The large gatherings, religious observances, and themed events that make the holidays festive for so many also make Hanukkah, Christmas, and New Year’s Eve an attractive target for violent extremists looking to take advantage of opportunistic, symbolic, and often soft targets.
The most recent National Terrorism Advisory System Bulletin, released by the Department of Homeland Security on Nov. 30, noted that “the holiday season and associated large gatherings” were among the upcoming events that “threat actors could exploit,” with targets of potential violence including “public gatherings, faith-based institutions, the LGBTQI+ community, schools, racial and religious minorities, government facilities and personnel, U.S. critical infrastructure, the media, and perceived ideological opponents.” French media also reported that, with an already high threat environment there, police will be protecting synagogues, churches, and surrounding areas over the holidays.
In the heyday of ISIS propaganda, imagery of terrorists torching Christmas trees, gunning down or running down Santa, bombs in Santa’s toy sack, or blood-spattered holiday decorations were as much a fixture in the run-up to the season as half-price sales and caroling. And what might appear to some to be a hateful yet harmless meme can inspire violent action as intended: Everitt Aaron Jameson, a Modesto, Calif., tow-truck driver and former Marine, pleaded guilty in 2018 to planning a Christmas-season attack on San Francisco’s Pier 39 after he had “liked” on Facebook an ISIS propaganda image depicting Santa with a box of dynamite in New York’s Times Square.
This year, multiple factors are shaping a rapidly evolving threat environment. Holiday gatherings could be targeted by extremists looking to make a statement with a symbolic strike on individuals of a certain religious or ethnic background, or their primary driver could be simply a tightly packed crowd distracted by revelry. Those seeking a broader attack landscape may be thinking that the holidays could leave critical infrastructure targets with lower staffing or that a hit on this sector during holiday celebrations would make a louder statement in furtherance of their cause. And tactics used in attacks or plots outside of the season could inspire those who have been considering their own attack — the manifesto of the shooter who attacked an LGBT bar in Slovakia in October said he had “slowly been preparing” since 2019 — to take advantage of the large holiday crowds and soft targets.
Recent events influencing the threat landscape
The season of lights was hit by days of darkness in one North Carolina county after a pair of substation gun attacks Dec. 3 that knocked out power to tens of thousands of residents and businesses. Extremists have praised these attacks and especially lauded the results, urging more lone actors and cells to strike multiple infrastructure systems. Accelerationists view infrastructure attacks as critical to creating the kind of chaos needed for their goal of societal and government collapse.
Attacks on LGBT bars
The deadly attacks on LGBT bars in Bratislava in October and Colorado Springs in November have also drawn extensive praise from extremists who have long targeted the gay community. Juraj Krajcik, the 19-year-old shooter who killed two at the bar in Slovakia, was quickly labeled a “saint” after his attack by accelerationists; they bestow the distinction upon white killers who meet certain criteria including deliberate intent, motive, inflicting at least one death, and having a neo-Nazi, white nationalist, or far-right anti-system worldview. These extremists have been pushing for more would-be “saints” to conduct their own attacks.
The mainstreaming of antisemitic sentiment in recent months has raised alarm among Jewish groups, security officials, and other counterextremists. Extremists who have long expressed desire to exterminate the Jewish people while denying the Holocaust have heralded these recent antisemitic incidents regardless of the messenger. Anti-Jewish hate expressed by figures with public platforms is compounding security concerns that were already escalating in the Jewish community. This week’s administration announcement of the creation a new inter-agency group led by the Domestic Policy Council and the National Security Council to increase and coordinate government efforts to counter antisemitism, Islamophobia, and related forms of bias and discrimination is also likely to stoke extremists.
Six letter bombs were delivered to high-profile targets in Spain between Nov. 24 and Dec. 1, including one intercepted at the security post of the U.S. Embassy in Madrid, and another wounding an employee at the Ukrainian embassy in Madrid. Incidents can serve as tactical inspiration even if the copycat perpetrator doesn’t share the ideology or motive of the original attacker. When no arrests are made in the case, this can further inspire extremists to act — believing that their own activity can have one or more sequels.
Christmas market threats
Last week, officials in Dusseldorf, Germany, closed down outdoor Christmas markets after police received a threat warning that a truck would be crashed into the market at the historic old town’s city hall. A week before that, Berlin police received a threat from a caller claiming that he was planning a vehicle attack against the Alexanderplatz Christmas market, resulting in temporary road closures around the market. After the Christmas market attacks in Germany in 2016 and France in 2018, authorities don’t consider these idle threats; extremists have also held up these previous attacks and emphasized that Christmas markets hold weight as both symbolic and soft targets.
Buffalo shooter’s guilty plea
Payton Gendron pleaded guilty last month to state charges of committing a domestic act of terrorism motivated by hate, first-degree murder, attempted murder and a weapons possession charge, and is now exploring a guilty plea in federal court where he faces hate crime charges. The white supremacist gunman who killed 10 people in a mass shooting at a Buffalo grocery store in May is heavily lionized on extremist forums through memes, the circulation of his manifesto, and calls for others to follow in his footsteps.
Oath Keepers verdicts
Days after Thanksgiving, Oath Keepers founder Stewart Rhodes and Florida chapter leader Kelly Meggs were convicted of seditious conspiracy and other charges in the Jan. 6, 2021, attack on the U.S. Capitol. The trial just began for four more Oath Keepers charged with seditious conspiracy and other felonies. With the second trial underway and the Jan. 6 anniversary approaching, anti-government extremists could see the next few weeks as timely to conduct violent action.
Holiday threat considerations and potential targets
Houses of worship
Out of at least 121 antisemitic incidents targeting Jewish institutions reported to ADL since this past June, more than 60 targeted Jewish houses of worship. Attacks on synagogues or churches could come from extremists acting out of religious motivation — such as ISIS or al-Qaeda attacks on institutions they believe to be un-Islamic — along with antisemitic beliefs, like the synagogue shooters in Pittsburgh and Poway. The current extremism climate could also make a house of worship a target if it is seen as not aligning politically or culturally with the attacker(s) or their associated extremist movement. Houses of worship should information share year-round and implement extra security measures around holiday events.
Shopping centers packed with people buying last-minute gifts, music venues, clubs welcoming patrons for events or regular dance nights, New Year’s Eve celebrations, and other crowded venues can be attractive to extremists looking to inflict a high number of casualties in a crowded space that may be difficult to flee. Loud music, lots of chatter, and general holiday chaos can also cut down on situational awareness as many in the crowd may be slow to react to a rapidly unfolding violent incident, such as the 2017 attack on New Year’s Eve revelers at the Reina nightclub in Istanbul. In addition to screening patrons when applicable, venues should review their security posture taking into account holiday crowds and ensure that personnel are trained to react and coordinate in their specific settings.
Opportunistic strikes during the holiday season can hit targets that may have light or nonexistent security measures, may be familiar places considered safe by the people there, and may contain people with an extra degree of distraction if they’re celebrating. Syed Rizwan Farook, for example, picked an especially soft — and familiar — target for his 2015 attack in San Bernardino, Calif., with wife Tashfeen Malik: a training event and Christmas party with his co-workers in a rented conference hall. Any location where people gather should consider its security posture and potential as a soft target; CISA has resources to help soft targets build relationships and mitigate or deter incidents.
Given the nature of the season, a symbolic target could include a faith-based institution or faith leaders as well as an extensive or well-known holiday display or event. A target can be symbolic and overlap with a crowded venue or a soft target, such as crowds waiting to see Santa in a mall or the county employees’ Christmas party. But given the recent threat environment, a target may be symbolic to extremists for other reasons — for example, a holiday-themed drag show or story hour that would be targeted by extremists year-round yet is currently wrapped into holiday festivities. Events, faith-based entities, and venues that have a connection to the holiday season should assume a heightened security posture and establish relationships with law enforcement and information-sharing and analysis centers to keep abreast of the threat environment and mitigations along with any specific threats.
Holiday parades, community festivals, Christmas markets, New Year’s Eve fireworks, and similar outdoor events can be attractive to potential attackers because they draw distracted people who are immersed in the events and attractions into areas that may be difficult to secure. The 2017 Las Vegas mass shooter was able to bypass perimeter security at the outdoor music festival with his sniper’s perch at a nearby hotel. The accused gunman in this year’s July Fourth parade shooting in Highland Park, Ill., is said to have used a ladder on the side of a business to gain access to the rooftop and, after the attack, used a disguise to blend in with the fleeing crowd. Security officials should review event perimeters as well as nearby vantage points along with the potential for vehicles or explosive devices to access the area.