As Election Day nears, the potential for unrest and other election-related issues remains. This document provides an overview of the current situation, highlighting the importance of continued interagency collaboration and operational coordination during this period.

The United States Intelligence Community has underscored, in multiple briefings and intelligence reports, the persistent efforts by foreign and domestic actors to exploit the current polarized political environment. The coming weeks present numerous opportunities for violent extremists to carry out attacks at mass gatherings, including polling places and protests. Several potential threats are outlined below.

Cyber Attacks

Election-related cyber-attacks may be conducted by domestic or foreign actors with varying objectives, such as sowing discord, favoring or discrediting candidates, undermining confidence in the electoral process, or using high-profile events as phishing opportunities.

Cybercriminals have adopted new tactics to entice individuals to open messages and attachments, including election-themed emails designed to arouse curiosity or align with political interests. Malware-laden attachments could enable successful breaches in the coming weeks, demanding heightened vigilance.

Cyber-attacks have successfully disrupted 911 call operations in the past. In light of this, fire departments are advised to maintain redundant communication capabilities. It is also critical for departments to stay aware of cybersecurity threats and ensure IT staff keep systems and networks updated with recommended patches and security measures.

Unrest

A contested election outcome could trigger protests or unrest. As seen in previous instances, violent opportunists may exploit perceived or actual grievances to engage in unlawful activities.

Fire and law enforcement agencies should prepare for large-scale protests, support peaceful demonstrations, and develop plans to address outbreaks of violence. These plans should account for the possibility of extended periods of unrest.

Shooting Incidents

Firearms have been involved in acts of violence during protests and related unrest. Conflicts between protesting groups have become more common, and there is a risk of lone-wolf attacks aimed at exploiting the symbolism of the election period or targeting large gatherings at polling places or protest sites.

Vehicle Ramming

Vehicle ramming are low-complexity attacks that are increasingly common. Public gatherings, protests, and celebrations in unprotected or open areas may present appealing targets for such attacks, warranting additional protective measures.

Terrorist Attacks

Although there is no precedent for a foreign terrorist organization (FTO) targeting U.S. election sites, recent incidents highlight potential risks. Attorney General Merrick Garland recently announced the foiling of an ISIS-linked Election Day plot, stating, “As charged, the Justice Department foiled the defendant’s plot to acquire semi-automatic weapons and commit a violent attack in the name of ISIS on U.S. soil on Election Day.”

The tactics, techniques, and procedures (TTPs) used by FTOs often target “soft” areas. The foiled plot illustrates that Election Day’s symbolism may be significant in terrorist planning and warrants heightened vigilance.

Chemical or Biological Agents and White Powder Mailings

While rare, chemical, and biological agents have been used by violent extremists, pepper spray—and the more concentrated bear spray—being used against law enforcement officers and protesters. Online posts have advocated for dispersing hazardous chemicals, including throwing bottles with urine and feces at law enforcement officers and protesters.

White powder mailings are another known tactic. Although most of these have proven harmless, every white powder incident should be treated seriously due to the potential presence of harmful agents.

Arson

In the unrest of 2020, numerous buildings, and vehicles, often affiliated with government or law enforcement, were targeted for arson. Some were even marked as targets by violent opportunists.

Interagency Collaboration and Operational Coordination

Effective preparedness and response to these scenarios will rely on close coordination across public safety agencies. Unified planning and training are essential to protect fire personnel and other first responders while ensuring an effective response to incidents or unrest.

Unified planning must also consider exposure to hazardous chemicals or pathogens and include practical countermeasures to mitigate contamination risks.

Given the evolving nature of unrest-related threats and the potential lack of clearly designated Hot, Warm, and Cold Zones, operational planning should incorporate law enforcement escorts for fire department resources in potentially impacted areas. Combined law enforcement and fire department task forces, as well as Rescue Task Forces (RTFs), may be established as needed to conduct fire suppression and emergency medical tasks within affected areas.

Response Considerations

The following considerations offer guidance to address potential gaps when responding to incidents or unrest involving large crowds. These points are intended to support existing policies by providing practical insights for managing unique challenges that may arise in the context of election-related events.

1. Maintain Situational Awareness

• Stay updated as the latest information becomes available.
• Keep track of local mass gatherings and public reactions, including large celebrations or protests.
• Monitor the community climate. Is it peaceful, or are tensions escalating? Identify any individuals or groups present at gatherings who may incite or perpetrate violence. Warning signs often precede violent outbreaks.
• Maintain open communication with law enforcement and fusion centers regarding threat information.
• Share relevant information with field commands and other personnel.
• Use social media with caution to gather information about current or planned unrest. Be aware that both foreign and domestic actors may sensationalize events or spread misinformation, particularly via social media. It may be necessary to verify reports before sharing or acting on them.
• Note: During periods of unrest, personnel should exercise caution on social media, avoiding posts that may reveal operational activities, as these may be monitored or exploited by violent actors.
• Be alert to cyber threats disguised as legitimate information sources.

2. Implement Unified Command

• Unified Command is the recommended framework for establishing comprehensive incident objectives and strategies. While command structures for large gatherings are typically law enforcement-centered, Unified Command promotes cohesive incident objectives and strategies that address the needs of both community members and responders.

3. Provide Unified Messaging and Establish a Crisis Communications Plan

• Communities expect timely and accurate information in crises. First responder agencies should be prepared to provide clear and prompt updates using effective communication channels.
• Consider developing a Joint Information System (JIS) or a Joint Information Center (JIC), which can operate virtually if needed, to coordinate unified messaging and manage a Crisis Communications Plan.
• Use maps or diagrams to identify densely populated areas where it may not be safe for fire personnel to operate.
• If Hot, Warm, and Cold Zones have been designated, ensure these boundaries are up-to-date and regularly reviewed. Fire department personnel should only enter Warm Zones when escorted by law enforcement.
• Take advantage of available aerial footage (e.g., from news media) to assess incident areas.

4. Ensure Decontamination Provisions Are in Place for Responders and Civilians.

• Prepare for the possibility of contaminated substances being thrown at first responders. If warranted, implement rapid decontamination measures.
• Develop specific decontamination protocols for law enforcement personnel, who may be targeted.

To help fire departments provide service to their communities in uncertain environments, the IAFC has compiled the following resources:

IAFC Fire Service Quick Incident Response Workbook for Civil Unrest and Disturbance - IAFC Releases New Resource for Responding to Civil Unrest

This new resource for IAFC members helps fire and chiefs prepare for and respond to incidents of civil unrest.

IAFC “Hot Wash” Document for Major Incidents and Training Exercises - IAFC Releases New “Hot Wash” For Major Incidents and Training Exercises

This IAFC document allows fire and EMS chiefs to collect pertinent lessons learned; challenges that were faced; and successes that a fire chief and their community faced during a significant event or large-scale training exercise. The information can be basic; to the point; and must always be respectful of sensitive issues that the incident may have caused. This information also can be sent to the IAFC to share with the entire fire and EMS community.

Fire and EMS Civil Unrest Response – Fire and EMS response to civil unrest

The U.S. Fire Administration (USFA) developed resources on the safe response to arson incidents during civil unrest and a manual to mitigate occupational violence to Firefighters and EMS responders.

Violent Extremists & Terrorists Exploit Civil Unrest & Public Assemblies in the U.S.. This two-page report summarizes the civil unrest threat and includes resources for local public safety agencies’ use.

Protecting Infrastructure During Public Demonstrations. This DHS document provides guidance and resources to prevent and mitigate the opportunity for unlawful acts during public demonstrations.

IAFC Terrorism Response – A Checklist and Guide for Fire Chiefs and Community Preparedness Leaders. This IAFC document provides a framework to help fire and EMS departments prepare for, respond to, and recover from acts of terrorism and other large-scale incidents.

IAFC Checklist for Active Shooter Response. This IAFC resource is a two-page document to help incident commanders when they arrive on scene at an active shooter incident.

IAFC Active Shooter Toolkit. This member-only IAFC resource provides access to reports, briefings, and other information to help fire and EMS departments prepare for active shooter incidents.

IAFC Homeland Security Intelligence Guide for Fire Chiefs. This guide provides information to help fire and EMS chiefs contact federal, state, and local homeland security and law enforcement partners to access information about threats to their community.