July 4th Warning

U N C L A S S I F I E D / / F O R O F F I C I A L U S E O N L Y


(U) Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO). It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to be controlled,

stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know

without prior approval of an authorized DHS official. State and local homeland security officials may share this document with authorized critical infrastructure and key resource personnel and private sector security officials without

further approval from DHS.

(U) This product contains US person information that has been deemed necessary for the intended recipient to understand, assess, or act on the information provided. It has been highlighted in this document with the label USPER

and should be handled in accordance with the recipient's intelligence oversight and/or information handling procedures.

IA-0223-15

26 June 2015

(U//FOUO) Holiday Celebrations Remain Attractive Targets, Vigilance

Encouraged

(U) Scope

(U//FOUO) This Joint Intelligence Bulletin (JIB) is intended to remind law enforcement, military,

security personnel, and US citizens residing overseas to remain vigilant and aware of upcoming

public and private events this summer in light of the heightened threat of attacks by the Islamic

State of Iraq and the Levant (ISIL) and its supporters. The FBI, DHS, and NCTC advise law

enforcement and security personnel to coordinate operational plans with partner agencies for

events that commemorate the July 4th holiday or are likely to be perceived as defaming the

Islamic prophet, Muhammad, as these events are likely to result in threats or plans to conduct

violent extremist attacks. Recent arrests also highlight the need for law enforcement, military,

and security personnel to be alert in matters of personal safety and aware of the potential for

unexpected attackseven with subjects who previously have not displayed intentions to conduct violence. This JIB is intended to assist federal, state, local, tribal, and territorial

counterterrorism and law enforcement officials and private sector security partners in

effectively deterring, preventing, preempting, or responding to terrorist attacks against the

United States.



Page 2 of 6

(U//FOUO) Holiday Celebrations Remain Attractive Targets

(U//FOUO) The FBI, DHS, and NCTC remain concerned that upcoming July 4th celebrations,

such as parades or other large gatherings in the United States or overseas, could be targeted by

violent extremists, particularly those supporting ISIL. US-based ISIL supporters may be further

encouraged or inspired to act during this time, as it coincides with the Islamic holy month of

Ramadan, during which terrorist organizations, to include ISIL, often make announcements that

encourage and are likely to incite violence, and previously have conducted attacks overseas.

Furthermore, we assess ISIL will likely release English-and Arabic-language messaging over the

coming weeks to commemorate the one year anniversary of the declaration of the Caliphate.

To date, however, we have no information to suggest homegrown violent extremists (HVEs)

aim to conduct attacks in the United States related to this anniversary.*

(U//FOUO) In March 2015, a Syria-based US female urged followers to conduct drive-by shootings in the Homeland on various military holidays, according to open

source reporting. The female encouraged followers to wake up and rent a big truck n [sic] drive all over them. Kill them. We assess this statement is likely aspirational and not indicative of a specific plot, but it highlights violent extremists interest in upcoming holidays.

(U//FOUO) On 23 June 2015, ISIL spokesman Abu-Muhammad al-Adnani al-Shami posted an Arabic language audio message on Twitter urging jihad during Ramadan and claiming that jihad during Ramadan is greater than jihad during other months. Furthermore, he called upon all Muslims to come to your caliphate. Last year, ISIL announced the reestablishment of the Caliphate on the first day of Ramadan, 29 June

2014. In 2013, the group, then known as al-Qaida in Iraq, facilitated the escape of 500 prisonersmany of whom were members of the groupfrom Abu Ghraib during Ramadan.

(U//FOUO) Messaging commemorating the Caliphate declaration will likely promote its self-proclaimed military and governance successes over the past year, but could also

encourage HVEs to conduct attacks or travel overseas to support ISIL.

(U//FOUO) Upcoming Rallies Could Lead to Threats of Violence

(U//FOUO) The FBI, DHS, and NCTC assess that planned rallies this summer intending to

support individuals rights to draw the Islamic prophet, Muhammad, carry the risk of being targeted by violent extremists. Past events of this nature have resulted in threats or overt acts

of violence against both artists and publishers. While we have no credible intelligence

concerning threats to known upcoming events, we urge security officials to be aware of

indicators of preoperational activity threatening events, participants, or American Muslims and

their places of worship.

* (U//FOUO) The FBI and DHS define an HVE as a person of any citizenship who has lived or operated primarily in

the United States or its territories and who advocates, is engaged in, or is preparing to engage in ideologically-

motivated terrorist activities, including providing support to terrorism, in furtherance of political or social objectives

promoted by a foreign terrorist organization but who is acting independently of direction by a foreign terrorist

organization. HVEs are distinct from traditional domestic terrorists who engage in unlawful acts of violence or to

intimidate civilian populations or attempt to influence domestic policy without direction from or influence from a

foreign actor.



Page 3 of 6

(U//FOUO) On 28 May 2015, a Syria-based ISIL fighter issued a threat against a Phoenix, Arizona, Freedom of Speech Rally, and posted the home address of the events organizer on Twitter, reportedly resulting in threats against the organizer and his family. The event was advertised as a draw Muhammad cartoon contest held outside

of a mosque that the perpetrators of an attack in Garland, TexasElton Simpson and Nadir Soofiattended, and the participants had planned to draw pictures of the prophet, Muhammad.

(U//FOUO) On 3 May 2015, Simpson and Soofi attacked a Muhammad Art Exhibit & Contest in Garland, Texas. The two men exited their vehicle and shot at a security guard, who suffered a leg wound. A Garland Police Department officer shot and killed

both men.

(U//FOUO) In January 2015, an attack likely approved by al-Qaida in the Arabian Peninsula killed 12 persons at the offices of Charlie Hebdo, a satirical magazine in Paris,

France, that has on several occasions published depictions of the prophet, Muhammad.

(U//FOUO) Recent Arrests Highlight Continued Threat

(U//FOUO) Many recent arrests highlight HVEs continued interest in conducting attacks in the Homeland and the threat that law enforcement officers could be unexpectedly attacked by

HVEs.* Many US-based violent extremists are empowered and may be mobilized to act through

rapidly developed online associations with terrorists overseas and other like-minded associates,

possibly providing law enforcement with limited warnings that these individuals plan to act.

(U) On 19 June 2015, North Carolina-based Justin Nolan SullivanUSPER was arrested for

allegedly attempting to provide material support to ISIL, receipt of a silencer in

interstate commerce with intent to commit a felony, and receipt and possession of an

unregistered silencer. Sullivan was allegedly planning to shoot and kill people before

possibly detonating a bomb at an unknown location sometime between 21 and 23 June

2015, according to a criminal complaint.

(U//FOUO) Separately, on 19 June 2015, Ohio-based Amir Said Abdul Raman Al-GhaziUSPER, aka Robert C. McCollumUSPER, was arrested for allegedly attempting to provide material

support to ISIL. Al-Ghazi pledged his allegiance to ISIL leader Abu Bakr Al-Baghdadi and

made multiple online statements to incite others to engage in violence in the United States

or recruit others to join ISIL. Al-Ghazi also allegedly expressed his desire to commit

terrorist attacks in the United States and attempted to purchase an AK-47 assault rifle,

according to court documents.

* (U//FOUO) For more information on recent incidents highlighting the threat of law enforcement officers being

unexpectedly attacked by HVEs, see the FBI, DHS, and NCTC JIB entitled (U//FOUO) Recent Incidents by US-Based ISIL Supporters Underscore Threat to Law Enforcement, released 19 June 2015. (U//FOUO) Events described in this section are taken from an affidavit in support of a criminal complaint and arrest warrants. The charges contained in the complaint are mere allegations; as in any criminal case, the defendants are

presumed innocent until proven guilty in a court of law.



Page 4 of 6

(U//FOUO) In mid-June 2015 two New York-based individuals were arrested after they exited their vehicle and ran toward a surveillance vehicle in an alleged attempt to attack

law enforcement. One of the perpetrators had been planning to conduct an attack in

ISILs name, according to the criminal complaint. Further, a third New York-based associate attacked a SWAT operator with a knife after a SWAT team entered the

individuals residence to execute a search warrant, according to the criminal complaint.

(U) Outlook

(U//FOUO) The FBI, DHS, and NCTC remain concerned about the difficulty of detecting

violent extremists, especially lone offenders, given the individualized nature of radicalization to

violence.* Further, Syria-based ISIL members easy access to aspirational violent extremists through social media, combined with ISILs aggressive push for lone offender attacks in the West, raises our concern that attacks by US-based ISIL supporters could happen with little to

no warning. We continue to advise current and former US government employees, military

personnel, and law enforcement to actively review their social media accounts for information

that could attract violent extremists attention and routinely exercise operational security in their interactions online. We advise individuals and agencies to keep current on evolving privacy

restrictions on social media accounts and be aware of online mentions of their locations and

activities around the time of federal holidays and military events, which could be used by violent

extremists to target individuals and/or their families.

(U) Past Behaviors Associated with Pre-Operational Surveillance and Testing of Security

(U//FOUO) Some observed activities that may be suspicious include constitutionally protected

activity, such as lawful weapons procurement and training. These activities should not be

reported absent articulable facts and circumstances that support the source agencys suspicion that the observed behavior is not innocent, but rather reasonably indicative of criminal activity

associated with terrorism, including pre-operational activity. Observable behaviors that may

constitute indicators of attack planning include the following:

(U//FOUO) New or increased interest in critical infrastructure locations and landmarks with no reasonable explanation, including obtaining aerial views of these locations;

(U//FOUO) Suspicious observation of or unusual questions to building maintenance or security personnel about security procedures;

(U//FOUO) Engaging in overtly suspicious actions to provoke and observe responses by security or law enforcement officers;

* (U//FOUO) The FBI and DHS define a lone offender as an individual motivated by one or more violent extremist

ideologies who, operating alone, supports or engages in acts of violence in furtherance of that ideology or ideologies

that may involve influence from a larger terrorist organization or foreign actor.

(U//FOUO) For more information related to ISILs calls for attacks on military, law enforcement, and other government personnel, see the FBI and DHS JIB entitled (U/FOUO) Islamic State of Iraq and the Levant and Online Supporters Continue to Encourage Attacks Against Law Enforcement and Government Personnel, released 11 January 2015.



Page 5 of 6

(U//FOUO) Suspicious interest in entry points, peak days and hours of operation, security personnel, surveillance assets (including cameras), and access controls such as

alarms, barriers, doors, gates, or locks;

(U//FOUO) Suspicious observation of security reaction drills or procedures; multiple false alarms or fictitious emergency calls to same locations or similar venues;

(U//FOUO) Loitering, parking, or standing in the same area over multiple days with no reasonable explanation;

(U//FOUO) Attempts to disguise appearance from visit to visit (change in hair color, style of dress);

(U//FOUO) Garments not appropriate for weather/seasons;

(U//FOUO) Discreet use of still cameras and video recorders or note taking or use of sketching materials that would raise suspicion in a reasonable person;

(U//FOUO) Attempted or unauthorized access to rooftops or other potentially sensitive areas; and

(U//FOUO) Suspicious observations of or questions about facility air conditioning, heating, and ventilation systems.

(U) Suggested Protective Measures Physical Security

(U//FOUO) Terrorists have demonstrated continued interest in attacking significant

infrastructure, economic, and symbolic targets. We encourage state and local law enforcement,

as well as security personnel, to conduct a risk assessment and consider the following protective

measures:

(U//FOUO) Report suspicious activity to proper authorities, to include missing or stolen weapons;

(U//FOUO) Install secure locks and protection on all external and internal doors and windows with quick-release capability from within for emergency and fire escape;

(U//FOUO) Train security personnel to watch for suspicious or unattended vehicles on or near facilities; watch for repeated visitors or outsiders who have no apparent

business in non-public areas; watch for abandoned parcels, suitcases, backpacks, and

packages and any unusual activities;

(U//FOUO) Consider establishing safe areas within the facility for assembly and refuge during crises;

(U//FOUO) Consider installing closed-circuit television systems, intruder detection systems, and lighting to cover key areas;

(U//FOUO) Ensure that emergency communications equipment is present and operable. Practice emergency communications plans and systems;



Page 6 of 6

(U//FOUO) Install vehicle barriers and designate vehicle marshaling locations to ensure adequate standoff distances from vehicle-borne improvised explosive device;

(U//FOUO) Establish personnel screening checkpoints for access control into the facility or event;

(U//FOUO) Conduct explosive detection canine team searches of vehicles requiring entrance into a secure zone;

(U//FOUO) Ensure personnel receive training on improvised explosive device (IED) and threat awareness, emergency communication, response actions, and reporting of

suspicious activity;

(U//FOUO) Remove objects (e.g., trash containers, crates, etc.) which could conceal IEDs in accordance with stand-off distance guidelines;

(U//FOUO) Conduct additional sweeps of the facility or event area using roving patrols and explosive detection canine teams; and

(U//FOUO) Be vigilant of secondary devices, specifically at anticipated evacuation routes.

(U) Administrative Note: Law Enforcement Response

(U//FOUO) Information contained in this intelligence bulletin is for official use only. No portion of this bulletin

should be released to the media, the general public, or over nonsecure Internet servers. Release of this material

could adversely affect or jeopardize investigative activities.

(U) For comments or questions related to the content or dissemination of this document, please contact the FBI

Counterterrorism Analysis Section by email at [email protected] or the I&A Production Branch by e-mail at

[email protected].

(U) Tracked by: HSEC-8.1, HSEC-8.2, HSEC-8.3, HSEC-8.6

(U) Report Suspicious Activity

(U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and

emergency managers should follow established protocols; all other personnel should call 911 or

contact local law enforcement. Suspicious activity reports (SARs) will be forwarded to the appropriate fusion

center and FBI Joint Terrorism Task Force for further action. For more information on the Nationwide SAR

Initiative, visit http://nsi.ncirc.gov/resources.aspx.

Product Title:

1. Please select partner type: and function:

4. Please rate your satisfaction with each of the following:

2. What is the highest level of intelligence information that you receive?

3. Please complete the following sentence: I focus most of my time on:

5. How do you plan to use this product in support of your mission? (Check all that apply.)

Very Satisfied

Somewhat Satisfied

Neither Satisfied norDissatisfied

Somewhat Dissatisfied

Very Dissatisfied N/A

Products relevance to your mission

Products timeliness

Products responsiveness to your intelligence needs

Products overall usefulness

To help us understand more about your organization so we can better tailor future products, please provide: Name: Organization:Contact Number:

SubmitRequest

Customer Feedback FormOffice of Intelligence and Analysis

Position:State:Email:

Privacy Act Statement

7. What did this product not address that you anticipated it would?

8. To what extent do you agree with the following two statements?

6. To further understand your response to question #5, please provide specific details about situations in which you might use this product.

9. How did you obtain this product?

10. Would you be willing to participate in a follow-up conversation about your feedback?

Drive planning and preparedness efforts, training, and/or emergency response operationsObserve, identify, and/or disrupt threatsShare with partnersAllocate resources (e.g. equipment and personnel)Reprioritize organizational focusAuthor or adjust policies and guidelines

Initiate a law enforcement investigationInitiate your own regional-specific analysis Initiate your own topic-specific analysisDevelop long-term homeland security strategiesDo not plan to useOther:

Strongly Agree

Neither Agree nor Disagree DisagreeAgree

Strongly Disagree N/A

This product provided me with intelligence information I did not find elsewhere.

This product will enable me to make better decisions regarding this topic.

CLASSIFICATION:

CLASSIFICATION:REV: 29 October 2014Product Serial Number:

Stripped Final Holiday Celebrations Remain Attractive Targets, Vigilance EncouragedIA Customer Feedback Form v4-0 A-LAN_EXT

01_Date_Submitted: 10/16/201403_Prod_Title: (U//FOUO) Holiday Celebrations Remain Attractive Targets, Vigilance Encouraged04_Partner_Type_dropdown: Select One05_function_Type_dropdown: Select One06_Highest_Level_Information: Select One07_My_Time_Focus: Select One18_Products_Overall_Usefulness:

19_Products_Relevance:

20_Products_Timeliness:

21_Products_responsiveness:

22_Drive_Planning_Efforts: 24_Observe_ID_Threats: 28_Share_With_Partners: 29_Allocate_Resources: 31_Reprioritize_Organizational_Focus: 32_Author_Adjust_Policies: 23_Initiate_Law_Enforcement_Investigation: 26_Regional_Specific_Analysis: 27_Topic_Specific_Analysis: 30_Develop_Longterm_HS_Stategies: 33_Do_Not_Plan_To_Use: 34_Other: 35_other_text: 36_Specific_Details_For_Use_Text: 37_Product_Not_Addressed_Topics: 38_Make_Better_Decisions:

39_Info_Not_Found_Elsewhere:

40_Receive_Product_dropdown: Select One41_Feedback_Followup: Yes42_Name_identified_fillbox: 43_Position_identified_fillbox: 46_Contact_number: 44_Organization_Identified_fillbox: 45_State_identified: 47_Email_identified: 50_Submit_Feedback: 48_privacy: 02_Classification: UNCLASSIFIED//FOR OFFICIAL USE ONLY

17_serial: IA-0223-1549_Survey_version: v4.008_blank: 09_blank: 10_blank: 11_blank: 12_blank: 13_blank: 14_blank: 15_blank: 16_blank:

Documents

July 4th Warning