Photo: TigerSwan

A shadowy international mercenary and security firm known as TigerSwan targeted the movement opposed to the Dakota Access Pipeline with military-style counterterrorism measures, collaborating closely with police in at least five states, according to internal documents obtained by The Intercept. The documents provide the first detailed picture of how TigerSwan, which originated as a U.S. military and State Department contractor helping to execute the global war on terror, worked at the behest of its client Energy Transfer Partners, the company building the Dakota Access Pipeline, to respond to the indigenous-led movement that sought to stop the project.

Internal TigerSwan communications describe the movement as “an ideologically driven insurgency with a strong religious component” and compare the anti-pipeline water protectors to jihadist fighters. One report, dated February 27, 2017, states that since the movement “generally followed the jihadist insurgency model while active, we can expect the individuals who fought for and supported it to follow a post-insurgency model after its collapse.” Drawing comparisons with post-Soviet Afghanistan, the report warns, “While we can expect to see the continued spread of the anti-DAPL diaspora … aggressive intelligence preparation of the battlefield and active coordination between intelligence and security elements are now a proven method of defeating pipeline insurgencies.”

More than 100 internal documents leaked to The Intercept by a TigerSwan contractor, as well as a set of over 1,000 documents obtained via public records requests, reveal that TigerSwan spearheaded a multifaceted private security operation characterized by sweeping and invasive surveillance of protesters.

As policing continues to be militarized and state legislatures around the country pass laws criminalizing protest, the fact that a private security firm retained by a Fortune 500 oil and gas company coordinated its efforts with local, state, and federal law enforcement to undermine the protest movement has profoundly anti-democratic implications. The leaked materials not only highlight TigerSwan’s militaristic approach to protecting its client’s interests but also the company’s profit-driven imperative to portray the nonviolent water protector movement as unpredictable and menacing enough to justify the continued need for extraordinary security measures. Energy Transfer Partners has continued to retain TigerSwan long after most of the anti-pipeline campers left North Dakota, and the most recent TigerSwan reports emphasize the threat of growing activism around other pipeline projects across the country.

The leaked documents include situation reports prepared by TigerSwan operatives in North Dakota, South Dakota, Iowa, Illinois, and Texas between September 2016 and May 2017, and delivered to Energy Transfer Partners. They offer a daily snapshot of the security firm’s activities, including detailed summaries of the previous day’s surveillance targeting pipeline opponents, intelligence on upcoming protests, and information harvested from social media. The documents also provide extensive evidence of aerial surveillance and radio eavesdropping, as well as infiltration of camps and activist circles.

TigerSwan did not respond to a request for comment. Energy Transfer Partners declined to comment, telling The Intercept in an email that it does not “discuss details of our security efforts.”


A screen shot taken from one of the “daily intelligence updates” developed by TigerSwan that were shared with members of law enforcement.

Photo: PowerPoint screen grab

Additional documents, obtained via public records requests, consist of communications among agents from the FBI, the Department of Homeland Security, the U.S. Justice Department, the Marshals Service, and the Bureau of Indian Affairs, as well as state and local police. The “Intel Group,” as its members refer to it, closely monitored anti-Dakota Access protests in real time, scooped up information on the water protectors from social media, and shared intelligence.

Included among the documents obtained via public records requests were “daily intelligence updates” developed by TigerSwan that were shared with law enforcement officers, thus contributing to a broad public-private intelligence dragnet. In the internal situation reports, TigerSwan operatives comment frequently about their routine coordination and intelligence sharing with law enforcement. The intel group went so far as to use a live video feed from a private Dakota Access security helicopter to monitor protesters’ movements. In one report, TigerSwan discusses meeting with investigators from North Dakota’s Attorney General’s Office.

North Dakota’s Attorney General’s Office declined to comment.

TigerSwan’s internal reports and the intelligence briefings shared with law enforcement name dozens of DAPL opponents. Some of those named are well-known activists, while others have minimal public affiliation with the water protector movement. The reports’ authors often comment on camp dynamics, including protester morale and infighting, and speculate about violent or illegal actions specific individuals might take and weapons they might carry. The documents reveal the existence of a “persons of interest” list as well as other databases that included identifying information such as photographs and license plate numbers.

The situation reports also suggest that TigerSwan attempted a counterinformation campaign by creating and distributing content critical of the protests on social media.

The Intercept is publishing a first set of TigerSwan’s situation reports from September 2016, which describe the company’s initial operations. We are also publishing two additional situation reports dated October 16 and November 5, along with PowerPoint presentations shared with law enforcement that correspond to the same dates. The names of private individuals whose actions are not already in the public record, or whose authorization we did not obtain, have been redacted to protect their privacy. The Intercept will publish the remaining situation reports in the coming weeks.

In addition, The Intercept is publishing a selection of communications, obtained by public records requests, detailing coordination between a wide range of local, state, and federal agencies, which confirm that the FBI participated in core Dakota Access-related law enforcement operations starting soon after protests began last summer. Finally, we are publishing two additional documents, also in the public record, that detail TigerSwan’s role spearheading Energy Transfer Partner’s multipronged security operation.

The FBI did not respond to a request for comment.

Police guard a bridge near Oceti Sakowin Camp on the edge of the Standing Rock Sioux Reservation on December 3, 2016 outside Cannon Ball, North Dakota, as Native Americans and activists from around the country gather at the camp trying to halt the construction of the Dakota Access Pipeline.  / AFP / JIM WATSON        (Photo credit should read JIM WATSON/AFP/Getty Images)

Police guard a bridge near Oceti Sakowin Camp on the edge of the Standing Rock Sioux reservation outside Cannon Ball, N.D., on Dec. 3, 2016.

Photo: Jim Watson/AFP/Getty Images

A Public-Private Partnership

Beginning in April of last year, indigenous activists calling themselves water protectors and their allies spent months attempting to block construction of the 1,172-mile Dakota Access Pipeline, which runs near the Standing Rock Sioux reservation in North Dakota and traverses three other states. DAPL opponents were met with a heavily militarized police apparatus including local and out of state police and sheriff’s deputies, as well as Bureau of Indian Affairs police and National Guard troops. The police became notorious for their use of so-called less than lethal weapons against demonstrators, including rubber bullets, bean bag pellets, LRAD sound devices, and water cannons.

But it was the brutality of private security officers that first provoked widespread outrage concerning the pipeline project. On Labor Day weekend of 2016, Democracy Now! captured footage of pipeline security guards attacking peaceful protesters with dogs.

In the aftermath of that incident, Energy Transfer Partners turned to TigerSwan — a company with a deep background in counterterrorism operations — to oversee the work of the other security companies contracted to protect the pipeline. Other security firms working along the pipeline included Silverton, Russell Group of Texas, 10 Code LLC, Per Mar, SRC, OnPoint, and Leighton, documents show.

Based in Apex, North Carolina, TigerSwan was created by retired Army Col. James Reese during the height of the war in Iraq. Reese, a former commander in the elite Army special operations unit known as Delta, entered into the exploding private security and intelligence industry hoping to compete with Blackwater, then the most successful of the private military companies supporting U.S. war efforts in the Middle East and Afghanistan. TigerSwan has an estimated 350 employees and maintains offices in Iraq, Afghanistan, Saudi Arabia, Jordan, India, Latin America, and Japan.

Records from the North Dakota Private Investigation and Security Board show that TigerSwan has operated without a license in North Dakota for the entirety of the pipeline security operation, claiming in a communication with the board, “We are doing management and IT consulting for our client and doing no security work.” In September, the licensing board learned about the company’s position as a Dakota Access contractor and wrote a letter to its North Carolina headquarters requesting that it submit a license application.

TigerSwan then did so, but the board denied the application on December 19. After James Reese wrote a letter objecting to the decision, the security board’s executive director responded on January 10 that “one reason for the denial concerns your failure to respond to the Board’s request for information as to TigerSwan’s and James Reese’s activities within the State of North Dakota.” Neither TigerSwan nor the board responded to questions regarding the current status of the company’s license.

The leaked situation reports indicate that during the company’s first weeks working on the pipeline, TigerSwan operatives met with law enforcement in Iowa and North Dakota, including Sheriff Dean Danzeisen of Mercer County, North Dakota, who “agreed to sharing of information.” (In the report, TigerSwan misspells the sheriff’s name as “Denzinger.”) By September 13, the documents indicate, TigerSwan had placed a liaison inside the law enforcement “joint operation command” in North Dakota. The fusion of public and private intelligence operations targeting water protectors was underway.

One of TigerSwan’s lines of communication with law enforcement was via intelligence briefings that echo the company’s internal situation reports. The briefings obtained by The Intercept were sent by TigerSwan’s deputy security director Al Ornoski to a variety of recipients, including the Gmail account of Sheriff Danzeisen. Morton County Sheriff Kyle Kirchmeier, who was regularly involved in policing the protests, also received at least one of the TigerSwan briefings.

Danzeisen did not respond to a request for comment. A spokesperson for the Morton County Sheriff’s Department wrote in an email to The Intercept that the department “did maintain communication with TigerSwan security in order to understand when and where DAPL construction activities were taking place. This gave law enforcement situational awareness in order to monitor and respond to illegal protest activity.”

TigerSwan also aided prosecutors in building cases against pipeline opponents. According to an October 16 document obtained via a records request, the security team’s responsibilities included collecting “information of an evidentiary level” that would ultimately “aid in prosecution” of protesters.

A leaked report dated September 14, 2016, indicates that TigerSwan met with the North Dakota Bureau of Criminal Investigation “regarding video and still photo evidence collected for prosecution.” The same document describes plans to “continue building Person of Interest (POI) folders and coordination with [law enforcement] intelligence.” TigerSwan’s situation reports also describe conversations between the company’s operatives and FBI agents on at least four occasions.

Activists on the ground were tracked by a Dakota Access helicopter that provided live video coverage to their observers in police agencies, according to an October 12 email thread that included officers from the FBI, DHS, BIA, state, and local police. In one email, National Security Intelligence Specialist Terry Van Horn of the U.S. attorney’s office acknowledged his direct access to the helicopter video feed, which was tracking protesters’ movements during a demonstration. “Watching a live feed from DAPL Helicopter, pending arrival at site(s),” he wrote. Cecily Fong, a spokesperson for law enforcement throughout the protests, acknowledged that an operations center in Bismarck had access to the feed, stating in an email to The Intercept that “the video was provided as a courtesy so we had eyes on the situation.”

Asked about the intel group, Fong replied, “The Intelligence Group was formed from virtually the beginning. It involved personnel from our [State and Local Intelligence Center], the BIA, FBI, and Justice” consisting of “around 7 people who monitored social media in particular, in this case, because that was the medium most if not all of the protestors were using.”

“I’m honored that they felt that we were a big enough threat to go to this level of intervention,” Ed Fallon, an activist mentioned several times in the TigerSwan documents, told The Intercept.

As the water protector movement expanded from North Dakota to other states, so did the surveillance. A report dated March 29, for instance, points to a meeting between TigerSwan and “the Des Moines Field Office of the FBI, with the Omaha and Sioux Falls offices joining by conference call. Also in attendance were representatives of the Joint Terrorism Task Force, Department of Homeland Security, Iowa Department of Emergency Services, Iowa Department of Homeland Security and Iowa Department of Wildlife. Topics covered included the current threat assessment of the pipeline, the layout of current security assets and persons of interest. The FBI seemed were [sic] very receptive to the information presented to them, and follow-up meetings with individuals will be scheduled soon.”

TigerSwan’s relationship with public police agencies was not always harmonious. The situation reports describe TigerSwan’s frustration with the amount of leeway some law enforcement gave protesters in Iowa and the company’s efforts to convince officers to use more punitive tactics.

In a situation report dated October 16, TigerSwan applauds a recent increase in bail in Lee County, Iowa, calling it “significant because this may impede protestors from risking arrest due to the high cost to be released from bail.” The document contrasts that county’s tactics to those used by others. “Calhoun, Boone and Webster county law enforcement are not supportive of DAPL Security’s mission” the report says, noting those agencies’ “reluctance to arrest or cite trespassing individuals.”

“We need to work closer with Calhoun, Boone, and Webster county [law enforcement] to ensure future protestors will at least be fined, if not arrested,” the analyst notes. “Alternatively, we could request Lee County LE speak to other counties about tactics that are working.”

Contacted for comment, recently elected Lee County Sheriff Stacy Weber said he hadn’t discussed TigerSwan with the previous sheriff. “As far as I knew, the protest stuff was over with, and we haven’t had any protests since,” he said. In fact, Weber hadn’t heard of the company until earlier this week, when a TigerSwan program manager named Don Felt stopped by the office. “He dropped his card off and said he wanted to say hello,” Weber said.


An image on the homepage of the TigerSwan website headlined “Security & Safety: Vulnerability Management.”


Find, Fix, Eliminate

TigerSwan’s internal files describe its utilization of aerial surveillance, including use of helicopters and drones to photograph and monitor the pipeline opponents. The September 12 situation report notes that an operation by construction workers was “over-watched by a predator on loan to the JEJOC from Oklahoma.” The TigerSwan contractor who provided the Intercept with the situation reports said he did not believe the company ever operated a predator drone, but metadata in images he shared pointed to a camera used by a commercially available Phantom 4 drone. One of the daily intelligence updates notes plans to obtain night-vision goggles, LRADs, body armor, and FLIR (forward looking infrared) cameras.

The reports also reveal a widespread and sustained campaign of infiltration of protest camps and activist circles. Throughout the leaked documents, TigerSwan makes reference to its intelligence-gathering teams, which infiltrated protest camps and activist groups in various states. TigerSwan agents using false names and identities regularly sought to obtain the trust of protesters, which they used to gather information they reported back to their employer, according to the TigerSwan contractor.

The September documents make numerous references to Silverton personnel, who were overseen by TigerSwan, attending protests in Iowa. Silverton did not respond to a request for comment.

Covert operations are implicit in many of the other situation reports, which are filled with details that only individuals with close and consistent access to the protesters’ communities could have gathered. On a few occasions, however, the reports make that presence more explicit, for instance by referring to “sources in the camp.”

For example, the November 5 situation report describes the “exploitation of documents found at Camp 1.” Apparently, they didn’t contain much revealing material. “Of most concern,” the situation report says, “were the ‘Earth First’ magazines found on the camp. These magazines promote and provide TTP’s [tactics, techniques, and procedures] for violent activity.”

In an October 3 report, TigerSwan discusses how to use its knowledge of internal camp dynamics: “Exploitation of ongoing native versus non-native rifts, and tribal rifts between peaceful and violent elements is critical in our effort to delegitimize the anti-DAPL movement.” On February 19, TigerSwan makes explicit its plans to infiltrate a Chicago protest group. “TigerSwan collections team will make contact with event organizers to embed within the structure of the demonstration to develop a trusted agent status to be cultivated for future collection efforts,” the report notes, later repeating its intent to “covertly make contact with event organizers.”

“At every action I went to, they had their own people walking around with a video camera getting in people’s faces,” Ian Souter, a protester who was described as a “person of interest” in a TigerSwan report, told The Intercept.

Perhaps one of the most striking revelations of the documents is the level of hostility displayed by TigerSwan toward the water protectors. TigerSwan consistently describes the peaceful demonstrators using military and tactical language more appropriate for counterterrorism operations in an armed conflict zone. At times, the military language verges on parody, as when agents write of protesters “stockpiling signs” or when they discuss the “caliber” of paintball pellets. More often, however, the way TigerSwan discusses protesters as “terrorists,” their direct actions as “attacks,” and the camps as a “battlefield,” reveals how the protesters’ dissent was not only criminalized but treated as a national security threat. A March 1 report states that protesters’ “operational weakness allows TS elements to further develop and dictate the battlespace.”

In one internal report dated May 4, a TigerSwan operative describes an effort to amass digital and ground intelligence that would allow the company to “find, fix, and eliminate” threats to the pipeline — an eerie echo of “find, fix, finish,” a military term used by special forces in the U.S. government’s assassination campaign against terrorist targets.

TigerSwan pays particular attention to protesters of Middle Eastern descent. A September 22 situation report argues that “the presence of additional Palestinians in the camp, and the movement’s involvement with Islamic individuals is a dynamic that requires further examination.” The report acknowledges that “currently there is no information to suggest terrorist type tactics or operations,” but nonetheless warns that “with the current limitation on information flow out of the camp, it cannot be ruled out.”

Haithem El-Zabri, a Palestinian-American activist singled out in the reports, was shocked to hear his name mentioned in that context. “As indigenous people, Palestinians stand in solidarity with other indigenous people and their right to land, water, and sovereignty,” he told The Intercept. “To insinuate that our assumed faith is a red flag for terrorist tactics is another example of willful ignorance and the establishment’s continued attempts to criminalize nonviolent protest and justify violence against it.”

Such ethnic and religious profiling of protesters was not unusual. An October 12 email thread shared among members of the intel group provides a striking example of how TigerSwan was able to cast suspicion on specific individuals and communicate it to law enforcement officials. Cass County Sheriff’s Deputy Tonya Jahner emailed several other officers, including two FBI agents, with an overview of information provided by “company intel.” The information pertained to a woman whom Jahner labeled as a “strong Shia Islamic” with a “strong female Shia following.” The woman had “made several trips overseas,” Jahner wrote.

TigerSwan agents also regularly tracked individuals’ movements across state lines.

On November 4, according to one of TigerSwan’s internal documents, a white SUV pulled up to a pipeline valve site in South Dakota. Approached by a security guard, the driver introduced himself as Gary Tomlin and informed the official that he was a freelance reporter covering the pipeline. In an interview, 63-year-old Tomlin, who covers the local school board for the Galesburg, Illinois, Register-Mail, said he had set out to travel the length of the pipeline and write a story about it as a freelancer. “I had time and the ability to do it, and I thought, well, I’ll go look at that sucker,” he said.

A situation report from that day notes, “This is the same individual identified in the SITREP a few days ago in Illinois and Iowa.” The security company, OnPoint, quickly contacted TigerSwan Intel “for an assessment of Gary Tomlin” and notified the guard in the next “sector” that Tomlin was on his way. “Movement of Spread Team 6 was conducted so as to intercept and/or observe Gary Tomlin’s movement throughout the South Dakota Sector,” the document states. “It is my belief,” the analyst adds, “that Gary Tomlin is hiding his true intentions and that he has a plethora of information to provide to the protesters. It is estimated that he will arrive in North Dakota on the evening of the 4th or morning of the 5th.”

Tomlin laughed at the notion that he was working with protesters. When he arrived at the camps in North Dakota, few people would talk openly with him. “They were highly aware of infiltrators,” he said. “I fit the profile of those security people — I’m a white old man.”

Cody Hall, a prominent native activist whose movements are tracked closely in the TigerSwan reports, told The Intercept he knew he was being followed whenever he left the camp.

“It was obvious, they were driving in trucks, SUVs, they would be right behind me, right next to me … it was like, damn, man, it’s like you’re getting an escort,” he said. “That was always the scary thing: How did they know that I was coming?”

Robert Rice hosted a series of videos critical of the pipeline protest movement without disclosing that he was working for TigerSwan. The videos, which were posted on two Facebook pages, were taken down after The Intercept reached out to the firm for comment.

Social Engagement Plan

A document dated October 16, obtained via a public records request, lays out the mission of the TigerSwan-led security team working in North Dakota: In addition to protecting the pipeline workers, machinery, and construction material, the company was also expected to “protect the reputation of DAPL.” The public relations mission quickly became a priority for the firm, documents show. As a leaked situation report from early September puts it, success would require “strategic messaging from the client that drives the message that we are the good guys, tell the real story and address the negative messaging with good counter messaging.”

On numerous occasions, TigerSwan agents stressed the need to change the public narrative established by protestors and to swing public support in favor of the pipeline. As accounts of protest repression garnered nationwide support for the NoDAPL movement, the firm’s agents painstakingly collected and analyzed media coverage, warning their client about how certain incidents might be received by the public.

“This article is only in the Huffington post, but the expansion of the tribe’s narrative outside of the Native American community media outlets is of concern,” an October 3 report notes. TigerSwan agents regularly describe protesters’ accounts of events as “propaganda.”

But TigerSwan personnel did not limit themselves to monitoring the narrative — they also tried to change it.

In a report dated September 7, TigerSwan agents discuss the need for a “Social Engagement Plan.” On September 22, they discuss the development of an information operations campaign run by the company’s North Carolina-based intel team and Robert Rice, who without disclosing his TigerSwan affiliation posed as “Allen Rice” in a series of amateurish videos in which he provided commentary critical of the protests. The videos, posted on the Facebook pages “Defend Iowa” and “Netizens for Progress and Justice,” were removed after The Intercept contacted TigerSwan, Rice, and the pages’ administrators for comment. None responded.

With the Dakota Access Pipeline construction nearing completion, TigerSwan might have found itself out of a lucrative contract. But in the months leading up to the first oil delivery through the pipeline, the company made sure to stress the continued need for security.

“Everyone must be concerned of the lone wolf,” a TigerSwan operative wrote in a March 7 report. “Should we slip from that conscience, we may all be amiss. I cannot afford this in my duties, nor will We/I allow or accept this. I cannot thank everyone for enough for their support during this entire process, However, the movement continues, and We/I will not stop. That’s not in my vocabulary. We will always over-watch as the protectors what is in the best interest for ETP, as we are the guardians.”

In recent weeks, the company’s role has expanded to include the surveillance of activist networks marginally related to the pipeline, with TigerSwan agents monitoring “anti-Trump” protests from Chicago to Washington, D.C., as well as warning its client of growing dissent around other pipelines across the country.

In a March 24 report discussing the likely revival of protests as summer approaches, TigerSwan writes, “Much like Afghanistan and Iraq, the ‘Fighting Season’ will soon be here with the coming warming temperatures.”

Documents published with this story:

We depend on the support of readers like you to help keep our nonprofit newsroom strong and independent. Join Us 

Part 2

Standing Rock Documents Expose Inner Workings of “Surveillance-Industrial Complex”

Contact the author:

Alleen Brownalleen.brown@​

Will Parrishwillparrish2017@​

Alice Sperialice.speri@​

Additional Credits:

Additional Reporting: Matthew Cole. Research: Sheelagh McNeill and Talya Cooper.
Read more
Photo: Scott Olson/Getty Images

On a freezing night in November, as police sprayed nonviolent Dakota Access Pipeline opponents with water hoses and rubber bullets, representatives of the FBI, the Bureau of Indian Affairs, North Dakota’s U.S. Attorney’s Office, and local law enforcement agencies frantically exchanged emails as they monitored the action in real time.

“Everyone watch a different live feed,” Bismarck police officer Lynn Wanner wrote less than 90 minutes after the protest began on the North Dakota Highway 1806 Backwater Bridge. By 4 a.m. on November 21, approximately 300 water protectors had been injured, some severely. Among them was 21-year-old Sophia Wilansky, who nearly lost her arm after being hit by what multiple sworn witnesses say was a police munition.

The emails exchanged that night highlight law enforcement efforts to control the narrative around the violent incident by spreading propaganda refuting Wilansky’s story, demonstrate the agencies’ heavy reliance on protesters’ social media feeds to monitor activities, and reveal for the first time the involvement of an FBI informant in defining the story police would promote.

The exchange is included in documents obtained by The Intercept that reveal the efforts of law enforcement and private security contractors to surveil Dakota Access Pipeline opponents between October and December 2016, as law enforcement’s outsized response to the demonstrators garnered growing nationwide attention and the number of water protectors living in anti-pipeline camps grew to roughly 10,000. Although the surveillance of anti-DAPL protesters was visible at the time — with helicopters circling overhead, contingents of security officials watching from the hills above camp, and a row of blinding lights illuminating the horizon along the pipeline’s right of way — intelligence collection largely took place in darkness.

In addition to the email communications, The Intercept is publishing 15 internal situation reports prepared by the private security firm TigerSwan for its client, Dakota Access parent company Energy Transfer Partners, as well as three PowerPoint presentations that TigerSwan shared with law enforcement. The documents are part of a larger set that includes more than 100 internal TigerSwan situation reports that were leaked to The Intercept by one of the company’s contractors and more than 1,000 Dakota Access-related law enforcement records obtained via public records request.

Last week, The Intercept published an exclusive report detailing TigerSwan’s sweeping enterprise, over nine months and across five states, which included surveillance of activists through aerial technology, social media monitoring, and direct infiltration, as well as attempts to shift public opinion through a counterinformation campaign. The company, made up largely of special operations military veterans, was formed during the war in Iraq and incorporated its counterinsurgency tactics into its effort to suppress an indigenous-led movement centered around protection of water.


An image of a gorilla overseeing the Standing Rock camp appears in an October 18, 2016, daily intelligence update the private security firm TigerSwan circulated to law enforcement.

Photo: Daily Intelligence Updates

Federal Agencies Circulate Dubious Theories

Roughly eight hours prior to Sophia Wilansky’s injury, Bismarck police officer Lynn Wanner — who, records indicate, acted as a liaison between intelligence agencies and field officers throughout the anti-DAPL protests — alerted local, state, and federal law enforcement partners that an “FBI inside source” was “reporting propane tanks inside the camp rigged to explode.” Wanner’s email about the FBI informant echoes the story the Morton County Sheriff’s Department would later tell journalists about Wilansky’s injury.

“We probably should be ready for a massive media backlash tomorrow although we are in the right. 244 angry voicemails received so far,” wrote Ben Leingang, a North Dakota state official, at about 10 p.m. on November 20. By morning, images of Wilansky’s severely injured arm were circulating online.

TigerSwan fretted about the backlash, too. “Protesters are claiming over 100 injuries associated with the demonstration and will surely contort video of the event into anti-DAPL propaganda,” the security firm noted in its internal report that next morning.

As another day passed, U.S. Attorney’s Office National Security Intelligence Specialist Terry Van Horn sent an email to members of various federal agencies noting the FBI’s claim that “a source from the camp reported people were making IED’s from small Coleman type propane canisters.” Van Horn added that Wilansky “was witnessed throwing an IED while on the bridge, it detonated early and caused the below injuries (see graphic photos).”

Less than an hour later, Van Horn emailed to the thread the text of a Facebook post from the page Netizens for Progress and Justice. “This wasn’t caused by law enforcement, it was caused by dumbass ‘direct action’ protesters that think they are doing the right thing without any consideration for the safety and welfare of honest protesters nearby that are caught up in things,” the post read, going on to describe a theory of the injury that conflicted even with law enforcement’s propane tank theory.

“How can we get this story out?” replied Maj. Amber Balken, a public information officer for the National Guard, which was also involved in policing the protests. “This is a must report,” Balken added, suggesting the name of a local conservative blogger. Cecily Fong, a public information officer with the North Dakota Department of Emergency Services, replied by promising to “get with” the blogger to circulate the article.

As The Intercept reported last week, Netizens for Progress and Justice also frequently published content produced on behalf of TigerSwan, including videos critical of pipeline opponents. Fong declined to comment on the exchange. Neither Van Horn nor Balken replied to a request for comment. The FBI declined to comment on any involvement it had in the protests, and the Bureau of Indian Affairs did not respond to a request for comment.

Ultimately, police promoted a story about the incident that echoed the claims of the FBI informant. On November 22, the Morton County Sheriff’s Department distributed press releases implying that Wilansky’s injury had been caused by a protester’s IED.

The Intercept reached Lauren Regan, an attorney representing Sophia Wilansky, and read the text of Van Horn’s email to her over the phone. “So much of it is totally factually incorrect,” Regan said.

“There has never been any evidence I have seen or heard of that gave any credibility to the allegation that propane tanks were being rigged as explosive devices,” continued Regan, who is a staff attorney at the Oregon-based Civil Liberties Defense Center. “To me, the timing of that revelation, in light of their having just basically blown a white woman’s arm off, always seemed extremely dubious.”

Sophia Wilansky’s father, Wayne Wilansky, agreed that “there’s not a shred of truth” to Van Horn’s account of Wilansky’s injury. “Obviously, disinformation is a major component of how they dealt with the protests,” he told The Intercept.

CANNON BALL, ND - NOVEMBER 24: A water protector loads up on goggles and milk of magnesia in anticipation of a confrontation with police as she prepares to cross the bridge to Turtle Island at Standing Rock on Nov. 24, 2016, during an ongoing dispute over the building of the Dakota Access Pipeline. (Photo by Jessica Rinaldi/The Boston Globe via Getty Images)

A water protector loads up on goggles and milk of magnesia in anticipation of a confrontation with police as she prepares to cross the bridge to Turtle Island at Standing Rock on Nov. 24, 2016, during an ongoing dispute over the building of the Dakota Access Pipeline.

Photo: Jessica Rinaldi/The Boston Globe/Getty Images

Surveillance Reports Paint Protesters as Desperate and Deviant

The internal situation reports from around the time of Wilansky’s injury contain their own examples of disinformation, invasive intelligence-gathering practices, and a fixation on the purported violence of DAPL’s opponents. At times, TigerSwan refers explicitly to informants and infiltrators. A document from October 3, for example, explains the ways the company monitored members of the American Indian Movement “mostly through social media” and “informant collection” in order to gauge the effectiveness of their security practices and “develop possible counter-measures moving forward.”

The documents, four of which were first published by Grist, include the names of dozens of pipeline opponents, labeling some as “persons of interest.” They describe meetings with law enforcement, including campus police at the University of Illinois and Lincoln Land College, as well as TigerSwan’s attempts to pressure officers into more aggressive action against protesters.

In the reports, TigerSwan declares success in accessing hard-to-find Facebook content, noting in an October 10 document, “The social media cell has harnessed a URL coding technique to discover hidden profiles and groups associated with the protesters.”

But TigerSwan’s intelligence was far from perfect and its interpretation of events was frequently off. For example, one document referenced a shell necklace that, TigerSwan speculated, marked members of the Mississippi Stand group who “have been arrested for the cause.” Mississippi Stand member Alex Cohen told the Intercept that the necklaces had nothing to do with arrests and were merely gifts given to a number of members by people indigenous to the area of one of their camps.

Overall, TigerSwan depicted the situation on the ground as volatile, at times painting the anti-pipeline camps as rife with drug use and “sexual deviance,” its inhabitants likely to stir violence. The security company found ways to interpret even the most benign social gatherings as potentially dangerous. One document previewed a casino concert featuring Jackson Browne and Bonnie Rait, fretting that it would draw “numerous outside influencers.” The document predicted, “Depending on the progress of drilling by then, the project could be adversely affected if not counter measured.”

After November 8, TigerSwan noted that “the election of President-elect Trump is likely to have a positive effect for the project overall and cooperation from the Federal level will likely improve after 20 JAN.” At the same time, TigerSwan commented on protesters’ post-election “despair,” writing on November 12 that “the DAPL protesters are inherently desperate and are not looking for a peaceful solution regarding the Dakota Access Pipeline (DAPL) in turn we can expect this situation to become more volatile than it has ever become before.”

On November 13, TigerSwan again insisted on the likelihood of violence erupting. “Most locals are now carrying weapons to protect themselves, their families and their property,” that report notes. “They have also expressed frustration with what they see as a lack of action by law enforcement.” Around the same time, TigerSwan and law enforcement expressed concerns about the impact the death of a protester might have on the pipeline project. “The use of force or death of a protester or rioter will result in the immediate halt to DAPL operations, which will likely permanently halt the entire project,” the PowerPoint presentations TigerSwan shared with law enforcement warned.

Weeks later, the Obama administration would deny the pipeline company a key federal permit, putting construction on hold. In January, President Donald Trump revived the project. The pipeline began service to customers last Thursday.

UNITED STATES - NOVEMBER 02:  Maryland state "fusion center," where federal and local officials share info about possible terrorist activities. Photo taken in the Watch Center where all terrorism and suspicious calls are routed. On the right is Jeffrey L. Wobbleton, Maryland Coordination and Analysis Center Watch Commander speaking with one of the working specialists.  (Photo by Robert A. Reeder/Washington Post/Getty Images)

A fusion center in Maryland.

Photo: Robert A. Reeder/Washington Post/Getty Images

Fusion Centers and the “Surveillance-Industrial Complex”

The email chain from the night of the Backwater Bridge incident and other documents represent detailed illustrations of the work of a so-called fusion center. In 2007, President George W. Bush signed the 9/11 Commission Act, which allocated $300 million to the Department of Homeland Security for the establishment of fusion centers, originally intended to facilitate sharing of anti-terrorism intelligence among different state, local, and federal law enforcement agencies. According to the DHS website, there are currently 77 fusion centers nationwide, with every state home to at least one.

Brendan McQuade, an assistant professor of sociology at the State University of New York, Cortland, who is working on a book on fusion centers, said the records pertaining to the North Dakota State and Local Intelligence Center’s monitoring and repression of Standing Rock demonstrations offer unique insight into how fusion centers are used for political repression. “We’ve seen hints of this monitoring of the online presence of Black Lives Matter and Occupy protests, but never such explicit evidence of it as in the documents you’ve collected,” he told The Intercept after reviewing a selection of the documents.

According to former FBI Special Agent Michael German, who is now with the Brennan Center for Justice at New York University Law School, fusion centers have become part of a broader “surveillance-industrial complex” in which security agencies and the corporate sector merge together in a frenzy of mass information gathering, tracking, and surveillance. Federal support for fusion centers is predicated on increased government access to “non-traditional information sources,” he notes. And one of the goals of fusion centers is to protect the nation’s critical infrastructure, 85 percent of which is owned by private interests.

“The insidious thing is that the role of private-sector entities in fusion centers has grown up without any specific legislation authorizing it,” said German, who co-authored a 2007 report on behalf of the ACLU called “What’s Wrong with Fusion Centers?” “Instead, the development of these techniques and relationships, such as the one involving TigerSwan and North Dakota law enforcement, has occurred within the closed-off world of law enforcement.”

A Native American protestors holds up his arms as he and other protestors are threatened by private security guards and guard dogs, at a work site  for the Dakota Access Pipeline (DAPL) oil pipeline, near Cannon Ball, North Dakota, September 3, 2016. Hundreds of Native American protestors and their supporters, who fear the Dakota Access Pipeline will polluted their water, forced construction workers and security forces to retreat and work to stop. / AFP / Robyn BECK        (Photo credit should read ROBYN BECK/AFP/Getty Images)

A private security guard and guard dog threaten protesters at a work site for the Dakota Access Pipeline near Cannon Ball, N.D., on Sept. 3, 2016.

Photo: Robyn Beck/AFP/Getty Images

Legal Ambiguity

TigerSwan’s status as a private company has enabled it to operate with virtually no transparency or oversight. The North Dakota Private Investigation and Security Board confirmed in an email to The Intercept this week that TigerSwan still has not obtained a license to work as a private security firm in the state despite nine months on the ground. The company’s close collaboration with law enforcement, to which it has regularly fed intelligence, raises serious questions.

“The line between private security and law enforcement at DAPL has been nonexistent,” Bruce Ellison of the National Lawyers Guild, who also works with the Water Protector Legal Collective, told The Intercept. “They have been one in the same.”

Still, it’s not clear that either TigerSwan or law enforcement crossed a legal line with their surveillance activities. Private companies have few obligations to protect constitutional rights to free speech, association, or privacy. And while public agencies, including law enforcement, do have that obligation, they also have ample leeway to operate in invasive and unethical ways that are nonetheless legal. As The Intercept reported in January, detailed guidelines govern the FBI’s activities involving confidential informants and covert online work. But the guidelines are filled with loopholes that ultimately allow FBI agents to spy on just about anybody if they get the right approvals.

If TigerSwan were meeting regularly enough with the FBI, acting at the bureau’s behest, or even simply feeding agents information, it could represent an end-run around FBI rules. However, as Ramzi Kassem, a law professor at the City University of New York School of Law who directs the Creating Law Enforcement Accountability & Responsibility (CLEAR) project, put it, “The guidelines are one thing, but the legal baseline for what’s constitutional and what’s not constitutional is another.”

To a large degree, unless they were found to be acting at the direction of government, TigerSwan’s agents would likely be held to similar standards as regular citizens, their most likely violations being things like trespassing.

Despite the legal ambiguity, TigerSwan’s actions raise questions. “You have these privatized actors that are performing what are commonly understood to be government functions — whether or not we’ve agreed that these are acceptable government functions,” said Kassem. “Private corporations are taking these actions on a scale that is unheard of before — this isn’t your local private eye investigative service, we’re talking about tactics that the military uses overseas.”

“We need to be looking at whether our laws are sufficient to protect political groups from disruption, interference, and attacks by people who are infiltrating or surveilling their activities,” said Kris Hermes, an author and activist who has worked for years providing legal support at protests as a member of the National Lawyers Guild. “What it has done is thrown a chilling blanket over political organizing today whereby everybody feels that they should be engaging in some kind of security culture to avoid the snooping of law enforcement or private security firms. That has a far-reaching effect that I don’t think is appreciated enough. It prevents people from engaging effectively in First Amendment activity.”

Modern-Day Pinkertons

The privatization of law enforcement and its subjugation to corporate interests are hardly a novelty, though the increased militarism of the domestic policing of dissent has taken on sinister overtones in the wake of the so-called global war on terror.

In the late 19th century, Allan Pinkerton’s National Detective Agency offered private detective and security services to public and corporate clients. The “Pinkertons,” as they were known, relied heavily on undercover agents and often acted as agents provocateur, triggering violence as much as they engaged in surveillance and propaganda.

Through their involvement as armed guards during labor conflicts, the Pinkertons “became a shorthand for the abusive power of unchecked capitalism,” Paul O’Hara, a history professor at Xavier University who wrote a book about them, told The Intercept. To workers, the Pinkertons were “hired thugs for capital” and “a symbol of corporate power,” he wrote. Their activities led to two congressional investigations and the Anti-Pinkerton Act of 1893, which barred the federal government from contracting with the Pinkertons and similar groups. But the act largely failed in its intent, and the Pinkertons set the stage for public partnerships with mercenary groups continuing to this day.

TigerSwan never responded to The Intercept’s repeated requests for comment, oscillating instead between following and blocking these reporters on Twitter. The company did, however, retweet a comment by a reader of The Intercept. He had called TigerSwan “modern day Pinkertons.”

Documents published with this story:

The Intercept has redacted the names of persons identified in internal TigerSwan and public documents unless those persons have directly communicated their willingness to be included. The names of senior TigerSwan and law enforcement personnel have not been redacted. To search all TigerSwan documents published by The Intercept, go to the TigerSwan project page on DocumentCloud.

Correction: June 3, 2017
This story has been updated to correct Brendan McQuade’s title and the spelling of his name.

Top photo: Military veterans confront police guarding a bridge near Oceti Sakowin Camp on the edge of the Standing Rock Sioux Reservation on Dec. 1, 2016, outside Cannon Ball, N.D.

We depend on the support of readers like you to help keep our nonprofit newsroom strong and independent. Join Us 

Part 3

As Standing Rock Camps Cleared Out, TigerSwan Expanded Surveillance to Array of Progressive Causes

Contact the author:

Alleen Brownalleen.brown@​

Will Parrishwillparrish2017@​

Alice Sperialice.speri@​

Read more
Photo: Tom Stromme/The Bismarck Tribune/AP

By the time law enforcement officers began evicting residents of the Oceti Sakowin Dakota Access Pipeline resistance camp near the Standing Rock Sioux reservation on February 22, the brutal North Dakota winter had already driven away most of the pipeline opponents. With protesters’ numbers dwindling, along with nationwide attention to their cause, it would have been a natural time for the private security company in charge of monitoring the pipeline to head home as well. But internal communications between TigerSwan and its client, pipeline parent company Energy Transfer Partners, show that the security firm instead reached for ways to stay in business.

“The threat level has dropped significantly. This however does not rule out the chance of future attack,” states a document dated February 24, two days after the eviction began. “As with any dispersion of any insurgency, expect bifurcation into splinter groups, looking for new causes.”

Indeed, TigerSwan appeared to be looking for new causes, too. As The Intercept has reported, the security firm’s sweeping surveillance of anti-Dakota Access protesters had already spanned five months and expanded into Iowa, South Dakota, and Illinois. More than 100 leaked situation reports provided to The Intercept by a contractor working for TigerSwan describe in detail the firm’s observations of the NoDAPL movement; information obtained via invasive surveillance tactics such as infiltration of protest groups, aerial surveillance, and radio eavesdropping; and efforts to track the movements of individual pipeline opponents.

In January and February the NoDAPL movement suffered major blows. On January 24, days after his inauguration, President Donald Trump revived the stalled pipeline by reversing an Obama administration decision that had denied Energy Transfer Partners a key permit. The eviction of the resistance camps followed a month later.

Situation reports filed to Energy Transfer Partners in January and February reveal that as the pipeline’s construction neared completion, potentially threatening TigerSwan’s continued relationship with its client, the security company stepped up its efforts to portray the situation as volatile and dangerous.

In a document dated February 27, the report’s author made a comparison clearly derived from TigerSwan’s background as a private defense contractor in Afghanistan and Iraq:

The archetype of a jihadist post-insurgency is the aftermath of the anti-Soviet Afghanistan jihad. While many insurgents went back to their pre-war lives, many, especially the external supporters (foreign fighters), went back out into the world looking to start or join new jihadist insurgencies. Most famously this “bleedout” resulted in Osama bin Laden and the rise of Al Qaeda, but the jihadist veterans of Afghanistan also ended up fighting in Bosnia, Chechnya, North Africa, and Indonesia, among other places.

The “anti-DAPL diaspora,” the document argued, was spreading to Iowa, New York, Florida, and Arkansas. Finding less to report in North Dakota, the company focused in February on individual opponents’ movements to other states and described surveillance of causes as varied as climate change and resistance to incoming President Donald Trump.

Demonstrators protest against US President Donald Trump outside Trump Tower on the one-month anniversary of his inauguration, February 19, 2017 in Chicago, Illinois. / AFP / Derek R. HENKLE        (Photo credit should read DEREK R. HENKLE/AFP/Getty Images)

Demonstrators protest against President Donald Trump outside Trump Tower on Feb. 19, 2017, in Chicago.

Photo: Derek R. Henkle/AFP/Getty Images

TigerSwan became particularly interested in Chicago, and the February documents describe various efforts to infiltrate area activist groups. A February 4 report refers to a TigerSwan operative’s intention to conduct “observation and photographic documentation” of a local protest. Documents dated between February 19 and February 21 describe TigerSwan’s efforts to monitor an anti-Trump protest organized by the local chapter of the Answer Coalition, an anti-war, anti-racism group. “TigerSwan collections team will make contact with event organizers to embed within the structure of the demonstration to develop a trusted agent status to be cultivated for future collection efforts,” notes the February 19 report, which also speculates on the remote possibility of violence at the event.

Answer Coalition’s coordinator in Chicago, John Beacham, who organized the protest TigerSwan described, said that while participants were supportive of the NoDAPL movement, it was not the event’s primary focus. “They’re trying to make connections where they aren’t. It’s almost like they’re trying to cast conspiracy theories across the entire progressive movement because they’re sympathetic to the NoDAPL movement,” he told The Intercept.

A February 22 document describes an upcoming organizer training put on by the group Lifted Voices: “This would be a good opportunity for us to get someone inside, become known and gather the most current direct action [tactics, techniques, and procedures]. While Lifted Voices is not a #NoDAPL organization, Kelly Hayes has influenced organizing protest events and has spoken at the last two events in Chicago.”

“We were pretty aware that, with that number of people in the mix, an agent of law enforcement might be in the room,” Hayes told The Intercept. “So hearing that it was a rent-a-spy that was in the room isn’t that shocking.”

TigerSwan also focused on Iowa, and the documents describe in detail the growth there of the Little Creek Camp, built primarily as a space for education and healing. Documents dated between February 22 and February 27 provide updates on the movements of a group of water protectors as they traveled from North Dakota to the new Iowa camp, stopping at a hotel and at one point getting stuck in the mud.

A Protester make their last stand as authorites approach Oceti Sakowin Encampment in North Dakota Authorities clear Standing Rock protest camp, North Dakota, USA - 23 Feb 2017 (Rex Features via AP Images)

A protester makes a last stand as authorities approach the Oceti Sakowin encampment in North Dakota to clear the Standing Rock protest camp on Feb. 23, 2017.

Photo: Rex Features/AP

Meanwhile, in the weeks before the Oceti Sakowin camp eviction, TigerSwan continued to deploy its invasive surveillance tactics in North Dakota. On February 7, TigerSwan noted its use of a “rotary-wing mounted mobile [forward-looking infrared cameras] to conduct evaluation of heat signatures and disposition of camps,” while on February 10 it made a case for the expansion of a “listening post” that might “yield increased situational awareness due to proximity of [radio frequency] devices” and on February 13 it made reference to “unsecure [radio frequency] communications used by camp security.”

The documents also highlight TigerSwan’s continued close cooperation with law enforcement, often referencing meetings with local sheriffs’ deputies, police chiefs, and the National Guard, as well as its effort to procure intelligence to be used to prosecute protesters. On February 10, a TigerSwan operative in Iowa even mentioned a meeting with Sen. Joni Ernst’s husband “to rekindle an informal relationship.” Sen. Ernst did not respond to a request for comment on the nature of any such relationship.

A February 5 document notes that the company had “continued to proceed with ETP’s legal team’s requests,” and on February 12, a report stated that the company would continue to “assist Federal Law Enforcement with identifying locations of Camp 4, pertinent to their criminal activity investigations.” On February 13, discussing the movement of “weapons cases” by some unidentified individuals, TigerSwan reported that the federal Bureau of Alcohol, Tobacco, Firearms, and Explosives and North Dakota law enforcement “were passed the information and media gathered from the event.” And a February 27 document notes, “(TigerSwan-North Dakota) continues to support The Department of Interior with requests for [intelligence, surveillance, and reconnaissance] and information in the completion of the full removal of illegal personnel within the [U.S. Army Corps of Engineers] land and the Reservation lands.”

On February 9, mentioning a well-known water protector’s recommendation that others stop using Facebook, TigerSwan notes: “Remaining protestors are acutely aware of LE infiltration, and the monitoring of Social Media, seeing themselves as increasingly vulnerable to prosecution.”

As it was throughout the operation, TigerSwan was particularly alarmist about the potential for violence and sabotage, speculating about “flammable liquids being gathered” and “homemade incendiary weapons.”

At times, the speculative nature of its observations is almost farcical. “There is no indication the protesters have planned sabotage activities; however successful sabotage of equipment will hinder ongoing construction,” a report dated February 15 reads. “The threat of IEDs is of concern, however there is no indication that such devices are employed along the routes used by DAPL personnel.”

The February documents also repeatedly refer to water protectors with derogatory terms such as “snow poopers” and “sewage producers,” apparently in reference to a refuted narrative spread by local officials that water protectors had polluted the grounds of their camp. Occasionally, the documents openly display racism toward Native Americans. On February 24, for instance, after listing the names of various water protectors, the author adds, “Editors note! These names were not made up at a bar!” 

While earlier documents had focused on the presence of Palestinians and Muslims at the camps, in February TigerSwan zeroed in on groups like Veterans for Peace and the Catholic Worker, which it accused, respectively, of “anti-American/Pro-communist activities” and gathering funds “from various democratic parties, communist groups, and various other groups that seek to establish a revolutionary movement in the United States.”

As was the case in the fall, the January and February reports name dozens of individuals, with particular focus on some whom TigerSwan deemed to be the “most radical.”

Among them is Chase Iron Eyes, an activist, attorney, and former candidate for Congress, whom TigerSwan tracked to the airport where he boarded a flight to a climate conference in British Columbia, which TigerSwan characterized as a meeting with “an extremist native organization.”

“I had suspicions [they were watching me] but I also want to believe that we live in liberty, and that we can pursue freedom, justice, and equality without being demonized, having our rights violated, having our privacy violated, and being treated like a terrorist and not a patriot,” Iron Eyes told The Intercept.

“It was an event at a university. … Naomi Klein was one of the speakers,” he added. “It literally was inside this university amphitheater and we had Indian tacos and we had a meal together and we talked about the context and the importance of these pipeline struggles.”

The Dakota Access Pipeline began service to its clients this month. Opponents saw a win last week when a federal judge ordered the U.S. Army Corps to revisit parts of its environmental review of the project, raising the possibility that oil flow could be halted as the review is completed.

Energy Transfer Partners declined to comment on the leaked situation reports, writing in an email to The Intercept that it does not “discuss details of our security initiatives, which are designed to ensure the safety of our employees and the communities in which we live and work.” In an email sent to The Intercept from a TigerSwan account, an unnamed representative of the firm stated, “We will not comment on the security aspects of your story beyond saying that safety is always our top priority.”

Documents published with this story:

Internal TigerSwan Situation Report 2017-02-28
Internal TigerSwan Situation Report 2017-02-27
Internal TigerSwan Situation Report 2017-02-26
Internal TigerSwan Situation Report 2017-02-25
Internal TigerSwan Situation Report 2017-02-24
Internal TigerSwan Situation Report 2017-02-23
Internal TigerSwan Situation Report 2017-02-22
Internal TigerSwan Situation Report 2017-02-21
Internal TigerSwan Situation Report 2017-02-20
Internal TigerSwan Situation Report 2017-02-19
Internal TigerSwan Situation Report 2017-02-18
Internal TigerSwan Situation Report 2017-02-17
Internal TigerSwan Situation Report 2017-02-16
Internal TigerSwan Situation Report 2017-02-15
Internal TigerSwan Situation Report 2017-02-14
Internal TigerSwan Situation Report 2017-02-13
Internal TigerSwan Situation Report 2017-02-12
Internal TigerSwan Situation Report 2017-02-11
Internal TigerSwan Situation Report 2017-02-10
Internal TigerSwan Situation Report 2017-02-09
Internal TigerSwan Situation Report 2017-02-08
Internal TigerSwan Situation Report 2017-02-07
Internal TigerSwan Situation Report 2017-02-05
Internal TigerSwan Situation Report 2017-02-04
Internal TigerSwan Situation Report 2017-01-25
Internal TigerSwan Situation Report 2017-01-18

The Intercept has redacted the names of persons identified in internal TigerSwan and public documents unless those persons have directly communicated their willingness to be included. The names of senior TigerSwan and law enforcement personnel have not been redacted. To search all TigerSwan documents published by The Intercept, go to the TigerSwan project page on DocumentCloud.

Top photo: This aerial photo shows the Sacred Stones Camp on the Standing Rock Reservation and along the Cannonball River where people protested the Dakota Access Pipeline in Cannon Ball, N.D., on Feb. 13, 2017.

We depend on the support of readers like you to help keep our nonprofit newsroom strong and independent. Join Us 

Part 4

Dakota Access-Style Policing Moves to Pennsylvania’s Mariner East 2 Pipeline

Contact the author:

Alleen Brownalleen.brown@​

Will Parrishwillparrish2017@​

Alice Sperialice.speri@​

Additional Credits:

Research: Sheelagh McNeill.
Read more
Photo: Emily Cohen/State Impact Pennsylvania

After months of employing military-style counterinsurgency tactics to subvert opposition to the Dakota Access Pipeline in North Dakota, Iowa, Illinois, and South Dakota, the private security firm TigerSwan is monitoring resistance to another project — the controversial Mariner East 2 pipeline.

Like DAPL, Mariner East 2 is owned by Energy Transfer Partners. The pipeline is slated to run for 350 miles, transporting ethane, butane, and propane through Ohio, Pennsylvania, and West Virginia to a hub near Philadelphia for shipment to both domestic and international markets. Internal TigerSwan documents reviewed by The Intercept suggest the company has had a presence in Pennsylvania since at least April.

On April 1, the Mariner East 1 pipeline, which runs parallel to the proposed path of ME2, spilled 20 barrels of ethane and propane near Morgantown, Pennsylvania. On the day of the incident, an email provided to The Intercept by a TigerSwan contractor shows the firm was watching social media for signs the spill would become a rallying point for pipeline opponents.

“At this time the incident has NOT gained any public interest,” a TigerSwan operative wrote in the email.

TigerSwan founder James Reese replied, “We nees [sic] to monitor social media for blow baxk [sic] on the leak.”

The company had been monitoring Dakota Access opponents’ social media for months and analyzing press coverage related to that pipeline fight, according to more than 100 internal situation reports leaked to The Intercept. The documents routinely referenced counterinformation efforts to produce and distribute propaganda favorable to the pipeline.

TigerSwan apparently carried at least some of these practices to Pennsylvania. It would be weeks before the public learned of the leak of highly explosive natural gas liquids. According to a source with direct knowledge of TigerSwan’s operation, making sure nobody found out about the incident was part of TigerSwan’s mission on the project. Nearby residents were kept in the dark until April 20, when Sunoco, which recently completed a merger with Energy Transfer Partners, confirmed to a local media outlet that the leak had occurred.

As Dakota Access opponents moved to new pipeline fights across the country, other repressive tactics deployed against the NoDAPL movement migrated too. TigerSwan’s entry into the ME2 struggle comes as industry-supported lawmakers in Pennsylvania, a center of the nation’s fracking boom, are advancing legislative efforts to increase fines and charges associated with anti-pipeline direct action protests.

CHICAGO, IL - FEBRUARY 04:  Demonstrators rally downtown before marching to Trump Tower while protesting the construction of the Dakota Access pipeline on February 4, 2017 in Chicago, Illinois. President Donald Trump recently signed executive actions to advance approval of Dakota Access and the Keystone XL pipelines, undermining efforts by the administration of President Barack Obama to block their construction.  (Photo by Scott Olson/Getty Images)

Demonstrators in Chicago protest the Dakota Access Pipeline on Feb. 4, 2017.

Photo: Scott Olson/Getty Images

The TigerSwan situation reports show that as early as February, as state officials prepared to evacuate the first pipeline resistance camp in North Dakota, the security firm was monitoring the potential for DAPL opposition to spill over into grassroots struggles against other pipeline projects, including ME2 and Energy Transfer Partners’ Rover pipeline in Ohio. “Recently, Illinois activists have begun to shift their focus in earnest from anti-DAPL to anti-pipeline,” a situation report dated February 21 reads. “They have started sharing information on multiple pipeline projects across the country. There has not yet been any mention of Mariner East or Rover, but there is an active effort to continue their momentum in fighting pipeline construction and operation.”

Public records also show an increased interest by the company in areas through which other Energy Transfer Partners projects would pass.

Last November, TigerSwan obtained business licenses in Pennsylvania, Ohio, and West Virginia, the three states in the path of ME2. On June 1, TigerSwan also obtained a business license to operate in Louisiana, where Energy Transfer Partners is building the Bayou Bridge Pipeline, which would connect to the Dakota Access Pipeline system and carry Bakken shale oil to Gulf Coast export terminals.

At a February hearing held by the Louisiana Department of Natural Resources, TigerSwan advisory board chair James “Spider” Marks, a retired U.S. Army major general, spoke in favor of building the pipeline — without revealing his association with TigerSwan. He also published an op-ed in the Lafayette Daily Advertiser newspaper decrying the “anti-energy agitators” who oppose the project.

“No Louisianan wants to live under the conditions that those unsuspecting North Dakota residents were subject to — with protesters trespassing, interrupting the local flow of traffic, and generally injecting elements of fear and the unknown into their daily lives,” Marks wrote. “A timely approval process of the Bayou Bridge Pipeline, however, would prevent the possibility of such conditions arising in this state.”

In May, Marks wrote another opinion piece that failed to disclose his TigerSwan affiliation, this time for the Pennsylvania news site PennLive, warning readers there to “be wary of professional pipeline protesters” who turned Standing Rock into a scene of “hapless violence and bloodshed.”

“Many of the same professional agitators who fomented chaos in North Dakota are turning their efforts to the Mariner East II Pipeline in Pennsylvania,” Marks wrote. “These orchestrators make no qualms about their intent to turn Camp White Pine — a small but growing protest area in Huntingdon County — into the next national showdown.”

Energy Transfer Partners declined to comment, writing in an email to The Intercept that it does not “discuss details of our security initiatives, which are designed to ensure the safety of our employees and the communities in which we live and work.” In an email sent to The Intercept from a TigerSwan account, an unnamed representative of the firm declined to answer questions about TigerSwan’s work on ME2, but commented on its social media monitoring efforts. “Of course we monitor social media during any type of situation,” the person wrote. “With the advent of so many bots on twitter and those organizations who perpetuate defamatory and outrageous slander against not only American companies but local, state and national law enforcement on the internet, we wouldn’t be doing our job unless we did.” Marks did not respond to a request for comment. Last week, TigerSwan retweeted a comment characterizing his PennLive piece as a “TigerSwan op-ed.”

Opponents of the ME2 project say they’ve noticed an increased security presence around the pipeline’s path in recent months. “They’ve been making us feel that we’re under constant threat and observation,” Elise Gerhart told The Intercept.

Elise and her parents, Ellen and Stephen Gerhart, have campaigned against ME2 for more than two years and currently host Camp White Pine on their 27-acre property along the pipeline’s right of way in Pennsylvania’s Huntingdon County, where they stage tree-sits to protest the clearing of land for construction. As the pipeline’s construction moves closer, Elise said unmarked pickup trucks have parked across the road from their driveway at night, shining their high beams toward the camp. Helicopters have regularly hovered low over their land, a tactic familiar to Standing Rock protesters.

According to StateImpact Pennsylvania, a spokesperson for Sunoco and Energy Transfer Partners denied that the newly merged company or its partners had flown helicopters over the Gerhart property.

In southeastern Pennsylvania’s Delaware County, Eric Friedman, president of a local homeowner’s association, said that as resistance to the project has grown more vocal, so has residents’ sense that they are being watched. Friedman’s group is concerned that the pipeline will move pressurized natural gas liquids through a densely populated suburban area, in close proximity to schools and a senior living facility. Last month, one of the schools started practicing emergency drills to prepare for a possible pipeline explosion, and a study commissioned by a local coalition for community safety warned of the worst-case consequences of potential leaks, including the ignition of “a fireball with a blast radius up to 1,100 feet.”

In recent months, administrators of area Facebook groups opposed to the pipeline reported getting requests from individuals they “have questions about,” Friedman noted. “I suspect that they’re here and using the same kinds of tactics,” he told The Intercept, referring to private security agents. “My sense is that they escalate their response in accordance to the resistance that they’re being met with.”

While the unmarked trucks and strange Facebook requests couldn’t be definitively traced to a private security contractor, TigerSwan’s documented efforts on behalf of Energy Transfer Partners to repress the anti-DAPL movement have raised concerns for ME2 opponents.

“A year ago, people didn’t realize that the company that was using these kinds of tactics in North Dakota was the same company that’s proposing to build this project here. There wasn’t a lot of awareness,” Friedman said. “Now that’s very much in everybody’s mind.”


Stretches of pipeline to be used in the construction of Mariner East 2 sit in Silver Spring Township, Pa., on May 25, 2017.

Photo: Joshua Vaughn/The Sentinel

In Pennsylvania, as in North Dakota, public officials have also played a role increasing pressure on pipeline opponents.

On May 4, state Sen. Scott Martin hosted a closed-door forum between first responders in Lancaster County and officials from North Dakota who were involved in policing the NoDAPL movement. The next day, citing costs associated with the North Dakota protests, Martin distributed a memorandum seeking a co-sponsor for a bill he was drafting that would hold individuals “civilly liable for response costs related to a demonstration if the person is convicted for rioting,” “is a public nuisance,” or “is involved in hosting the demonstration.”

Martin represents much of Lancaster County, which is home to the Lancaster Stand, an action camp located on private property whose organizers have promised to use the grounds as a base for direct actions against the Atlantic Sunrise pipeline once construction begins.

This isn’t the first anti-protester legislation to be pushed in the state. State Sen. Mike Regan recently introduced a measure defining a new type of felon: the “critical infrastructure facility trespasser.” The label could be applied for as little as “attempt[ing] to enter a critical infrastructure facility, knowing that the person is not licensed or privileged to do so.” An individual who succeeded in entering the property with “intent” to damage or destroy equipment or even simply to impede facility operations would face up to two years in prison and a minimum $10,000 fine, as would anyone “conspiring” with others to trespass. Critical infrastructure is defined in the bill as including numerous types of oil and gas infrastructure. The bill was scheduled for a judiciary committee vote last month, which was canceled at the last minute.

As Pennsylvania’s Raging Chicken Press reported, language in the bill mirrors that of a recently approved Oklahoma law penalizing oil and gas industry protesters. And indeed, it’s part of a trend of anti-protester legislation introduced in more than a dozen states across the U.S., including bills aimed at oil infrastructure protesters in Colorado, South Dakota, and North Dakota.

But even without the new legislation, ME2 opponents have faced stiff penalties for hindering construction.

In March 2016, as contractors for Sunoco began cutting down trees, Huntingdon County sheriff’s deputies arrested Ellen Gerhart on her own property when she attempted to warn construction crews that her daughter, Elise, was in a tree dangerously close to where they were clearing. Two other pipeline opponents were also arrested. One of them, Alex Lotorto, was detained for three days on a $200,000 bail. Gerhart, a retired special education teacher, was later arrested a second time on her property, and according to a public comment she submitted to the state Department of Environmental Protection, was held in isolation for three days without access to a lawyer.

Charges against her were eventually dropped, but Sunoco later requested that a Pennsylvania judge allow law enforcement to arrest trespassers on the pipeline easement — even if they happened to own the easement land. On April 28, in a rare decision, Huntingdon County Judge George Zanic complied with the request, ordering what’s known as a “writ of possession” enabling authorities to arrest the Gerharts for trespassing on their own property.


Sunoco Logistics/Energy Transfer Partners carry out construction on the Mariner East 2 easement on April 23, 2017, in Union Township in Pennsylvania’s Huntingdon County.

Photo: Camp White Pine

Meanwhile, in Delaware County, disputes between property owners and the pipeline company have also ramped up. In May, after some stakes that a pipeline survey crew had placed along the project site were removed overnight, a project manager representing Sunoco emailed an attorney for the local homeowners association. “Because of this, the survey will have to be done again and further monitoring of the property will be requested from the local authorities,” the agent warned in an email reviewed by The Intercept. The Sunoco agent added that “the professional survey crew staked within the limits of the project and did not trespass on anyone’s property.”

But Eric Friedman disputes that and says the stakes were placed by the pipeline company on the private property of the Andover Homeowners’ Association and private lots within the subdivision. “The very idea that Sunoco’s agents would call upon law enforcement to protect their trespass strikes me as completely backwards,” Friedman told The Intercept.

“I took that as a threat to use law enforcement against us,” he added. “It indicated to me that he was at some level in contact with the Pennsylvania State Police and threatening to activate them against us.”

Lt. James Hennigan of the Pennsylvania State Police, which is in charge of the area where the incident took place, wrote in a statement to The Intercept that the agency “responds to all calls for service. Our members take appropriate action if any crime has been committed.”

In North Dakota and Iowa, TigerSwan regularly shared information with law enforcement. The Huntingdon County Sheriff’s Office, in the Gerharts’ county, and the police department in Caernarvon Township, where the Mariner East 1 leak took place, did not respond to requests for comments about collaboration with private security.

Friedman said he hopes local law enforcement will work with residents rather than pipeline representatives. “We live here, we are your neighbors, we are the same as you,” he said. “These people are not, they are outsiders, and you should be working for us. We are your constituents.”

Top photo: Construction of the Mariner East 2 pipeline breaks ground in Pennsylvania’s Delaware County on Feb. 20, 2017.

We depend on the support of readers like you to help keep our nonprofit newsroom strong and independent. Join Us 

Part 5

TigerSwan Faces Lawsuit Over Unlicensed Security Operations in North Dakota

Contact the author:

Alleen Brownalleen.brown@​

Will Parrishwillparrish2017@​

Alice Sperialice.speri@​

Additional Credits:

Research: Sheelagh McNeill.
Read more
Photo: Michael Nigro/Sipa/AP

TigerSwan, the private company behind a monthslong, multi-state surveillance operation targeting opponents of the Dakota Access Pipeline, illegally provided security and investigative services to the pipeline’s parent company, Energy Transfer Partners, despite being denied a license to do so, a new civil lawsuit alleges. Even after oil began to flow through the contested pipeline, and long after the crowded Dakota Access resistance camps gave way once again to empty prairie, TigerSwan continued its unlicensed security operations in North Dakota.

The allegations are part of a lawsuit the North Dakota Private Investigation and Security Board filed against TigerSwan and its founder James Reese on Tuesday. Violating the license law is a class B misdemeanor in North Dakota, though local prosecutors have not filed criminal charges.

The complaint against TigerSwan requests an injunction against the firm and its founder, which would prevent them from continuing to illegally operate as a security company in the state. At the time of the lawsuit, TigerSwan continued to deploy personnel “armed with semiautomatic rifles and sidearms” in North Dakota and was still monitoring “persons affiliated with the DAPL protests,” according to the court filing.

Two weeks prior to the initiation of the suit, The Intercept published a selection of more than 100 leaked situation reports prepared by TigerSwan for its client ETP, as well as additional documents obtained via public records request detailing the scale of TigerSwan’s security operation and its close collaboration with law enforcement. Communications to the security board obtained via public records requests show that as late as December, Reese, a former Army Delta Force commander, declared that TigerSwan was only “doing management and IT consulting for our client and doing no security work.” But internal company reports as well as an overview of TigerSwan’s operations that was shared with law enforcement show the company had been doing much more than that since September. Both sets of documents were included in the lawsuit.

The complaint describes invasive tactics used by TigerSwan, including “flyover photography,” “surveillance of social media accounts,” placing or attempting to place “undercover private security agents within the protest group,” and coordination with local law enforcement officials. The security operations overview obtained by The Intercept and cited in the suit states plainly, “All elements are engaged to provide security support to DAPL.”

According to the suit, the security board first notified TigerSwan on September 23 that it was illegally providing security services without a license. The company responded on October 4, stating, “TigerSwan is not conducting ‘private security services’ in North Dakota.” The company simultaneously submitted an application for a license “should such services, which are not present at the time, be required from TigerSwan.”


A mug shot of James Reese from his arrest on July 15, 2015, for assault on a female.

Photo: APEX Police

On December 19, the board notified Reese that it intended to deny his application for a license, citing “positive criminal history for one or more disqualifying offenses,” as well as failure to disclose all arrests and failure to provide sufficient information “for the Board to determine whether a reported offense or adjudication has a direct bearing on Reese’s fitness to serve the public.” Reese’s record shows numerous citations in various states, including several for traffic violations such as reckless driving and speeding, and an arrest for “assault on a female” in 2015, flagged as a domestic violence case and later dismissed. Reese’s wife, Niki, filed a restraining order against him in Florida in 2012, public records show.

On December 27, Reese requested an administrative review of the license denial. “I have never been convicted of any criminal crime in my life,” he wrote to the board. “If I failed to disclose on the application all arrests, this was an oversight by me and my apologies.” Reese went on to describe an incident leading to the assault charge, from July 2015, claiming that his “bipolar” wife had become “belligerent” during a “depression act” and called police on him. Reese also requested a copy of the criminal record reviewed by the board.

Reached by phone, Niki Reese categorically denied ever having been diagnosed with a mental health condition and refuted her husband’s account of the episode in the letter to the board.

“It’s false information. I don’t have any kind of diagnosis,” she told The Intercept. “His allegations that he wrote are completely false.”

The board denied James Reese’s application on January 6. Reached by phone, Reese asked The Intercept not to publish his letter to the board. “Why would you take a private letter like that and send it out to everybody in the world?” he asked. “I’d ask you to leave my family out of this.”

When reminded that he included the allegations about his wife in a letter to a public licensing board, making it part of the public record, he replied, “That was my mistake.”

Reese also claimed there were inaccuracies in a series of stories on TigerSwan reported by The Intercept. “I can’t even begin to start here which facts are wrong,” he said. The only example he pointed to was the investigation board’s allegation that TigerSwan staff were armed — an allegation that the Intercept has not actually made.

“We take our job seriously, we take our client seriously,” Reese added.

TigerSwan did not respond to a request for comment. A spokesperson for Energy Transfer Partners declined to comment, referring questions to TigerSwan and the security board. Keegan Pieper, a counsel for ETP, wrote in an email to The Intercept that he was “not aware of this lawsuit.”

WASHINGTON, DC - NOVEMBER 04:  Illinois Attorney General, Lisa Madigan speaks about a crackdown on deceptive and abusive debt collection practices during a news conference at the FTC headquarters November 4, 2015 in Washington, DC. The FTC announced a nationwide coordinated federal and state enforcement initiative targeting deceptive and abusive debt collection practices.  (Photo by Mark Wilson/Getty Images)

Illinois Attorney General Lisa Madigan at a news conference at the Federal Trade Commission headquarters in Washington, D.C., on Nov. 4, 2015.

Photo: Mark Wilson/Getty Images

TigerSwan is also facing pressure in Illinois, where the environmental group Food & Water Watch is demanding that the state’s attorney general, Lisa Madigan, launch an investigation into the company’s activities after The Intercept revealed that TigerSwan had infiltrated local activist groups, including some that had little to do with the Dakota Access fight. Food & Water Watch, which worked to highlight the financial interests behind the pipeline, was mentioned repeatedly in the leaked reports.

“We strongly believe that TigerSwan engaged in illegal surveillance activities against me and other employees and supporters of Food & Water Watch (FWW) in a manner that is violates [sic] our state constitutional and statutory rights, including our rights of privacy,” Jessica Fujan, the group’s Midwest director, wrote in the letter. “We now have reason to believe that these infiltrators were recording our conversations, photographing participants and FWW staff and perhaps making videos of our meetings.”

The attorney general’s office did not respond to a request for comment. Fujan said that the group had been tipped off about the presence of an undercover agent and that “paid infiltrators are easy enough to detect, but create distraction and even fear among volunteer activists.”

“Hundreds of leaders, many of them volunteers, are working long hours on outstanding campaigns, well within the letter of the law, and winning victories for the environment,” she wrote in an email to The Intercept. “These leaders are owed our constitutional right to privacy, at the very least.”

CORRECTION - Private security guards allow attack dogs to lung at a protestors after protestors arrived to stop bulldozing of land for the Dakota Access Pipeline (DAPL), near Cannon Ball, North Dakota, September 3, 2016. Hundreds of Native American protestors and their supporters, who fear the Dakota Access Pipeline will polluted their water, forced construction workers and security forces to retreat and work to stop. / AFP / Robyn BECK / The erroneous mention appearing in the metadata of this photo by Robyn BECK has been modified in AFP systems in the following manner: [Private security guards allow attack dogs to lung at a protestors after protestors arrived to stop bulldozing of land for the Dakota Access Pipeline (DAPL), near Cannon Ball, North Dakota, September 3, 2016.] instead of [A protestor is treated after being pepper sprayed by private security contractors on land being graded for the Dakota Access Pipeline (DAPL) oil pipeline, near Cannon Ball, North Dakota, September 3, 2016.] Please immediately remove the erroneous mention from all your online services and delete it from your servers. If you have been authorized by AFP to distribute it to third parties, please ensure that the same actions are carried out by them. Failure to promptly comply with these instructions will entail liability on your part for any continued or post notification usage. Therefore we thank you very much for all your attention and prompt action. We are sorry for the inconvenience this notification may cause and remain at your disposal for any further information you may require. (Photo credit should read ROBYN BECK/AFP/Getty Images)

Private security guards allow attack dogs to lunge at a protesters arriving to stop the bulldozing of land for the Dakota Access Pipeline, near Cannon Ball, N.D., on Sept. 3, 2016.

Photo: Robyn Beck/AFP/Getty Images

Back in North Dakota, TigerSwan is just one of several security companies hired to monitor the Dakota Access Pipeline that have been targeted by the North Dakota Private Investigation and Security Board for failing to obtain licenses.

In February, the board launched an administrative action against EH Investigations and its head Jeremie Meisel, threatening to revoke or suspend the company’s license. The board alleged that EH conspired with another company, Leighton Security Services, to hire and deploy unlicensed or unregistered Leighton personnel to provide private investigative services for DAPL in the state. Meisel, EH, and Leighton did not respond to requests for comment.

The board also launched an investigation last fall into the reportedly unlicensed company Frost Kennels after personnel sicced dogs on pipeline opponents who were attempting to stop workers from disturbing land that the area tribe had identified as burial grounds. The board’s lawyer, Monte Rogneby, told The Intercept that the Frost Kennels case “is still ongoing.” Frost Kennels did not respond to a request for comment. Rogneby declined to comment on whether the board is investigating any of at least six other security companies that worked on the pipeline.

In its administrative complaint against EH Investigations, the security board stated that Leighton Security Services employed “a project manager, two deputy project managers, three intel analysts, and three evidence technicians,” none of whom “were properly licensed or registered to provide private security services in North Dakota.” EH allegedly conspired to facilitate the unlicensed work. Administrative complaints are decided by the board itself rather than a court, and the board’s lawyer said the matter is ongoing.

A yearlong investigation into the national landscape of private security licensure in December 2014 by the Center for Investigative Reporting and CNN described “a haphazard system of lax laws, minimal oversight and almost no accountability.”

Kevin Ingram, president of the International Association of Security and Investigative Regulators, noted in an email to The Intercept that “Several states have no regulation at all. Among those that do, it could be the company or the individual or both that require licensure, and the criteria could be vastly different for armed or unarmed security.”

Yet the industry continues to grow. According to a 2014 report by Frost & Sullivan, a marketing research and consulting company, the oil and gas industry spent $19.6 billion globally on infrastructure security in 2013 and was expected to reach nearly $25 billion by 2021.

Simultaneously, law enforcement agencies have established an unprecedented range of formal collaborations with oil and gas corporations in the name of preventing threats to so-called “critical infrastructure,” which in the parlance of national security agencies refers to installations that are important to the domestic economy — a category that includes oil pipelines that have yet to be fully permitted.

“Environmental campaigns are always difficult, given that our opponents are global profiteers like Big Oil & Gas,” wrote Fujan, of Food & Water Watch. “I take our infiltration as a clear sign that polluters in the energy industry know they’re losing public opinion, and the fight for the future of energy.”

Documents published with this story:

TigerSwan Complaint
North Dakota Private Investigation and Security Board Records
Food & Water Watch Letter to Attorney General
EH Investigations Administrative Action

To search all TigerSwan documents published by The Intercept, go to the TigerSwan project page on DocumentCloud.

Top photo: Water protectors continue their massive clean-up effort of the Oceti Sakowin camp in Standing Rock, N.D., on Feb. 19, 2017.

We depend on the support of readers like you to help keep our nonprofit newsroom strong and independent. Join Us 

Part 6

TigerSwan Responded to Pipeline Vandalism by Launching Multistate Dragnet

Contact the author:

Alleen Brownalleen.brown@​

Will Parrishwillparrish2017@​

Alice Sperialice.speri@​

Additional Credits:

Research: Sheelagh McNeill.
Read more
Photo: Brian Powers/The Register

When the largest Dakota Access Pipeline resistance camp in North Dakota was forcibly shut down in February, the work of TigerSwan, the private security company hired by Energy Transfer Partners to guard its property, appeared to be nearly done. Then the pipeline was hit by several acts of vandalism targeting valve sites along the route. Starting in mid-March, saboteurs snaked down the line, piercing holes in exposed parts of the pipeline and setting equipment on fire.

The vandalism, which disrupted completion of the pipeline, created new work for TigerSwan. But the company did more than deploy additional guards along the line — it also embarked on a multistate hunt for the culprits.

By early May, TigerSwan had a pair of suspects. “The best assessment based on the known facts is that the attack was most likely conducted by Iowa activists; Jessica Reznicek and Ruby Montoya,” states an internal report dated May 4.

On July 24, Reznicek and Montoya claimed responsibility for the sabotage. Standing in front of an Iowa Utilities Board sign, the two women read a joint statement: “After having explored and exhausted all avenues of process, including attending public commentary hearings, gathering signatures for valid requests for environmental impact statements, participating in civil disobedience, hunger strikes, marches and rallies, boycotts and encampments, we saw the clear deficiencies of our government to hear the people’s demands.”

“We are speaking publicly to empower others to act boldly, with purity of heart, to dismantle the infrastructures which deny us our rights to water, land and liberty.”

Reznicek and Montoya then turned to the utility board sign behind them, and using a crowbar and a hammer, they began to remove its letters, prompting Iowa State Patrol officers to arrest them. They were charged with fourth-degree criminal mischief for damaging the sign and released on bond two days later.

Jessica Reznicek and Ruby Montoya publicly confess to vandalizing valve sites along the Dakota Access Pipeline. To watch the full video, click hereVideo: Unicorn Riot

Explaining the timing of their confession, Reznicek and Montoya referred in their statement to a phone call from The Intercept that they viewed “as an opportunity to encourage public discourse surrounding nonviolent direct action.” The Intercept had contacted the two women to give them an opportunity to respond to allegations about their involvement in the valve sabotage included in daily situation reports that TigerSwan prepared for its client Energy Transfer Partners.

For at least two weeks in May, Reznicek and Montoya had been a primary focus of TigerSwan’s work, as operatives attempted to track their movements, sharing their photos and other identifying information with employees at hardware stores, hotels, and gas stations, and passing intelligence they collected to local law enforcement and the FBI, according to the reports, among more than 100 provided to The Intercept by a contractor working for TigerSwan. At the time this story was published on August 26, Reznicek and Montoya had not been charged in connection with any of the vandalism for which they claimed responsibility.

TigerSwan was founded amid a private security industry boom, its business driven by U.S. government contracts supporting the nation’s wars in Afghanistan and Iraq. With its Dakota Access Pipeline contracts, agents applied the tactics they had honed in wars abroad to an environmental and indigenous rights movement based in the rural American Midwest.

“Our concentrated focus is the massing of intelligence (digital and ground) to find, fix and eliminate one person from the ‘detachment’ who will lead us to the arrest and conviction to the remainder of these terrorists,” TigerSwan wrote on May 4, echoing a phrase, “find, fix, finish,” used by U.S. special operations forces in so-called targeted killing campaigns in Yemen, Somalia, and Afghanistan. The firm used the term “detachment” to refer to a group of anti-DAPL activists they believed were operating outside of protest camps.

But as with the U.S. targeted killing program, TigerSwan’s surveillance operation frequently reached far beyond its mark, sweeping up dozens of individuals in its hunt for a few and casting suspicion on pipeline opponents who say they were uninterested in property destruction.

Previously unreleased documents from March, April, and May — which the company referred to as “fighting season” — reveal that while protest activity had substantially died down, TigerSwan only escalated its efforts to convince Energy Transfer Partners that threats remained. In its reports, TigerSwan indicated to its client that agents could keep the pipeline safe by deploying infiltrators to influence activists’ actions, monitoring private residences connected to pipeline resistance, and recruiting employees at local businesses to help keep watch.

The Intercept spoke to dozens of individuals mentioned in the documents, many of whom were disturbed by TigerSwan’s language and tactics. Several denied the accuracy of the reports. According to people whose activities were described by TigerSwan, the company misidentified their places of work and positions within tribal communities, misinterpreted disputes, and erroneously claimed that a protest encampment was armed. In multiple cases, the documents placed individuals at locations they said they had never been.

A former TigerSwan contractor, who declined to be named out of fear of legal consequences, told The Intercept that the threats described in the situation reports were often inflated. Reports were framed based on “whatever sounded better for the company to put forth to ETP,” the former contractor said. “They were using scare tactics.”

Robert Cross Crocked Eyes of the Lakota Nation addresses indigenous rights activists gathered at the Colorado State Capital during the Native Nations March in Denver, Colorado on March 10, 2017.Native tribes from around the US gathered for four days of protest against the administration of US President Donald Trump and the Dakota Access oil pipeline. In the first week of his presidency, Donald Trump signed executive orders to revive the Dakota Access project, along with a second pipeline put on hold by the Obama administration, Keystone XL. / AFP PHOTO / Jason Connolly (Photo credit should read JASON CONNOLLY/AFP/Getty Images)

Robert Cross Crocked Eyes of the Lakota Nation addresses supporters of indigenous rights gathered at the Colorado state Capitol during the Native Nations March in Denver on March 10, 2017.

Photo: Jason Connolly/AFP/Getty Images

“Dictate the Battlespace”

In early March, the media spectacle created by protest encampments and police violence at Standing Rock faded as national attention shifted to the chaotic Trump administration.

But the NoDAPL movement lived on. Some water protectors started smaller encampments along the route, including the Little Creek camp in Iowa and the Takini, or Native Roots, camp in South Dakota. A busload of young people began crisscrossing the nation and giving talks, calling themselves the “Rolling Resistance.” And individuals who had called the large Oceti Sakowin camp home for months left North Dakota searching for their next move.

TigerSwan continued to monitor many of them, but the company didn’t just watch — the spring situation reports are more explicit than those obtained by The Intercept from earlier months in descriptions of activities that went beyond observation into intervention.

A March 5 report, for example, describes TigerSwan agents engaging in a vehicle pursuit of Tawasi, a DAPL opponent with a large social media following who helped coordinate media for the anti-pipeline Sacred Stone camp in North Dakota. As the activist drove through an industrial area in Patoka, Illinois, near the pipeline’s endpoint, agents used what they described as vehicle posturing to “manipulate” his direction of travel and “persuade Tawasi to take an alternate route.”

Indeed, a live video Tawasi posted on Facebook at the time aligns with the company’s description of the incident. “He’s following us now — the [mercenary is] following us,” Tawasi says in the video. “I think we need to go and go to a diner or something and just go somewhere where we can be in public.”

Only when Tawasi entered the freeway did TigerSwan call off the pursuit “in order to ensure to avoid a possible high speed chase.”

Tawasi posted a live video on Facebook as he was pursued by security guards near the Dakota Access Pipeline’s endpoint in Patoka, Illinois, on March 5, 2017. To watch the full video, click hereVideo: Tawasi

TigerSwan agents on the ground also sought to disrupt Little Creek and Takini by undermining public perception of the camps, priming local residents to assist with surveillance, and sowing internal discord. As a report from March 1 puts it, referring to members of Little Creek, “Their operational weakness allows TS elements to further develop and dictate the battlespace.”

As The Intercept previously reported, around the time that Little Creek opened in February, videos began appearing on Facebook pages called Defend Iowa and Netizens for Progress and Justice featuring an individual named Robert Rice, who failed to disclose his link to TigerSwan. A September 22 document noted that Rice had assisted TigerSwan in developing an information operations campaign. He didn’t just warn area residents that Little Creek members might be dangerous — at least one video also encouraged people to send tips to the administrators of the Facebook page on what they were seeing and hearing about the camp.

Videos were posted on Facebook featuring Robert Rice, who encouraged local residents to submit tips about the Little Creek camp without disclosing his link to TigerSwan. Video: Defend Iowa

Camp members felt the impact of TigerSwan’s efforts. “Law enforcement was warning people in the vicinity that they should lock their doors,” recalled Christine Nobiss, one of the founders of Little Creek. “When the Netizens videos came out, there were locals that stopped talking to us because they were scared.”

Neither TigerSwan nor Rice responded to requests for comment on the videos. Energy Transfer Partners spokesperson Vicki Granado told The Intercept, “We were not involved in any way with Robert Rice.”

TigerSwan’s reports repeatedly claimed that agents, at times posing as protesters, held sway over camp members. “Reporting officer has convinced some activists to leave Little Creek Camp and settle in the more forward-looking Native roots camp,” TigerSwan wrote in April. At that camp, the document notes, “Reporting officer was able to increase existing divisions between the Native American groups and Hippie group, which is a thinly veiled Marxist commune led by ‘Travis.’” Not long afterward, another report suggested that “it would be relatively simple to disband the camp internally, by inserting divisive rumors, as well as information operations on social media.”

TigerSwan included a surveillance photo of an individual tampering with equipment at a valve site in a May report.

TigerSwan Situation Report, May 1, 2017

Hunting the Valve Saboteurs

On March 13, TigerSwan described the first valve incident. “At approximately 430 PM/1630 today a hole, roughly 1/4 in diameter was produced by some type of torch or stick, was discovered on IA Valve 430.” Days later, five more damaged valves were discovered in Iowa and South Dakota, according to TigerSwan’s reports.

As far as the security firm was concerned, the valve incidents were more than property destruction: They were acts of terrorism with potentially dire environmental consequences.

Pipeline infrastructure expert Richard Kuprewicz, who serves on an advisory committee of the Pipeline and Hazardous Materials Safety Administration, told The Intercept that burning a hole in the valve could indeed cause serious problems if damage to the empty line went undiscovered and oil began to flow. But Kuprewicz, who reviewed the DAPL project on behalf of Earthjustice last year, also said TigerSwan’s claim that the resulting ecological damage “would be far worse than anything DAPL could have accidentally caused” was “not an accurate statement.”

The company’s frequent references to eco-terrorism echo rhetoric that law enforcement agencies first widely adopted in the aftermath of 9/11. As the U.S. government’s definition of terrorism expanded, agencies like the FBI and Department of Homeland Security established new information-sharing partnerships with “critical infrastructure” industries, including the oil industry.

A legal complaint filed on Tuesday suggests that ETP agrees that Dakota Access Pipeline opposition represents a terroristic movement. The 187-page complaint accuses Greenpeace and an array of other anti-pipeline entities of racketeering and defamation, characterizing NoDAPL as driven by “a network of putative not-for-profits and rogue eco-terrorist groups who employ patterns of criminal activity and campaigns of misinformation.”

TigerSwan repeatedly sought to collaborate and share information with local, state, and federal law enforcement agencies investigating the sabotage, the documents show.

The FBI declined to comment on its investigation or any meetings that took place with TigerSwan. Mike England, a spokesperson for the federal Department of Homeland Security, said the only contact the agency had with TigerSwan was when the company reported valve vandalism on March 13 and March 17. A spokesperson from the Iowa Department of Natural Resources, Alex Murphy, said the agency met TigerSwan for an intelligence-sharing meeting regarding DAPL in March, but had no further contact.

Mark Schouten, director of the Iowa Homeland Security and Emergency Management Division, said that such conversations are “generally classified at a ‘secret’ level” and noted that the existence of a pending criminal investigation into the valve incidents further prohibited him from commenting. “We spend a great deal of our time talking with the private sector, because 80 percent of the nation’s critical infrastructure is held in the hands of private sector entities,” he said. “Frankly, the nature of our discussions are dependent on us holding their information confidential.”

TigerSwan’s March and April reports reveal wide speculation about the culprits behind the vandalism, blaming the sabotage at various points on Tawasi; residents of Little Creek; the Mississippi Stand group, of which both Reznicek and Montoya are members; and the Rolling Resistance.

In an interview with The Intercept, Tawasi denied involvement in the valve sabotage. “I want to be a law-abiding citizen, and I make a point of behaving that way, because I don’t want to go to jail,” he said, adding, “I’d lose my ability to be a mouthpiece.” He said he was unaware of any contact he had with the FBI, although, he noted, “I suspect that people who are in my daily life are either agents or operatives or mercenaries.”

Christine Nobiss vehemently denied the accusations levied against her and the Little Creek camp. “I don’t do anything illegal at all,” she said. At the camp, she added, “All we did was argue a lot, buy goats, and try to build a sustainable community.” Stuart Perkins, who traveled with the Rolling Resistance, said the group was never involved in any valve sabotage.

As TigerSwan hunted the valve culprits, the Takini camp in particular became a talking point used to paint the NoDAPL movement as growing increasingly radicalized even as it shrunk.

TigerSwan included in its situation reports photographs from inside the anti-pipeline Takini camp in South Dakota.

TigerSwan Situation Report, April 15, 2017

Takini was located on private property, yet the reports fixate on allegations that its members were armed. The landowners “wish to develop the land into an armed resistance sustained community,” an April 16 document notes. “The arming of the groups within the camp are not at 100 percent, but each native familial-group has individual weapons.”

TigerSwan identified Frank Archambault and Aidoneus Bishop — “the ‘Viking’ nut job” — as running the operation.

Archambault, who was at the camp, said he and others had discussed whether the local community should hire security for self-defense, to protect against a proposed temporary housing site for pipeline workers in the area, known as a “man camp.” In North Dakota’s Bakken region, man camps have been linked to sexual violence and drug trafficking. “The thing about the weapons is false,” he told The Intercept. “I am a felon, and I cannot possess weapons, especially firearms.” Archambault also said he had never heard of any plans to damage valve sites or other property.

Bishop, meanwhile, who goes by Viking, told The Intercept he had never even visited the camp and has not left Washington state since January. “I wish I was there,” he said. Bishop is tall, red-haired, and known for wearing a neon orange jacket. “I’m pretty easy to spot.”

The reports also claimed that a nonprofit called Sustainable Settings had offered to purchase weapons for the Takini camp, and Angela Ohmer and Phyllis Bald Eagle had planned a trip to Colorado to make arrangements.

“Wow,” Ohmer said in response to the allegation. “It’s not true.” She said she did travel to Colorado, but met with the organization to discuss camp design. A member of Sustainable Settings said the group had only provided consultation in designing a sustainable community.

The camp was created as a “healing space,” explained Amos Cook and Phyllis Bald Eagle, the native couple who own the land where Takini was set up. They called TigerSwan’s repeated claims that the camp was armed “funny” and “not true.”

“Me and my wife, we are praying people, as our ancestors were,” Cook added. “We have no reason to have any weapons.”

Spring was “when things started to get more crazy,” said the former TigerSwan contractor of the sinister light in which the situation reports cast activists’ activities. “It’s kind of amateur. You thought it sounded good, but it just made us sound like idiots.”

“Use as Many Locals as We Can”

At the end of April, TigerSwan reported that a burned-up Bobcat front-end loader was discovered at a valve site in Iowa. Within a few days, “the valve was torched” at another Iowa site. “The times have changed, nothing can be taken for granted anymore,” says a TigerSwan report submitted April 28.

After a surveillance camera reportedly captured individuals cutting through a fence surrounding a South Dakota valve, where no additional damage was done, TigerSwan became convinced that Montoya and Reznicek were behind many of the incidents.

Reports from the beginning of May describe how Reznicek smashed a window at the office of defense contractor Northrop Grumman in 2016 — for which she was arrested and charged with criminal trespassing and criminal mischief. “This was her turning point in the escalation of force,” one document states. “Most recently, Reznicek and Montoya participated in a fasting ceremony in order to ‘gain wisdom in dismantling the DAPL pipeline.’”

TigerSwan’s hunt only became more sprawling as it zeroed in on its suspects.

The company began sending agents into area businesses, showing employees images of the two women. In one case, the spouse of a hotel employee claimed to remember Montoya, saying she recalled the activist’s “smell” and that she was taken from the hotel to an area hospital. Montoya denied ever visiting the hotel or any hospital during that time.

A May 9 document describes using digital surveillance to monitor the women and locating residences of Reznicek’s family members in Iowa that were believed to be “potential hiding places.”

Operatives scoured hardware stores, searching for the location where the culprits bought their tools. But the images passed around weren’t just of Reznicek and Montoya. Members of Little Creek were also posed to store employees as suspicious characters. And, according to the reports, two employees at stores agreed that they’d seen Nobiss or her partner, Lakasha.

“If members of Little Creek Camp purchased the supplies, they likely used Christine Nobiss’s Indigenous Iowa credit card. (TigerSwan is in possession of Nobiss’s credit card information and can potentially match it to receipts),” a May 5 report states. Two other reports from the period note that TigerSwan captured drone footage of the Little Creek camp.

Nobiss was alarmed to hear that the company had obtained her credit card information, and said that she kept her distance from Reznicek and Montoya because of their participation in acts of civil disobedience. As for visiting the hardware store where she was allegedly spotted, she said, “I don’t even know where that store is — that’s a complete lie.” She added that she suspected racial profiling was at play in the employees’ identifications, since both she and Lakasha are native. Lakasha also denied the accuracy of the reports.

“The feeling of being surveilled doesn’t bother me so much, because I have nothing to hide,” Nobiss said. “What does bother me is the inaccuracies in these reports.”

“A lot of this stuff is not really happening; it’s just them guessing,” she added.

As they had done since the beginning of the Standing Rock protests, TigerSwan operatives on the ground kept track of vehicles they deemed to be suspicious — sometimes simply for driving in the vicinity of the pipeline at slower speeds. They listed license plate numbers and other identifying details in a “Be On Look Out” list, known as “BOLO,” and used the mobile app WhatsApp to warn their network in real time when they sighted a suspicious car. They also shared that information with law enforcement, as well as local landowners, gas station attendants, construction crews, and store employees they had recruited into their surveillance effort.

In South Dakota, TigerSwan personnel began meeting with residents near the pipeline, asking them to be on the lookout and recording their names and contact information in the reports. “Use as many locals as we can to further our oversight on the valves,” a TigerSwan operative noted on May 5.

TigerSwan itself admitted the zealous effort yielded little of relevance. “Security personnel have been diligently reporting any suspicious vehicles,” a May report notes. “All reports at this time have not been anything resulting in malicious activity. All reports have been linked with either curious people or ETP inspectors.”

But in one case, the company’s information sharing led a sheriff’s department in South Dakota to arrest someone TigerSwan operatives falsely suspected to be Montoya. “Description of the driver fits Ruby Montoya’s physical features. The woman had a brief conversation with the guard, was very upset, told the guard to stop following her, and sped off,” TigerSwan reported in a May document.

TigerSwan then shared the license plate information with the Minnehaha County Sheriff’s Office, despite the fact that the same document also reported spotting Reznicek and Montoya in Des Moines, Iowa, demonstrating at a drone base.

“As of today, the vehicle has been found and the sheriff’s department has the driver in custody. The driver was arrested because the plates that were on the vehicle did not belong to that vehicle. We are currently waiting to hear back on the driver’s information to determine the driver’s identity,” TigerSwan wrote.

Contacted for comment, the Minnehaha County Sheriff’s Office provided an update on the arrest described in TigerSwan’s report. “Quite frankly, she was in the wrong place (with substitute plates on her vehicle) at the wrong time,” Sheriff Mike Milstead noted in an email. He said people often use such plates when they can’t afford a renewal fee.

Regarding the department’s contacts with DAPL security, he said, “We really had very limited contact and events. We had a couple of vandalisms to the wellheads or whatever, but other than that, it went off here relatively with little, if any, problems.”

Meanwhile, in Illinois, TigerSwan surveilled the private residence of Susan and Bradley Stanton, a native couple who had gone to Standing Rock and occasionally welcomed water protectors on their property. A report dated May 7 includes two Google Earth images of the couple’s property in Nauvoo, Illinois, as well as grainy photos taken at much closer range that show their home from behind a fence. “On site, the frame for a sweat lodge was discovered behind a shop,” the report states.

TigerSwan included images of Susan and Bradley Stanton’s property in a May situation report.

TigerSwan Situation Report, May 7, 2017

Reached by phone, Susan Stanton was shocked to find her home and sweat lodge in a TigerSwan report. “Why would they even pick on that? That’s so bizarre,” Stanton told The Intercept.

“I’m not hiding. They can take pictures of my home. I don’t have anything under wraps,” she added. “If they wanted to come here, I’d show them around. I’d put them in the sweat lodge if they wanted to go and pray.”

CHICAGO, IL - FEBRUARY 04:  Demonstrators rally near Trump Tower while protesting the construction of the Dakota Access pipeline on February 4, 2017 in Chicago, Illinois. President Donald Trump recently signed executive actions to advance approval of Dakota Access and the Keystone XL pipelines, undermining efforts by the administration of President Barack Obama to block their construction. (Photo by Scott Olson/Getty Images)

Demonstrators in Chicago, Illinois, rally near Trump Tower while protesting the construction of the Dakota Access Pipeline on Feb. 4, 2017.

Photo: Scott Olson/Getty Images

Counterinformation Ops

Outside of the valve hunt, TigerSwan’s surveillance spread beyond the boundaries of the NoDAPL movement, portraying a range of progressive efforts as threatening.

“Illinois activists have switched their current focus from the environment to the POTUS and recent combat activity in Syria,” a TigerSwan operative reported in April. Yet the firm continued to closely monitor those groups. “Chicago is a key indicator of the ongoing rise of the progressive movement and the hub of the financial support for that movement,” another report noted.

Describing a pipeline divestment proposal presented to the Chicago City Council, TigerSwan wrote: “It will also affect the platform of the Democratic party, pushing it further left.”

TigerSwan also pushed to expand its efforts at shaping the public narrative around the pipeline, pitching its client regularly on the need for a counterinformation campaign.

“Chicago continues to foster continuance of the Narrative of Standing Rock,” an operative wrote on May 4, pointing to an issue of Scholastic News, a magazine distributed to elementary school kids, that featured water protectors on the cover. “The schools in the suburbs are now providing students with indoctrination of the same Standing Rock Narrative that the Native Americans are all being systematically repressed and discriminated against.”

All the while, TigerSwan sought contracts for new pipelines, and messaging efforts similar to those faced by Iowa’s Little Creek camp have begun to surface in other states where Energy Transfer Partners has a presence.

In August, pipeline opponents in Pennsylvania and Louisiana discovered videos posted on local Facebook pages dedicated to criticizing anti-pipeline activists, called PA Progress and Louisiana First. As The Intercept confirmed in earlier reporting, TigerSwan operatives have been working on the ETP-owned Mariner East 2 Pipeline, slated to run through Pennsylvania. In Louisiana, ETP is seeking to build the Bayou Bridge Pipeline, which would deliver crude from the Dakota Access Pipeline to the refineries and ports of the Gulf Coast.

The first video, posted on August 8, features a young man named Josh Baker warning Pennsylvania residents of the dangers associated with an anti-Mariner East camp called White Pine. The second, posted August 11, accuses an anti-Bayou Bridge activist in Louisiana of organizing protests for profit. It features the same man, who this time introduces himself as Brent Williamson.

On August 8, a video featuring an individual identified as “Josh Baker” appeared on a Facebook page criticizing anti-pipeline organizers in Pennsylvania. Video: PA Progress

On August 11, the same individual appeared in a similar video posted on the Louisiana First Facebook page, this time introduced as “Brent Williamson.” Video: Louisiana First

“We’re asking people in the area to please stay away from [members of the camp] if you see them. And if you see anything suspicious, call the number below,” says “Josh Baker,” listing the number of Pennsylvania’s Huntingdon County sheriff.

TigerSwan did not respond to questions about the videos, nor did administrators of the PA Progress or Louisiana First pages. ETP spokesperson Vicki Granado told The Intercept that the company had no involvement with either Facebook page.

Meanwhile, the chair of TigerSwan’s advisory board, retired Maj. Gen. James “Spider” Marks, has been criticized for failing to disclose his link to the security company in a number of op-eds denouncing protest activities related to ETP projects. After learning of Marks’s affiliation with TigerSwan, the Pennsylvania news outlet PennLive promised his work would not appear on its website again. Yet a new Marks op-ed appeared in the Washington Examiner on August 23, referring to the valve sabotage and stating, “If Islamist terrorists had sabotaged a U.S. oil pipeline, held a press conference to claim credit for their crime, then punctuated their declaration by defacing government property, it would be a national news story.”

In recent months, TigerSwan’s efforts to obtain new business have been stymied by increasing scrutiny from regulators.

In June, citing documents published by The Intercept, the North Dakota Private Investigation and Security Board sued TigerSwan for operating without a license for the duration of its work in that state. In July, the company was denied a license to operate in Louisiana. In Illinois, meanwhile, the Department of Financial and Professional Regulation had no record of TigerSwan even seeking a license, a Freedom of Information Act request revealed, despite the company having operated in the state for several months.

TigerSwan is appealing the Louisiana decision and fighting the North Dakota suit, demanding the state pay the firm’s attorneys’ fees. In legal filings, the company denied providing private security services at all in North Dakota, instead describing its activities as “management consulting.”

“Contrary to what has been alleged on the internet and elsewhere, the reports were not a summary of TigerSwan’s security and investigative activity,” a filing reads. “Except for information gathered by TigerSwan in North Carolina, the information was gathered by other companies hired directly by the client and the client’s contractors.” TigerSwan also denied that it “placed or attempted to place undercover private security agents within the protest group to carry out investigative and surveillance activities” in North Dakota.

TigerSwan did not respond to The Intercept’s requests for comment for this story. “We do not speak for TigerSwan,” ETP’s Granado told The Intercept. “I can confirm that we do use TigerSwan as an adviser for some of our security programs, however, beyond that we don’t discuss details of our security initiatives, which are designed to ensure the safety of our employees and the communities in which we live and work.”

In its suit accusing DAPL opponents of racketeering, ETP counts Reznicek and Montoya among members of a massive “enterprise” led by Greenpeace. The suit alleges that the two were “incited by the enterprise’s misinformation campaign” to vandalize the valves. The law firm representing the pipeline corporation is Kasowitz Benson Torres, which was started by Trump’s longtime private lawyer Marc Kasowitz. Kasowitz drew criticism this summer when he responded to an email from a stranger encouraging him to resign. “Watch your back, bitch,” he replied.

Jessica Reznicek sits in a Iowa State Patrol car after she was arrested for vandalism after prying off letters from the Iowa Utilities Board sign on Monday, July 24, 2017 in Des Moines.

Jessica Reznicek sits in an Iowa State Patrol car after she was arrested for prying letters off an Iowa Utilities Board sign in Des Moines on July 24, 2017.

Photo: Brian Powers/The Register

“At All Personal Costs”

When The Intercept first spoke with Jessica Reznicek, she denied TigerSwan’s allegations about her involvement in the pipeline vandalism, though she noted that she did not perceive property destruction as violent and had previously taken responsibility for smashing a window at Northrop Grumman. “[I] stayed, expressed my opinion, and told the public why I was there. I did not strike and run.”

“I don’t see property destruction as a bad thing — I see it as something that’s really honorable, and I commend those people, groups, or whatever that have taken it to that next level,” Ruby Montoya told The Intercept, after also denying a role in the vandalism. “I’m also glad they’re looking at me because that takes heat off of whoever else.”

But days later, Reznicek and Montoya took responsibility for many of the valve incidents and arsons, stating that their first action was a $2.5 million arson on election night and their last was in Wapello County, where they burned a valve with a blow torch at the beginning of May.

Reznicek and Montoya told The Intercept they had changed their story after consulting with each other and deciding that the TigerSwan reports offered them an opportunity to advance their cause. Both women said they acted alone, without consulting any other people.

“I guess this was one last opportunity for me to put my case forward in a system that I have no faith in,” Reznicek said. “This really is about getting this pipeline stopped. Apparently at all personal costs.”

Asked to comment on the way TigerSwan used the valve actions to justify the surveillance of others, Reznicek replied, “Ruby and I weighed that in at every point, particularly because we care very deeply for our friends and family and comrades. It is unfortunate that we live in this security state,” she added, but “I can’t allow that to limit my ability to act.”

Although TigerSwan reported sharing information related to the vandalism extensively with police and the FBI as it carried out its investigation, Montoya and Reznicek said they were never questioned or picked up. In the early morning of August 11, the FBI raided the Catholic Worker house where the two women live, hauling away bags of their belongings, reportedly including attorney-client privileged material. But so far, more than a month after their confession, they have not been charged.


To search all TigerSwan documents published by The Intercept, go to the TigerSwan project page on DocumentCloud.

The Intercept redacted the names of individuals included in internal TigerSwan documents unless those individuals directly communicated their willingness to be identified. The names of public figures and senior TigerSwan and law enforcement personnel were not redacted. Several of the situation reports TigerSwan submitted to Energy Transfer Partners in March, April, and May contained inconsistent or inaccurate dates on the title page of the report. In our articles, we defer to the date listed in the report’s file name.

We depend on the support of readers like you to help keep our nonprofit newsroom strong and independent. Join Us 

Part 7

Police Used Private Security Aircraft for Surveillance in Standing Rock No-Fly Zone

Contact the author:

Alleen Brownalleen.brown@​

Will Parrishwillparrish2017@​

Alice Sperialice.speri@​

Read more
Dean Dedman Jr.

At the height of the movement to stop the Dakota Access Pipeline’s construction last fall, the Federal Aviation Administration imposed a rare “temporary flight restriction,” also known as a no-fly zone, covering nearly 154 square miles of airspace above the pipeline resistance. The no-fly zone — a response to the activities of indigenous drone pilots, whose aerial videos documenting the struggle at Standing Rock drew large social media followings — was approved from October 25 to November 4 in 2016 and renewed twice to cover a smaller area, remaining in effect until December 13.

Drone footage by Dean Dedman, a member of the Standing Rock Sioux tribe

Documents obtained via open records requests, as well as material from court cases, reveal new details about how the FAA and state agencies helped police and private security companies wrest control of the airspace above the NoDAPL resistance from indigenous water protectors.

Following the flight ban, the media was no longer permitted to use aircraft to cover the events without undergoing a review process. According to the FAA’s no-fly order, “Only relief aircraft ops under direction of North Dakota Tactical Operations Center [were] authorized in the airspace.” Meanwhile, aircraft operated by Dakota Access Pipeline security officials continued to fly over the area to conduct surveillance. The FAA confirmed to The Intercept that the flights would have been legal only if the private security aircraft were participating in a law enforcement action. Prosecutors have used footage from those flights as evidence in felony cases brought against pipeline opponents, displaying an unusual and troubling partnership between the private security operatives and law enforcement.

As The Intercept has previously reported, pipeline builder Energy Transfer Partners hired the shadowy mercenary firm TigerSwan in September 2016 to oversee its security operation. TigerSwan moved quickly to establish a collaborative relationship with law enforcement. The Intercept received more than 100 leaked documents from a TigerSwan contractor describing those efforts in detail, along with DAPL security’s broader strategy of using aerial surveillance, infiltration, and social media monitoring to counter the water protector movement. TigerSwan, which began as a military and State Department contractor, frequently used the language of counterterrorism to inflate threat assessments, at times comparing the water protectors to jihadi insurgents.

Court documents confirm that DAPL security personnel were coordinating their flights with state agencies. In a police report concerning a highly militarized October 27 police raid during the no-fly period, Lt. Cody Trom of the Bismarck Police Department wrote that a team of officers assigned to clear protesters from a bridge at County Road 134 included a “DAPL air asset.” A spokesperson for the Morton County Sheriff’s Department, one of the agencies leading the police response at Standing Rock, told The Intercept, “DAPL was not deputized.” The spokesperson did confirm, however, that law enforcement personnel were present on DAPL aircraft. “During no-fly zone periods, a law enforcement officer was always on board the helicopter. The helicopter was flown by a private contractor, and a law enforcement officer accompanied him to conduct aerial surveillance.”

As the temporary flight restriction went into effect, at least one DAPL security aircraft circled the airspace above the police raid on October 27, photographing water protectors and coordinating with police. 

The DAPL photos from that day have become key evidence in a federal felony case accusing five indigenous men of helping set fire to barricades on North Dakota County Road 134. If convicted, they each face a mandatory minimum sentence of 10 years in prison.

In a January 24 affidavit and in a later court hearing, Special Agent Derek Hill of the Bureau of Alcohol, Tobacco, Firearms and Explosives described how he identified at least two of the defendants, Michael Markus and Brennon Nastacio. “While law enforcement was conducting their operation, a helicopter that was being utilized by the Dakota Access Pipeline was monitoring the situation from the air,” Hill wrote in the affidavit. “A passenger in the helicopter was utilizing a digital camera to document the operation, and these digital photos were provided to law enforcement.”

“From a constitutional standpoint, landowners and others who have property rights have every right to show the police evidence that someone has trespassed on their land,” says Lee Rowland, a senior staff attorney with the ACLU’s Speech, Privacy, and Technology Project. “But if this instead amounted to deputizing a private company to take aerial surveillance of protesters on public property, including streets, and snitch on them to the police, that’s deeply problematic.”

According to water protectors, a DAPL helicopter frequently strayed from Dakota Access property. “The yellow helicopter that we’d identified as being DAPL’s flew to the south of DAPL property lots of times on October 27,” says Dallas Goldtooth of the Indigenous Environmental Network, who often filmed and livestreamed from the water protector camps in North Dakota.

A spokesperson for the North Dakota Department of Emergency Services did not respond to a request for comment. Vicki Granado, a spokesperson for Energy Transfer Partners, told the Intercept, “We are thankful for the professionalism and the services provided by all the law enforcement teams that were on the ground in North Dakota that ensured the safety not only of our employees, but the safety of those who live and work in the Mandan area. Beyond that, we do not comment on our security programs.” TigerSwan did not respond to inquiries.

A spokesperson for the FAA noted, “The Federal Aviation Administration carefully considers requests from law enforcement and other entities before establishing Temporary Flight Restrictions (TFR) in U.S. airspace. The TFR over the pipeline protest was approved to ensure the safety of aircraft in support of law enforcement and the safety of people on the ground.”

The FAA spokesperson noted that the flight restriction offered provisions for media to operate aircraft as long as they complied with FAA rules around licensing and safety, and coordinated with the agency before flying. The agency did not respond to questions about how many media operators obtained waivers, stating, “We did not deny any requests from media who met those requirements.” One drone pilot, Rob Levine, eventually obtained a media waiver, but only in a small segment of the restriction zone.


A screenshot from a drone video of law enforcement shooting rubber bullets at a drone at Standing Rock.

Dean Dedman Jr.

Myron Dewey, a videographer who attracted hundreds of thousands of viewers to his series of DAPL-related videos on social media, was among the people whose use of consumer drones to document the anti-DAPL struggle spurred the request for a no-fly zone.

“I told the FAA, the difference between how we’re approaching this is that I’m exercising sovereignty,” said Dewey, who is Newe-Numah/Paiute-Shoshone. “I said, ‘If you want to bring up a no-fly zone, you need to go to the tribal council and make your request to them.’”

The no-fly zone came at a moment of heightened tension between police and pipeline opponents, as water protectors, claiming what they called “eminent domain,” built a new camp on land owned by Energy Transfer Partners that would have been covered under the 1851 Treaty of Fort Laramie. Two days after the no-fly zone was imposed, law enforcement and private security officers forcibly evicted the new camp, using military-grade armored personnel carriers and shooting protesters with rubber bullets and other “less-than-lethal” weapons.

Yet even before the no-fly zone, law enforcement had been targeting drone operators. On October 19, Aaron Turgeon, a member of the Rosebud Sioux tribe of South Dakota, was charged with two counts of “reckless endangerment” and one count of “physical obstruction of a government function” for flying his drone in the vicinity of a law enforcement operation. Prosecutors also charged Dewey with misdemeanor “stalking” for flying his drone near a DAPL security guard. Turgeon was eventually found not guilty, and Dewey’s charges were dropped.

Law enforcement went so far as to shoot at a drone belonging to Dean Dedman, a member of the Standing Rock Sioux tribe, in the days leading up to the temporary flight restriction, claiming that the drone was flying too close to a helicopter.

An October 24 law enforcement email obtained by The Intercept shows police and emergency response officials communicating with a representative of the California-based security company Trak Assets, which had offered a demonstration on “drone defense technology” for the police to use in North Dakota. And a “logistics tracking sheet” shows that law enforcement acquired a “drone shoot down device” from the Dakota Zoo to “disable protestor drones” on November 4. The document notes that the device was eventually returned to the zoo.


Screenshot of a law enforcement email with “logistics tracking sheet” from Oct. 24, 2016.

This wasn’t the first time the FAA had been accused of allowing law enforcement to use flight restrictions to keep out cameras. The agency came under criticism in 2014 when a temporary flight restriction was put in place over protests in Ferguson, Missouri, following the police killing of 18-year-old Michael Brown. In audio recordings obtained by the Associated Press, an FAA manager described how St. Louis police “finally admitted it really was to keep the media out.”

Recognizing the “substantial sensitivities” of the issue, officials “at the highest levels” of the FAA weighed in on the decision to institute the no-fly zone at Standing Rock. Internal records show the request generated controversy within the agency. “I know this is a high profile event so I wanted you onboard with my denial. I plan on denying the request based on there being no hazard from the ground to [aircraft], exp: no shots fired,” wrote Kevin George, an air traffic control specialist at the FAA, on October 23. George noted that violations of law by drone pilots would be more appropriately pursued individually by police.

When a request to renew the restriction was submitted in November, FAA officials again expressed hesitation. “Candidly,” an FAA official wrote at the time, “some of the involved tribes are arguing that the FAA’s action to implement a [temporary flight restriction] was driven not by a genuine safety/security threat, but rather by the desire of the local [law enforcement agents] handling the situation to prevent the protesters from using drones to surveil unlawful actions on the part of [law enforcement] that infringe on the protesters’ First Amendment rights.”

“A pattern we have to be very vigilant about in the future is that the FAA tends to just respond in lockstep to requests from law enforcement,” the ACLU’s Rowland told The Intercept. “And we need to ensure that law enforcement does not get used to the perverse incentive of asking for an over-broad no-fly zone that creates a blackout on media surveillance.”

Ultimately, North Dakota law enforcement officers helped sway FAA officials by suggesting that anti-DAPL water protectors would take up arms and consumer drones might cause a fatal accident. “There is also good intel they are going to be even more desperate in their actions,” wrote Sean Johnson of the state’s Department of Emergency Services.

In the same email exchange, Johnson alleged that pilots had intentionally flown their drones toward law enforcement aircraft, and “it is only a matter of time until a law enforcement officer, a lawful protester, or member of the public is injured (or worse yet killed) as a result of unlawful actor usage of UAS.” Highway Patrol officer Shannon Henke added, “We can only pray for the best that a flight crew is not lost due to the violations that keep occurring.” Henke claimed that law enforcement had observed protesters wielding “both long guns and handguns” and stated, “We need to ensure the movement of law enforcement trying to protect the innocent is not being broadcast live by the use of drones.”

In the spring of 2017, as TigerSwan expanded its surveillance effort to new camps in multiple states, the security firm encouraged staff to “focus on becoming Certified Drone Pilots to support the DAPL program,” according to a situation report dated May 5 that was leaked to The Intercept. A day later, TigerSwan confirmed that one of its contractors “completed drone training and has successfully passed the drone operator test” and “is now an official drone operator in the state of SD.”

Top photo: A screenshot from a drone video over a circle of Dakota Access Pipeline opponents on Sept. 20, 2016.

We depend on the support of readers like you to help keep our nonprofit newsroom strong and independent. Join Us 

Contact the author:

Alleen Brownalleen.brown@​

Will Parrishwillparrish2017@​

Alice Sperialice.speri@​

Read more
Filters SVG