAR) Topics of Interest Winter 2013
DHS/I&A is interested in the following SAR topics, which have been updated based on current issues of national interest. Previous topics remain relevant, and law enforcement, first responders, and other homeland security professionals should continue to submit reports on these issues. Per the SAR Functional Standard, only information validated as reasonably indicative of preoperational planning related to terrorism should be reported as a SAR. I&A is reviewing SAR reports on these topics but would welcome any additional context, ideas or local analysis on these topics and opportunities for joint production.
Intelligence Fusion Centers, New Jersey
(U//FOUO) New Jersey Fusion Center Phone Kidnapping Scams Report
During recent weeks, various sources in law enforcement and media outlets have been reporting phone kidnapping scams occurring in Central and Northern New Jersey and New York. In most incidents, scammers have alleged that a member of the phone scam victim’s family had been involved in a car accident and claimed to have taken the victim’s family member hostage. The scammers then claim they will drop their hostage at a hospital after a certain amount of money (usually $1500‐2000) is wired via Western Union to the scammers, as restitution for damage to the scammer’s vehicle. In addition, the scammers state that they have the hostage’s cell phone and any attempts to call the cell phone or disengage from the conversation will result in the murder or beating of the hostage.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Suspicious Activity Reporting Bulletin: Recruiting
Terrorists are attempting to recruit new members in the United States and overseas to support their operations, obtain funding, and conduct terrorist attacks. For example, in May 2012, Maryland-based Mohammad Hassan Khalid pled guilty to attempting to use the Internet to recruit individuals who had the ability to travel to and around Europe to conduct terrorist acts, in addition to providing logistical and financial support to terrorists. In prior cases of recruitment, individuals who were willing to participate in terrorist acts became involved with known and suspected terrorists, participated in paramilitary training abroad, or tried to acquire small arms and build explosives.
Intelligence Fusion Centers, New York
(U//FOUO) New York Fusion Center Threat Assessment: Major Terror Attacks Against Hotels 2002-2011
This product analyzes major terror attacks on hotels and provides a strategic-level assessment of the groups, tactics, and frequency of global terror attacks against hotels from 2002 – 2011. Additionally, the product identifies the deadliest types of attacks, comparing casualty counts and attack methods. The product was derived from media reporting and unclassified, for official use only sources.
Intelligence Fusion Centers, New Jersey
(U//FOUO) New Jersey Fusion Center School Shootings Commonalities Analysis
This report attempts to analyze the indicators and commonalities of recent school shootings in an effort to inform public safety officials and assist in the detection and prevention of potential school shooter plots or attacks. All incidents included in this assessment occurred in the United States while classes were in session. Domestic violence shootings and gang violence were not included in an effort to differentiate between “active shooter” incidents and other acts of violence. DHS defines an “active shooter” as an individual actively engaged in killing or attempting to kill people in a confined and populated area.
Intelligence Fusion Centers, New Jersey
(U//FOUO) New Jersey Fusion Center Mass Shootings Analysis
This report examines the 29 deadliest mass shootings in the past 13 years, starting with the shootings at Columbine High School in Colorado in 1999, to identify commonalities and trends. These 29 incidents include shooting incidents in which at least five people were killed.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Suspicious Activity Reporting Bulletin: Testing of Cybersecurity
Terrorists or cyber criminals might try to discover vulnerabilities in computer systems by engaging in unauthorized testing of cybersecurity in order to exploit those vulnerabilities during an attack. These attempts might include port scanning, phishing, and password cracking. “Social engineering,” another technique, leverages unwitting insider access by eliciting information about operational and security procedures from employees, personnel, and their associates.
California, Intelligence Fusion Centers
(U//FOUO) Central California Intelligence Center Exploding Gun Targets Report
The Central California Intelligence Center (CCIC)/Sacramento Regional Threat Assessment Center (RTAC) has prepared the following Situational Information Report on exploding targets, a commercially available binary explosive agent, to provide law enforcement and public safety officials with a better understanding of the potential public safety risks involving its use. While exploding targets are legally permissible depending on state and local regulations, the CCIC is concerned that the mixture may be more dangerous than what is stated on the manufacturer’s website especially if mishandled by individuals with novice experience in handling explosive components or when used in large quantities to detonate bigger targets and, in essence, creating an explosives or incendiary device.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Bulletin: Recent Active Shooter Incidents Highlight Need for Continued Vigilance
This Joint Intelligence Bulletin (JIB) is intended to provide information on the recent active shooter incidents that have taken place in the Homeland. This information is provided to support the activities of DHS and FBI and to assist private sector security officials and federal, state, local, tribal, and territorial law enforcement in identifying protective and support measures relating to active shooters.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Radiological Terrorism Incident After-Action Reporting Guide
This Reference Aid was jointly produced by DHS and the FBI to assist in the acquisition of detailed information in the aftermath of a successful or attempted radiological terrorism incident that would be of interest to the national law enforcement and emergency response communities. It is intended to help state, local, tribal, and territorial agencies and private sector entities deter, prevent, preempt, or respond to terrorist attacks against the United States.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Bulletin: Indicators of Suspicious Chemical, Biological, and Radiological Activity
Law enforcement and first responders may encounter chemical, biological, or radiological (CBR) related material or equipment at private residences, businesses, or other sites not normally associated with such activities. There are legitimate reasons for possessing such material or equipment, but in some cases their presence can indicate intent or capability to build CBR weapons, particularly when other suspicious circumstances exist.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Suspicious Activity Reporting Bulletin: Theft/Loss/Diversion
Terrorists may attempt to steal or divert precursor materials, uniforms, identification, blueprints, documents, access cards, facility vehicles, or other items–possibly with the help of knowledgeable insiders–for use in pre-operational planning or attacks. Emilio Suarez Trashorras, a Spanish national convicted for his role in the 2004 Madrid train bombings, stole the explosives used in the attack and the vehicles used to transport the explosives from a mining company where he worked.
Department of Homeland Security, National Counterterrorism Center, U.S. Navy
(U//FOUO) National Counterterrorism Center Special Report: IED Targeting of First Response Personnel
Although most terrorist IED attacks outside war zones target civilians or symbols of authority and usually involve a single device, some are designed specifically to target emergency response personnel. The most common tactics involve using secondary or tertiary devices in tiered or sequential attacks intended to kill or maim response personnel after they arrive on the scene of an initial IED incident.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Suspicious Activity Reporting Bulletin: Acquisition of Expertise
Terrorists may attempt to gain skills and knowledge necessary to plan and execute by obtaining specialized training, soliciting or stealing technical and proprietary information, or reaching out to academics and experts. In 2007, German police arrested three terrorist suspects for allegedly planning and preparing car bomb attacks against US citizens and interests in Germany. The suspects traveled to Pakistan where they received weapons and explosives training from a Pakistan-based Uzbek jihadist group called the Islamic Jihad Union.
Department of Homeland Security, United States
Senator Coburn DHS Urban Areas Security Initiative Waste Report
This report examines the UASI grant program, including a detailed review of 15 cities that have received funding through the program. It is intended to assess whether spending on DHS antiterrorism grants like UASI have made us safer, and whether the taxpayer dollars that have been spent on these programs have yielded an adequate return on investment in terms of improved security.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Suspicious Activity Reporting Bulletin: Observation/Surveillance
Terrorists often conduct physical surveillance to identify suitable targets, determine vulnerabilities, plan attack methods, or assess the target’s security posture. In March 2010, David Coleman Headley pled guilty for his role in the November 2008 terrorist attacks in Mumbai, India by conducting video and photographic surveillance of potential targets, as well as later surveilling Danish newspaper offices–the target of another attack plot.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Suspicious Activity Reporting Bulletin: Photography
Terrorists and criminals may use photos or videos of potential targets to gain insight into security operations and details of facility operations, including traffic flow through and around facilities, opening times, and access requirements. In late 2000 and early 2001, convicted al-Oa’ida operative Dhiren Barot took extensive video footage and numerous photographs of sites in downtown New York City and Washington, DC in preparation for planned attacks. Photographs and video useful in planning an attack may include facility security devices (surveillance cameras, security locks, metal detectors, jersey walls and planters); security personnel; facility entrances and exits; and other features such as lighting, access routes, gates, roads, walkways, and bridges.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Suspicious Activity Reporting Bulletin: Materials Acquisition/Storage
Terrorists overseas and in domestic attack plots have used various methods to acquire and store materials necessary to construct explosives. Najibullah Zazi, who pled guilty in 2010 to plotting to attack the New York subway system, made multiple, large-quantity purchases of chemical components needed to assemble the homemade explosive Triacetone Triperoxide (TATP)—6 bottles on one day and 12 bottles on a separate day—at beauty supply stores throughout the summer of 2009. Law enforcement and first responders should be aware that the possession, storage, or attempt to acquire unusual quantities of laboratory equipment, personal protective equipment, chemicals, and flammable accelerants—although legal to purchase and own—could provide indicators of preoperational attack planning.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Bulletin: No Specific Threats to American Jewish Community, Despite Recent World Events
This Joint Intelligence Bulletin (JIB) provides law enforcement and private sector safety officials with an evaluation of potential terrorist threats to Jewish organizations, facilities, and personnel in the United states. The information is provided to support the activities of DHS and FBI and to assist federal. state, local, tribal, and territorial government counterterrorism and first responder officials to deter, prevent, preempt, or respond to terrorist attacks in the United States.
Department of Homeland Security
DHS Social Media Monitoring and Situational Awareness Initiative Privacy Compliance Review
The Office of Operations Coordination and Planning (OPS), National Operations Center (NOC), has statutory responsibility to (1) provide situational awareness and establish a common operating picture for the federal government, and for state, local, and tribal governments as appropriate, in the event of a natural disaster, act of terrorism, or other man-made disaster, and (2) ensure that critical terrorism and disaster-related information reaches government decisionmakers. Traditional media sources and, more recently, social media sources such as Twitter, Facebook, and a vast number of blogs provide public reports on breaking events with a potential nexus to homeland security. By examining open source traditional and social media information, comparing it with many other sources of information, and including it where appropriate into reports, the NOC can provide a more comprehensive picture of breaking or evolving events.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Bulletin: Cyanide Awareness
Terrorist groups, including al-Qa‘ida, and violent extremists have considered using or have possessed cyanide compounds. Cyanides probably appeal to terrorists because of their toxicity, availability, and ease of dissemination. Some of the cyanide tactics that have been considered by terrorists include mixing it with oils and lotions for use as a contact poison, contaminating food or water supplies, or by using it in an improvised chemical dispersal device.