May 2017 Field Analysis Report

2 May 2017 TTPs Used in Recent US Pipeline Attacks by Suspected Environmental Rights Extremists . Prepared by the Montana Analysis and Technical Information Center (MA TIC), Minnesota Fusion Center (MNFC), North Dakota State and Local Intelligence Center (NDSLIC), South Dakota Fusion Center (SDFC), Washington State Fusion Center (WSFC), the Illinois Statewide Terrorism 8. Intelligence Center and the Iowa Division of Intelligence and Fusion Center jointly with the DHS Office of Intelligence and Analysis and coordinated with Transportation Security Administration (TSA). (U) Scope: This Field Analysis Report (FAR) highlights recent criminal disruptions and violent incidents against pipeline projects in the Midwestern and Western United States in 2016, and shows how activities at these events compare with larger environmental rights extremist strategic trends?including those related to targeting, tactics and procedures (TTPs). it This product is intended to asSist government and law enforcement security partners in identifying, deterring, preventing, and responding to potential threats against pipelines and related entities. It includes a discussion of drivers possibly affecting the future threat of pipeline-related violence from environmental rights extremist violence. (U) Key Judgments . We assess the October 2016 valve shutoff attacks against five pipelines along the Canada border by suspected environmental rights extremists showed a high level of pre-operational planning. . We assess suspected environmental rights extremists exploited Native American causes in furtherance of their own violent agenda during a campaign to halt construction of the Dakota Access Pipeline-(DAPL) in the Midwest and Western United States in 2016.i . We assess that while some characteristics of a series of arsons against lowa pipeline construction sites in 2016 could be'indicative of an environmental rights extremist attack, other factors could reasonably suggest a possible non-ideological motive. This assessment is subject to change if new information emerges. Additionally, environmental rights extremism is a plausible motivation behind multiple attacks against construction equipment in North Dakota during the same period. . The TTPs observed during the 2016 incidents included but were not limited to: destroying property; using small teams for attacks; choosing remote and guarded targets; wearing disguises; starting simple fires to create barricades; ?doxing? government of?cials; using drones; using 'small improvised explosive devices (lEDs); and throwing projectiles and Molotov cocktails at officers-? DHS defines environmental rights extremists as groups or individuals who facilitate or engage in acts of unlawful violence against peOpIe, businesses, or government entities perceived to be destroying, degrading, or exploiting the natural environment. DHS defines terrorism as any activity that involves an act that is dangerous to human life or potentially destructive to critical infrastructure or key resources, and is a violation of the criminal laws of the United States or of any state or other subdivision of the United States and appears to be intended to intimidate or coerce a civilian population to influence the policy of a government by intimidation or coercion, or to affect the conduct of a government by mass destruction, assassination, or kidnapping. i (U) For background information on DAPL, see Appendix A. (U) Doxing attacks often include posting on websites targeting individuals? personal background, associates or family, place of employment, home address, or contact information. ENFORCEMENT SENSITIVE PARRISH

ENFORCEMENT SENSITIVE. 5 We assess environmental rights extremists are likely to use some of these same criminal and violent tactics in attempts to disrupt other energy projects elsewhere in the United States? including those related to pipeline construction?in the coming year. (U) Significant Incidents in 2016 Pipelines and associated construction projects in the Midwestern and . 7 . 7 4 7 7 Western United States in 2016 were targeted with multiple criminal and violent acts designed to disrupt fossil fuel transportation infrastructure and impede or injure law enforcement. These include valve shutoffs along the northern border, destruction of construction equipment, and arson attacks against Iowa pipeline construction sites. - (U) Valve Shutoffs along Northern Border We assess the October 2016 valve shutoff attacks against five pipelines along the US?Canada border by suspected environmental rights extremists showed a high level of pre- operational planning. Multiple teams? comprised of individuals who traveled from across the United States?conducted simultaneous attacks against remote valve'sites, wore disguises, and executed plans.7'12- The apparent ease with whigh?these valve shutoff attacks were carried outahd the heavy media coverage they attracted lead us to be concerned that other environmental rights extremists could also pursue coOrdinated attacks against the energy sector. Although these valve attacks did not?result in any loss of life, manually shuttingjpi'peline valves carries an inherent risk of death'or serious injury if a pipeline On 11 October 2016, suspected environmental rights extremists shut down five pipelines along the US?Canadian border in Minnesota, Montana, North Dakota, and Washington for over seven hours, resulting in estimated financial losses in the hundreds of thousands of dollars, according to DHS, court documents, law enforcement information, and press reporting.? 18 Nine individuals were subsequently arrested on charges related to tampering with pipeline valves and preventing the transportation of petroleum. The subjects claimed to have targeted the pipelines to show solidarity with actions against DAPL. They also called on the President to use emergency powers to keep the pipelines closed and requested a total ban on new fossil fuel extractions and an immediate end to use of tar sands and DHS recognizes that individuals associated with various groups and movements participated in criminal and violent acts against pipelines in 2016. For the purposes of this paper, these individuals are referred to as environmental rights extremists, as these campaigns were fundamentally about protecting the environment??whether that is oppo'sing oil pipeline construction projects or protecting the indigenous water supply from pollution. I (U) For other examples of environmental rights extremists attacks against the energy sector, see Appendix B. ENFORCEMENT SENSITIVE Page20f18 PARRISH

ENFORCEMENT SENSITIVE coal, according to DHS reporting and an online press release from a group representing the individuals. 19, 20. (U) OBSERVATIONSITTPS Small Teams Used for Attacks In each of the valve shutoff incidents, there were at least three participants?one initiating the shutdown and the other two filming the event, according to US Department of Energy and law enforcement reporting. 21 22. 23. 2? Many Attackers Traveled from Outside of State: Many of the attackers were from outside the area? some from as far away as Vermont and New York, according to court documents and law enforcement report_ing.26I27I28 One female participants arrested for filming the shutdown of one of the pipelines in North Dakota claimed to have little knowledge of the other attackers? plans to commit simultaneous pipeline attacks in the region. She, however, later admitted to law enforcement she had traveled by train from New York City with one of the individuals who planned to disrupt pipelines in Minnesota and stayed in the same motel with the two other 7 individuals who disrupted another pipeline in North Dakota.29 Guarded Targets Selected. Pipeline valve sites?such as those targeted' In the attackw-are typically located every 10 to 15 miles along a pipeline and have minimal security, according to law enforcement reporting. 30 3/ Attackers Gave Advance Notice to Pipeline Companies: Attackers made phone calls to pipeline operators in NOrth Dakota and Minnesota to give advanced notice that a valve Closure was imminent, according to media reporting.? .32 Disguises Worn During Attacks: Pictures posted to websites supportive of the valve attackers indicate they disguised themselves as pipeline?employees to carry out their attacks, donning hard hats and reflective safety vests. 33 According to law enforcement reporting, the hard hats and reflective vests had a red on them?a known symbol of their campaign to halt fossil fuel production. 3? Unsophisticated, Easily Acquired Tools Used During Attacks: The subjects used bolt cutters to gain access to the above?ground maintenance facilities and removed chains protecting the valves from being turned off, according to websites supportive of the valvershutoff (U) For background information on tar sands, see Appendix C. ENFORCEMENT SENSITIVE Page3of18 PARRISH

ENFORCEMENT SENSITIVE action. The individuals then prevented others from regaining control of the valve by attaching their own locks. 35 36I 37 Contingency Plans Made: During one of the attacks against the pipelines, the attackers were unable to close a valve and instead simply chained themselves to the pipeline, according to US Department of Energy reporting.38 (U) Escalation to Violence at DAPL Occupation in North Dakota We assess that starting in the summer of 2016, suspected environmental rights extremists exploited Native American anti- DAPL protests to attract new members to their movement, gain public sympathy, and justify their criminal and violent acts. 39. 40 Native American tribes claim the pipeline route crosses sacred sites and burial places, and they are concerned a future pipeline rupture could pollute tribal drinking water. 41 We as?Sess the significant media attention and public sympathy gained by the environmental rights extremists from this new alliance with Native American tribes makes it likely environmental rights extremists will attempt to exploit indigenous causes for their own ideological purposes in future environment- related events. 42 47 -. Since August 2016, suspected environmental rights extremists have engaged' In multiple violent incidents' In North Dakota at illegal encampments on DAPL and US Army Corps of Engineers property in an effort to halt pipeline construction, according to law enforcement reporting. The occupation, which ended on 24 March 2017, resulted in 761 arrests for various crimes?primarily on charges cf criminal trespassing and engaging in a riot with individuals who traveled to the region from California, representing the largest number of arrests at 115, or 15.1 percent, according to law enforcement reporting. 49 5? Individuals have engaged' In physical assault and threats of physical assault, as well as use of Molotov cocktails and lEDs. (U) OBSERVATIONSITTPS: Use of Potentially Lethal Devices: On 27 October 2016, during law enforcement clearing of an encampment, an individual shot a firearm at law enforcement officers who had confronted her while taking her into custody, according to law enforcement. No injuries were reported in that incident.55 That same day, individuals threw three Molotov cocktails at officers during clearing operations, according to media reporting.56 On 21 November 2016, an individual female involved in violent clashes with law enforcement threw small IEDs at officers, resulting in near amputation of her arm after one of the IEDs exploded prematurely, according to (U) The Dakota Access Pipeline is sometimes referred to as the Bakken Oil Pipeline. ENFORCEMENT SENSITIVE Page4of18 PARRISH

ENFORCEMENT SENSITIVE law enforcement and DHS reporting.57 From 3 to 5 December, individuals, including suspected environmental rights extremists, plotted, but did not execute, a coordinated attack on a DAPL drill site from all directions. The individuals claimed they would stop the pipeline at all costs and were not opposed to using Suspicious Drone Use: On 07 September 2016, three suspected environmental rights extremists in Bismarck approached the front gate of the Fraine Barracks?which houses several emergency services agencies, the National Guard, and the NDSLIC?~stating they had crashed a drone on the property, according to law enforcement. After being informed they could not access the site, they asked questions about the barracks before leaving the area.61 On 23 October 2016, according to law enforcement, a suspected environmental rights extremist used an 18-inch? ?b-y 18 inch drone to disrupt law enforcement air operations by flying it within 50 feet of a law enforcement helicopter. The same drone was later encountered by law enforcement when it flew towards officers approximately 20?30 yards off the ground and then started hovering above them. Law enforcement, which attempted to disable the drone With nonlethal and lethal munitions due to officer safety concerns, believed the drone was. surveilling them, according to DHS reporting. We judge this was likely an effort designed to provide advanced notice of enforcement operations protecting DAPL construction. 62 63 Surveillance and Doxing: Since the beginning of the anti- DAPL campaign in August 2016, there have been several incidents of suspected environmental rights extremists surveilling law enforcement facilities In cities near encampments. We jUdge these incidents?including reports of individuals being photographed entering and exiting a law enforcement facility' In Mandan and officers being surveilled at their residences and followed by suspicious vehicles? were likely an attempt to intimidate officers for their r6le' In protecting DAPL construction efforts. 64 Personal contact information for a senior North Dakota Emergency Services (NDDES) official accused of removing water from encampments was posted online on 24 August 2016, resulting' In a sharp" Increase in harassing phone calls to the NDSLIC against the NDDES employee, according to law enforcement. 65 A private security guard for DAPL had her personal phone number and e- m?ail address posted on social media by supporters of the anti- DAPL campaign, apparently In reaction to a previous incident' In which she used dogs against an - aggressive crowd, according to law enforcement sources. Another security guard? 8 children were identified on social media and law enforcement officers reported their home addresses had also been posted online 66 Travel from. outside the State: On 08 September 2016, members of Canadian indigenous tribes took multiple buses from three reservations/territories to panicipate' In the US campaign to stop DAPL construction. Suspected violent extremists on these bUses reportedly carried weapons and riot gear, according to law enforcement, indicating likely intent to commit violent acts. 67 68 Indigenous travel from Canada has been confirmed by Canadian law enforcement. 69 As of 24 March 2017, only 51 of the 761 persons arrested for politically motivated criminal acts In opposition to DAPL were from North Dakota, according to law enforcement. 7? Call to Arms from Hacking Movements: An individual associating himself or herself with the hacking collective Anonymous posted a call for support online, listing the North Dakota Highway Patrol and National Guard as possible targets. However, there has been no evidence of unusual activity on their networks, according to law enforcement.71 Additionally, a movement called the ?Anon Resistance Movement? posted a video on social media advocating for violence in solidarity with the anti- DAPL campaign, including further sabotage of pipelines and railroads. 72 ENFORCEMENT SENSITIVE . Page50f18 PARRISH

ENFORCEMENT SENSITIVE Possible Pre-Operational Surveillance: On 14 November 2016, law enforcement received information regarding two suspicious subjects who were encountered twice by law enforcement on 11 November 2016 near DAPL drill sites' In Patoka and Meredo'sia, Illinois The individuals claimed to be birdwatchers looking for a local wildlife refuge, and stated they would either find a hotel or camp, although officers said they had no camping equipment and appeared to be surveilling the drill site. The individuals also appeared to be recording the encounter with the officer, and one of them had a mapping application open on a cellphone, possibly pinning their locations on the map. 73 Vandalism against DAPL Financiers and Vague Online Threats: On 18 November 2016, a suspected environmental rights extremist indicated the movement?s intent to disrupt the financial operations of DAPL by posting a communiqu? on an anarchist website claiming credit for vandalizing and "smashing" all the windows of a US bank' In Chicago because it was "a key investor' In 'the Dakota Access Pipeline. The individual warned other financiers with the threat that "it will remain open season on [their] offices, homes, and prejects" unless they withdraw financial support for DAPL 7? On 23 November, a suspected environmental rights extremist posted a statement to an anarchist website claiming credit for vandalism against a second branch of the Chicago bank In retaliation for "atrocities committed against" protestors' In North Dakota, and blamed the bank for the loss of their "cOmrade? arm. The individual called for vandalism of the bank?s branch offices, ATMs, security cameras, and signs, and then demanded that the bank and other DAPL supporters withdraw their support immediately, "otheIwise you may expect a long night before the dawn. "76 76 Disruption to Rail Transportation. On 15 No-,vember suspected environmental rights extremists placed debris and abandoned a vehicle with an accelerant-soaked rag hanging out of its gas tank on rail tracks near Mandan. Twenty?six individuals were arrested' In relation to the incident. Delays 'from this attack cost the rail company $2,071 9.4: On 09 January 2017, rail employees found Jumper cables connected to tracks that were painted white and hidden under snow. The cables created a signal interruption to the conductor, causing delays that cost the business 544. 52. There have been no arrests. The affected rail line' IS one of two non- passenger lines that transport Bakken Oil out of North Dakota. 76 76 Environmental rights extremist attacks against railways are typically designed to cauSe disruption rather than inflict mass casualties. However, such activity does introduce safety hazards that create the risk of injuries on the affected line. UNCLASSIFIEDHLAW ENFORCEMENT SENSITIVE Page60f18 PARRISH

ENFORCEMENT SENSITIVE Directed- -Energy Weapon: In early to mid? November, suspected environmental rights extremists attempted to construct at least one directed? ?energy device designed to disrupt or shut down radio frequencies . . . used by law enforcement, according to law enforcement sources. If properly configured and pointed at a communication network's antenna or repeater, such a device could disrupt transmissions or cause the system to reset itself, temporarily disrupting communications. If aimed at a communication network long enough, it Could destroy internal components or cause them to catch fire. In addition to posing a threat to a communication network's antenna or repeater, handheld radio and vehicular units are also susceptible to electromagnetic interference from such a device.81 :25,le CLASSIFIED (U) Use of Fire to Create Barricades: As law enforcement was breaking up encampments on 27 Octo,ber individuals I de ris and tIres on fire to create barricades, according to media reporting. 37- i (U) Construction Equipment and Pipelines Targeted in Igwa and the Dakotas We assess that a series of arsons against lbwa pipeline construction sites' In 2016 could be indicative of an environmental rights extremist attack?due to the targets? proximity and relationship with DAPL and because the use of arson attacks targeting construction sites Is an established tactic of the movement. However, Other factors?including a lack of graffiti at the crime scene, no claims of responsibility, a lack of historical activity in the region, and public controversy over the project?s use of eminent domain?suggest a non- -ideological motive. 83 This asseSsment' Is subject to change if new information emerges. Additionally, environmental rights extremism Is a plausible motivation behind multiple attacks against construction equipment' In North Dakota during the same period, as well as a series of attacks puncturing pipelines' In Iowa and South Dakota In late February and March 2017. On 14 September, employees of a construction company reported an unknown individual(s) used firearms to shoot several rounds of ammunition into a portable toilet and a backhoe at a pipeline construction site near Alexander, North Dakota. According to law enforcement, two of the rounds were fired at, but did not penetrate, the backhoe? 3 fuel tank, which could have sparked a fire. There were no injuries, and there have been no arrests or claims of reSponsibility for the attacks 8? On 13 September, law enforcement arrested individuals for criminal mischief and trespassing after they allegedly sabotaged an under-construction pipeline at a site near New Salem, North Dakota by placing a crate of miscellaneous items in the pipe. According to the pipeline?s lead safety inspector, had the crate gone undetected, it could have made the pipeline into a ?pipe bomb? capable of killing bystanders once a ?pig?' IS run through the pipeline. The individuals also broke the keys off' In the ignition of machinery and spray- painted the messages IS DAPL, and ILLINOIS IOWA NO DAPL. ?85 The individuals are awaiting trial. (U) A ?pig? Is a device used to check for pipeline leaks. ENFORCEMENT SENSITIVE . Page7of18 PARRISH

ENFORCEMENT SENSITIVE On 6 September, an unknown number of individuals damaged electrical wires of construction equipment at an oil pipeline construction site near St. Anthony, North Dakota creating a threat to worker safety. Additionally, the attackers cut hoses, punctured a tire, filled a radiator with fire extinguisher suppressant, and filled fuel tanks with dirt. There have been no arrests or claims of responsibilityfor the attacks.86 During the early morning hours of 31 July, 1 August, and 15 October, an unknown individua (s) set fires targeting heavy machinery at three construction sites associated with DAPL in Mahaska and Jasper Counties, Iowa, resulting in over $3 million in damage.87 There have been no arrests or claims of responsibility for the On 09 November, an unknown number of individuals set fire to four pieces of heavy construction equipment in Buena Vista County, Iowa. According to law enforcement, two additional pieces of equipment were prepped for burning but not set on fire. There have been no claims of responsibility for the attack. 92 - Between '24 and 25 September, unidentified environmental extremists sabotaged five pieces of heavy equipment at DAPL site near Winfred, South Dakota. The sabotage included cutting brakes and electrical wiring, causing a potential threat to worker safety. Additionally, dirt was found' In the motor, and rocks and gravel were found' In swing boxes. Estimated damages are over $50,000. Two individuals were identified as suspects and provisionally charged with first degree vandalism pending arrest. 93 (U) OBSERVATIONSITTPS: Sabotaging Heavy Equipment: The attackers targeted construction equipment at multiple sites?including bulldozers, a track hoe, excavators, and side-booms, according to law enforcement reporting.94*95 Some of the fires originated in the vehicles? cab compartments.96 Use of Simple Fires: In all cases, the arsons committed against construction equipment did not involve use of complex improvised incendiary devices, such as those that employ a time- delay mechanism to initiate a fire, according to law enforcement. 97 98 Possible Pre-Operational Surveillance: A few days prior to the Mahaska County attack, construction workers reported seeing an individual in a vehicle slowly driving past one of the construction sites and taking photographs, according to law enforcement. 99 Puncturing Pipelines: Between 28 February and 17 March 2017, an'unknown number of individuals at multiple DAPL-related aboveground valve stations in Iowa and South Dakota used a welding torch or similar tool to pierce segments of pipeline filled with nitrogen gas, which is pumped into pipelines to test for leaks. While nitrogen gas is non-flammable and poses no physical danger to the public, the hissing sound of gas escaping through puncture holes could lead'to Additionally, at an Iowa site that received a similar puncture attack, graffiti spray-painted on the control building declared Children Need Water,? ?Oil is Death,? and ?Mni Wiconi??a phrase that has recently become popular among opponents of DAPL campaign that means ?water is life? in the Lakota Indian tribe language.103 UNCLASSIFIEDHLAW ENFORCEMENT SENSITIVE . Page80f18 PARRISH

ENFORCEMENT SENSITIVE Outlook: Tactics and Drivers of Pipeline-Related Violence in Near Term We assess environmental rights extremists are likely to use some of these same criminal and violent tactics in attempts to disrupt other US energy projects for the remainder of 2017. Most of these tactics, which are available online for all to see, are relatively easy to carry out have perceived utility among environmental rights extremists in the larger effort?to halt DAPL construction. We further assess the following developments, if observed, could lead to an increased threat of violence in the coming months from environmental rights extremists against pipeline- related entities in the Midwest and Western United States: . High?profileinstances or allegations of excessive use of force during law enforcement actions related to pipeline construction; 0 Death or serious injury to occupiers at the hands of law enforcement, making for the cause; and New Canadian pipelines are constructedu-such as the Canadian Trans Mountain pipeline?potentially creating new grievances and resulting in enhanced sharing of violent TTPs between US and Canadian environmental rights extremists. . We assess the following developments, if observed, could lead me decreased threat of violence: . Law enforcement blockades prevent resupply of remaining occupiers; and I . Indigenous leaders involved in anti?pipeline campaigns ask remaining occupiers to leave out of concerns about the impending spring floods along the Missouri River and tributaries. (U) Intelligence Gaps Which camps house individuals who have an interest in using lethal weapons such as lEDs against law enforcement or pipeline entities in thefuture? Were training camps established to teach violent tactics to environmental rights extremists prior to their arrival in the region? Why are individuals conducting surveillance on law enforcement personnel and member of their family? What coordinated resourcing and funding is available to environmental rights extremists? ENFORCEMENT Page90f18 PARRISH

ENFORCEMENT SENSITIVE Comments, requests, or shareable intelligence may be directed to: STIC at 877-455-7842 or state. il. us; at 515- 725- 6310 or intca@dps. state. ia. us; MNFC at 651-793- 3730 or mn. fc@state, mn. us; MATIC at 406- 444? 1330 or dojintel@mt. gov; NDSLIC at 701?328? 8172 or ndslic@nd. gov; SDFC at 866- 466- 5263 or sdfusioncenter@state. sd. us; WSFC at 877- 843- 9522 or intake@wsfc. wa. gov. To report actIVIty, law enforcement Fire EMS, private security personnel and emergency managers should established protocols all other personnel should call 911 or contact local law ethrCemerIt. Su?Spicious I actiVIty reports (SARS) WIll be forwarded to the appropriate fusion center and FBI Joint TerrOrism Task Force for further action. 'For more infOrmation on the NatIonWIde SAR InitiatiVe, viSit http: ncirc. goV/resOurces. aspx. . Tracked byDHS NFCA- 2016/17- KIQ- 24 1, HSEC 8. 2' HSEC- 8. 3' HSEC- 8. 5, HSEC- 8. 6; 8. 8' 8. 10' HSEC- 101, HSEC- 10. 2? 10. 5? HSEC 10. 6' HSEC-10. 8; 10; 17? 05. 52015; MNO1. 3; ND HSEC 8.;1 ND- HSEC 8. 2, ND- HSEC 8. 3; ND- HSEC 8. 5; ND HSEC 8. 6, ND- HSEC 8. 8; ND-HSEC 8.10; ND-HSEC 101 ND HSEC10 2; ND- HSEC 10. 5; ND- HSEC 10. 6' ND- HSEC 10. 8; ND-HSEC 10.10; HSEC-02 02000? P1- 2010, HSEC- 02- 03000? P1 2010' 8.1, 12.1; STIC- SIN- 12. 7' STIC- SIN-12. 11; WSFC-1. 1 1 3.;1 WSFC- 1. 8.1 1. 8.;2 WSFC-1.101 UNCLASSIFIEDHLAW ENFORCEMENT SENSITIVE . - Page100f18 PARRISH

ENFORCEMENT SENSITIVE (U) Appendix A: The Dakota Access Pipeline The Dakota Access Pipeline project is an underway $3.78 billion construction project to build a 1,172?mile, 30-inch diameter pipeline for transporting US light sweet crude oil from the Bakken and Three Forks production areas of North Dakota to existing pipelines in Patoka,? Illinois for further distribution to refining markets.104 DAPL construction attracted controversy as a result of a North Dakota-based indigenous tribe?s claims that pipeline leaks would contaminate the water supply of their reservation;105 In July 2016, the tribe filed a lawsuit against the US Army Corps of Engineers for its role in granting permits to build the pipeline.106 The lawsuit spUrred a series of protests and demonstrations near the reservation.107 Members of other Indian tribes?as well as environmental rights extremists who share the tribes? underlying goal of halting construction of the pipeline?have traveled from across the United States and Canada to join the Since August 2016, there have been hundreds of arrests for criminal and violent incidents at encampments set up by anti-pipeline groups and nearby DAPL-related sites in an effortto stymie construction efforts?wv111 Minneso?ta ENFORCEMENT SENSITIVE Page11of18 PARRISH

ENFORCEMENT SENSITIVE (U) Appendix B: Prior Energy Sector Attacks by Environmental Rights Extremists The pipeline attacks in the Midwest and Western United States in the latter half of 2016 were the first significant environmental rights extremist attacks targeting the transportation and energy sectors since September 2015. The last known attack specifically targeting a pipeline occurred' In Texas in 2012. On 16 September 2015, environmental rights extremist Rory Gunderman exchanged gunfire with South Dakota law enforcement officers and then fatally shot himself. Subsequently, law enforcement officers located Gunderman?s remote campsite in Custer County, South Dakota, where they discovered a stolen weapon, digital media,.and the components necessary to manufacture numerous According to recovered evidence, Gunderman purchased numerous . components in Spearfish, South Dakota on 8 September 2015.114 Analysis of digital media In Gunderman? possession revealed recently accessed copies of al- Qa? ida' In the Arabian Peninsula? 8 Inspire magazine, including editions 1, 10, and 12. ?5 Though the exact targets and timing of Gunderman? plot remain unknown, his behavior and statements indicated a fixation on the energy sector. ?6 Gunderman additionally claimed membership' In the Crescent City, California? based Deep Green ResistanceUSPER. Though the group maintains it only engages in nonviolent activities, the organization promotes the belief that a separate ?underground? IS needed to conduct violent ?direct action? in order to save humanity and other life on earth from environmental disaster. This violent direct ation would include attacks against critical infrastructure ?to disrupt and dismantle industrial civilization.?117 In September 2014, a suspected environmental rights extremist(s) in Washington stole a bulldozer and drove it into the base of a US Department of Energy 500?kilovolt powerline tower in an apparent attempt to knock the tower down. The incident did not result in any significant damage. Graffiti associated with anti-capitalism and environmental rights extremism was spray? ?painted at the scene and on nearby structures. Graffiti included the phrase ?#killcap? (?Kill Capitalism?), ?Corrupt Society,? and the acronym for the environmental rights extremist movement Earth Liberation Front. The case is currently under investigation. ?9 (U) From 17 to 18 June 2012., environmental rights extremist Anson set off a series of explosive devices on top of an gas pipeline in Plano, Texas. Chi. intended to damage the pipeline and disrupt natural gas flow. He was sentenced to 20 years in prison without parole on 30 June 2014.120!121 Chi pled guilty to a charge of attempting to destroy a natural gas pipeline used in interstate commerce, and to a charge Of possessing an explosive device not registered with the National Firearms Registration and Transfer Record.122 Chi also contacted well known convicted bomber Theodore to be a mentor; eventually broke off contact and told Chi to seek professional help.123 ENFORCEMENT SENSITIVE Page120f18 PARRISH

ENFORCEMENT SENSITIVE (U) Appendix C: Tar Sands (U) Several pipelines along the US?Canadian border carry crude oil into the'United States for refinement and distribution.124 Alberta, Canada has one of the world?s largest deposits of a particularly thick and heavy form of crude oil known as tar sands oil. Tar sands oil is controversial because of perceived negative impacts to the environment that occur during mining, processing, and transporting the oil?such as large 002 emissions contributing to climate change, contamination of groundwater during extraction, and destrUction of natural resources used by indigenous tribes.125 In October 2016, US environmental rights extremists engaged in coordinated attacks to disrupt five border pipelines perceived to be transporting tar sands oil from Canada into the United States.126 ENFORCEMENT SENSITIVE- Page130f18 PARRISH

ENFORCEMENT SENSITIVE Appendix D: Behavioral Indicators of Planned Criminal or Violent Activities Targeting Pipelines There area number of potential behaviors and indicators of planned criminal or violent activities targeting pipelines and associated entities. Some of these behavioral indicators may be constitutibnally protected activities and should be supported by additional facts to justify increased suspicions. Planning of violent activities related to major protests on message boards, social networking sites, or in Internet chat rooms; - Reports of rhetoric indicating a desire to manually close pipeline valves or engage in violence targeting pipelines and associated entitities; Possession of bolt cutters to cut security fencing or locks and homemade devices to chain oneself to pipeline valves or construCtion equipment; Reports of graffiti threatening violence related to a pipeline; Threatening phone calls or emails to corportate executives, businesses, or contractors associated with pipeline construction efforts; Signs of trespassing or suspicious persons in_ construction areas?possibly indicating pre-incident surveillance; Reports of individuals wearing all dark or black clothing and masks or bandanas without a reasonable explanation; Possession of sharp or blunt objects (knives, axes, machetes, dowels, tire irons) or illegal firearms during protests; Reports of attacks on opposition vehicles, possibly involving lighting them on fire or using them as roadblocks; Reports of individuals acquiring materials that could be used to build improvised incendiary devices propane gas canisters) or IEDs without a'reasonable explanation; Reports of individuals moving heavy materials fences, tires, trashcans, or dumpsters) to make barricades during protests, possibly with the intention to light them on fire; Reports of individuals pilfering bricks, rebar, or pipes from construction sites for use as potential projectiles; Pre-staging of bricks, rocks, or debris near protest sites for possible use as weapons; Reports of individuals carpooling from other locations to engage in planned criminal or violent acts during protests; and Reports of drivers not obeying law enforcement directions at traffic control checkpoints. ENFORCEMENT SENSITIVE Page14of18 PARRISH

ENFORCEMENT SENSITIVE 1 James F. Jarboe, Domestic Terrorism Section Chief, FBI Counterterrorism Division; Testimony before the House Resources Committee, Subcommittee on Forests and Forest Health; 12 FEB 2002; ?The Threat of Eco?Terrorism"; ?archives. fbi. of?eco? terrorism; accessed on 26 APR 2016. 2 The Washington Post; ?The Big Fight over the Dakota Access Pipeline, Explained"; 20 SEP 2016; targeting- energy- -pipelines? like?the-north? dakota? ?project/; accessed on 17 NOV 2016. 3 Sources Available Upon Request. 4 GreenMedlnfo. com; Special Report on Standing Rock: The Environmental and Social Justice Consequences of the Dakota Access Pipeline"; 28 OCT 2016; http: greenmedinfo. com/blog/special- -report-standing? rock- consequences-dakota; accessed on 30 NOV 2016; Environmetal protection website. 5 KXAS- TV, ?Anson Chi Given 20 Years In Plano Pipeline Bombing"; 30 JUN 2014; http: com/news/local/Anson-Chi? Given-20 Years? ?in? ??Piano Pipeline?Bombing? 305731811. html; accessed on 18 OCT 2016, (U), Dallas- Fort Worth NBC affiliate news website. 6 South Dakota Attorney General? 3 Office; Press release; ?Lawrence County Officer Involved Shooting Summary Released?; 08 OCT 2015; http: //atg sd. gov/LinkClick. aspx?fi eticket= F- Ronn36MEg%3d&tabid= 442; accessed on 03 DEC 2015. 7 (U), Sources Available Upon Request. 8 Sources Available Upon Request. 9 State of North Dakota District Court; CRIMINAL 1-3 OCT 2016; vs. Michael Eric File No. 34- 2016- Extracted information' Is Overall document classification' IS UNCLASSIFIED. 10 Sources Available Upon Request. 11 Sources Available Upon Request. 12 Sources Available Upon Request. 13 Sources Available Upon Request. 14 Rebecca Hersher; ?Protesters Disrupt Pipelines Across the Northern 12- OCT 2016; west; accessed on 17 NOV 2016. 15 Sources Available Upon Request. 16 Sources Available Upon Request. 17 Sources Available Upon Request. 13 Sources Available Upon Request. 19 Sources Available Upon Request. 2? Sources Available Upon Request. 21 Sources Available Upon Request.? 22 Sources Available Upon Request. 23 Sources Available Upon Request. 7-4 (U), Sources Available Upon Request. Raw Story (Reuters); ?Daring US Pipeline Sabotage Spawned by Lobster Boat Coal Protest"; 1-3 OCT 2016; http: rawstory. com/2016/10/daring- -us- pipeline?sabotage-spawned? by- lobster- boat~coal~ protestl; accessed on 17 NOV 2016; National news website. 26 Sources Available Upon Request. 27 Sources Available Upon Request. Sources Available Upon Request. 29 Sources Available Upon Request. 3? Sources Available Upon Request. 31 (U), Rebecca Hersher; NPR, ?Protesters Disrupt Pipelines Across the Northern 12 OCT 2016; http: npr. org/sections/thetwo- ?dlsrupt?pipe ines? across-the? west, accessed on 17 NOV 2016. 32 Sources Available Upon Request. 33 Sources Available Upon Request. 34 Sources Available Upon Request. 35 Sources Available Upon Request. 36 Sources Avaiiable Upon Request. 37 Sources Available Upon Request. 38 Sources Available Upon Request. 39 The Washington Post; ?The Big Fight over the Dakota Access Pipeline, Explained?; 20 SEP 2016; washingtonpost. com/neWs/monkey cage/wp/2016/09/20/this is?why-environmentalists- a?re? targeting- energy? pipelines- like-the- north- dakota- -project/; accessed on 17 NOV 2016. 4? Sources Available Upon Request. ENFORCEMENT SENSITIVE Page15of18 PARRISH

ENFORCEMENT SENSITIVE 41 Rebecca Hersher; ?Protesters Disrupt Pipelines Across the Northern 12 OCT 2016; http: npr. org/sections/thetwo- ?disrupt?pipeiines-across? the- west; accessed on 17 NOV 2016. 42 Holly Yan; ?Dakota Access Pipeline: What?s At Stake"; 28 OCT 2016; accessed on 04 JAN 2017. 43 Fox News "Feds Block Controversial Dakota Access Pipeline Route"; 04 DEC 2016; http: foxnews. com/us/2016/12/04/feds? block?route- dakota? ?a-ccess p-ipeline. html; accessed on 04 JAN 2017. 44 ?Dakota Access Pipeline Protest Update"; 22 OCT 2016; http: msnb.c com/am- joy/watch/dakota- a?ccess pipeline-protest?update- 791551043506; accessed on 04 JAN 2017; Update by Amy Goodman of Democracy Now on the show AM JOY. 45 Nives Dolsak, Aseem Prakash, Maggie Allen; The Washington Post; ?The Big Fight Over the Dakota Access Pipeline, Explained"; 20 SEPT 2016; washingtonpost. com/news/monkey- cage/wp/2016/09/20/this- i?s? why? ?envir0nmentalists- energy-pipelines- like-the? north- dakota- projectl?utm_ term= .e93e5659923d; accessed on 04 JAN 2017. 46 (U), Jack Healy and Nicholas Fandos; The New York Times; "Protesters Gain Victory In Fight Over Dakota Access Pipeline"; 04 DEC 2016; http: nytimes. com/2016/12/04/us/federal- officials- to? explore?different- -route-for-dakota- -pipeline html; accessed on 04 JAN 2017. 47 (U), Merrlt Kennedy; NPR, "More than 1 Million Check In to Support the Standing Rock Sioux?; 01 NOV 2016, http: than? a-million- check-in- -on- facebook- to- -support?the-standing? rock?sioux; accessed on 04 JAN 2017. 48 Sources Available Upon Request. 49 (U), Sources Available Upon Request. 50 Sources Available Upon Request. 51 Sources Available Upon Request. 52 Sources Available Upon Request. 53 Caroline Grueskin and Lauren Donovan; The Bismarck Tribune; "Protesters, Law Enforcement Clash as Camp Cleared?; 27 OCT 2016; http: enfOrcement'? clash as?camp? -c eared/artic e_ d8170db7- 66f9? 5f34?916a? 35d40097e07c. html; accessed on 17 NOV 2016.. 54 SourCes Available Upon Request. 55 Sources Available Upon Request. 56 (U) CNN, ?Dakota Access Pipeline. Police Remove Protesters?Scores Arrested"; 27 OCT 2016; cnn. pipeline- protests/index. html; accessed on 17 NOV 2016 57 Sources Available Upon Request. 58 Sources Available Upon Request. 59 Sources Available Upon Request. 60 Sources Available Upon Request. 61 Sources Available Upon Request. 62 Sources Available Upon Request. 63 Sources Available Upon Request. 64 Sources Available Upon Request. 65 Sources Available Upon Request. 65 (U), Sources Available Upon Request. 57 Mark Rendell; CBC News, "Denendeh to Dakota. .W. T. Activists Head to Standing Rock to Join Pipeline Protests?; 01 NOV 2016; http: cbc. ca/news/canada/north/denendeh- a-gainst-dapl- -nwt- activists-to- -standing- rock?1. 3830987; accessed on 17 NOV 2016; Canadian national news website. .68 Sources Available Upon Request. 69 Sources Available Upon Request. 70 Sources Available Upon Request. 71 Sources Available Upon Request. 72 Sources Available Upon Request. 73 Vital Dbase Entry 239207; 14 NOV 2016; DOI 14 NOV 2016 ?Possible Surveillance of Dakota Access Pipeline In Illinois?; Extracted information is Overall document classification is 74 Sources Available Upon Request. 75 Sources Available Upon Request. 76 Sources Available Upon Request. 77 Sources Available Upon Request. 78 Sources Available Upon Request. 79 Sources Available Upon Request. ENFORCEMENT SENSITIVE Page160f18 PARRISH

ENFORCEMENT SENSITIVE 80 Billings Gazette; ?Gallatin County May not Help at DAPL Protest"; 09 NOV 2016; accessed on 17 NOV 2016. 81 Sources Available Upon Request. 82 ?Dakota Access Pipeline: Police Remove Protesters?Scores Arrested?; 27 OCT 2016; accessed on 17 NOV 2016. 83 William Petroski;The Des Moines Register; "Dakota Access Pipeline Approval Disputed in Iowa Court"; 15 DEC 2016; http: desmoinesregister. pipeline- approval disputed? iowa?court/95420126; accessed on 02 MAR 2017. 84 Sources Available Upon Request. 85 Sources Available Upon Request. 86 Sources Available Upon Request. 87 Newton Daily News; ?Arson Investigation UndenIvay on Three Bakken Pipeline Sites"; 01 AUG 2016; newtondailynews. com/2016/08/01/arson? ?investigation underway?on?three- bakken pipeline? sites/a7lcOhyl; accessed on 17 NOV 2016. 83 Mike Mendenhall; Newton Daily News; ?Arson Investigation Underway on Three Bakken Pipeline Sites?; 1 AUG 2016; http: newtondailynews. com/2016/08/01/arson? i?nvestigation? Underway-on- three? bakken? ?pipe ine- -sltes/a7 cOhy/; accessed on 17 NOV 2016. 89 Sources Available Upon Request. 90 Radio Iowa; ?More Pipeline Construction Equipment Burned' In Jasper County"; 17 OCT 2016; radioiowa. -equipment- ~~burned ln-jasper-countyl; accessed on 17 NOV 2016; Local radio news biog. 9? Josh Morgan; Reuters; "Fire Near North Dakota Pipeline Protests' IS Under Investigation"; 30 OCT 2016, http: reuters. com/article/us- ~usa? ?pipeline- accessed on 17 NOV 2016; (U), National news website. 92 Sources Available Upon Request. 93 Sources Available Upon Request. 94 Sources Available Upon Request. 95 Sources Available Upon Request. 95 Sources Available Upon Request. 97 Sources Available Upon Request. 98 Sources Available Upon Request. 99 Sources Available Upon Request. 10? Sources Available Upon Request. 101 Sources Available Upon Request. 102 Sources Available Upon Request. 103 Sources Available Upon Request. 104 Energy Transfer Partners, ?Dakota Access Pipeline Fact Sheet"; 24 DEC 2016?, http: daplpipelinefacts. com/about/fact?sheet. html; accessed on 17 NOV 2016; Pipeline company website. 105 Sources Available Upon Request. 106 Catherine Thorbeke; ABC News; "Timeline of the Dakota Access Protests?; 28.0CT 2016; accessed on 17 NOV 2016. 107 Catherine Thorbeke; ABC News; "Timeline of the Dakota Access Protests?; 28 OCT 2016; http: llabcnews. go. com/US/timeline? dakota-access- -pipeline? ?protests/story?id= 43131355; accessed on 17 NOV 2016. 108 Sources Available Upon Request. 109 The Washington Post; ?The Big Fight over the Dakota Access Pipeline, Explained"; 20 SEP 2016; Washingtonpost. com/news/monkey? ?cage/wp/2016/09/20/this- -is- why-environmentalists- a?re? targeting- energy? ?pipelines like-the- north? dakota- -project/; accessed on 17 NOV 2016. 11? Sources AVailable Upon Request. 111 Fortune. com (Reuters); ?Police Have Arrested at Least 141 North Dakota Protesters"; 28 OCT 2016' http: //fortune. com/2016/10/28/north? dakota- pipeline?protest-arrestsl; accessed on 17 NOV 2016. ?2 93. 7 FM Radio, ?County Sees Population Increase Due to Pipeline Construction"; 04 JUL 2016; accessed on 17 NOV 2016; Radio news blog. ?3 Sources Available Upon Request. ?4 Sources Available Upon Request. 115 Sources AVailable Upon Request. 116 Sources Available Upon Request. 117 Sources Available Upon Request. 118 Sources Available Upon Request. ENFORCEMENT SENSITIVE Page17of18 PARRISH

ENFORCEMENT SENSITIVE ?9 The Seattle Times ?2 Radio Towers in Everett Toppled"; 04 SEP 2016; accessed on 17 NOV 2016. 120 ?Anson Chi Given 20 Years in Plano Pipeline Bombing"; 30 JUN 2014; 305731811.html; accessed on 18 OCT 2016. 121 US Department ofJustice; Press Release; ?Piano Man Guilty in Pipeline Bombing incident"; 03 JUN 2013; accessed on 18 OCT 2016. 122 Valerie Wigglesworth; The Dal/as Morning News; ?Plano Pipeline Bomber Given 20 Year Sentence?; 30 JUN 2014; sentence; accessed on 18 OCT 2016. 123 "Anson Chi Given 20 Years in Plano Pipeline Bombing"; 30 JUN 2014; 305731811.htm ; accessed on 18 OCT 2016. 124 Canadian Energy Pipeline Association; SHEET: What are the Different Types of Crude Oil Transported by Transmission Pipelines?"; 01 JUL 2016; accessed on 17 NOV 2016; Canadian petroleum agency. . . 125 DeSmogBlog; ?Top 10 Facts About the Alberta Oil Sands?; 21 SEP 2015; accessed on 17 NOV 2016; Environmental blog focusing on air pollution issues. 4 123 Jesse Ferreras; The Huffington Post; ?Canada-US Pipelines Shut Off by Activists?; 12 NOV 2016; accessed on 17 NOV 2016. - 127 BBC News; "Canada?s Black Gold Oil Rush"; 10 DEC 2008; accessed on 17 NOV 2016. ENFORCEMENT SENSITIVE Page18of18 PARRISH