April 2017 Joint Intelligence Bulletin

LAW ENFORCEMENT SENSITIVE JOINT INTELLIGENCE BULLETIN (U) This Information is the property of the CFIX and NDSLIC and may be distributed to federal, state, local, tribal and territorial law enforcement, and US Intelligence Community personnel on a need-to-know basis. This document contains LAW ENFORCEMENT SENSITIVE Information that cannot be released to the public, media, or other personnel who do not have a valid ?need-to?know? without prior authorization from the CFIX or NDSLIC. Criminal Activities and incidents Surrounding the Dakota Access Pipeline and the Impact on the Sabal Trail Pipeline (U) Scope This Joint Intelligence Bulletin (JIB) provides situational awareness regarding the criminal activities and incidents surrounding the Dakota Access Pipeline (DAPL) and it' the impact on the Sabal Trail Pipeline (STPL) in Florida. (U) The Central Florida Intelligence Exchange (CFIX) and North Dakota State and Local Intelligence Center (NDSLIC) bases the analysis in this document from lawenforcement reports and open source reporting which includes internet and social media site postings with varying degrees of reliability, especially in regards?to the true intention and capabilities of Domestic Violent Extremists (DVEs) and their supporters. This information is intended to support state, federal, and local government agencies and authorities, and other entities in developing and prioritizing protective and support measures relating to an existing or emerging threat to homeland security. (U) First Amendment Acknowledgement (U) The CFIX and NDSLIC recognize that Americans have constitutionally protected rights to assemble, speak, and petition the government. The CFIX and NDSLIC safeguards these ?rst amendment rights, and repOrts on only those activities where the potential use of rhetoric and/or propaganda could be used to incite DVEs to carry out acts of violence. Additionally, potential criminality exhibited by certain members of a group does not negate the constitutional rights of the group itself or its law?abiding participants to exercise their individual liberties under the First Amendment to the U.S. Constitution. Unless specifically noted, the social media reporting In this product - originated from users whose af?liation and credibility are unknown and are included for the purpose of providing broad trends in online behavior and situationalawareness for Law Enforcement and First Responders. (U) Key Judgments The CFIX and NDSLIC'assess environmental extremists and their sUpporters are i <ely to share effective protest tactics through training sessions and locked social media accounts. This may be accomplished by event organizers traveling to other pipeline locations across the US. and providing direct support by sharing their knowledge based on experience. The CFIX and NDSLIC assess there is likely to be Continued environmental support of Various pipelines due to national media coverage of the Dakota Access Pipeline (DAPL) and related criminal activities and incidents. This national coverage may inspire environmentalist extremists and their supporters to travel to pipeline construction sites to sabotage future construction efforts or engage in criminal activity. LAW ENFORCEMENT SENSITIVE PARRISH

LAW ENFORCEMENT SENSITIVE CFIX I NDSLIC JOINT INTELLIGENCE BULLETIN (U) Overview Since the fall of 2016, protests and criminal activity surrounding various pipelines across the U.S. increased substantially. Particularly with the national media coverage of the Dakota Access Pipeline (DAPL). Due to the increased publicity experienced with the DAPL protest activities and law enforcement con?icts, other areas of the U.S. began experiencing similar activities. (U) Dakota Access Pipeline (DAPL) (LES) The Dakota Access Pipeline (DAPL) Project isa new approximate 1,172-mile pipeline that connects the rapidly expanding Bakken and Three Forks production areas in North Dakota to Patoka, Illinois. Although construction plans circumvent reservation lands and go underneath the Missouri River and not through it, protests continue with concerns a pipeline leak would contaminate the water supply on the nearby Standing Rock Indian Reservation and other parts of the U. S.. The route through North Dakota was originally expected to be completed on 31 December 2016, but that date has since been pushed back due to violent protest actions, ?rst responder and law enforcement conflicts and inclement weather. (LES) The first con?icts and physical resistance between protestors and law enforcement occurred on 12 August 2016 when approximately 300 individuals were demonstrating at a Construction site near Cannonball, ND. Initially, the majority of protesters were from the Standing Rock Indian Reservation, but later people from across the US. and Internationally arrived to support the protestors. As of 24 February 2017, there have been 761 arrests directly related to the DAPL. The three most common home states of arrestees are California (115 arrests), South DakOta (80 arrests) and,Washington (48 arrests). Only 51 arrests (6.7 percent of arrestee total) have been from North Dakota. The arrests were made by many different federal, state and local law enforcement agencies who provided support during the DAPL protests. (LES) Subjects involved in protest activity in Cannon Ball, ND began to leave the area as early as 23 February 2017. Many of the individuals that were the. greatest advocates of the actions of the protestors and frequently documented the events at the camps on social media have moved on to various other pipeline and political protest activitiesin various states, including but not limited to: Florida, Minnesota, South Dakota, Oklahoma, Oregon, Texas, and Iowa - (U) Sabal Trail Pipeline (STPL) Although the Sabal Trail Pipeline (STPL) does- not connect to the DAPL, there have been several social media posts and comments regarding those involved in the DAPL traveling to and supporting the STPL protest activities. More specifically, they plan to support STPL protest activities by sharing effective protest techniques and how to avoid law enforcement actions. Additionally, STPL protest activities have used verbiage and images that have also been used for DAPL activities. The STPL is an interstate natural pipeline approximately 515 miles long that spans across Alabama, Georgia and Florida. Approximately 268-miles are located in Florida, Speci?cally Alachua, (U) This Information is the property of the CFIX and NDSLIC and may be distributed to federal, state, local, tribal and territorial law enforcement, and US. Intelligence Communlty personnel on a need-to-know basis. This document contains LAW ENFORCEMENT SENSITIVE information that cannot be released to the public, media, or other personnel who do not have a valid ?need?to-know" without prior authorization from the CFIX or NDSLIC. LAW ENFORCEMENT SENSITIVE 7 April 2017 PARRISH

LAW ENFORCEMENT SENSITIVE CFIX I NDSLIC . JOINT INTELLIGENCE BULLETIN Hamilton, Suwannee, Gilchrist, Levy, Marion, Sumter, Lake, Polk, ?Osceola, Orange and Citrus Counties. The STPL is expected to be operational by the end ofJune 2017. The Compressor Stations are expected to be completed by 2020 with other projects connecting to the STPL In the future.rA majority of the criminal activities have occurred at the Hildreth Compression Station (Suwannee County), Dunnellon Compression Station (Marion County) and Reunion Compressor Station Central Florida Hub (Osceola County). Several arrests have been made directly related to protests against the STPL. These arrests were the result of various direct action activities which include firing projectiles at construction sites and equipment, use of sleeping dragons*, obstructing roadways, and vandalizing and damaging construction equipment. One arrestee commented these incidents are meant to raise awareness and that ?it takes something (U) Individuals using sleeping this drastic in order for us to be able to? move others and inspire change.? . dragons linking themselves to a truck at a STPL construction site. (U) Observed Protest Tactics at DAPL and STPL Various tactics have been used by protestors demonstrating against the DAPL and STPL across the US. and Florida. These tactics may either occur at the protest site as direct action against the target or in a virtual setting by sharing of information on social media sites to bring greater awareness to the cause and to potentially draw in additional supporters. (U) Direct Action (.LES) While the level of participation varies, some of the events that draw larger crowdsare likely well organized and have more direct action taken. For instance, during a large Florida protest with over 400 participants, organizers separated individuals into three groups based on their level of anticipated participation. One gr0up was identified as ?Red? and included active participation and those willing to be arrested. These individuals used Sleeping Dragons and physically prevented vehicular traf?c to and from construction sites. The second group, ?Orange,? included those who supported the ?Red? group, but did not engage in activities resulting in arrest. The third group, ?Green,? were those who supported the cause but did not engage in criminal activities. Some of the direct action tactics which often led to arrest and have been used during both the DAPL and STPL protests include but are not limited to: (LES) installing Sleeping Dragons to adjoin individuals to constrUction equipment and crawling inside pipelines to prevent construction efforts 0 (LES) Constructing and using small Improvised Explosive Devises and incendiary devices, ?ring projectiles, and verbally threatening and physically assaulting officers during con?icts With law enforcement (LES) Ramming into law enforcement vehicles 0 (LES) Conducting counter-surveillance of law enforcement and their activities 0 (LES) Possibly using jamming devices to prevent communication among law enforcement and ?rst responders (LES) Setting ?res to debris to create barricades between the protestors, encampments and law enforcement (LES) Possession of illicit items on their person and in the encampments (LES) Lazing aircraft during flyovers (LES) Using animals to intimidate law enforcement response, speci?cally horse mounted riders in tactical formations and herding buffalo with ATVs - (LES) Vandalizing and damaging construction machinery and equipment by pouring sugar, bleach and dirt into air ?lters, batteries, window washer fluid reservoir and fuel tanks *The Sleeping Dragon is a maneuver to link individuals together using handcuffs and PVC pipe. This protest tactic prevents the immediate removal of the handcuffs by law enforcement. Individuals often employ the Sleeping Dragonto link themselves to machinery and equipment to prevent their use. 7 April 2017 (U) This information is the property of the CFIX and NDSLIC and may be distributed to federal, state, local, tribal and territorial law enforcement, and U5. Intelligence Community personnel on a need?toLknow basis. This document contains LAW ENFORCEMENT SENSITIVE Information that cannot be released to the public, media, or other personnel who do not have a valid ?need-to?know? without-prior authorization from the CFIX or NDSLIC. LAW EN FORCEMENT SENSITIVE PARRISH

LAW ENFORCEMENT SENSITIVE anuc JOINT INTELLIGENCE BULLETIN (U) Using Open Source and Social Media Open source and Social media sites (SMS) continue to serve an integral role in the sharing of information and tactics by those involved in the protests against the DAPL and STPL. While each pipeline has their Own protest groups, it is important to note that SMS allows other individuals elsewhere to provide material, monetary and emotional support. Additionally, it is possible closely guarded information is shared among protest organizers in closed groups and private SMS accounts and event pages. (LES) Protest organizers have also conducted trainings which cover tactics and how to operate online, similar to other domestic violent extremist groups. Prior to a large Florida protest, an individual associated With the Sacred Stone protestor camp located in North Dakota travelled to Florida to provide a two day training on material support asking for speci?c various topics to include but not limited to: soft blockades, technical blockades, SUpplieS for an encampment near a media/talking points, intro to? know your rights, history of nonviolence/civil Site' disobedience, .direct action 101, action roles, police liaison and de-escalation. (LES) Protestors involved with the DAPL would also travel to various Energy Transfer Partners Access work sites and secure themselves to construction equipment. It was also during this time that non-credentialed? media became popular and protest activities and law enforcement interactions would be live streamed and shared Openly on SMS, blogs and forums to bring greater awareness to the cause. One non-credentialed media group, often involved in high pro?le actions, would request pubiically available records to identify law enforcement agencies and. persons involved. (LES) The live streaming of law enforcement interactions would garner the support of environmental extremists among other supporters, particularly when the interaction was perceived to be negative towards protestors. In particular Was a November 2016 interaction where law enforcement used several less lethal tactics to push protestors away from a police barricade on the Backwater Bridge which included water hoses, rubber shells, tear gas and pepper spray. This resulted in a fundraising campaign for other supporters to travel to the protest site. Earlier, in September 2016, an incident occurred between security of?cers and protestors showing protestors engaging with security using trained K95. That incident continued to build attention following the live stream of,the con?ict. Protest support continued to build with each perceivedlaw enforcement use of force that -was streamed through SMS. (LES) Additionally, there are several hashtags used on SMS in conjunction with sharing of extreme protest activities and declaring their disapproval of the pipeline. While some hashtags are for Specific ,encampments and protest areas, individuals have showed support of protest activities outside their physical location and used together. Some of the hashtags used include but are not limited to: #MiniWiconi, #ReZpectTheWater, #FreeRedFawn, #FreeMarkus, #BlackSnakeKillaz, #SabalTrail, #StopSabalTrail, #WaterProtectors, #WaterWarriors, #StandingRock, #waterislife, #freepeltier, #indigenousresistance and #energyrevolution. (U) This information is the property of the CFIX and and may be distributed to federal, state, local, tribal and territorial law enforcement, and U.S. intelligence Community personnel on a need-to-know basis. This document contains LAW ENFORCEMENT SENSITIVE information that cannot be released to the public, media, or other personnel who do not have a valid ?need-to?know? without prior authorization from the CFIX or NDSLIC. LAW ENFORCEMENT SENSITIVE PARRISH

SENSITIVE CFIX I NDSLIC JOINT INTELLIGENCE BULLETIN (U) Outlook and implications Although the DAPL and STPL are located in separate parts of the U.S., protest activities are correlated . through similarly sharing of tactics, law enforcement con?icts and using open source and SMS. This is likely to result in the sharing of information through locked SMS accounts or hosting various training sessions'in other parts of the US where there is opposition to pipelines. This may be accomplished by event organizers traveling to other pipeline locations across the US. and providing the direct support by sharing their knowledgebased on experience. Further, as DAPL and STPL protest con?icts with law enforcement are shared on national mainstream media and SMS, there is likely to be continued environmental support, particularly among environmental extremists. This may inspire environmental extremists and their supports to travel to and engage in criminal activity to sabotage future or existing pipeline locations. (U) Reporting Notice (U) The CFIX and NDSLIC are providing this information for situational awareness. For additional information on this product, or to report su5picious activity, please contact the CFIX at (407) 858 ?3950 or CFIX Cyber@ocfl. net and the NDSLIC at (701) 328 8172, (866) 885- 8295 (toll free ND only) or gov. (U) Entities and agencies outside of the Central Florida region should report suspicious activity to the appropriate law enforcement agency and their regional or state fusion center. Tracked by: (U) Sources CFIX, based on review of publically available social media andlopen source 2 - 3 March 2017. CFIX, based on review of publically available social media and open source 8 - 10 March 2017. CFIX, based on review of publically available social media and open source 28 - 29 March 2017. (LES) Florida Department of Law Enforcement Jacksonville Regional Operations Center Situational Awareness Brief. 17? 042 dated 3 March 2017 Morton County Sheriff?s Of?ce internal documents and law enforcement reports. NDSLIC, based on review of publically available social media and open source 8 August 2016 17 March 20.17 (LES) North Florida Fusion Exchange. Situational Awareness Brief 17- 01: Suwannee County Sabal Trail Pipeline Protest? AfterAction Intelligence Report dated 20 January 2017. I (U) This information is the property of the CFIX and NDSLIC and may be distributed to federal, state, local, tribal and territorial law enforcement, and U.S. Intelligence Community personnel on a need-to-know basis. This document contains LAW ENFORCEMENT SENSITIVE information that cannot be released to the public, media, or other personnel who do not have a valid "need-to-know? without prior authorization from the CFIX or NDSLIC. LAW ENFORCEMENT SENSITIVE . . PARRISH