Leaked Documents Reveal Counterterrorism Tactics Used at Standing Rock to “Defeat Pipeline Insurgencies”

A shadowy international mercenary and security firm known as TigerSwan targeted the movement opposed to the Dakota Access Pipeline with military-style counterterrorism measures, collaborating closely with police in at least five states, according to internal documents obtained by The Intercept. The documents provide the first detailed picture of how TigerSwan, which originated as a U.S. military and State Department contractor helping to execute the global war on terror, worked at the behest of its client Energy Transfer Partners, the company building the Dakota Access Pipeline, to respond to the indigenous-led movement that sought to stop the project.

Internal TigerSwan communications describe the movement as “an ideologically driven insurgency with a strong religious component” and compare the anti-pipeline water protectors to jihadist fighters. One report, dated February 27, 2017, states that since the movement “generally followed the jihadist insurgency model while active, we can expect the individuals who fought for and supported it to follow a post-insurgency model after its collapse.” Drawing comparisons with post-Soviet Afghanistan, the report warns, “While we can expect to see the continued spread of the anti-DAPL diaspora … aggressive intelligence preparation of the battlefield and active coordination between intelligence and security elements are now a proven method of defeating pipeline insurgencies.”

More than 100 internal documents leaked to The Intercept by a TigerSwan contractor, as well as a set of over 1,000 documents obtained via public records requests, reveal that TigerSwan spearheaded a multifaceted private security operation characterized by sweeping and invasive surveillance of protesters.

As policing continues to be militarized and state legislatures around the country pass laws criminalizing protest, the fact that a private security firm retained by a Fortune 500 oil and gas company coordinated its efforts with local, state, and federal law enforcement to undermine the protest movement has profoundly anti-democratic implications. The leaked materials not only highlight TigerSwan’s militaristic approach to protecting its client’s interests but also the company’s profit-driven imperative to portray the nonviolent water protector movement as unpredictable and menacing enough to justify the continued need for extraordinary security measures. Energy Transfer Partners has continued to retain TigerSwan long after most of the anti-pipeline campers left North Dakota, and the most recent TigerSwan reports emphasize the threat of growing activism around other pipeline projects across the country.

The leaked documents include situation reports prepared by TigerSwan operatives in North Dakota, South Dakota, Iowa, Illinois, and Texas between September 2016 and May 2017, and delivered to Energy Transfer Partners. They offer a daily snapshot of the security firm’s activities, including detailed summaries of the previous day’s surveillance targeting pipeline opponents, intelligence on upcoming protests, and information harvested from social media. The documents also provide extensive evidence of aerial surveillance and radio eavesdropping, as well as infiltration of camps and activist circles.

TigerSwan did not respond to a request for comment. Energy Transfer Partners declined to comment, telling The Intercept in an email that it does not “discuss details of our security efforts.”

Additional documents, obtained via public records requests, consist of communications among agents from the FBI, the Department of Homeland Security, the U.S. Justice Department, the Marshals Service, and the Bureau of Indian Affairs, as well as state and local police. The “Intel Group,” as its members refer to it, closely monitored anti-Dakota Access protests in real time, scooped up information on the water protectors from social media, and shared intelligence.

Included among the documents obtained via public records requests were “daily intelligence updates” developed by TigerSwan that were shared with law enforcement officers, thus contributing to a broad public-private intelligence dragnet. In the internal situation reports, TigerSwan operatives comment frequently about their routine coordination and intelligence sharing with law enforcement. The intel group went so far as to use a live video feed from a private Dakota Access security helicopter to monitor protesters’ movements. In one report, TigerSwan discusses meeting with investigators from North Dakota’s Attorney General’s Office.

North Dakota’s Attorney General’s Office declined to comment.

TigerSwan’s internal reports and the intelligence briefings shared with law enforcement name dozens of DAPL opponents. Some of those named are well-known activists, while others have minimal public affiliation with the water protector movement. The reports’ authors often comment on camp dynamics, including protester morale and infighting, and speculate about violent or illegal actions specific individuals might take and weapons they might carry. The documents reveal the existence of a “persons of interest” list as well as other databases that included identifying information such as photographs and license plate numbers.

The situation reports also suggest that TigerSwan attempted a counterinformation campaign by creating and distributing content critical of the protests on social media.

The Intercept is publishing a first set of TigerSwan’s situation reports from September 2016, which describe the company’s initial operations. We are also publishing two additional situation reports dated October 16 and November 5, along with PowerPoint presentations shared with law enforcement that correspond to the same dates. The names of private individuals whose actions are not already in the public record, or whose authorization we did not obtain, have been redacted to protect their privacy. The Intercept will publish the remaining situation reports in the coming weeks.

In addition, The Intercept is publishing a selection of communications, obtained by public records requests, detailing coordination between a wide range of local, state, and federal agencies, which confirm that the FBI participated in core Dakota Access-related law enforcement operations starting soon after protests began last summer. Finally, we are publishing two additional documents, also in the public record, that detail TigerSwan’s role spearheading Energy Transfer Partner’s multipronged security operation.

The FBI did not respond to a request for comment.

A Public-Private Partnership

Beginning in April of last year, indigenous activists calling themselves water protectors and their allies spent months attempting to block construction of the 1,172-mile Dakota Access Pipeline, which runs near the Standing Rock Sioux reservation in North Dakota and traverses three other states. DAPL opponents were met with a heavily militarized police apparatus including local and out of state police and sheriff’s deputies, as well as Bureau of Indian Affairs police and National Guard troops. The police became notorious for their use of so-called less than lethal weapons against demonstrators, including rubber bullets, bean bag pellets, LRAD sound devices, and water cannons.

But it was the brutality of private security officers that first provoked widespread outrage concerning the pipeline project. On Labor Day weekend of 2016, Democracy Now! captured footage of pipeline security guards attacking peaceful protesters with dogs.

In the aftermath of that incident, Energy Transfer Partners turned to TigerSwan — a company with a deep background in counterterrorism operations — to oversee the work of the other security companies contracted to protect the pipeline. Other security firms working along the pipeline included Silverton, Russell Group of Texas, 10 Code LLC, Per Mar, SRC, OnPoint, and Leighton, documents show.

Based in Apex, North Carolina, TigerSwan was created by retired Army Col. James Reese during the height of the war in Iraq. Reese, a former commander in the elite Army special operations unit known as Delta, entered into the exploding private security and intelligence industry hoping to compete with Blackwater, then the most successful of the private military companies supporting U.S. war efforts in the Middle East and Afghanistan. TigerSwan has an estimated 350 employees and maintains offices in Iraq, Afghanistan, Saudi Arabia, Jordan, India, Latin America, and Japan.

Records from the North Dakota Private Investigation and Security Board show that TigerSwan has operated without a license in North Dakota for the entirety of the pipeline security operation, claiming in a communication with the board, “We are doing management and IT consulting for our client and doing no security work.” In September, the licensing board learned about the company’s position as a Dakota Access contractor and wrote a letter to its North Carolina headquarters requesting that it submit a license application.

TigerSwan then did so, but the board denied the application on December 19. After James Reese wrote a letter objecting to the decision, the security board’s executive director responded on January 10 that “one reason for the denial concerns your failure to respond to the Board’s request for information as to TigerSwan’s and James Reese’s activities within the State of North Dakota.” Neither TigerSwan nor the board responded to questions regarding the current status of the company’s license.

The leaked situation reports indicate that during the company’s first weeks working on the pipeline, TigerSwan operatives met with law enforcement in Iowa and North Dakota, including Sheriff Dean Danzeisen of Mercer County, North Dakota, who “agreed to sharing of information.” (In the report, TigerSwan misspells the sheriff’s name as “Denzinger.”) By September 13, the documents indicate, TigerSwan had placed a liaison inside the law enforcement “joint operation command” in North Dakota. The fusion of public and private intelligence operations targeting water protectors was underway.

One of TigerSwan’s lines of communication with law enforcement was via intelligence briefings that echo the company’s internal situation reports. The briefings obtained by The Intercept were sent by TigerSwan’s deputy security director Al Ornoski to a variety of recipients, including the Gmail account of Sheriff Danzeisen. Morton County Sheriff Kyle Kirchmeier, who was regularly involved in policing the protests, also received at least one of the TigerSwan briefings.

Danzeisen did not respond to a request for comment. A spokesperson for the Morton County Sheriff’s Department wrote in an email to The Intercept that the department “did maintain communication with TigerSwan security in order to understand when and where DAPL construction activities were taking place. This gave law enforcement situational awareness in order to monitor and respond to illegal protest activity.”

TigerSwan also aided prosecutors in building cases against pipeline opponents. According to an October 16 document obtained via a records request, the security team’s responsibilities included collecting “information of an evidentiary level” that would ultimately “aid in prosecution” of protesters.

A leaked report dated September 14, 2016, indicates that TigerSwan met with the North Dakota Bureau of Criminal Investigation “regarding video and still photo evidence collected for prosecution.” The same document describes plans to “continue building Person of Interest (POI) folders and coordination with [law enforcement] intelligence.” TigerSwan’s situation reports also describe conversations between the company’s operatives and FBI agents on at least four occasions.

Activists on the ground were tracked by a Dakota Access helicopter that provided live video coverage to their observers in police agencies, according to an October 12 email thread that included officers from the FBI, DHS, BIA, state, and local police. In one email, National Security Intelligence Specialist Terry Van Horn of the U.S. attorney’s office acknowledged his direct access to the helicopter video feed, which was tracking protesters’ movements during a demonstration. “Watching a live feed from DAPL Helicopter, pending arrival at site(s),” he wrote. Cecily Fong, a spokesperson for law enforcement throughout the protests, acknowledged that an operations center in Bismarck had access to the feed, stating in an email to The Intercept that “the video was provided as a courtesy so we had eyes on the situation.”

Asked about the intel group, Fong replied, “The Intelligence Group was formed from virtually the beginning. It involved personnel from our [State and Local Intelligence Center], the BIA, FBI, and Justice” consisting of “around 7 people who monitored social media in particular, in this case, because that was the medium most if not all of the protestors were using.”

“I’m honored that they felt that we were a big enough threat to go to this level of intervention,” Ed Fallon, an activist mentioned several times in the TigerSwan documents, told The Intercept.

As the water protector movement expanded from North Dakota to other states, so did the surveillance. A report dated March 29, for instance, points to a meeting between TigerSwan and “the Des Moines Field Office of the FBI, with the Omaha and Sioux Falls offices joining by conference call. Also in attendance were representatives of the Joint Terrorism Task Force, Department of Homeland Security, Iowa Department of Emergency Services, Iowa Department of Homeland Security and Iowa Department of Wildlife. Topics covered included the current threat assessment of the pipeline, the layout of current security assets and persons of interest. The FBI seemed were [sic] very receptive to the information presented to them, and follow-up meetings with individuals will be scheduled soon.”

TigerSwan’s relationship with public police agencies was not always harmonious. The situation reports describe TigerSwan’s frustration with the amount of leeway some law enforcement gave protesters in Iowa and the company’s efforts to convince officers to use more punitive tactics.

In a situation report dated October 16, TigerSwan applauds a recent increase in bail in Lee County, Iowa, calling it “significant because this may impede protestors from risking arrest due to the high cost to be released from bail.” The document contrasts that county’s tactics to those used by others. “Calhoun, Boone and Webster county law enforcement are not supportive of DAPL Security’s mission” the report says, noting those agencies’ “reluctance to arrest or cite trespassing individuals.”

“We need to work closer with Calhoun, Boone, and Webster county [law enforcement] to ensure future protestors will at least be fined, if not arrested,” the analyst notes. “Alternatively, we could request Lee County LE speak to other counties about tactics that are working.”

Contacted for comment, recently elected Lee County Sheriff Stacy Weber said he hadn’t discussed TigerSwan with the previous sheriff. “As far as I knew, the protest stuff was over with, and we haven’t had any protests since,” he said. In fact, Weber hadn’t heard of the company until earlier this week, when a TigerSwan program manager named Don Felt stopped by the office. “He dropped his card off and said he wanted to say hello,” Weber said.

Find, Fix, Eliminate

TigerSwan’s internal files describe its utilization of aerial surveillance, including use of helicopters and drones to photograph and monitor the pipeline opponents. The September 12 situation report notes that an operation by construction workers was “over-watched by a predator on loan to the JEJOC from Oklahoma.” The TigerSwan contractor who provided the Intercept with the situation reports said he did not believe the company ever operated a predator drone, but metadata in images he shared pointed to a camera used by a commercially available Phantom 4 drone. One of the daily intelligence updates notes plans to obtain night-vision goggles, LRADs, body armor, and FLIR (forward looking infrared) cameras.

The reports also reveal a widespread and sustained campaign of infiltration of protest camps and activist circles. Throughout the leaked documents, TigerSwan makes reference to its intelligence-gathering teams, which infiltrated protest camps and activist groups in various states. TigerSwan agents using false names and identities regularly sought to obtain the trust of protesters, which they used to gather information they reported back to their employer, according to the TigerSwan contractor.

The September documents make numerous references to Silverton personnel, who were overseen by TigerSwan, attending protests in Iowa. Silverton did not respond to a request for comment.

Covert operations are implicit in many of the other situation reports, which are filled with details that only individuals with close and consistent access to the protesters’ communities could have gathered. On a few occasions, however, the reports make that presence more explicit, for instance by referring to “sources in the camp.”

For example, the November 5 situation report describes the “exploitation of documents found at Camp 1.” Apparently, they didn’t contain much revealing material. “Of most concern,” the situation report says, “were the ‘Earth First’ magazines found on the camp. These magazines promote and provide TTP’s [tactics, techniques, and procedures] for violent activity.”

In an October 3 report, TigerSwan discusses how to use its knowledge of internal camp dynamics: “Exploitation of ongoing native versus non-native rifts, and tribal rifts between peaceful and violent elements is critical in our effort to delegitimize the anti-DAPL movement.” On February 19, TigerSwan makes explicit its plans to infiltrate a Chicago protest group. “TigerSwan collections team will make contact with event organizers to embed within the structure of the demonstration to develop a trusted agent status to be cultivated for future collection efforts,” the report notes, later repeating its intent to “covertly make contact with event organizers.”

“At every action I went to, they had their own people walking around with a video camera getting in people’s faces,” Ian Souter, a protester who was described as a “person of interest” in a TigerSwan report, told The Intercept.

Perhaps one of the most striking revelations of the documents is the level of hostility displayed by TigerSwan toward the water protectors. TigerSwan consistently describes the peaceful demonstrators using military and tactical language more appropriate for counterterrorism operations in an armed conflict zone. At times, the military language verges on parody, as when agents write of protesters “stockpiling signs” or when they discuss the “caliber” of paintball pellets. More often, however, the way TigerSwan discusses protesters as “terrorists,” their direct actions as “attacks,” and the camps as a “battlefield,” reveals how the protesters’ dissent was not only criminalized but treated as a national security threat. A March 1 report states that protesters’ “operational weakness allows TS elements to further develop and dictate the battlespace.”

In one internal report dated May 4, a TigerSwan operative describes an effort to amass digital and ground intelligence that would allow the company to “find, fix, and eliminate” threats to the pipeline — an eerie echo of “find, fix, finish,” a military term used by special forces in the U.S. government’s assassination campaign against terrorist targets.

TigerSwan pays particular attention to protesters of Middle Eastern descent. A September 22 situation report argues that “the presence of additional Palestinians in the camp, and the movement’s involvement with Islamic individuals is a dynamic that requires further examination.” The report acknowledges that “currently there is no information to suggest terrorist type tactics or operations,” but nonetheless warns that “with the current limitation on information flow out of the camp, it cannot be ruled out.”

Haithem El-Zabri, a Palestinian-American activist singled out in the reports, was shocked to hear his name mentioned in that context. “As indigenous people, Palestinians stand in solidarity with other indigenous people and their right to land, water, and sovereignty,” he told The Intercept. “To insinuate that our assumed faith is a red flag for terrorist tactics is another example of willful ignorance and the establishment’s continued attempts to criminalize nonviolent protest and justify violence against it.”

Such ethnic and religious profiling of protesters was not unusual. An October 12 email thread shared among members of the intel group provides a striking example of how TigerSwan was able to cast suspicion on specific individuals and communicate it to law enforcement officials. Cass County Sheriff’s Deputy Tonya Jahner emailed several other officers, including two FBI agents, with an overview of information provided by “company intel.” The information pertained to a woman whom Jahner labeled as a “strong Shia Islamic” with a “strong female Shia following.” The woman had “made several trips overseas,” Jahner wrote.

TigerSwan agents also regularly tracked individuals’ movements across state lines.

On November 4, according to one of TigerSwan’s internal documents, a white SUV pulled up to a pipeline valve site in South Dakota. Approached by a security guard, the driver introduced himself as Gary Tomlin and informed the official that he was a freelance reporter covering the pipeline. In an interview, 63-year-old Tomlin, who covers the local school board for the Galesburg, Illinois, Register-Mail, said he had set out to travel the length of the pipeline and write a story about it as a freelancer. “I had time and the ability to do it, and I thought, well, I’ll go look at that sucker,” he said.

A situation report from that day notes, “This is the same individual identified in the SITREP a few days ago in Illinois and Iowa.” The security company, OnPoint, quickly contacted TigerSwan Intel “for an assessment of Gary Tomlin” and notified the guard in the next “sector” that Tomlin was on his way. “Movement of Spread Team 6 was conducted so as to intercept and/or observe Gary Tomlin’s movement throughout the South Dakota Sector,” the document states. “It is my belief,” the analyst adds, “that Gary Tomlin is hiding his true intentions and that he has a plethora of information to provide to the protesters. It is estimated that he will arrive in North Dakota on the evening of the 4th or morning of the 5th.”

Tomlin laughed at the notion that he was working with protesters. When he arrived at the camps in North Dakota, few people would talk openly with him. “They were highly aware of infiltrators,” he said. “I fit the profile of those security people — I’m a white old man.”

Cody Hall, a prominent native activist whose movements are tracked closely in the TigerSwan reports, told The Intercept he knew he was being followed whenever he left the camp.

“It was obvious, they were driving in trucks, SUVs, they would be right behind me, right next to me … it was like, damn, man, it’s like you’re getting an escort,” he said. “That was always the scary thing: How did they know that I was coming?”

Robert Rice hosted a series of videos critical of the pipeline protest movement without disclosing that he was working for TigerSwan. The videos, which were posted on two Facebook pages, were taken down after The Intercept reached out to the firm for comment.

Social Engagement Plan

A document dated October 16, obtained via a public records request, lays out the mission of the TigerSwan-led security team working in North Dakota: In addition to protecting the pipeline workers, machinery, and construction material, the company was also expected to “protect the reputation of DAPL.” The public relations mission quickly became a priority for the firm, documents show. As a leaked situation report from early September puts it, success would require “strategic messaging from the client that drives the message that we are the good guys, tell the real story and address the negative messaging with good counter messaging.”

On numerous occasions, TigerSwan agents stressed the need to change the public narrative established by protestors and to swing public support in favor of the pipeline. As accounts of protest repression garnered nationwide support for the NoDAPL movement, the firm’s agents painstakingly collected and analyzed media coverage, warning their client about how certain incidents might be received by the public.

“This article is only in the Huffington post, but the expansion of the tribe’s narrative outside of the Native American community media outlets is of concern,” an October 3 report notes. TigerSwan agents regularly describe protesters’ accounts of events as “propaganda.”

But TigerSwan personnel did not limit themselves to monitoring the narrative — they also tried to change it.

In a report dated September 7, TigerSwan agents discuss the need for a “Social Engagement Plan.” On September 22, they discuss the development of an information operations campaign run by the company’s North Carolina-based intel team and Robert Rice, who without disclosing his TigerSwan affiliation posed as “Allen Rice” in a series of amateurish videos in which he provided commentary critical of the protests. The videos, posted on the Facebook pages “Defend Iowa” and “Netizens for Progress and Justice,” were removed after The Intercept contacted TigerSwan, Rice, and the pages’ administrators for comment. None responded.

With the Dakota Access Pipeline construction nearing completion, TigerSwan might have found itself out of a lucrative contract. But in the months leading up to the first oil delivery through the pipeline, the company made sure to stress the continued need for security.

“Everyone must be concerned of the lone wolf,” a TigerSwan operative wrote in a March 7 report. “Should we slip from that conscience, we may all be amiss. I cannot afford this in my duties, nor will We/I allow or accept this. I cannot thank everyone for enough for their support during this entire process, However, the movement continues, and We/I will not stop. That’s not in my vocabulary. We will always over-watch as the protectors what is in the best interest for ETP, as we are the guardians.”

In recent weeks, the company’s role has expanded to include the surveillance of activist networks marginally related to the pipeline, with TigerSwan agents monitoring “anti-Trump” protests from Chicago to Washington, D.C., as well as warning its client of growing dissent around other pipelines across the country.

In a March 24 report discussing the likely revival of protests as summer approaches, TigerSwan writes, “Much like Afghanistan and Iraq, the ‘Fighting Season’ will soon be here with the coming warming temperatures.”

Documents published with this story:

• Internal TigerSwan Situation Report 2016-09-07
• Internal TigerSwan Situation Report 2016-09-11
• Internal TigerSwan Situation Report 2016-09-12
• Internal TigerSwan Situation Report 2016-09-13
• Internal TigerSwan Situation Report 2016-09-14
• Internal TigerSwan Situation Report 2016-09-22
• Internal TigerSwan Situation Report 2016-10-16
• Internal TigerSwan Situation Report 2016-11-05
• Security Operations Overview 2016-10-16
• Security Operations Overview 2016-10-19
• Shared Daily Intelligence Update 2016-10-16
• Shared Daily Intelligence Update 2016-11-05
• Intel Group Email Thread 2016-10-12

To search all TigerSwan documents published by The Intercept, go to the TigerSwan project page on DocumentCloud.