Greater Cincinnati Fusion Center Field Analysis Report July 2016

UNCLASSIFIED//FOR OFFICIAL USE ONLY 11 July 2016 (U//FOUO) The NAACP 107th National Convention Threat Assessment (U//FOUO) Prepared by the Greater Cincinnati Fusion Center (GCFC), with contributions from the Office of Intelligence and Analysis (I&A). (U//FOUO) Scope: This Field Analysis Report (FAR) assesses threats to the NAACPUSPER 107th National Convention taking place at the Duke Energy Center and associated events and venues in Cincinnati, Ohio. This product is intended to support the security and public safety efforts of government agencies and private sector partners in identifying, deterring, preventing, and responding to potential threats during the convention. This assessment focuses only on the event itself and not individual threats to attendees, for which we lack insight. (U//FOUO) Key Judgments ((b) (3) (A), (b) (5) * (U//FOUO) The GCFC defines an HVE as a person of any citizenship who has lived and/or operated primarily in the United States or its territories who advocates, is engaged in, or is preparing to engage in ideologically motivated terrorist activities (including providing support to terrorism) in furtherance of political or social objectives promoted by a foreign terrorist organization, but is acting independently of direction by a foreign terrorist organization. HVEs are distinct from traditional domestic terrorists who engage in unlawful acts of violence or to intimidate civilian populations or attempt to influence domestic policy without direction from or influence from a foreign actor. ** (U//FOUO) The GCFC defines domestic terrorist violence as any act of unlawful violence that is dangerous to human life or potentially destructive of critical infrastructure or key resources and is committed by a group or individual based and operating entirely within the United States or its territories without direction or inspiration from a foreign terrorist group. This act is a violation of the criminal laws of the United States or of any state or other subdivision of the United States and appears to be intended to intimidate or coerce a civilian population, to influence the policy of a government by intimidation or coercion, or to affect the conduct of a government by mass destruction, assassination, or kidnapping. A domestic terrorist differs from a homegrown violent extremist in that the former is not inspired by and does not take direction from a foreign terrorist group or other foreign power. †† (U//FOUO) The GCFC defines a lone offender as an individual motivated by one or more violent extremist ideologies who, operating alone, supports or engages in acts of unlawful violence in furtherance of that ideology or ideologies that may involve influence from a larger terrorist organization or a foreign actor. ‡‡ (U//FOUO) The GCFC defines white supremacist extremists as groups or individuals who facilitate or engage in acts of unlawful violence directed at the federal government, ethnic minorities, or Jewish persons in support of their belief that Caucasians are intellectually and morally superior to other races and their perception that the government is controlled by Jewish persons. IA-0XXX-16 (U) Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO). It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know without prior approval of an authorized DHS official. State and local homeland security officials may share this document with authorized critical infrastructure and key resource personnel and private sector security officials without further approval from DHS. (U) This product contains US person information that has been deemed necessary for the intended recipient to understand, assess, or act on the information provided. It has been highlighted in this document with the label USPER and should be handled in accordance with the recipient's intelligence oversight and/or information handling procedures. Other US person information has been minimized. Should you require the minimized US person information, please contact the I&A Production Branch at I(b) (6) . UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLY (b) (3) (A), (b) (5) (b) (3) (A), (b) (5) (U//FOUO) Introduction (U//FOUO) The 107th NAACP National Convention will be held primarily at the Duke Energy Center in Cincinnati from 13 July through 20 July 2016. During that week, other convention events are scheduled to occur at several locations in downtown Cincinnati—the President’s reception at the National Underground Freedom Center; the Afro-Academic, Cultural, Technological and Scientific Olympics at the Hyatt Hotel; the NAACP National Convention Armed Services and Veterans Affairs Awards Luncheon at the Westin Hotel; and NAACP Night with the Cincinnati RedsUSPER at the Great American Ball Park. The convention is expected to draw over 10,000 attendees during the week.1 (U//FOUO) The array of venues poses challenges for security planners due to open access to many of the events. We assess (b) (3) (A), (b) (5) (U//FOUO) Domestic Terrorist Threat (U//FOUO) The GCFC (b) (3) (A), (b) (5) (U) On 7 October 2015, three white supremacist extremists in Richmond, Virginia were arrested and later convicted for a plot to either bomb African-American churches and synagogues or shoot occupants in furtherance of their beliefs—in addition to a plot to kill a local jewelry dealer and rob an armored car with the intent of using the proceeds to purchase land, weapons, and training for an impending perceived race war.2 One subject has been sentenced to 17.5 years in prison, and the other two are awaiting sentencing.3 (U//FOUO) On the evening of 17 June 2015, South Carolina-based white supremacist extremist– lone offender Dylann RoofUSPER allegedly shot and killed nine members of a prominent AfricanAmerican church in Charleston, South Carolina, including a state senator, according to open source and law enforcement reporting. The subject has since admitted to carrying out the attack and * (U//FOUO) The GCFC defines anarchist extremists as groups or individuals who facilitate or engage in acts of unlawful violence as a means of changing the government and society in support of the belief that all forms of capitalism and corporate globalization should be opposed and that governing institutions are unnecessary and harmful to society. † (U//FOUO) The GCFC defines black supremacist extremists as groups or individuals who facilitate or engage in acts of unlawful violence as a means to oppose racial integration and/or to eliminate non-black people and Jewish people. Page 2 of 7 UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLY claimed it was intended to ignite a “race war,” according to media reporting of law enforcement custodial interviews. Roof is currently awaiting trial.4 (U) On February 25, 2012, a white supremacist extremist was sentenced to 40 years in prison for a 2004 package bombing in Arizona that injured Scottsdale’s diversity director and a secretary. At the time of the bombing the perpetrator was associated with White Aryan ResistanceUSPER, a white supremacist extremist group that encourages members to act as “lone wolves” and commit violence against non-whites and the government.5,6 (U) In January 2011, a white supremacist extremist and former member of the neo-Nazi group National AllianceUSPER placed a bomb along the parade route of the Spokane, Washington MLK Day Parade, with the goal of killing African-American participants. The device was discovered and disarmed.7 The individual is currently is serving a 32-year prison sentence.8 (U//FOUO) Further, the NAACP event will overlap with the RNC in Cleveland, which is scheduled to run 18–21 July, with delegates arriving as early as several days prior to the event. Political conventions such as the RNC historically have attracted domestic terrorist’s intent of taking advantage of these events to commit violent acts. We are concerned (b) (3) (A), (b) (5) (b) (3) (A), (b) (5) (U) As of June 2016, (U) According to (b) (3) (A), (b) (5) (U//FOUO) Anarchist extremists used black bloc tactics to violently disrupt the 2008 RNC in St. Paul, Minnesota, causing considerable property damage to the streets surrounding the convention center. Members of an anarchist extremist group called the Republican National Convention Welcoming Committee—some of whom traveled from Austin, Texas—were convicted of firearms charges relating to the construction of Molotov cocktails after an undercover informant revealed the group’s plans to disrupt the event by kidnapping delegates, sabotaging the convention center’s air vents, and capturing federal buildings.13 Among the items seized by police were gallons of urine, high powered slingshots, a machete, a hatchet, several knives, flammable liquids, axes, bolt cutters, and sledge hammers.14 * (U//FOUO) The GCFC defines “black bloc” tactics as tactics typically carried out by individuals dressed in black and covering their faces to conceal their identity as they commit illegal actions such as vandalism, property destruction, and sometimes acts of violence. These types of tactics appeal to anarchist extremists because they allow anonymity from law enforcement, show solidarity within the movement, and provide public visibility for their cause. Page 3 of 7 UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO) International Terrorism and Homegrown Violent Extremist Threat (U//FOUO) The GCFC (b) (3) (A), (b) (5) (U//FOUO) FTOs, such as the self-proclaimed Islamic State of Iraq and the Levant (ISIL) and al-Qa‘ida in the Arabian Peninsula, have encouraged HVEs to conduct attacks within the Homeland. These groups use social media to inspire and urge violent extremists to attack targets in the Homeland, including mass gatherings such as the NAACP convention. (U//FOUO) In March 2016, social media posting by the ISIL’s media company, Al-Wafa, titled “America, You Are Next,” pledged to infiltrate the Homeland and carry out attacks, according to open source reporting.15 (U//FOUO) In May 2016, ISIL released an audio message urging its supporters to launch lone wolf attacks against military and civilian targets within the Homeland, according to open source reporting.16 (U//FOUO) DHS assess (b) (3) (A), (b) (5) (U//FOUO) Potential Indicators of Suspicious Activities (U//FOUO) There are numerous behaviors and indicators of potential criminal or violent activities that might be observed at or near the NAACP convention venues. Some of these behavioral indicators may be constitutionally protected activities and should be supported by additional facts to justify increased suspicions. No single behavioral indicator should be the sole basis for law enforcement action. The totality of behavioral indicators and other relevant circumstances should be evaluated when considering any law enforcement response or action. Independently, each indicator may represent legitimate recreational or commercial activities; however, multiple indicators could suggest a heightened threat. (U//FOUO) Possible behaviors and indicators of planned criminal or violent activity during NAACP Convention events that would arouse the suspicion in a reasonable person include: (U//FOUO) Persons attempting to gain unauthorized entry to restricted areas; (U//FOUO) Persons discovered with documents highlighting critical areas or infrastructure associated with events without a reasonable explanation or that a reasonable person would find suspicious; Page 4 of 7 UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO) Discreet use of cameras or video recorders, sketching, or note-taking consistent with pre-operational surveillance that a reasonable person would find suspicious; (U//FOUO) Unusual observation of or questions about security measures, to include barriers, restricted areas, cameras, or the locations of public safety personnel and equipment; (U//FOUO) Persons wearing bulky clothing not consistent with weather conditions; (U//FOUO) Bags, containers, or vehicles left unattended near event venues; and (U//FOUO) Persons with insignia, symbols, codes, or other regalia utilized by violent neo-Nazi and white supremacist extremists. (U) Suspicious Activity Reporting (U) Suspicious activity is any observed behavior that could indicate criminal activity, terrorism, or terrorism-related crime. This activity includes unusual items or situations, persons asking abnormal or atypical questions about event security, and persons conducting surveillance on the venues. (U) Reporting suspicious activity can mitigate many threats to the 107th NAACP Convention and associated activities. (U) For suspicious activity that might have greater implications, the GCFC has a Suspicious Activity Reporting System that can be accessed through the Greater Cincinnati Fusion Center website www.GCFC.org or by calling the tip-line at 513-263-8000 (Option 1). The GCFC encourages our federal, state, local, and private sector partners to report suspicious activity through either method. (U//FOUO) Source Summary Statement (U//FOUO) The information in this FAR is drawn from (b) (3) (A), (b) (5) (U) Report Suspicious Activity (U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency managers should follow established protocols; all other personnel should call 911 or contact local law enforcement. Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism Task Force for further action. For more information on the Nationwide SAR Initiative, visit http://nsi.ncirc.gov/resources.aspx. (U) Tracked by: (b) (3) (A) Activity Page 5 of 7 UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLY (b) (3) (A) Page 6 of 7 UNCLASSIFIED//FOR OFFICIAL USE ONLY

OFFICIAL USE ONLY Page 7of7 OFFICIAL USE ONLY