Internal TigerSwan Situation Report 2017-05-07

DAPL SITREP 236 May 7, 2017 John Porter Chief Security Officer INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE. DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS.

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS The Highlights The Stanton?s have a second property, which now appears to be the primary residence. Social Media posts showing disunion between prominent protesters from No DAPL movement are increasing. There are factions forming and in-fighting is growing as protester egos grow with their following and then clash with one another. Examination of the game camera footage from the 9 April shows the arsonist appears to be wearing a two-piece disposable chemical suit . The Details 1. NORTH DAKOTA A. Intel Update 1) Cheyenne River Camp traffic has remained consistent over the last 24 hours with approximately 4 - 6 vehicles present. Possible sighting of the Buick Park Avenue from yesterday?s events. a. Analyst Comment: Traffic is expected to increase over the next 24 hours with the camp allegedly being ?re-opened? tomorrow. However, the events that follow in this report indicate the camp has already began receiving new occupants, even if the vehicle counts do not reflect it. TigerSwan Prepared for Energy Transfer Partners 1

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS 2) At approximately 1750 CST yesterday, 2 people were identified walking around the former Oceti Sakowin Camp grounds with a third person standing along HWY 1806 watching the other two. No vehicles were in sight. a. Analyst Comment: The lack of a vehicle being present and the lack of any structures or nearby civilization suggests the 3-people walked down from the Cheyenne River Camp as it is the only thing within walking distance. 3) At Approximately 1420 CST today, 1 male and 1 female Native American were observed walking Northbound on HWY 1806 from the direction of the camps. At approximately 1447 CST, the 2 walkers stopped at HDD-West Gate 3 and spoke with a TigerSwan employee holding static position. The (2) walkers claimed to be walking to Mandan for personal reasons, then asked for a ride. The protesters continued Northbound on HWY 1806 on foot without further incident. a. Analyst Comment: This is the second consecutive day of scouting attempts by protesters along HWY 1806. 4) Social Media posts showing disunion between prominent protesters from No DAPL movement are increasing. There are factions forming and in-fighting is growing as protester egos grow with their following and then clash with one another. Recent targets are Ernesto Burbank and Tawasi. a. Analyst Comment: The disunity is a positive thing for DAPL and could be exploited from a PR perspective, but overall, the in-fighting appears to only be between prominent social media figureheads. The actual operational organization structure of the movement appears to be primarily intact and cohesive with small camps springing up all across the nation. B. Past 24 Hours 1) Maintained security at valves ND-280 to ND-430 using roving patrols. 2) Conducted aerial roving patrol from valves SD-160 to ND-280. 3) Valve sites inspections: HDD-West Gate 3 / Gate 1 - Interaction between protesters and TigerSwan employees at 1815 CST yesterday ended without incident - Interaction between solo protester and TigerSwan employee at 2100 CST yesterday resulted in damage to DAPL Security vehicle and 1 arrest - Interaction between TigerSwan employee and 1 male and 1 female Native Americans on foot at approximately 1447 CST today ended without incident - “No Trespassing” signs added along HWY 1806 and CR134 C. Next 24 Hours 1) Continue monitoring of Open Source information, ISR feeds, and other sources of information to provide accurate assessments of protester activities/migration which may impact DAPL operations. TigerSwan Prepared for Energy Transfer Partners 2

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE 2) 3) DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS DAPL security will continue to rove the valve sites in North Dakota. Michels continues restoration efforts at the HDDs, awaiting delivery of trees 2. IOWA A. Intel Update 1) 2) TigerSwan Examination of the game camera footage from the 9 April shows the arsonist appears to be wearing a two-piece disposable chemical suit. Local distributors of this suit are limited, with Airgas welding supply appearing to be the only store that offers this product. This further limit where the arsonists purchased their welding supplies. It is likely this suit was destroyed during the fires on 9 April and the arsonist upgraded to the more durable black suit seen on 02 May. MCR Safety! Clear Squall .2 mm PVC 2-Piece Rain Suit With Attached Hood And Elastic Waist Pants Airgas Part Reno luL Manufacturer #2 IZZL $10.86 Each Reports from protesters claim they have a large and growing local support group in Iowa with the exception of a group who drove by the camp yelling Obscenities. Protesters have been able to sway even the most conservative Iowan landowners because water quality and eminent domain have been an ongoing issue in Iowa. Prepared for Energy Transfer Partners 3

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE 3) DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS According to protesters, there is an upcoming hearing for the eminent domain lawsuit, however, the exact date is TBD. This hearing may be the attempt to add more groups to the plaintiff?s claim as protesters discussed during the climate rally on 29 April. B. Past 24 Hours 1) 2) 3) 4) Iowa DAPL Security patrolled the ROW, assessed the condition and upgrades, and interacted with the DAPL security force. Continued to adjust security posture to account for recent attacks. Communicated BOLO information with local landowners, gas station attendants, additional construction crew members, and hardware store workers. Finished presentation to local LE and fusion center C. Next 24 Hours 1) 2) 3) 4) Obtain meeting with Fusion center at Iowa Department of Public Safety Visit welding gas supply shops to see if salesmen can photo id Reznicek, Montoya, or other protesters Continue monitoring of Open Source information, ISR feeds, and other sources of information to provide accurate assessments of protester activities/ migration which may impact DAPL operations DAPL security will continue to rove the valve sites in Iowa. Continue to have the field managers patrol the ROW, access security and validate ROW upgrades conducted. Assist and mentor DAPL security personnel as required 3. ILLINOIS A. Intel Update TigerSwan 1) TS-IL has recently determined that the Stanton?s have a second property, which now appears to be the primary residence. This property allows easy travel and access to sites IL 10- IL 30, within minutes. On site, the ?ame for the sweat lodge was discovered behind a shop. TS-IL will continue to gather intel and conduct smveillance of the Stanton ro oer w?l' Prepared for Energy Transfer Partners 4

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS (Looqlc TigerSwan Prepared for Energy Transfer Partners

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS B. Past 24 Hours 1) Continued ROW and facility assessment and update running estimate of the security status 2) Conducted increased presence patrols throughout the AO as a means of active deterrence. 3) Conducted patrols to identify the presence and location of POls C. Next 24 Hours 1) Continue to support Sunoco personnel with operations as needed 2) Conduct assessments and photo documentation of the sites across the entire Illinois line 3) Conduct open source monitoring of activist groups 4) Conduct active security in order to deter or apprehend any threats to the DAPL valve facilities 5) Assist in multi-state search in person of interest, Jessica Reznicek. 6) Continue search effort with TS .Ioint Intel Team in the effort to locate persons of interest suspected of attacking and attempting to attack valve sites in Iowa and Illinois SOUTH DAKOTA D. Intel/Incident Update 1) SD security personnel made contact with- an_, Ph._ - a neighbor in close proximity to SD-250. Guard also made contact with- -, close to SD-260. Both the_ and- are willing to assist, keeping eyes on the valve site. They were given SD security personnel information to report any suspicious activity. TigerSwan Prepared for Energy Transfer Partners 6

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS Past 24 Hours 1) DAPL security has hired more detail to guard the SD valve sites. These guards will begin patrolling in the upcoming days. This will give more coverage on the valve sites and leave them less vulnerable to damages caused by protestors. 2) Security guards continue to make liaison with homeowners in vicinity to DAPL valve sites to establish good rapport and use as a source of information for reporting. Next 24 Hours 1) Leadership personnel will continue to ensure guards are roving constantly and changing their routes to sites, making it more difficult for onlookers to note a pattern. We will also continue to make sure guards are paying close attention to areas of interest, and reporting accordingly. Continue to ensure all guards are aware of the heightened threat level because of the 14 May deadline, the date reported to the public of when oil will be flowing through the pipeline. 4. WILLISTON A. Intel Update 1) Williston PM visited the Epping, Ramberg, Stanley, Trenton, Watford City and Johnsons Corner Terminals to ensure Security Guards meet standards, understand policies and adhere to Standard Operating Procedures. PM conducted security patrol to MLVs ND 170, 180, 190 and 200. Met with Securitas Williston Lead: discussed new Standard Operating Procedures, Operations Order and implementation procedures 2) Client pipeline installation nearing completion. Permanent fencing returned into position. Client gate needs to be locked on regular basis. 3) Approved DAPL signage in place. 4) Crews are sandblasting and priming tanks. 5) Groundwork underway B. Past 24 Hours 1) Epping Security Guard now on duty 24/7 on weekends. 2) Gap under fence on south side near client facilities 3) Large gap under client gate on southside C. Next 24 Hours 1) There will be a guard present from 18:00 to 06:00 hours Monday 5. MAIN TERMINALS A. Intel Update TigerSwan Prepared for Energy Transfer Partners 7

INFORMATION CONTAINED IN THIS REPORT IS PROPRIETARY AND SENSITIVE DO NOT RELEASE OUTSIDE OF AUTHORIZED AND APPROVED RECIPIENTS 1) Trenton - Client pipeline installation complete. Permanent fencing returned to position. Client gate chained so loosely that access is available for pedestrians. Recommend (3) gates be installed at temporary fence at old main gate, tie in from outer perimeter barbed wire fence to chain link perimeter fence and at Main entrance to tie in outer perimeter barbed wire fence to access control point. No tank preparation at this time. Installation of permanent light fixtures underway at this time. Approved DAPL signage installed. Some older signage is loose from it?s attachment. (2 locations) 2) Ramberg - Client pipeline installation complete. Crews sandblasting and priming tanks. Recommend outer perimeter barbed wire fence be tie in to existing fence line and gated to control access to construction yard, which has considerable material in it. 3) Stanley - Client pipeline complete. Remediation of ground needs completed. Permanent fencing replaced, but barbed wire on top is missing. Client gate has been found ?dummy locked? but was locked and chained during visit. Pedestrian gate to retention pond was unlocked, but is now locked, NOT chained. Crews are sandblasting and priming tanks. Card reader at main gate NOT in operation B. Past 24 Hours 1) Sunoco ordered removal of light plants today that affected guard shack at Ramberg and Watford city. Call was made to_ removal postponed until Monday. Issue: decisions made without regard to affect to personnel or security. 2) Trenton Light Fixture emplacement continues 3) Ramberg - Security Guard present 24/7 on weekends 4) Stanley - Security guard present 24/7 C. Next 24 Hours 1) Continue to refine and improve Operations Order to cover new guard procedures 2) Trenton - Light Fixture emplacement continues 3) Ramberg - Security Guard present 24/7 on weekends 4) Stanley - Security guard present 24/7 TigerSwan Prepared for Energy Transfer Partners 8