UNCLASSIFIED//FOR OFFICIAL USE ONLY

26 June 2015

(U//FOUO) Holiday Celebrations Remain Attractive Targets, Vigilance

Encouraged
(U) Scope
(U//FOUO) This Joint Intelligence Bulletin (JIB) is intended to remind law enforcement, military,
security personnel, and US citizens residing overseas to remain vigilant and aware of upcoming
public and private events this summer in light of the heightened threat of attacks by the Islamic
State of Iraq and the Levant (ISIL) and its supporters. The FBI, DHS, and NCTC advise law
enforcement and security personnel to coordinate operational plans with partner agencies for
events that commemorate the July 4th holiday or are likely to be perceived as defaming the
Islamic prophet, Muhammad, as these events are likely to result in threats or plans to conduct
violent extremist attacks. Recent arrests also highlight the need for law enforcement, military,
and security personnel to be alert in matters of personal safety and aware of the potential for
unexpected attackseven with subjects who previously have not displayed intentions to
conduct violence. This JIB is intended to assist federal, state, local, tribal, and territorial
counterterrorism and law enforcement officials and private sector security partners in
effectively deterring, preventing, preempting, or responding to terrorist attacks against the
United States.

IA-0223-15
(U) Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO). It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to be controlled,
stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know
without prior approval of an authorized DHS official. State and local homeland security officials may share this document with authorized critical infrastructure and key resource personnel and private sector security officials without
further approval from DHS.
(U) This product contains US person information that has been deemed necessary for the intended recipient to understand, assess, or act on the information provided. It has been highlighted in this document with the label USPER
and should be handled in accordance with the recipient's intelligence oversight and/or information handling procedures.

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLY

(U//FOUO) Holiday Celebrations Remain Attractive Targets

(U//FOUO) The FBI, DHS, and NCTC remain concerned that upcoming July 4th celebrations,
such as parades or other large gatherings in the United States or overseas, could be targeted by
violent extremists, particularly those supporting ISIL. US-based ISIL supporters may be further
encouraged or inspired to act during this time, as it coincides with the Islamic holy month of
Ramadan, during which terrorist organizations, to include ISIL, often make announcements that
encourage and are likely to incite violence, and previously have conducted attacks overseas.
Furthermore, we assess ISIL will likely release English-and Arabic-language messaging over the
coming weeks to commemorate the one year anniversary of the declaration of the Caliphate.
To date, however, we have no information to suggest homegrown violent extremists (HVEs)
aim to conduct attacks in the United States related to this anniversary.*

(U//FOUO) In March 2015, a Syria-based US female urged followers to conduct

drive-by shootings in the Homeland on various military holidays, according to open
source reporting. The female encouraged followers to wake up and rent a big truck n
[sic] drive all over them. Kill them. We assess this statement is likely aspirational and
not indicative of a specific plot, but it highlights violent extremists interest in upcoming
holidays.

(U//FOUO) On 23 June 2015, ISIL spokesman Abu-Muhammad al-Adnani al-Shami

posted an Arabic language audio message on Twitter urging jihad during Ramadan and
claiming that jihad during Ramadan is greater than jihad during other months.
Furthermore, he called upon all Muslims to come to your caliphate. Last year, ISIL
announced the reestablishment of the Caliphate on the first day of Ramadan, 29 June
2014. In 2013, the group, then known as al-Qaida in Iraq, facilitated the escape of 500
prisonersmany of whom were members of the groupfrom Abu Ghraib during
Ramadan.

(U//FOUO) Messaging commemorating the Caliphate declaration will likely promote its
self-proclaimed military and governance successes over the past year, but could also
encourage HVEs to conduct attacks or travel overseas to support ISIL.

(U//FOUO) Upcoming Rallies Could Lead to Threats of Violence

(U//FOUO) The FBI, DHS, and NCTC assess that planned rallies this summer intending to
support individuals rights to draw the Islamic prophet, Muhammad, carry the risk of being
targeted by violent extremists. Past events of this nature have resulted in threats or overt acts
of violence against both artists and publishers. While we have no credible intelligence
concerning threats to known upcoming events, we urge security officials to be aware of
indicators of preoperational activity threatening events, participants, or American Muslims and
their places of worship.
(U//FOUO) The FBI and DHS define an HVE as a person of any citizenship who has lived or operated primarily in
the United States or its territories and who advocates, is engaged in, or is preparing to engage in ideologicallymotivated terrorist activities, including providing support to terrorism, in furtherance of political or social objectives
promoted by a foreign terrorist organization but who is acting independently of direction by a foreign terrorist
organization. HVEs are distinct from traditional domestic terrorists who engage in unlawful acts of violence or to
intimidate civilian populations or attempt to influence domestic policy without direction from or influence from a
foreign actor.
*

UNCLASSIFIED//FOR OFFICIAL USE ONLY

Page 2 of 6

UNCLASSIFIED//FOR OFFICIAL USE ONLY

(U//FOUO) On 28 May 2015, a Syria-based ISIL fighter issued a threat against a

Phoenix, Arizona, Freedom of Speech Rally, and posted the home address of the
events organizer on Twitter, reportedly resulting in threats against the organizer and
his family. The event was advertised as a draw Muhammad cartoon contest held outside
of a mosque that the perpetrators of an attack in Garland, TexasElton Simpson and
Nadir Soofiattended, and the participants had planned to draw pictures of the
prophet, Muhammad.

(U//FOUO) On 3 May 2015, Simpson and Soofi attacked a Muhammad Art Exhibit &
Contest in Garland, Texas. The two men exited their vehicle and shot at a security
guard, who suffered a leg wound. A Garland Police Department officer shot and killed
both men.

(U//FOUO) In January 2015, an attack likely approved by al-Qaida in the Arabian

Peninsula killed 12 persons at the offices of Charlie Hebdo, a satirical magazine in Paris,
France, that has on several occasions published depictions of the prophet, Muhammad.

(U//FOUO) Recent Arrests Highlight Continued Threat

(U//FOUO) Many recent arrests highlight HVEs continued interest in conducting attacks in the
Homeland and the threat that law enforcement officers could be unexpectedly attacked by
HVEs.* Many US-based violent extremists are empowered and may be mobilized to act through
rapidly developed online associations with terrorists overseas and other like-minded associates,
possibly providing law enforcement with limited warnings that these individuals plan to act.

(U) On 19 June 2015, North Carolina-based Justin Nolan SullivanUSPER was arrested for
allegedly attempting to provide material support to ISIL, receipt of a silencer in
interstate commerce with intent to commit a felony, and receipt and possession of an
unregistered silencer. Sullivan was allegedly planning to shoot and kill people before
possibly detonating a bomb at an unknown location sometime between 21 and 23 June
2015, according to a criminal complaint.

(U//FOUO) Separately, on 19 June 2015, Ohio-based Amir Said Abdul Raman Al-GhaziUSPER,
aka Robert C. McCollumUSPER, was arrested for allegedly attempting to provide material
support to ISIL. Al-Ghazi pledged his allegiance to ISIL leader Abu Bakr Al-Baghdadi and
made multiple online statements to incite others to engage in violence in the United States
or recruit others to join ISIL. Al-Ghazi also allegedly expressed his desire to commit
terrorist attacks in the United States and attempted to purchase an AK-47 assault rifle,
according to court documents.

(U//FOUO) For more information on recent incidents highlighting the threat of law enforcement officers being
unexpectedly attacked by HVEs, see the FBI, DHS, and NCTC JIB entitled (U//FOUO) Recent Incidents by US-Based
ISIL Supporters Underscore Threat to Law Enforcement, released 19 June 2015.
*

(U//FOUO) Events described in this section are taken from an affidavit in support of a criminal complaint and arrest
warrants. The charges contained in the complaint are mere allegations; as in any criminal case, the defendants are
presumed innocent until proven guilty in a court of law.

UNCLASSIFIED//FOR OFFICIAL USE ONLY

Page 3 of 6

UNCLASSIFIED//FOR OFFICIAL USE ONLY

(U//FOUO) In mid-June 2015 two New York-based individuals were arrested after they
exited their vehicle and ran toward a surveillance vehicle in an alleged attempt to attack
law enforcement. One of the perpetrators had been planning to conduct an attack in
ISILs name, according to the criminal complaint. Further, a third New York-based
associate attacked a SWAT operator with a knife after a SWAT team entered the
individuals residence to execute a search warrant, according to the criminal complaint.

(U) Outlook
(U//FOUO) The FBI, DHS, and NCTC remain concerned about the difficulty of detecting
violent extremists, especially lone offenders, given the individualized nature of radicalization to
violence.* Further, Syria-based ISIL members easy access to aspirational violent extremists
through social media, combined with ISILs aggressive push for lone offender attacks in the
West, raises our concern that attacks by US-based ISIL supporters could happen with little to
no warning. We continue to advise current and former US government employees, military
personnel, and law enforcement to actively review their social media accounts for information
that could attract violent extremists attention and routinely exercise operational security in
their interactions online. We advise individuals and agencies to keep current on evolving privacy
restrictions on social media accounts and be aware of online mentions of their locations and
activities around the time of federal holidays and military events, which could be used by violent
extremists to target individuals and/or their families.

(U) Past Behaviors Associated with Pre-Operational Surveillance and Testing of

Security
(U//FOUO) Some observed activities that may be suspicious include constitutionally protected
activity, such as lawful weapons procurement and training. These activities should not be
reported absent articulable facts and circumstances that support the source agencys suspicion
that the observed behavior is not innocent, but rather reasonably indicative of criminal activity
associated with terrorism, including pre-operational activity. Observable behaviors that may
constitute indicators of attack planning include the following:

(U//FOUO) New or increased interest in critical infrastructure locations and landmarks

with no reasonable explanation, including obtaining aerial views of these locations;

(U//FOUO) Suspicious observation of or unusual questions to building maintenance or

security personnel about security procedures;

(U//FOUO) Engaging in overtly suspicious actions to provoke and observe responses by

security or law enforcement officers;

(U//FOUO) The FBI and DHS define a lone offender as an individual motivated by one or more violent extremist
ideologies who, operating alone, supports or engages in acts of violence in furtherance of that ideology or ideologies
that may involve influence from a larger terrorist organization or foreign actor.
*

(U//FOUO) For more information related to ISILs calls for attacks on military, law enforcement, and other
government personnel, see the FBI and DHS JIB entitled (U/FOUO) Islamic State of Iraq and the Levant and Online
Supporters Continue to Encourage Attacks Against Law Enforcement and Government Personnel, released 11
January 2015.

UNCLASSIFIED//FOR OFFICIAL USE ONLY

Page 4 of 6

UNCLASSIFIED//FOR OFFICIAL USE ONLY

(U//FOUO) Suspicious interest in entry points, peak days and hours of operation,
security personnel, surveillance assets (including cameras), and access controls such as
alarms, barriers, doors, gates, or locks;

(U//FOUO) Suspicious observation of security reaction drills or procedures; multiple

false alarms or fictitious emergency calls to same locations or similar venues;

(U//FOUO) Loitering, parking, or standing in the same area over multiple days with no
reasonable explanation;

(U//FOUO) Attempts to disguise appearance from visit to visit (change in hair color,
style of dress);

(U//FOUO) Garments not appropriate for weather/seasons;

(U//FOUO) Discreet use of still cameras and video recorders or note taking or use of
sketching materials that would raise suspicion in a reasonable person;

(U//FOUO) Attempted or unauthorized access to rooftops or other potentially

sensitive areas; and

(U//FOUO) Suspicious observations of or questions about facility air conditioning,

heating, and ventilation systems.

(U) Suggested Protective Measures Physical Security

(U//FOUO) Terrorists have demonstrated continued interest in attacking significant
infrastructure, economic, and symbolic targets. We encourage state and local law enforcement,
as well as security personnel, to conduct a risk assessment and consider the following protective
measures:

(U//FOUO) Report suspicious activity to proper authorities, to include missing or

stolen weapons;

(U//FOUO) Install secure locks and protection on all external and internal doors and
windows with quick-release capability from within for emergency and fire escape;

(U//FOUO) Train security personnel to watch for suspicious or unattended vehicles on

or near facilities; watch for repeated visitors or outsiders who have no apparent
business in non-public areas; watch for abandoned parcels, suitcases, backpacks, and
packages and any unusual activities;

(U//FOUO) Consider establishing safe areas within the facility for assembly and refuge
during crises;

(U//FOUO) Consider installing closed-circuit television systems, intruder detection

systems, and lighting to cover key areas;

(U//FOUO) Ensure that emergency communications equipment is present and

operable. Practice emergency communications plans and systems;

UNCLASSIFIED//FOR OFFICIAL USE ONLY

Page 5 of 6

UNCLASSIFIED//FOR OFFICIAL USE ONLY

(U//FOUO) Install vehicle barriers and designate vehicle marshaling locations to ensure
adequate standoff distances from vehicle-borne improvised explosive device;

(U//FOUO) Establish personnel screening checkpoints for access control into the
facility or event;

(U//FOUO) Conduct explosive detection canine team searches of vehicles requiring

entrance into a secure zone;

(U//FOUO) Ensure personnel receive training on improvised explosive device (IED) and
threat awareness, emergency communication, response actions, and reporting of
suspicious activity;

(U//FOUO) Remove objects (e.g., trash containers, crates, etc.) which could conceal
IEDs in accordance with stand-off distance guidelines;

(U//FOUO) Conduct additional sweeps of the facility or event area using roving patrols
and explosive detection canine teams; and

(U//FOUO) Be vigilant of secondary devices, specifically at anticipated evacuation

routes.
(U) Report Suspicious Activity

(U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and
emergency managers should follow established protocols; all other personnel should call 911 or
contact local law enforcement. Suspicious activity reports (SARs) will be forwarded to the appropriate fusion
center and FBI Joint Terrorism Task Force for further action. For more information on the Nationwide SAR
Initiative, visit http://nsi.ncirc.gov/resources.aspx.

(U) Administrative Note: Law Enforcement Response

(U//FOUO) Information contained in this intelligence bulletin is for official use only. No portion of this bulletin
should be released to the media, the general public, or over nonsecure Internet servers. Release of this material
could adversely affect or jeopardize investigative activities.
(U) For comments or questions related to the content or dissemination of this document, please contact the FBI
Counterterrorism Analysis Section by email at FBI_CTAS@ic.fbi.gov or the I&A Production Branch by e-mail at
IA.PM@hq.dhs.gov.

(U) Tracked by: HSEC-8.1, HSEC-8.2, HSEC-8.3, HSEC-8.6

UNCLASSIFIED//FOR OFFICIAL USE ONLY

Page 6 of 6

CLASSIFICATION:

UNCLASSIFIED//FOR OFFICIAL USE ONLY

Office of Intelligence and Analysis

Customer Feedback Form

Product Title: (U//FOUO) Holiday Celebrations Remain Attractive Targets, Vigilance Encouraged
1. Please select partner type:

Select One

and function: Select One

2. What is the highest level of intelligence information that you receive?

Select One

3. Please complete the following sentence: I focus most of my time on: Select One
4. Please rate your satisfaction with each of the following:
Very
Satisfied

Somewhat
Satisfied

Neither
Satisfied nor
Dissatisfied

Somewhat
Dissatisfied

Very
Dissatisfied

N/A

Products overall usefulness

Products relevance to
your mission
Products timeliness
Products responsiveness
to your intelligence needs
5. How do you plan to use this product in support of your mission?

(Check all that apply.)

Drive planning and preparedness efforts, training, and/or

emergency response operations
Observe, identify, and/or disrupt threats
Share with partners
Allocate resources (e.g. equipment and personnel)
Reprioritize organizational focus
Author or adjust policies and guidelines

Initiate a law enforcement investigation

Initiate your own regional-specific analysis
Initiate your own topic-specific analysis
Develop long-term homeland security strategies
Do not plan to use
Other:

6. To further understand your response to question #5, please provide specific details about situations in which you might
use this product.

7. What did this product not address that you anticipated it would?

8. To what extent do you agree with the following two statements?

Strongly
Agree

Agree

Neither Agree
nor Disagree

Disagree

Strongly
Disagree

N/A

This product will enable me to make better

decisions regarding this topic.
This product provided me with intelligence
information I did not find elsewhere.

9. How did you obtain this product? Select One

10. Would you be willing to participate in a follow-up conversation about your feedback?
To help us understand more about your organization so we can better tailor future products, please provide:
Name:
Position:
Organization:
State:
Contact Number:
Email:

Yes

Submit
Request

Privacy Act Statement

CLASSIFICATION:
Product Serial Number:

UNCLASSIFIED//FOR OFFICIAL USE ONLY

IA-0223-15

REV: 29 October 2014