Documents
DHS Field Analysis Report
Mar. 2, 2017
UNCLASSIFIED//FOR OFFICIAL USE ONLY
21 February 2017
(U) North Carolina: Recent Spike in Election-related Physical and Cyber
Incidents Against Political Institutions Likely to Decrease In the Short
Term, but Threat Environment Remain Unpredictable
(U//FOUO) Prepared jointly by the North Carolina Information Sharing and Analysis Center (ISAAC) and the DHS Office of
Intelligence & Analysis (I&A).
(U) Scope: This Field Analysis Report (FAR) provides situational awareness to state and local partners in North
Carolina concerning criminal activities, physical violence, and cyber activity directed at government organizations
following the conclusion of the 2016 election and political transition. It was written in response to a spike in
violence and criminal acts—including an arson attack—targeting political party offices and staff that occurred
prior to of and immediately following the election. In this context, this assessment provides an overall threat
forecast for the first half of 2017 concerning like activities in the state.
(U) Key Judgments
(U//FOUO) We assess that the number of incidents of low level physical violence directed toward
political institutions in North Carolina—a short-term spike represented by such incidents as the 16
October arson attack targeting a political headquarters—will likely decrease through the first half of
2017 as compared to the last half of 2016. We base this conclusion on the lack of threat reporting
and the completion of the Presidential election and the near completion of political transitions in
federal and state governments which may have served as a drivng catalyst for the violence. We
also cannot rule out that the spike in violence may have inspired others to conduct similar acts.
(U//FOUO) We assess malicious cyber activities directed at government networks will likely
continue at a rate consistent to what has been observed in previous years; but will revert back to
the criminal focus seen in the state previously, as opposed to the more politically-motivated activity
seen in the end of the year duethe end of the election cycle.
(U//FOUO) Likely Decrease of Violent Incidents in North Carolina Targeting Political
Institutions in Early 2017 Due to Close of the Election Period
(U//FOUO) In the final months of the 2016 election cycle, specifically the beginning of September through the
beginning of November 2016, North Carolina public political institutions and figures experienced a spike of both
threats and violent activity that involved targeting of campaign office facilities. In the year prior to the first
incident, there appears to have been limitied to no reporting of similar activity. The ISAAC assesses that criminal
and violent incidents targeting those institutions are likely to decrease in first half of 2017 as compared to the last
half of 2016, due namely to the conclusion of the election and peaceful transitions of government and state and
federal levels as well as the cessation in violent acts.
IA-0085-17
(U) Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO). It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to be
controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid
need to know without prior approval of an authorized DHS official. State and local homeland security officials may share this document with authorized critical infrastructure and key resource personnel and private sector
security officials without further approval from DHS.
UNCLASSIFIED//FOR OFFICIAL USE ONLY
UNCLASSIFIED//FOR OFFICIAL USE ONLY
21 February 2017
(U) North Carolina: Recent Spike in Election-related Physical and Cyber
Incidents Against Political Institutions Likely to Decrease In the Short
Term, but Threat Environment Remain Unpredictable
(U//FOUO) Prepared jointly by the North Carolina Information Sharing and Analysis Center (ISAAC) and the DHS Office of
Intelligence & Analysis (I&A).
(U) Scope: This Field Analysis Report (FAR) provides situational awareness to state and local partners in North
Carolina concerning criminal activities, physical violence, and cyber activity directed at government organizations
following the conclusion of the 2016 election and political transition. It was written in response to a spike in
violence and criminal acts—including an arson attack—targeting political party offices and staff that occurred
prior to of and immediately following the election. In this context, this assessment provides an overall threat
forecast for the first half of 2017 concerning like activities in the state.
(U) Key Judgments
(U//FOUO) We assess that the number of incidents of low level physical violence directed toward
political institutions in North Carolina—a short-term spike represented by such incidents as the 16
October arson attack targeting a political headquarters—will likely decrease through the first half of
2017 as compared to the last half of 2016. We base this conclusion on the lack of threat reporting
and the completion of the Presidential election and the near completion of political transitions in
federal and state governments which may have served as a drivng catalyst for the violence. We
also cannot rule out that the spike in violence may have inspired others to conduct similar acts.
(U//FOUO) We assess malicious cyber activities directed at government networks will likely
continue at a rate consistent to what has been observed in previous years; but will revert back to
the criminal focus seen in the state previously, as opposed to the more politically-motivated activity
seen in the end of the year duethe end of the election cycle.
(U//FOUO) Likely Decrease of Violent Incidents in North Carolina Targeting Political
Institutions in Early 2017 Due to Close of the Election Period
(U//FOUO) In the final months of the 2016 election cycle, specifically the beginning of September through the
beginning of November 2016, North Carolina public political institutions and figures experienced a spike of both
threats and violent activity that involved targeting of campaign office facilities. In the year prior to the first
incident, there appears to have been limitied to no reporting of similar activity. The ISAAC assesses that criminal
and violent incidents targeting those institutions are likely to decrease in first half of 2017 as compared to the last
half of 2016, due namely to the conclusion of the election and peaceful transitions of government and state and
federal levels as well as the cessation in violent acts.
IA-0085-17
(U) Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO). It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to be
controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid
need to know without prior approval of an authorized DHS official. State and local homeland security officials may share this document with authorized critical infrastructure and key resource personnel and private sector
security officials without further approval from DHS.
UNCLASSIFIED//FOR OFFICIAL USE ONLY
UNCLASSIFIED//FOR OFFICIAL USE ONLY
(U//FOUO) Threats of violence and acts that may have been intended to intimidate individuals associated with
party offices took place in several parts of the state during the last quarter of 2016, according to corroborated
media and reliable law enforcement reporting. Tactics used in recent criminal activities targeting political
institutions in North Carolina have been mostly simple, using readily available materials, requiring little expertise
or training. Examples of some of the violent incidents that occurred in the state include:
(U) An unidentified individual or individuals shot and damaged the windows of a headquarters office for a
major political party in Pamlico County on at least two occasions during September and October 2016,
according to a statement released by party county chairman.1,2
(U) On 20 October 2016, an individual was arrested on state charges related to terrorism and filing false
reports after he allegedly called in a bomb threat to a political party headquarters in Henderson County
according to media reporting.3
(U//FOUO) During the night of 17 October 2016, an unidentified actor fired a non-lethal weapon at the state
headquarters for a political party in downtown Raleigh, damaging some of the signage infrastructure
according to law enforcement reporting.4
(U) In the early morning of 16 October in Orange Country, unidentified individuals threw improvised
incendiary devices (IIDs)—Molotov cocktails—through the large picture window of the local political party
office. At least one of the devices broke and ignited inside the office, causing extensive damage before
self-extinguishing. The office was empty at the time of the attack and no one was injured, but the attack
caused significant property damage. Additionally, the perpetrator(s) spray-painted "Nazi Republicans leave
town or else" on a nearby building, according to media and law enforcement reporting.5,6
(U//FOUO) In the two months leading up to the 2016 election, North Carolina experienced several incidents of
individuals targeting campaign offices—in many cases damaging property. Limited to no reporting has been
received by the ISAAC indicated the targeting or attempted disruption of similar offices prior to September 2016
through the time of publication for this product. In spite of the increased violence/as in past election years, the
ISAAC lacks credible indications of near-term domestic terrorism threats against political entities such as
campaign offices, party headquarters, associated facilities, or in North Carolina now that the Presidential and
Gubanotorial campaign has ended. The conclusion of the campaign and election process will result in the
cessasation of the daily barrage of negative campaign ads and political rhetoric, which likely contributed to
incitement of at least some of the violent and/or criminal incidents. Traditional government institutions involved
in the implementation of what may be perceived, by some extremists, as controversial policies are likely to be
viewed by those individuals as high value targeting during the non-election cycle years. Lower rates of incident
reporting following the election also supports this assessement.
(U//FOUO) North Carolina Government Institutions Also Target of Politically-Motivated Cyber
ActivityExperience
(U//FOUO) The ISAAC assesses that some malicious cyber activity targeting public sector—particularly
government—entities in the last half of 2016 may have been politically-motivated. This assessment is based on
the same reasons mentioned in the physical threats section, including diminished political rhetoric and
associated negative publicity. The activities specifically pursued political aims and/or intended to intimidate,
harass, disrupt and/or steal data from information technology networks, according to DHS reporting.
(U//FOUO) During early October 2016, a criminal hacker defaced a North Carolina law enforcement website
by gaining access and posting pro-Turkey messaging.7
(U//FOUO) In late September 2016, a criminal hacker group attempted to influence a North Carolina city
government’s law enforcement response decisions by threatening to leak government personnel records. It
UNCLASSIFIED//FOR OFFICIAL USE ONLY
Page 2 of 5
UNCLASSIFIED//FOR OFFICIAL USE ONLY
(U//FOUO) Threats of violence and acts that may have been intended to intimidate individuals associated with
party offices took place in several parts of the state during the last quarter of 2016, according to corroborated
media and reliable law enforcement reporting. Tactics used in recent criminal activities targeting political
institutions in North Carolina have been mostly simple, using readily available materials, requiring little expertise
or training. Examples of some of the violent incidents that occurred in the state include:
(U) An unidentified individual or individuals shot and damaged the windows of a headquarters office for a
major political party in Pamlico County on at least two occasions during September and October 2016,
according to a statement released by party county chairman.1,2
(U) On 20 October 2016, an individual was arrested on state charges related to terrorism and filing false
reports after he allegedly called in a bomb threat to a political party headquarters in Henderson County
according to media reporting.3
(U//FOUO) During the night of 17 October 2016, an unidentified actor fired a non-lethal weapon at the state
headquarters for a political party in downtown Raleigh, damaging some of the signage infrastructure
according to law enforcement reporting.4
(U) In the early morning of 16 October in Orange Country, unidentified individuals threw improvised
incendiary devices (IIDs)—Molotov cocktails—through the large picture window of the local political party
office. At least one of the devices broke and ignited inside the office, causing extensive damage before
self-extinguishing. The office was empty at the time of the attack and no one was injured, but the attack
caused significant property damage. Additionally, the perpetrator(s) spray-painted "Nazi Republicans leave
town or else" on a nearby building, according to media and law enforcement reporting.5,6
(U//FOUO) In the two months leading up to the 2016 election, North Carolina experienced several incidents of
individuals targeting campaign offices—in many cases damaging property. Limited to no reporting has been
received by the ISAAC indicated the targeting or attempted disruption of similar offices prior to September 2016
through the time of publication for this product. In spite of the increased violence/as in past election years, the
ISAAC lacks credible indications of near-term domestic terrorism threats against political entities such as
campaign offices, party headquarters, associated facilities, or in North Carolina now that the Presidential and
Gubanotorial campaign has ended. The conclusion of the campaign and election process will result in the
cessasation of the daily barrage of negative campaign ads and political rhetoric, which likely contributed to
incitement of at least some of the violent and/or criminal incidents. Traditional government institutions involved
in the implementation of what may be perceived, by some extremists, as controversial policies are likely to be
viewed by those individuals as high value targeting during the non-election cycle years. Lower rates of incident
reporting following the election also supports this assessement.
(U//FOUO) North Carolina Government Institutions Also Target of Politically-Motivated Cyber
ActivityExperience
(U//FOUO) The ISAAC assesses that some malicious cyber activity targeting public sector—particularly
government—entities in the last half of 2016 may have been politically-motivated. This assessment is based on
the same reasons mentioned in the physical threats section, including diminished political rhetoric and
associated negative publicity. The activities specifically pursued political aims and/or intended to intimidate,
harass, disrupt and/or steal data from information technology networks, according to DHS reporting.
(U//FOUO) During early October 2016, a criminal hacker defaced a North Carolina law enforcement website
by gaining access and posting pro-Turkey messaging.7
(U//FOUO) In late September 2016, a criminal hacker group attempted to influence a North Carolina city
government’s law enforcement response decisions by threatening to leak government personnel records. It
UNCLASSIFIED//FOR OFFICIAL USE ONLY
Page 2 of 5
UNCLASSIFIED//FOR OFFICIAL USE ONLY
was determined that the criminal actor was not able to successfully exfiltrate any data and thereby did not
possess any sensitive records.8
(U//FOUO) A distributed denial of service (DDoS) attack against a website associated with a city in
southwestern North Carolina on 21-22 September significantly degraded the website’s functionality and
impacted connectivity. The time frame of this incident coincided with nationally-publicized civil unrest taking
place in the area that resulted in veiled and open threats to government institutions. 9
(U//FOUO) Outlook and Implications
(U//FOUO) In the lead up to and immediately following the 2016 election, North Carolina experienced incidents
that included the targeting of political campaign offices and government organizations highlight their
attractiveness as targets for domestic terrorists and various cyber actors seeking to advance political aims and/or
influence government operations. In spite of this, we assess that political campaign offices in North Carolina are
likely to see a decrease in targeting against their facilities in the first half of 2017. While ISAAC has no evidence
at this time indicating that past attacks will inspire further violence in North Carolina, we urge law enforcement to
remain vigilant and report indicators of suspicious activity at locations and events deemed likely targets for
attacks. Malicious cyber activities directed against government institutions are likely to occur at consistent levels
that have been observed over the last few years.
(U//FOUO) DHS I&A Perspective
(U//FOUO) DHS assesses that anger over the results of the 2016 Presidential election continues to
be a driver of domestic terrorist violence throughout the United States—as evidenced by rioting in
Portland, Oregon following the election and violence and destruction of property in Washington
during the Inauguration.10,11 While we agree that the campaign cycle likely was a driving influence of
the rash of incidents in NC in the lead up to the election, we cannot discount the possibility that some
such individuals could be spurred to violence against a variety of political targets in the state in the
coming year. While criticism and dissenting views of the government is protected activity, some
individuals have engaged in violent or unlawful action to express these views. We assess there may
be other factors or occurrences that could foment further criminal acts and violence against political
entities in North Carolina:
–
–
–
–
(U//FOUO) Negative publicity surrounding perceived political scandal involving North Carolina
political entities;
(U//FOUO) Passage of new state or federal legislation that is unpopular with violent extremists—
such as legislation concerning: abortion rights, LGBT rights, environment al concerns, gun
control, or federal health insurance among others;
(U//FOUO) Perceived success in violent activity during the 2017 Presidential inauguration that
energized local and regional violent extremists; and
(U//FOUO) Negative publicity surrounding voting registration in North Carolina during the
previous 2016 Presidention election.
(U) DHS and the North Carolina ISAAC are interested in receiving tips and information on activities
related to threats to homeland security, malicious cyber activity, and foreign-inspired or domestic
terrorism. Comments, requests, or shareable intelligence should be directed to the ISAAC (for North
Carolina activities 888-NCISAAC) or DHS.
UNCLASSIFIED//FOR OFFICIAL USE ONLY
Page 3 of 5
UNCLASSIFIED//FOR OFFICIAL USE ONLY
was determined that the criminal actor was not able to successfully exfiltrate any data and thereby did not
possess any sensitive records.8
(U//FOUO) A distributed denial of service (DDoS) attack against a website associated with a city in
southwestern North Carolina on 21-22 September significantly degraded the website’s functionality and
impacted connectivity. The time frame of this incident coincided with nationally-publicized civil unrest taking
place in the area that resulted in veiled and open threats to government institutions. 9
(U//FOUO) Outlook and Implications
(U//FOUO) In the lead up to and immediately following the 2016 election, North Carolina experienced incidents
that included the targeting of political campaign offices and government organizations highlight their
attractiveness as targets for domestic terrorists and various cyber actors seeking to advance political aims and/or
influence government operations. In spite of this, we assess that political campaign offices in North Carolina are
likely to see a decrease in targeting against their facilities in the first half of 2017. While ISAAC has no evidence
at this time indicating that past attacks will inspire further violence in North Carolina, we urge law enforcement to
remain vigilant and report indicators of suspicious activity at locations and events deemed likely targets for
attacks. Malicious cyber activities directed against government institutions are likely to occur at consistent levels
that have been observed over the last few years.
(U//FOUO) DHS I&A Perspective
(U//FOUO) DHS assesses that anger over the results of the 2016 Presidential election continues to
be a driver of domestic terrorist violence throughout the United States—as evidenced by rioting in
Portland, Oregon following the election and violence and destruction of property in Washington
during the Inauguration.10,11 While we agree that the campaign cycle likely was a driving influence of
the rash of incidents in NC in the lead up to the election, we cannot discount the possibility that some
such individuals could be spurred to violence against a variety of political targets in the state in the
coming year. While criticism and dissenting views of the government is protected activity, some
individuals have engaged in violent or unlawful action to express these views. We assess there may
be other factors or occurrences that could foment further criminal acts and violence against political
entities in North Carolina:
–
–
–
–
(U//FOUO) Negative publicity surrounding perceived political scandal involving North Carolina
political entities;
(U//FOUO) Passage of new state or federal legislation that is unpopular with violent extremists—
such as legislation concerning: abortion rights, LGBT rights, environment al concerns, gun
control, or federal health insurance among others;
(U//FOUO) Perceived success in violent activity during the 2017 Presidential inauguration that
energized local and regional violent extremists; and
(U//FOUO) Negative publicity surrounding voting registration in North Carolina during the
previous 2016 Presidention election.
(U) DHS and the North Carolina ISAAC are interested in receiving tips and information on activities
related to threats to homeland security, malicious cyber activity, and foreign-inspired or domestic
terrorism. Comments, requests, or shareable intelligence should be directed to the ISAAC (for North
Carolina activities 888-NCISAAC) or DHS.
UNCLASSIFIED//FOR OFFICIAL USE ONLY
Page 3 of 5
UNCLASSIFIED//FOR OFFICIAL USE ONLY
(U//FOUO) Source Summary Statement
(U//FOUO) The information used in this FAR is drawn from DHS, open source information, state and local law enforcement
police reports, and press releases. We have high confidence in the information obtained from intelligence community,
DHS, and other US Government and law enforcement agencies. We have medium confidence in the information obtained
from open sources includes media reports and websites whose information is credibly sourced and plausible, but may
contain biases or unintentional inaccuracies. When possible, open source information has been corroborated through other
reliable law enforcement and judicial sources.
(U//FOUO) The judgments are guided by the following parameters:
(U) High confidence includes high-quality information from multiple sources or from a single, highly reliable source,
and the nature of the issue makes it possible to render a strong judgment.
(U) Medium confidence includes information that is credibly sourced and plausible but can be interpreted in various
ways, or information that is not sufficient quality or corroborated sufficiently to warrant a higher level of confidence.
(U) Low confidence includes information that lacks credibility and/or whose plausibility is questionable, information
that is too fragmented or poorly corroborated to make strong analytic judgments, or significant concerns or problems
exist with the sources of the information.
(U//FOUO) We have medium confidence in our assessment that physical violence against political organizations is likely
to decrease in the first half of 2017 as it is based on a lack of threat recent threat reporting and our judgments about
domestic terrorists targeting preferences as SMEs on the topic. We acknowledge that this lack of threat reporting could also
partially be the result of the inherent difficulties in obtaining comprehensive domestic terrorism reporting as a result of
privacy and civil rights restrictions on USPER data.
(U//FOUO) We have medium confidence in our assessment that malicious cyber activities in the first half of 2017 directed
at government networks will likely continue at a similar rate but will be more focused on criminal rather than political aims as
it is based largely onon our judgments regarding the goals of cyber actors as SMEs on the topic; these judgments have
been corroborated by DHS IIR reporting that is deemed credible by other cyber experts.
(U) Report Suspicious Activity
(U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency
managers should follow established protocols; all other personnel should call 911 or contact local law
enforcement. Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism
Task Force for further action. For more information on the Nationwide SAR Initiative, visit
http://nsi.ncirc.gov/resources.aspx.
(U) Tracked by: HSEC-8.1, HSEC-8.6, HSEC-8.8, HSEC-8.10
UNCLASSIFIED//FOR OFFICIAL USE ONLY
Page 4 of 5
UNCLASSIFIED//FOR OFFICIAL USE ONLY
(U//FOUO) Source Summary Statement
(U//FOUO) The information used in this FAR is drawn from DHS, open source information, state and local law enforcement
police reports, and press releases. We have high confidence in the information obtained from intelligence community,
DHS, and other US Government and law enforcement agencies. We have medium confidence in the information obtained
from open sources includes media reports and websites whose information is credibly sourced and plausible, but may
contain biases or unintentional inaccuracies. When possible, open source information has been corroborated through other
reliable law enforcement and judicial sources.
(U//FOUO) The judgments are guided by the following parameters:
(U) High confidence includes high-quality information from multiple sources or from a single, highly reliable source,
and the nature of the issue makes it possible to render a strong judgment.
(U) Medium confidence includes information that is credibly sourced and plausible but can be interpreted in various
ways, or information that is not sufficient quality or corroborated sufficiently to warrant a higher level of confidence.
(U) Low confidence includes information that lacks credibility and/or whose plausibility is questionable, information
that is too fragmented or poorly corroborated to make strong analytic judgments, or significant concerns or problems
exist with the sources of the information.
(U//FOUO) We have medium confidence in our assessment that physical violence against political organizations is likely
to decrease in the first half of 2017 as it is based on a lack of threat recent threat reporting and our judgments about
domestic terrorists targeting preferences as SMEs on the topic. We acknowledge that this lack of threat reporting could also
partially be the result of the inherent difficulties in obtaining comprehensive domestic terrorism reporting as a result of
privacy and civil rights restrictions on USPER data.
(U//FOUO) We have medium confidence in our assessment that malicious cyber activities in the first half of 2017 directed
at government networks will likely continue at a similar rate but will be more focused on criminal rather than political aims as
it is based largely onon our judgments regarding the goals of cyber actors as SMEs on the topic; these judgments have
been corroborated by DHS IIR reporting that is deemed credible by other cyber experts.
(U) Report Suspicious Activity
(U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency
managers should follow established protocols; all other personnel should call 911 or contact local law
enforcement. Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism
Task Force for further action. For more information on the Nationwide SAR Initiative, visit
http://nsi.ncirc.gov/resources.aspx.
(U) Tracked by: HSEC-8.1, HSEC-8.6, HSEC-8.8, HSEC-8.10
UNCLASSIFIED//FOR OFFICIAL USE ONLY
Page 4 of 5
UNCLASSIFIED//FOR OFFICIAL USE ONLY
1
(U); Chris Dyches; WBTV.com; “Shots Fired at Republican Headquarters in Pamlico County”; 19 OCT
2016; http://www.wbtv.com/story/33428361/ncgop-shots-fired-at-republican-headquarters-in-pamlico-county;
accessed on 11 JAN 2017; (U); Online news article from local news blog.
2 (U); Caryn Little; WCCB-TV; “Officials Say Shots Fired into Pamlico County Republican Party
Headquarters”; 19 OCT 2016; http://www.wccbcharlotte.com/2016/10/19/officials-say-shots-fired-pamlicocounty-republican-party-headquarters/; accessed on 11 JAN 2017; (U); Online news article from local news
source.
3 (U); Kristy Steward; WLOS TV; “Police: Arrest made after Henderson County GOP office bomb threat”; 20
OCT 2016; http://wlos.com/news/local/henderson-county-gop-office-evacuated-after-threat; accessed on 11
JAN 2017; (U); Online news article from local news source.
4 (U//FOUO); Raleigh Police Department; 18 OCT 2016; (U//FOUO) Report # LRP161018381897; Extracted
information is U//FOUO; Overall document classification is U//FOUO.
5 (U); Eric Bradner; CNN, “Local GOP office in North Carolina firebombed,” 17 OCT 2016;
http://www.cnn.com/2016/10/16/politics/north-carolina-gop-office-vandalized/; accessed on 11 JAN 2017;
(U); Online news article from national news source.
6 (U); FBI, Arson and Graffiti Investigation – Hillsborough, North Carolina; n.d.;
https://www.fbi.gov/wanted/seeking-info/arson-and-graffiti-investigation; accessed on 11 JAN 2017;
(U); Official government website.
7 (U//FOUO); DHS; IIR 4 015 0040 17; 062001Z DEC 2016; DOI 03 OCT 2016; (U//FOUO); Defacement of
North Carolina Law Enforcement Training Academy Website in October 2016; Extracted information is
U//FOUO; Overall document classification is U//FOUO.
8 (U//FOUO); DHS; IIR 4 015 0036 17; 021802Z DEC 2016; DOI 27 SEP 2016; (U//FOUO); Attempted
Exfiltration of Personal Information from a North Carolina City’s Computer Network to Use for Extortion;
Extracted information is U//FOUO; Overall document classification is U//FOUO.
9 (U//FOUO); DHS; IIR 4 015 0035 17; 021725Z DEC 2016; DOI 03 OCT 2016; (U//FOUO); Distributed
Denial of Service Attack Directed Against a City in Southwestern North Carolina During a Period of Unrest in
September 2016; Extracted information is U//FOUO; Overall document classification is U//FOUO.
10 (U); Unknown Author; CBS News, “Riot Declared in Portland, Oregon Amid New Wave of Anti-Trump
Demos,” 11 NOV 2016; http://www.cbsnews.com/news/riot-declared-in-portland-oregon-amid-new-wave-ofanti-trump-demos/; accessed on 11 JAN 2017; (U); Online news article from national news source.
11 (U); Chris York; Huffington Post, “Donald Trump Protests See Anarchists Smash Windowns in
Washington” 20 JAN 2016; http://www.huffingtonpost.co.uk/entry/donald-trump-inaugurationprotests_uk_58822fd9e4b0f94bb303c845; accessed on 01 JAN 2017; (U); National news blog.
UNCLASSIFIED//FOR OFFICIAL USE ONLY
Page 5 of 5
UNCLASSIFIED//FOR OFFICIAL USE ONLY
1
(U); Chris Dyches; WBTV.com; “Shots Fired at Republican Headquarters in Pamlico County”; 19 OCT
2016; http://www.wbtv.com/story/33428361/ncgop-shots-fired-at-republican-headquarters-in-pamlico-county;
accessed on 11 JAN 2017; (U); Online news article from local news blog.
2 (U); Caryn Little; WCCB-TV; “Officials Say Shots Fired into Pamlico County Republican Party
Headquarters”; 19 OCT 2016; http://www.wccbcharlotte.com/2016/10/19/officials-say-shots-fired-pamlicocounty-republican-party-headquarters/; accessed on 11 JAN 2017; (U); Online news article from local news
source.
3 (U); Kristy Steward; WLOS TV; “Police: Arrest made after Henderson County GOP office bomb threat”; 20
OCT 2016; http://wlos.com/news/local/henderson-county-gop-office-evacuated-after-threat; accessed on 11
JAN 2017; (U); Online news article from local news source.
4 (U//FOUO); Raleigh Police Department; 18 OCT 2016; (U//FOUO) Report # LRP161018381897; Extracted
information is U//FOUO; Overall document classification is U//FOUO.
5 (U); Eric Bradner; CNN, “Local GOP office in North Carolina firebombed,” 17 OCT 2016;
http://www.cnn.com/2016/10/16/politics/north-carolina-gop-office-vandalized/; accessed on 11 JAN 2017;
(U); Online news article from national news source.
6 (U); FBI, Arson and Graffiti Investigation – Hillsborough, North Carolina; n.d.;
https://www.fbi.gov/wanted/seeking-info/arson-and-graffiti-investigation; accessed on 11 JAN 2017;
(U); Official government website.
7 (U//FOUO); DHS; IIR 4 015 0040 17; 062001Z DEC 2016; DOI 03 OCT 2016; (U//FOUO); Defacement of
North Carolina Law Enforcement Training Academy Website in October 2016; Extracted information is
U//FOUO; Overall document classification is U//FOUO.
8 (U//FOUO); DHS; IIR 4 015 0036 17; 021802Z DEC 2016; DOI 27 SEP 2016; (U//FOUO); Attempted
Exfiltration of Personal Information from a North Carolina City’s Computer Network to Use for Extortion;
Extracted information is U//FOUO; Overall document classification is U//FOUO.
9 (U//FOUO); DHS; IIR 4 015 0035 17; 021725Z DEC 2016; DOI 03 OCT 2016; (U//FOUO); Distributed
Denial of Service Attack Directed Against a City in Southwestern North Carolina During a Period of Unrest in
September 2016; Extracted information is U//FOUO; Overall document classification is U//FOUO.
10 (U); Unknown Author; CBS News, “Riot Declared in Portland, Oregon Amid New Wave of Anti-Trump
Demos,” 11 NOV 2016; http://www.cbsnews.com/news/riot-declared-in-portland-oregon-amid-new-wave-ofanti-trump-demos/; accessed on 11 JAN 2017; (U); Online news article from national news source.
11 (U); Chris York; Huffington Post, “Donald Trump Protests See Anarchists Smash Windowns in
Washington” 20 JAN 2016; http://www.huffingtonpost.co.uk/entry/donald-trump-inaugurationprotests_uk_58822fd9e4b0f94bb303c845; accessed on 01 JAN 2017; (U); National news blog.
UNCLASSIFIED//FOR OFFICIAL USE ONLY
Page 5 of 5
CLASSIFICATION:
UNCLASSIFIED//FOR OFFICIAL USE ONLY
Office of Intelligence and Analysis
Customer Feedback Form
Product Title: (U//FOUO) North Carolina: Recent Spike in Election-related Physical and Cyber Incidents
All survey responses are completely anonymous. No personally identifiable information is captured unless you
voluntarily offer personal or contact information in any of the comment fields. Additionally, your responses are
combined with those of many others and summarized in a report to further protect your anonymity.
1. Please select partner type:
Select One
and function: Select One
Select One
2. What is the highest level of intelligence information that you receive?
3. Please complete the following sentence: “I focus most of my time on:” Select One
4. Please rate your satisfaction with each of the following:
Very
Satisfied
Somewhat
Satisfied
Neither
Satisfied nor
Dissatisfied
Somewhat
Dissatisfied
Very
Dissatisfied
N/A
Product’s overall usefulness
Product’s relevance to
your mission
Product’s timeliness
Product’s responsiveness
to your intelligence needs
5. How do you plan to use this product in support of your mission? (Check all that apply.)
Drive planning and preparedness efforts, training, and/or
emergency response operations
Initiate a law enforcement investigation
Intiate your own regional-specific analysis
Intiate your own topic-specific analysis
Develop long-term homeland security strategies
Do not plan to use
Other:
Observe, identify, and/or disrupt threats
Share with partners
Allocate resources (e.g. equipment and personnel)
Reprioritize organizational focus
Author or adjust policies and guidelines
6. To further understand your response to question #5, please provide specific details about situations in which you might
use this product. (Please Use Manuscript in the space provided.)
7. What did this product not address that you anticipated it would? (Please Use Manuscript in the space provided.)
8. To what extent do you agree with the following two statements?
Strongly
Agree
Agree
Neither Agree
nor Disagree
Disagree
Strongly
Disgree
N/A
This product will enable me to make
better decisions regarding this topic.
This product provided me with intelligence
information I did not find elsewhere.
9. How did you obtain this product? Select One
10. Would you be willing to participate in a follow-up conversation about your feedback?
To help us understand more about your organization so we can better tailor future products, please provide:
Name:
Position:
Organization:
Contact Number:
State:
Email:
Yes
Submit
Feedback
Privacy Act Statement
CLASSIFICATION:
Product Serial Number: IA-0085-17
UNCLASSIFIED//FOR OFFICIAL USE ONLY
REV: 10 November 2016
CLASSIFICATION:
UNCLASSIFIED//FOR OFFICIAL USE ONLY
Office of Intelligence and Analysis
Customer Feedback Form
Product Title: (U//FOUO) North Carolina: Recent Spike in Election-related Physical and Cyber Incidents
All survey responses are completely anonymous. No personally identifiable information is captured unless you
voluntarily offer personal or contact information in any of the comment fields. Additionally, your responses are
combined with those of many others and summarized in a report to further protect your anonymity.
1. Please select partner type:
Select One
and function: Select One
Select One
2. What is the highest level of intelligence information that you receive?
3. Please complete the following sentence: “I focus most of my time on:” Select One
4. Please rate your satisfaction with each of the following:
Very
Satisfied
Somewhat
Satisfied
Neither
Satisfied nor
Dissatisfied
Somewhat
Dissatisfied
Very
Dissatisfied
N/A
Product’s overall usefulness
Product’s relevance to
your mission
Product’s timeliness
Product’s responsiveness
to your intelligence needs
5. How do you plan to use this product in support of your mission? (Check all that apply.)
Drive planning and preparedness efforts, training, and/or
emergency response operations
Initiate a law enforcement investigation
Intiate your own regional-specific analysis
Intiate your own topic-specific analysis
Develop long-term homeland security strategies
Do not plan to use
Other:
Observe, identify, and/or disrupt threats
Share with partners
Allocate resources (e.g. equipment and personnel)
Reprioritize organizational focus
Author or adjust policies and guidelines
6. To further understand your response to question #5, please provide specific details about situations in which you might
use this product. (Please Use Manuscript in the space provided.)
7. What did this product not address that you anticipated it would? (Please Use Manuscript in the space provided.)
8. To what extent do you agree with the following two statements?
Strongly
Agree
Agree
Neither Agree
nor Disagree
Disagree
Strongly
Disgree
N/A
This product will enable me to make
better decisions regarding this topic.
This product provided me with intelligence
information I did not find elsewhere.
9. How did you obtain this product? Select One
10. Would you be willing to participate in a follow-up conversation about your feedback?
To help us understand more about your organization so we can better tailor future products, please provide:
Name:
Position:
Organization:
Contact Number:
State:
Email:
Yes
Submit
Feedback
Privacy Act Statement
CLASSIFICATION:
Product Serial Number: IA-0085-17
UNCLASSIFIED//FOR OFFICIAL USE ONLY
REV: 10 November 2016