On Oct. 8, the Department of Justice announced the arrests of six individuals who were charged with a conspiracy to kidnap the governor of Michigan at her vacation house. Leading up to the arrest, the FBI was able to capture several significant actions that the group carried out which aligned with the phases and stages of the Hostile Events Attack Cycle (HEAC). Viewing oneself from the eyes of a threat is an effective strategy. And through examination of those phases and stages, organizations can identify areas that threat actors consider and take proactive steps to assess their organization as well as make risk-informed decisions to reduce risks or security gaps they may have.
In early 2020, the FBI became aware through social media that a group of individuals were discussing the violent overthrow of certain government and law-enforcement components. This was initially thought to involve targeting law enforcement officers. As such, the FBI interviewed a member of the militia group who was concerned about the group’s plans to target and kill police officers, and that person agreed to become a Confidential Human Source (CHS). The FBI would ultimately develop another CHS during the conduct of the investigation, and these two individuals provided the FBI with firsthand access into the planning and development of this particular hostile event. It is largely through those efforts that we are able to understand the intricate details of this particular domestic terrorist group’s plan.
Phase One – Initial Target Consideration. In this phase, it is not essential for the threat actor to settle on a target location, but to begin that process to identify potential locations that will impact the rest of the planning and preparation. The basis for this attack appeared early on to be ideologically based. In this particular threat planning, members of the group (hereafter referred to as the Michigan group for the purposes of this report) met in early June and discussed “creating a society that followed the U.S. Bill of Rights and where they could be self-sufficient. They discussed different ways of achieving this goal from peaceful endeavors to violent actions.” Additional comments that support their ideology include:
- In an early meeting several members “talked about state governments they believed were violating the U.S. Constitution, including the government of Michigan and Governor Gretchen Whitmer.” Some members even talked about murdering “tyrants” or “taking” a sitting governor.
- Several members of the group took part in protests and demonstrations and in several planning discussions, which were recorded by one of the FBI’s CHS’s. The degree of their anger and frustration may well be captured in the words of the Michigan group’s leader who noted that, “In all honesty right now… I just wanna make the world glow, dude. I’m not even fuckin’ kidding. I just wanna make it all glow dude. I don’t fuckin’ care anymore, I’m just so sick of it. That’s what it’s gonna take for us to take it back, we’re just gonna have to everything’s gonna have to be annihilated man. We’re gonna topple it all, dude. It’s what great frickin’ conquerors, man, we’re just gonna conquer every fuckin’ thing man.”
- Other conversations also captured conversations that the government had become so tyrannical and needed to collapse.
- During the first surveillance operations, the leader of the Michigan group said, “We ain’t gonna let ‘em burn our fuckin’ state down. I don’t give a fuck if there’s only 20 or 30 of us, dude, we’ll go out there and use deadly force.” At the second surveillance, the leader of the Michigan group referenced the governor and said, “She fucking goddamn loves the power she has right now” and that “she has no checks and balances at all. She has uncontrolled power right now.” Another member stated, “All good things must come to an end.” To which the leader also remarked “I can see several states takin’ their fuckin’ tyrants. Everybody takes their tyrants.”
However, the group also noted that if they were going to continue their planning process, they would need to increase their numbers and encouraged each other to talk to their neighbors and spread their message. It was also determined to reach out to a Michigan-based militia group (hereafter referred to as Militia for the purposes of this report) to gauge interest. This initial meeting led to several additional discussions and events that would solidify the target of the attack, but where the attack would occur would still need to be determined.
- The militia group periodically met for field training exercises (“FTX”) on private property in remote areas of Michigan, where they engaged in firearms training and tactical drills. At one of these FTXs, one of the founders of the militia group was introduced to the leader of the Michigan group.
- The Michigan group and Militia met at a Second Amendment rally at the State Capitol in Lansing, Michigan, where a formal request was made to combine forces. It was initially believed that they would need “200 men” to storm the Capitol building in Lansing, Michigan, and take hostages, including the governor. The governor of Michigan was targeted for “treason,” and the leader of the Michigan group said they would execute the plan before the November 2020 elections.
- Later in June, the Michigan group discussed Governor Whitmer and referred to her as “this tyrant bitch.”
Phase 2 – Initial Surveillance / Research. Over the next two months, the Michigan group would work to fine tune the target. One of the ways was to discuss and conduct initial surveillance. In addition to reducing the potential target or locations, the group should also be working on collecting any outstanding information requirements. During this phase, it is not important that the attacker makes their selection during this phase, but by this phase’s completion, they will have accumulated enough information to aid in that decision. As it relates to this attack, there were several important developments that occurred:
- The groups discussed attacking a Michigan State Police facility, and in a separate conversation after the meeting, it was suggested shooting up the governor’s vacation home, which is located in the Western District of Michigan.
- Some of the group discussed their best opportunity to abduct Governor Whitmer would be when she was arriving at, or leaving, either her personal vacation home or the governor’s official summer residence. Both residences are located in the Western District of Michigan. One individual described it as a “Snatch and grab, man. Grab the fuckin’ Governor. Just grab the bitch. Because at that point, we do that, dude — it’s over.”
- It was also suggested that after kidnapping the governor, the group would remove her to a secure location in Wisconsin for “trial.”
- The leader of the Michigan group said he had researched the governor’s office online, and he believed that the governor kept only a ceremonial office in Lansing.
As it relates to research done in support of developing plans for the vacation home, a member suggested they get a realtor to help them find the exact location of the vacation home and collect information on the surrounding homes and structures. The group stressed the importance of knowing the layout of the yard, homes, and security, as well as needing to “map out the surrounding property and gates, and they needed plumbers and electricians to help them read blueprints to refine their strategy.” The group also identified that they may want to recruit additional personnel including those with experience in engineering, information technology, demolitions/explosives, and other operators.
Phase 3 – Target Selection. While the target of the attack was determined early on, the location for the attack did undergo additional discussion. In the end, the head of the Michigan group told one CHS that he “had narrowed down his attack targets to the vacation home and the summer residence.” On the group’s private Facebook page he noted: “We about to be busy ladies and gentlemen . . . This is where the Patriot shows up. Sacrifices his time, money, blood sweat and tears . . . it starts now so get fucking prepared!!”
Phase 4 – Planning and Rehearsals (Surveillance). With the target selected, the group continues to build upon their already established training as well as conduct more planning and surveillance to finalize the plan which will look at initiating the attack; logistics planning; actions at the target; and post-attack (escape / evasion / death). With this particular attack planning, we were able to get invaluable insight through the CHSes that revealed the extensive amount of concept development and surveillance done by the group to undertake such a task.
- Some of the early meetings occurred in the basement of a shop owned by one of the members which was accessed through a trap door hidden under a rug on the main floor.
- The Michigan group continued tactical training with the Militia which included firearms training and other “combat drills.”
- Improvised Explosive Device (IED).
- In one July FTX, the combined groups attempted to construct an IED using black powder, balloons, a fuse, and BBs for shrapnel. The construction was faulty, though, and the device did not denotate as planned.
- Over the weekend of Sept. 12-13 several group members attended an FTX at a member’s property. One individual brought what he referred to as his “chemistry set,” which included components for an IED. The individual constructed an IED by removing the cap from a commercial firework, adding additional black powder, and wrapping the device in pennies and electrical tape as shrapnel. During the exercise, the group set the device in a clearing surrounded by human silhouette targets, and the device was detonated in order to test its anti-personnel effectiveness.
- When discussing possible plans, one of the Michigan group suggested that “one person go to [the governor’s] house. Knock on the door and when she answers it just cap her . . . at this point. F#@k it.” He added, “I mean . . . fuck, catch her walking into the building and act like a passers-by and fixing dome her then yourself whoever does it.” (sic) In early August, the leader of the Michigan group asked the group about kidnapping the governor.
- Afterward it was determined that surveillance needed to be completed. But first they still needed to find the vacation house. “In an effort to locate the Governor’s vacation home, one of the members named specific cities where it could be located and told the group to check these cities.” In a follow-up private chat, the name of the lake in northern Michigan where the vacation home is located was revealed by one member who also said he was looking for an escape route using a boat on the lake.
The group conducted surveillance and additional research of the vacation home in preparation for the attack.
- One of the members advised he had recently spent almost $4,000 on a helmet and night-vision goggles.
- On Aug. 29, three individuals of the Michigan group conducted surveillance of the vacation home.
- Pictures of the house were obtained from online research.
- After finding the house, the group took photographs and slow-motion video from their vehicle as they drove by it and discussed conducting additional surveillance from the water at a later date.
- Another individual looked up the locations of the local police department and Michigan State Police in the area and used them to estimate how long it would take law enforcement to respond to an incident at the vacation home.
- The photos taken were shared in the encrypted chat group.
- One member offered to paint his personal boat black to support the surveillance of the vacation home from the lake where the vacation home is situated.
- In one text message conversation, a screenshot of a map of the area revealed a bridge in the vicinity. Using symbols and emoticons, one member replied, “If the 🌉🌉 go 👇👇, it also ❌ the 🌊🌊,” suggesting demolition of the bridge would hinder a police response.
- During the late night of Sept. 12 and early morning of Sept. 13, the group drove to the vicinity of the vacation home in three separate vehicles. Perhaps recognizing the increased risk in their activity, the participants in this activity were armed.
- The Michigan group leader discussed detonating explosive devices to divert police from the area of the vacation home.
- The group stopped at the M-31 highway bridge on the way, where they inspected the underside of the bridge for places to seat an explosive charge, and took a picture of the bridge’s support structure.
- In one vehicle, a digital dash camera was mounted and was activated to record the surveillance for later reference.
- The third vehicle in the group was tasked to drive around and make sure no one was following or surveilling the group (counter-surveillance).
- At the conclusion of the surveillance, one individual stated, “We’re doin’ all the reconnaissance work, so it should go smooth.”
Throughout the planning and preparation, the Michigan group were actively concerned about their operational security (OPSEC) and took measures to protect themselves.
- The groups often communicated via encrypted online platforms. They also used a private Facebook page for some of their early planning.
- They used “code words” or phrases to describe their plans in a self-proclaimed effort to avoid law-enforcement detection. In one conversation related to possible attack methods, the leader of the Michigan group discussed whether the group just needed to “party it out, make a cake and send it,” in what was believed to be a coded reference to sending a bomb to the governor. In another conversation, the “baker” was a reference to an explosives manufacturer.
- All attendees at meetings were required to bring personal documents to confirm their identities. And while they did change communications platforms from time to time, they never searched for wires on individuals, which was worn by the CHS.
In the final days leading up to the arrest, the leader of the Michigan group confirmed with members that they were the group that was going to kidnap Governor Whitmer. They also discussed limiting their public interaction with the Militia, especially if they were to have any chance of success in their plans. The Michigan group did note that it would cost approximately $4,000 to procure the explosives needed to blow up the bridge leading to the vacation home and they discussed purchasing a taser to use, presumably on the governor. In addition, they had planned to conduct a final training exercise in late October.
Much like with the Tampa terrorism arrest, the last three phases of the HEAC were not fully realized because the group was arrested; however, these areas are still worth reviewing as if they were to have continued their timeline. With regards to the completion of Phase 4, the group would likely look to incorporate some type of rehearsals into their FTX that were based on executing the plan. However, while much is known about motivations, ideology, and surveillance, there was little information about how the specific attack would be carried out, and especially in relation to “actions on the objective.” These are actions the group would take to review what would happen during the physical attack. Based on what is known, it appears that a big gap in their planning was a lack of awareness about the inside of the vacation home.
Phase 5 – Pre-Attack Operations. This phase is focused on ensuring supplies and equipment are ready for the attack. In this particular operation and based on known information in the criminal complaint the Michigan group would use this time to validate the attack plans and complete preparations. They would need to ensure the boat is serviced and ready for the escape; they would need to ensure the hideaway location is stocked with enough supplies to hold the governor hostage through “the trial”; they would want to make sure that all weapons and ammunition were on hand and the weapons were in fact operational; and they would want to ensure that the explosives needed for the bridge were ready.
It is also during this time that the group would begin to isolate and focus on the upcoming task at hand. This is a time when loved ones or those close to the individuals may begin to notice some suspicious indicators or withdrawal to come to peace with what is about to come. It was noted above that the Michigan group did want to pull away from the Militia near the end likely out of fear that they could be targeted by association by law enforcement.
Phase 6 – Attack and Phase 7 – Escape. The attack obviously represents the culmination of all the planning and preparation and will ultimately define the hostile actor moving forward. And in this particular case, the escape will be the culmination of their plan with the trial and expected execution of the governor. As noted above, while there were a lot of details about the preparation, there were little details of what would occur once the attack was initiated. It is likely that the group was very confident in their tactical skills that they worked on during the various FTXs that they felt they would just know what to do, but it is just as likely this type of planning may have initial success in approaching the target location yet may experience a setback in realizing their goal either through miscommunication or lack of awareness about the location.
Overall, this particular threat and the arrest highlighted several important considerations for organizations to understand as they look at potential risk to the organization:
- Suspicious Indicators. There is a difference between being angry about the direction of a particular institution and taking action. These individuals were clearly motivated and surrounded by like-minded individuals. And as such, they also revealed several important and suspicious behaviors that would could have highlighted their activity to others, including co-workers. This could be something that is worth discussing with employees in training situations with the 2019 version of the Homegrown Violent Extremist Mobilization Indicators as a guide.
- OPSEC. The group was aware enough to consider OPSEC, but they did not carry it through and were too trusting of those individuals within the group. Even so, the group did work to minimize their profiles and even went as far as trying to disassociate themselves with the higher-profile Militia group near the end of their planning process. The use of encrypted channels, private Facebook pages, and providing documentation are just some of the ways that threat actors have available to them as they carry out their activities.
- Lessons Learned. While this attack, and others like it, proved to be unsuccessful, as terrorism expert Bridget Johnson noted in a LinkedIn post, “Domestic violent extremists that come afterward may study and learn from the militia’s missteps in this case so that they don’t blow it when crafting their own attacks. Terrorists learn from each other’s successes and failures, especially when there’s ideological and sometimes physical tightness between these militia and anti-gov extremist groups.” So just as organizations can learn from these operations and refine training and security plans, threat actors can do likewise and tighten up areas, such as OPSEC or planning.
