In late December, the New York Police Department sent a packet of material to the U.S. Capitol Police and the FBI. It was full of what's known as raw intelligence — bits and pieces of information that turned up by scraping various social media sites. It all indicated that there would likely be violence when lawmakers certified the presidential election on Jan. 6.
The NYPD sent the information to Washington under the assumption it would be folded into a formal intelligence bulletin by the FBI and the Department of Homeland Security. The FBI's version is known as a joint intelligence bulletin. The DHS produces a threat assessment. These reports are typically written as a matter of course ahead of high-profile events. Local law enforcement officials see them as actionable intelligence — an early warning system to help them prepare for incoming threats.
And yet, for last week's deadly attack on the Capitol, an event the president himself had promised would be "wild," no formal report was ever released.
A spokesperson from DHS' Office of Intelligence and Analysis confirmed to NPR that the agency didn't produce any threat assessment about the possibility of violence on Jan. 6. The FBI confirmed it didn't produce one either. Instead, DHS provided a report about the "heightened threat environment during the 2020-2021 election season, including the extent to which the political transition and political polarization are contributing to the mobilization of individuals to commit violence," the DHS spokesperson said.
"I was surprised that we didn't receive any information" about Jan. 6, Mike Sena, president of the National Fusion Center Association, told NPR. "We received a number of reports, but they were all regarding events all around the election cycle, you know, information sharing."
The federal government created fusion centers after the Sept. 11 attacks to improve communication and intelligence sharing among local and federal law enforcement officials. There are 80 of them across the U.S., and one of their key responsibilities is to disseminate these kinds of intelligence bulletins.
The bulletins are considered a finished product — a synthesis of validated and analyzed intelligence that helps local law enforcement make informed decisions.
Some FBI officials have said that the bureau and DHS didn't produce a bulletin for Jan. 6 out of concern that doing so might run afoul of First Amendment free speech protections that allow people to protest and assemble peacefully.
But three law enforcement officials told NPR that this didn't stop DHS and the FBI from issuing intelligence bulletins ahead of mostly peaceful demonstrations in Portland, Ore., after the killing of George Floyd last May, before Black Lives Matter marches in Washington in early June or in anticipation of an annual convention of the Islamic Society of North America.
Given all the Sturm und Drang ahead of the Jan. 6 joint session of Congress to count the electoral votes and given all the threats on social media weeks ahead of a pro-Trump rally that morning, it struck Sena and other local law enforcement officials who spoke to NPR as strange that there wasn't a DHS-FBI report on what to expect. Threatening and planning violence aren't protected First Amendment speech.
The FBI revealed this week that its field office in Norfolk, Va., had indeed uncovered intelligence that might have helped the U.S. Capitol Police decide how to deploy its forces.
One law enforcement official confirmed to NPR that Norfolk FBI officials had found specific threats against members of Congress, an exchange of maps of the tunnel system under the Capitol complex, and gathering places in Kentucky, Pennsylvania and South Carolina where extremists were meeting before convoying up to Washington. (The Washington Post first reported the existence of the Norfolk FBI warning.)
The problem was that the threats they uncovered hadn't gone through any rigorous analysis process. "They seem to have only had a couple or single sourcing," said R.P. Eddy, a former U.S. counterterrorism official and diplomat who now runs Ergo, a private intelligence firm. "So, if you were a consumer of that intelligence and that's all you saw ... you'd say, 'Oh, it's just one source. You know, I'm not so sure I'm going to invest $2 million into extra overtime and get a bunch of new gear for my troops."
NPR spoke with three FBI special agents in charge around the country and four current and former DHS officials who all agreed that Jan. 6 was a fast-moving event that was hard to anticipate. But they also said a specific threat assessment from the FBI and DHS in the weeks before might well have persuaded Capitol Police and others to beef up security.
Eddy said if there wasn't an intelligence bulletin ahead of the pro-Trump rally, that was a problem. "If the reality is that ... neither FBI nor DHS did a threat assessment for Jan. 6, that was blinking red. If that's indeed the fact, then that's absolutely a failure of intelligence ... and weird," he said.
The head of the U.S. Capitol Police told reporters last week that he had no intelligence that suggested there would be a storming of the Capitol. DHS and FBI officials told NPR that what he hadn't seen was a specific threat assessment report or intelligence bulletin from DHS and the FBI. A raw intelligence report a day before an event just isn't the same thing.
"The invisible obvious"
Last week, Steven D'Antuono, the assistant director in charge of the FBI's Washington Field Office, told reporters that the FBI was working closely with its partners and that there was no indication that Jan. 6's events would turn so horribly violent. D'Antuono reversed himself this week after it became public that the Norfolk field office had indeed provided intelligence about a possible assault on the Capitol the day before the rally was set to start.
Local law enforcement partners who spoke to NPR said they felt blindsided by events because they had only a general intelligence report about unrest during the election season with which to work. Typically, raw intelligence, which is what the NYPD and Norfolk FBI provided, needs to be vetted and analyzed before it is actionable. NPR reached out to U.S. Capitol Police asking if a federal intelligence brief about Jan. 6 would have changed its planning and has not heard back.
The Office of Intelligence and Analysis at DHS is responsible for producing these threat assessments, and it often works in concert with the FBI. The I&A Office, as it is known, has had staffing and operations problems for months, ever since the former FBI agent who ran the division, Brian Murphy, was removed from the job in August after media reports that he was compiling dossiers on journalists and protesters in Portland. Among other things, the dossiers made note of which journalists were publishing leaked documents.
The acting secretary of homeland security at the time, Chad Wolf, ordered the intelligence office to stop collecting the information on journalists and said there would be an investigation into the matter. A short time later, Murphy filed a whistleblower complaint in which he alleged that he had been told to stop reporting on Russian threats to the U.S. election in his threat assessments. He said he was told it would make President Trump look bad. His whistleblower case is still pending.
Murphy was replaced in the fall by a longtime member of the department's general counsel's office. He was a lawyer and didn't have an analysis background. What that meant, officials said, was that one of the department's key missions — disseminating actionable threat information out to local law enforcement — was hobbled. This week, acting Secretary Wolf announced his own departure.
Against that backdrop, instead of a specific intelligence report focused on Jan. 6, the I&A Office produced something more general about demonstrations, according to a DHS spokesperson.
The National Fusion Center Association's Sena remembers seeing that report, and other local law enforcement officials contacted by NPR said they recall only that back in December there was a bulletin that focused on domestic extremists who might mobilize and create violence "in the coming months." It didn't focus on the Jan. 6 joint session of Congress, and it didn't indicate that Capitol Hill could be a target.
Some security specialists said they didn't think an intelligence report would have made much of a difference. "It was perfectly obvious, if you read the newspaper, that there was going to be a big rally, that the president was talking about ... be 'wild,' and that the focus was going to be the Capitol, where they were having a certification vote," said former Secretary of Homeland Security Michael Chertoff. "It didn't take rocket science to see if there was a realistic foreseeable risk to the Capitol and you would enhance the security."
The threat was so out in the open, Chertoff said, you didn't need the threat analysis to know what was going to happen.
A specific warning finally came from federal authorities the day before the riot at the Capitol. After the FBI field office in Virginia issued that explicit internal warning quoting an online threat that cited specific violence and an assault on the Capitol, officials convened a conference call with local law enforcement to discuss it. But by then it was too late. Less than 24 hours later, a mob would descend on the Capitol.
Eddy says in hindsight he believes the problem was something he calls "the invisible obvious" — things that sit right in front of us that we don't notice. "The reason that they are invisible to us ... gets to our biases," he said. "The situation here, I'm unfortunately quite sure we're going to find, that it was very hard for these decision-makers and these analysts to realize that people who look just like them could want to commit this kind of unconstitutional violence and could literally try to and want to kill them."
This was supposed to be a pro-Trump rally, until it wasn't.
"Foe look differently, foe act differently, say different things," Eddy said. "They don't have the same bumper stickers. They don't have the same yellow flag of 'Don't Tread on Me.' It was hard for them to see that the law-and-order hierarchy in which they were born and bred ... where they got their paycheck, was inciting the mob that was going to commit the violence that was indeed the foe, not the friend."
This Sunday, the FBI formally warned local law enforcement that armed protests were being planned for all 50 statehouses and the U.S. Capitol. The warning also said an unidentified group was calling on others to help it "storm" state, local and federal courthouses should Trump be removed as president before Inauguration Day. In Washington, the secretary of the Army announced that as many as 20,000 National Guard troops are expected to be deployed with guns.
RACHEL MARTIN, HOST:
Before you can prevent a threat, you got to know it's out there. And that apparently was not the case for U.S. security forces ahead of the January 6 attack on the U.S. Capitol. Before most major protests or rallies, the Department of Homeland Security and the FBI usually produce a formal intelligence report explaining the possible threats, and then they send that report to local law enforcement to help them plan. DHS and the FBI did one of these threat assessments ahead of the demonstrations in Portland, Ore., after the killing of George Floyd last spring. They also did one before Black Lives Matter marches in Washington in June. But there was no threat assessment done ahead of the deadly attack on the U.S. Capitol.
NPR's Dina Temple-Raston of our investigations team has been looking into this. Good morning, Dina.
DINA TEMPLE-RASTON, BYLINE: Good morning.
MARTIN: I mean, all you had to do, Dina, was look at social media for the weeks leading up to the January 6 rally to know things could potentially get really bad at the Capitol. You didn't even need a formal threat assessment to tell you that. Did law enforcement just not pick up on that?
TEMPLE-RASTON: No, that was part of the raw intelligence that they were putting together. Like, the New York Police Department scraped social media, and they sent what they found to Washington. There was sort of unverified threats, that sort of thing. And there was more raw intelligence that came before that - just a day - or after that. Just a day before the pro-Trump rally, the Norfolk field office in the FBI confirmed that they had found specific threats against members of Congress, an exchange of maps of the tunnel system under the Capitol complex. And there were people online talking about gathering in Kentucky and Pennsylvania and South Carolina to meet up before convoying up to Washington. And this Norfolk report was first reported in The Washington Post a couple of days ago. So they were gathering this together.
MARTIN: Then what happened to it? Where did that raw intelligence go?
TEMPLE-RASTON: Well, that's the problem. It never made it much past that raw intelligence stage. So basically, they might have picked up a thread or had a human source tell them something or that - or say that they saw something. But it didn't go to the next step where it's validated and analyzed and put into a larger picture, put into context. So when the FBI does that, they put it in a report called an intelligence bulletin. When DHS does something like that, they call it a threat assessment report. And then sometimes the two of them put out a report together. And typically, then they would send that, that finished product, out to local law enforcement.
MARTIN: So we're going to talk about why that didn't happen. But first, can you just explain, why is that assessment so much more valuable than straight raw intel? What's the difference?
TEMPLE-RASTON: Well, local law enforcement sees threat assessments as actionable intelligence. I mean, the bulletins are considered finished. Right? They're a synthesis of validated and analyzed intelligence, and that helps local law enforcement make informed decisions. So we talked to the former head of DHS, Michael Chertoff. And getting to your point, he said that in this case, that the threat was so out in the open, the threat assessment was almost beside the point.
MICHAEL CHERTOFF: It was perfectly obvious if you read the newspaper that there was going to be a big rally, that the president was talking about it being - you know, being wild and that the focus was going to be the Capitol, where they were having a certification vote. So they - it didn't take rocket science to see that there was a realistic, foreseeable risk to the Capitol and you would enhance the security.
MARTIN: I mean, but maybe they need the threat assessment to put the process in place to get troops on the ground or security forces on the ground. I mean, DHS and the FBI have issued intelligence bulletins for, as we mentioned, Black Lives Matter protests. What was different this time around? Why didn't they treat this the same way?
TEMPLE-RASTON: Our reporting found that one of the reasons that they didn't treat it the same way may have been bias. We talked to someone named R.P. Eddy, and he used to be in the National Security Council. He's done a lot of counterterrorism work. He worked with the NYPD and the LAPD, and now he has his own intelligence consultancy. And he thinks that something called the invisible obvious was at work. And basically, that's things that sit right in front of us that we don't notice.
R P EDDY: It was very hard for these decision-makers and these analysts to realize that people who look just like them could want to commit this kind of unconstitutional violence and could literally try to and want to kill them.
TEMPLE-RASTON: So in other words, this was supposed to be a pro-Trump rally, and then it wasn't. And it was hard for these law-and-order people to see that this mob, these people who were so pro-Trump, who had bumper stickers just like theirs on the back of their cars, were going to commit violence. And by the time they figured that out, it was too late.
MARTIN: And then it really begs the question, did they not see it because they didn't want to see it, I mean - or they couldn't see it? Were their blind spots?
TEMPLE-RASTON: Exactly. And that - in fact, a lot of these people that they were seeing - right? - I mean, they were wearing pro-Trump T-shirts. They were there to support the president. When you think of those kinds of people, you don't think about those being the people that you might have to worry will resort to violence. And that was what went wrong. It wasn't a - you know, something nefarious. It was just when you looked at it without the analysis, it seemed like this was just going to be another rally. And then it wasn't.
MARTIN: NPR's Dina Temple-Raston of our investigations team.
TEMPLE-RASTON: You're welcome. Transcript provided by NPR, Copyright NPR.