The United States is in a politically tense time – an overheated campaign season underpinned by a pandemic and summer of protests – while domestic extremism has been growing with recruitment, incitement, threats and attacks snowballing into what former DHS Assistant Secretary Elizabeth Neumann called a potential “doorstep of another 9/11” and what FBI Director Chris Wray called “the biggest challenge to us here in the homeland.”
Election security is not just about hardening systems to protect from cyber attacks and battling disinformation campaigns. Whether committing violence to further an ideology or taking advantage of instability to inflict harm, the possibility of a physical attack that could target voters, polling places, campaigns, or election offices looms over the 2020 vote. This could be premeditated or spontaneous violence, could involve a lone attacker or coordinated cell, could spring from established or fledgling movements, could first unfold online in the form of social media threats or discussions in like-minded forums, and could target entities based on demographics and perceived ideology or indiscriminately attack.
A Sept. 29 intelligence note from the FBI Dallas Field Office to law enforcement warned that Boogaloo, anti-government, and militia extremists have been increasing in activity and would likely expand in the region “with the presidential elections acting as a potential flashpoint.” The assessment was based on social media posts, recent history of incidents, more opportunities for violent action, and increasing influence of movements that at times overlap (the shooter in the June 2019 attack on the Earle Cabell Federal Building and Courthouse in Dallas, for example, left behind a manifesto reflecting both Boogaloo and incel credos). Some violent extremists have been wearing ballistic armor, carrying semi-automatic rifles, and using military-grade optics and laser sights, and also have been apprehended with items such as fireworks and gas masks.
The ACE Electoral Knowledge Network stresses that “security is a factor to be considered by electoral administrators in all environments, even those where risks of election-related physical violence are low.” Risk assessments should take into account the political environment including “acceptance of potentially adverse election results” and “the existence and strengths of any active groups or individuals who may wish to disrupt or subvert election processes,” the conflict environment including the level of distrust and intensity of political conflict, the administrative and information environments including the integrity of election mechanisms, and the security force environment, including “the existence of private militias or official armed forces under the partisan control or influence of political participants.”
It’s critically important that an assessment of potential threats is NOT interpreted or construed as an attempt to keep anyone from voting. Rather, an eyes-wide-open security posture can help keep every voter safer and embolden them to call for protection as needed at the polls. An alert voter who chooses to cast a ballot in person and is standing in line may see a threat approaching before election officials watching over the vote inside a polling station. Citizens who are attuned to threats can also spot suspicious behavior in the planning stages and help stop an attack before it starts.
Potential Motives
Attackers’ justifications behind plots or attacks on voters, campaigns, or election facilities may include:
- An attacker acting in support of or opposition to a candidate or political party. There may be a social media history, including potential threats, that could precede this type of attack.
- Using the symbolism of an election and soft targets to act out a political-related grievance, such as frustration with social media bans or a belief that one’s personal or property rights are being impinged upon by government or stakeholders in some way.
- Using the situation and symbolism of the election to further an accelerationist ideology. Accelerationists, usually linked to a co-ideology such as white supremacism, Islamist extremism, or the Boogaloo, seek to accelerate societal downfall by sowing violent chaos – so their core ideology can rise victorious from the ashes.
- Opposition to perceived saturation or influence of a particular voting group – either targeting a certain demographic of voter or a general location believed to harbor a number of the targeted group (such as in last year’s attack on the El Paso Walmart). A meme circulated by the neo-Nazi National Socialist Order (formerly Atomwaffen Division) after the Aug. 25 killings at Kenosha, Wis., protests used an image of accused shooter Kyle Rittenhouse and the words “mow down commie scum,” along with a recruitment contact. They or another group could believe that a polling place could have a sizable share of voters perceived to fall into a category they espouse hatred toward.
- Opposition to the practice of democracy, the country’s electoral system, or how an attacker believes election officials are running the vote in a certain area.
- An extremist belief that a certain class of people – gender, religion, race or ethnicity, sexual orientation, etc. – should not be participating in the democratic system or that particular election. Before the 2016 election, for example, ISIS released a seven-page voting guide vowing to “come to slaughter you and smash your ballot boxes” and declaring that a Muslim voter is one “whose blood is obligatory to spill unless he repents.”
- Belief that one is compelled to show force or commit a violent act because of a conspiracy theory. Political conspiracy theories aren’t always confined to tweetstorms but have fed acts of violence, including the “Pizzagate” gunman who fired shots inside a D.C. restaurant in 2016 and 2018 mail bomber Cesar Sayoc.
- Voter intimidation that escalates into violence. An attacker may come to the polls with the intent of “patrolling” or harassing voters in line, or accessing the polling place though not a designated poll watcher per state law. Unchecked, conflict can turn into clashes or unprovoked attacks that threaten the safety and security of voters.
A person driven by underlying motivations unrelated to the election or politics may also target voter queues as an easily accessible soft target, depending on security and the location of a polling place (i.e., a strip mall or community center as opposed to a government center or arena with a degree of protection against vehicle attacks).
Potential Tactics
The method(s) used by attacker(s) will be determined by the target, the desired level of casualties, potential symbolism in the method, the skill of perpetrator, and access to weapons.
- Guns: The U.S. Secret Service National Threat Assessment Center review of 27 mass attacks on public spaces (in which three or more people were harmed) in 2018 found that 24 of these attackers used firearms. In 2019, guns were used in 24 of 34 attacks reviewed. State laws regulate whether someone can bring a gun to vote, whether concealed or open carry.
- Complex coordinated attack: An individual or group could carry out more than one attack in different locations within a short time period possibly utilizing more than one type of weapon, such as the 2008 Lashkar-e-Taiba attacks in Mumbai or the 2015 ISIS attacks in Paris.
- Vehicle attack: Cars were the second weapon of choice in the 2018 Secret Service attack assessment and third in the 2019 review. Terror groups promote vehicle attacks as weapons anyone can obtain with no training required that can inflict mass casualties depending on the circumstances. Depending on the polling station location and perimeter security, lines of voters could be vulnerable to this type of attack.
- Simple weapons: Could range from knives to Molotov cocktails – weapons that are easy to obtain or construct and require no training. Six of the 34 attacks studied by USSS last year involved a knife, while three involved blunt objects used as weapons.
- Explosives: The potential for explosive devices either left at the scene for delayed detonation or carried on the body of the attacker underscores how critical it is for voters to watch for and report suspicious items such as abandoned bags or boxes. The Secret Service said “several” mass attacks last year involved attackers bringing multiple firearms or pipe bombs to the scene that ultimately were not used.
- Biothreat: More sophisticated chemical, biological, or radiological attacks are always a threat where large crowds gather. This year, it’s especially important for voters to remain masked and maintain social distancing under COVID-19 protection guidelines. An ISIS “lockdown special” magazine published by supporters of the terror group this spring told followers to “spread COVID virus among as many Kuffar [disbelievers] as possible to take them down easily and with less effort.” White supremacist propaganda has advocated spreading COVID “Holocough” to Jews, and a Missouri white supremacist who plotted in March to attack a hospital said that if he contracted COVID-19 he would conduct a “lone wolf attack” and “try to take out as many as I can during that time,” according to the FBI.
Potential Indicators
Someone who is in pre-attack mode – considering an attack, actively planning an attack, moving to commit an attack – usually gives off indicators that may be observed by those close to the assailant or those who happen to cross their path (i.e. a retail clerk who sold them weapons or explosive components, family members who hear threatening statements, or a witness who sees an individual exhibiting strange behavior). These are some behaviors that could potentially signal an election-specific threat of violence:
- Social media threats advocating violence toward a particular group of voters, polling place, government body overseeing elections, etc. Threats made online can also transfer when those threats turn into action if, for instance, an easier physical target becomes apparent to the person planning the attack or instead of targeting a political candidate the attacker goes after supporters of the politician instead.
- Expression of intent to commit voter intimidation, discussion of what one can get away with in a certain jurisdiction, etc. This can occur in person, within the context of private chats, on message boards, etc.
- A fervently expressed irrational belief that a certain group of voters or a certain polling place, board of elections, etc., will be engaged in an election behavior that would need to be “stopped” by a vigilante or militia. The “Pizzagate” shooter was convinced per conspiracy theory that he was going to stop a sex trafficking ring in the nonexistent basement of Comet Ping Pong.
- Taking weapons to act as a self-appointed poll watcher or monitor. The FBI Dallas memo noted that not only were Boogaloo adherents more active on social media but had been conducting increased “patrolling” at lawful racial-justice protests. States have individual rules regarding authorized partisan poll watchers, who are not allowed to interfere with the electoral process or engage in voter intimidation.
- Purchases in the run-up to Election Day of weapons or ingredients that can be used to construct explosive devices. Retailers should familiarize themselves with the materials offered by the DHS Cybersecurity and Infrastructure Security Agency’s Bomb-Making Materials Awareness Program (BMAP), which helps educate owners and employees on suspicious purchasing behaviors of common items that can be used to make IEDs.
Do not assume that threats won’t turn into an attack if the person making the threats lacks a history of violent offenses. The U.S. Secret Service review of 2019 mass attacks on public spaces found that 49 percent of the attackers had no criminal history, though two-thirds had a history of threatening or concerning communications and two-thirds “exhibited behaviors that elicited concern in other people.” Forty-six percent of attackers had a history of domestic violence, 46 percent had experienced mental health symptoms prior to their attacks, and 24 percent held ideological beliefs “including anti-Semitism, white supremacy, Nazism, xenophobia, antifascism, jihadism, and anti-immigration.” Nineteen percent had become so fixated on a belief, person, or activity that it negatively impacted aspects of their lives, and sometimes others in the person’s orbit knew about this.
Voting Safety
Election security is infrastructure security. The safety and security of every voter is imperative to our system of free and fair elections. By remaining aware and alert at a polling place, and reporting any people, vehicles or items that are amiss, you are a valuable force multiplier.
- If you see something, say something. This could be an individual who is acting suspiciously, brandishing a weapon in a threatening manner, making threats toward voters or polling places, or exhibiting other potential attack indicators. Report bags or parcels left in the area and vehicles entering areas where it is prohibited.
- Don’t wait for clashes or voter intimidation to escalate before reporting it. Voter intimidation can include verbal and physical threats, brandishing firearms, breaking into voting lines or blocking the entrance to a polling place, and harassing voters including by following them or their vehicles.
- Contact your local or state elections office to inquire about security at a polling place of concern. Election officials try to find a balance between making voting safe and secure while not intimidating voters with a heavy security presence. If you have concerns, make them known before Election Day.
If potential unrest or the pandemic threat make you nervous about voting in person, take advantage of voting by mail, submitting your ballot at a designated drop-off location, or early in-person voting. Voters can also choose to cast a ballot in person when polling stations are generally less crowded on Election Day: polling places are usually busiest in the early morning before people go to work and in the evening after they get off work, and during the lunch break. Always maintain situational awareness – look up when you’re in line and be aware of anomalies such as people hovering around the voting line but not getting in it, or individuals observing the polling place from a distance on foot or in a vehicle.
How to Report Threats
- If there is a threat of imminent violence, call 911. Don’t go vote without your phone on hand.
- Report to local police or on-site election officials any instances of a threatening or suspicious person leaving the site; there is the potential that the person could return or go to another polling site.
- Report non-emergency threats of potential terrorist activity, including online threats, to the FBI either by calling your local field office or submitting a tip online.
- Report voter intimidation to election officials on site or contact state or local election offices.
- Document suspicious or threatening activity when it is safe to do so.
Former DHS Assistant Secretary for Infrastructure Protection Caitlin Durkovich and former DHS Deputy Assistant Secretary for Counterterrorism Policy Thomas Warrick warned in the Atlantic Council’s Future of DHS Project report that “terrorist threats to the United States have changed from what they were immediately after 9/11 – and have further evolved from what they were as recently as 2016.” The physical threat to voters and election infrastructure could come from those driven by rising domestic extremism, those inspired by international terror groups, or those simply driven to take advantage of soft targets to commit violence as we saw in the 2017 Las Vegas mass shooting. Situational awareness from voters – whether noticing an online threat in the weeks before an election or suspicious activity near a polling place – can help Americans be safer while exercising a critical responsibility.
CISA Updates Soft-Target Resource Guide to Reflect Recent Attacks and Threats
