Internal TigerSwan Situation Report 2017-05-05

DAPL SITREP 234 May 5, 2017 John Porter Chief Security Officer INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE. DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS.

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS The Details 1. NORTH DAKOTA A. Intel Update 1) Cheyenne River Camp traffic is picking up over the previous 24 hours. Last night approximately 10 vehicles were identified in camp. This morning approximately 12 vehicles were identified with 4 of them being parked at the leadership tent, indicating the Camp Director,?, has likely returned to the camp. Most vehicles cleared out of the camp by noon. Monitoring efforts will continue. a. Source Comment: - will likely not open the camp for a few days after he returns. He will need to coordinate with the tribal councils and put together a plan of action after having been gone for over a week. b. Analyst Comment: The timing of- 5 return in conjunction with the above Source Comment coincides with the prior assessments and information indicating the camp will re-open to accept occupants and supporters on or around Monday, May 8th. 2) ono landowner, oostoo photos today TigerSwan which were taken yesterday at Gate 1 Oceti Sakowin Camp. a. Analyst Comment: Imagery analysis indicates the pictures were taken on a drive-by, not on a stop. The photos taken could be either nostalgic in nature or (more likely) a scouting effort to garner support and intelligence information about the site. - has apparently returned from here trip U:ch Prepared for Energy Transfer Partners

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS from D.C. and New York, which coincides with the increased vehicle traffic at Cheyenne River Camp. 3) Social media resurging today to support those who were arrested and injured during the No DAPL protests. There has been special emphasis and recirculation of news stories surrounding (the propane bomber) and Red Fawn (fired shots at police). a. Analyst Comment: Protesters are trying to highlight their martyrs. The efforts surrounding Red Fawn stretch across various locations in the U.S., showing a concerted effort; there is a greater umbrella organization at work. 4) Protesters are sharing social media demonstrating their outrage at the federal government lending aid in the form of $15 million to Morton County and the state of North Dakota for emergency law enforcement responses during the No DAPL protests. Governor Burgum is asking President Trump for an additional $38 million in aid, which further enraged the protesters and incited social media activity. 1) Analyst Comment: Protesters are spinning the story in order to control the media narrative about the news and to garner additional awareness and support for their cause. B. Past 24 Hours 1) Maintained security at valves ND-280 to ND-430 using roving patrols. 2) New back door installed in the North Barn on Meyer Properties 3) Valve sites inspections: ND-370 DAPL Security identified a three-strand barbed wire fence was cut down in full across the road from the valve. Fence was repaired in the morning C. Next 24 Hours 1) Continue monitoring of Open Source information, ISR feeds, and other sources of information to provide accurate assessments of protester activities/migration which may impact DAPL operations. 2) DAPL security will continue to rove the valve sites in North Dakota. 3) Michels continues restoration efforts at the HDDs, awaiting delivery of trees. 2. IOWA A. Intel Update 1) The places where Reznicek, Montoya, or other members of Little Creek Camp bought their welding supplies is limited based on equipment available at local hardware stores in IA. The gloves seen in the game camera footage most closely match Lincoln Electric brand. Lincoln Electric also produces a “port a torch” welding kit that contains tanks similar in size and color to the tanks captured on the game TigerSwan Prepared for Energy Transfer Partners 2

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS camera. So far, Home Depots are the only local stores supplying welding materials that carry both items. Store workers have not positively identified any protesters based on pictures shown to them, but TigerSwan employees intend to meet with Assets Control Specialists from these stores who may better remember purchases. 2) A typical “welding kit” costs approximately $300 which may be a large amount for protesters with no known employment or steady income. If Reznieck and Montoya bought the welding supplies, they may have used Catholic Worker funds or credit. If members of Little Creek Camp purchased the supplies, they likely used Christine Nobiss’s Indigenous Iowa credit card. (TigerSwan is in possession of Nobiss’s credit card number and can potentially match it to receipts). 3) Little Creek Camp announced a direct action planned for tomorrow at 1000 in Iowa City. They used the hashtag #divest, implying it will be at a DAPL-investing bank such as Wells Fargo. TigerSwan Prepared for Energy Transfer Partners 3

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS B. Past 24 Hours 1) Iowa DAPL Security patrolled the ROW, assessed the condition and upgrades, and interacted with the DAPL security force. 2) Continued to adjust security posture to account for recent attacks. 3) Canvassed local hardware stores throughout Iowa to look for potential spots Reznicek and Montoya bought welding supplies. 4) Communicated BOLO information with local landowners, gas station attendants, additional construction crew members, and hardware store workers C. Next 24 Hours 1) Continue to search for information on the whereabouts of Reznicek and Montoya and their vehicles and/or any information on the valve site attacks 2) Continue monitoring of Open Source information, ISR feeds, and other sources of information to provide accurate assessments of protester activities/migration which may impact DAPL operations. 3) DAPL security will continue to rove the valve sites in Iowa. Continue to have the field managers patrol the ROW, access security and validate ROW upgrades conducted. Assist and mentor DAPL security personnel as required 3. SOUTH DOKATO A. Intel Update 1) DOI 5 MAY 2017: Takini RD, Cheyenne River Indian Reservation, SD, Common Man Healing Camp (IKTCE WICASA OYATE) (LAT: LON: ) Physical Address 2) Many elements within the camp are awaiting establishment of KXL “Man Camps” in order to target and attack them at their staging and residential areas. Leaders of the camp voice a strong desire to acquire weapons, ballistic body armor and train with weapons. A recruitment of an arrestable class is desired for a constant attrition TigerSwan Prepared for Energy Transfer Partners 4

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS capability against law enforcement. The Tankini Camp is being regarded as a sustainment camp and a fallback position; and a staging ground for logistics/resources to establish a frontline camp in another location TBD. Location of frontline camp will be dictated by path of KXL Pipeline. (Source Comment: The time for prayer is over.) No Further Information (NFI) 3) Since the recent attempted attack on valve site SD-245, eyewitnesses. and- - have been very helpful providing information of what they saw took place on 1 May 2017. SD leadership security personnel,?, received written statements from both the- and that information has since been given to the FBI to further assist investigation. The Sheriff?s office in Minnehaha County, where the attempted attack took place, has also offered to help DAPL security, stepping up patrols in areas where the valve sites (SD-240 to SD-265) are located. 4) On 2 May 2017, Keloland CBS NEWS, reported the incident on the 10 o?clock news, minnehaha-county 5) Minnehaha County Sheriff's Captain, Jason Gearman, has asked locals in the area to be on the lookout of any suspicious activity stating, "These aren't the only people out there trying to cause harm to these things. We just want people to be aware that, if you see something, call it in, if you think it's suspicious, because it probably IS. B. Past 24 Hours 1) Currently working with Minnehaha Sheriff?s department to establish a good working relationship. The Investigator, Marc Wynia, Minnehaha County Sheriff,- - has been extremely helpful and wants to be involved with ensuring the valves and the surrounding areas stay secure. 2) The Minnehaha Sheriff?s office is currently patrolling the Sioux Falls valves and are in direct contact with the PM and DPM for SD. 3) Currently working with Minnehaha Sheriff?s department to establish a good working relationship. The Investigator, Marc Wynia, Minnehaha County Sheriff,- - has been extremely helpful and wants to be involved with ensuring the valves and the surrounding areas stay secure. 4) The Minnehaha Sheriff?s office is currently patrolling the Sioux Falls valves and are in direct contact with the PM and DPM for SD. C. Next 24 Hours 1) Continue to improve the guards? understanding of protocols, reporting procedures, and actions on contact by constant updates, as well as mentoring by SD security personnel leadership. SSAs in SD conduct a link-up with each guard in their and conducts face-to-face counseling of the guards? responsibilities. TigerSwan Prepared for Energy Transfer Partners 5

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS 2) Maintain positive oversight of guard activities to combat complacency by checking on guards regularly, using GA to ensure guards are roving in their assigned A/O, and to call guards directly for sitreps. 3) Contact property owners and neighbors that are located in the vicinity of the valve sites to establish good relationships with them. a. Pass along our contact info so, if they see anything, we can react to it and support them. b. Use as many locals as we can to further our oversight on the valves. 4) Continue to have SD security leadership personnel focus on becoming Certified Drone Pilots to support the DAPL program. 4. ILLINOIS A. Intel Update 1) The best assessment based on the known facts is that the attack was most likely conducted by Iowa activists; Jessica Reznicek and Ruby Montoya. Jessica Reznicek is a longtime activist throughout the world using mostly peaceful protest. In 2016 that changed when Reznicek attacked a Northrop Grumman office, smashing the windows in an attempt to make public information that she claimed was in the office. This was her turning point in the escalation of force to continue the protest narrative. Most recently, Reznicek and Montoya participated in a fasting ceremony in order to “gain wisdom in dismantling the DAPL pipeline.” Her most likely course of action is to continue her attacks against the pipeline until she is captured and incarcerated. 2) We believe that she will most likely continue her attacks along the pipeline moving initially south and into northern Illinois. Reznicek made a great deal of contacts in and around the Keokuk area during her protesting with her group Mississippi Stand, a group that prided themselves on direct actions to garner the press’s attention which they would in turn exploit. The group had multiple connections within Iowa but also got support from Illinois, Nauvoo. It was in Nauvoo that the ceremony was held. We believe that it is their intent to strike targets in the north west of Illinoi and south east Iowa in the hopes of garnering enough media coverage that would develop a recruiting a base of direct action prone individuals to conduct additional attacks maintaining a very decentralized structure B. Past 24 Hours 1) NSTR C. Next 24 Hours 1) Continued to support Sunoco personnel with operations as needed TigerSwan Prepared for Energy Transfer Partners 6

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS 2) Continued ROW and facility assessment and update running estimate of the security status 3) Conducted open source monitoring of activist groups 4) Assisted in the consolidation of intelligence efforts through instituting a tactical focused fusion cell integrating information from multiple states. 5) Conducted active security in order to deter or apprehend any threats to the DAPL valve facilities 5. MAIN TERMINALS A. Intel Update 1) Williston PM visited the Johnsons Corner and Watford City Terminals to ensure Security Guards meet standards, understand policies and adhere to Standard Operating Procedures. PM conducted security patrol to MLVs ND200, 190 and 180. PM met with , Securitas Williston Lead: discussed new Standard Operating Procedures based on new guard focus. 2) Epping- Client pipeline installation nearing completion. Permanent fencing removed for access 3) Johnson Corner - Intel Update Security status update: Outer perimeter barbed wire fence emplaced around construction yard. Gates not installed yet, but support poles positioned. New, SXL approved signage emplaced. Permanent light poles not installed yet 4) Watford City - Permanent Light poles not emplaced at this time. Gate at old entrance to construction yard has temporary gate 5) Trenton - Client pipeline installation almost complete. Permanent fencing returned to position. Remediation of land complete 6) Ramberg - Client pipeline installation complete B. Past 24 Hours 1) Epping – Client pipeline installation nearing completion. Permanent fencing removed for access 2) Johnson Corner – Outer perimeter fence emplaced 3) Watford – Groundwork in terminal area began 4) Trenton – Light Fixtures NOT emplaced Gaps under fence line in northwest corner. New Signage emplaced IAW DAPL standards. Williston PM will visit Trenton Terminal on Saturday May 6, 2017 5) Ramberg - Permanent Light Fixtures emplaced. Construction yard continues to be reduced and organized. New Signage emplaced. Outer perimeter barbed wire fence emplaced C. Next 24 Hours 1) Epping – a. There will be a guard present from 18:00 Friday to 06:00 hours Monday TigerSwan Prepared for Energy Transfer Partners 7

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS 2) 3) 4) 5) TigerSwan Johnson Corner – Continue on regular guard schedule until 17 May. Watford – Groundwork in terminal area began Trenton – Williston PM will visit Trenton Terminal on Saturday May 6, 2017 Ramberg - Security guard will be on duty from Friday at 18:00 till Monday at 06:00 hours Prepared for Energy Transfer Partners 8