Homeland Security identified threats prior to January 6 but did not share intelligence, watchdog says

The Department of Homeland Security’s Intelligence and Analysis Bureau could not widely share the specific open source threats observed before the Assault on January 6 at the United States Capitolfound a new surveillance report released on Tuesday.

Analysts in the Trump administration did not “produce any actionable information” or issue intelligence bulletins to its network of law enforcement partners until two days after the Capitol insurgency. they had observed online comments from individuals threatening to hang politicians, promising to assault Congress and in one case, “shoot and kill protesters at upcoming rallies related to the presidential election.”

The 54-page report from the DHS Office of the Inspector General found that the department “was unable to provide its numerous state, local, and federal partners with timely, actionable, and predictive intelligence,” although it was the only member of the federal intelligence community. required by law to share this information with state, local, and other non-federal officials.

The inspector general found that DHS fell short due to “inadequate training related to open source collection” which resulted in “inexperienced collectors” who did not follow the department’s guidelines for reporting of information about threats and “hesitated” to share information. Instead, DHS officials emailed information about threats to local Washington DC partners prior to the attack, opting not to issue widespread intelligence alerts.

Messages exchanged between collectors on Jan. 2 and 3 reveal that DHS employees observed a number of open source threats on social media and message boards, but ultimately decided that they did not meet the threshold. information.

“People will try to hurt politicians,” a collector wrote to his colleague on Jan. 2, after finding a map circulating online of all exits and entrances to the Capitol building. “January 6 will be crazy.”

In a different message exchange the next day, DHS analysts considered the threats unlikely, although one suggested he had some doubts. “I mean people are talking about assaulting Congress, carrying guns, getting ready to die for the cause, hanging politicians with ropes,” the collector wrote in a message to a colleague.

Messages from another chat appeared to show two collectors joking about possible threats to lawmakers. “It’s like these people are talking about hanging Democrats on ropes like wtf,” one DHS staff member wrote.

“They would need a lot of rope, I think DC is almost all Democrat haha,” another replied.

A collector was the author of a draft of an open source intelligence report or “OSIR” warning of threats at the U.S. Capitol on January 5, the watchdog found.

During the required peer review process, the Inspector General discovered that another collector had completed the draft report describing the threats to lawmakers, and the United States Capitol did not meet the information threshold because “contained hyperbolic information”.

“In general, open source collectors told us they didn’t think it was possible to storm the U.S. Capitol, so they dismissed this type of specific threat as hyperbole,” the watchdog found.

In short, the bulletin “did not end and was disseminated until January 8, two days after the breach,” which “refers[ed] it is useless “.

When asked about the delay, the management of the Department of Intelligence and Analysis told the inspector general that officials were not instructed to issue a bulletin before the events of January 6 “because there was no enough time “. Instead, the Counterterrorism Mission Center transmitted threats only in an information session with the department’s leadership.

But for weeks, three DHS intelligence divisions gave back-and-forth advice, without producing a useful guide for its network of state and local partners.

On December 21, 2020, the agency’s Field Operations Division (FOD) shared information with the Open Source Collection Operations Team (OSCO) “about a person who threatened to shoot and kill to protesters at upcoming presidential election-related rallies, “an individual told members of an online discussion group that he planned to kill at least 50 people. A FOD staff member later acknowledged to a colleague that an OSCO follow-up request had “escaped her” and no report, based on the advice, was written.

On December 29, the DHS Counterterrorism Mission Center requested open source intelligence testing on January 6 that could be used to report U.S. Capitol police, the U.S. Secret Service, and other partners. federal, state and local threats. Over the next week, five OSCO DHS collectors detailed “comments on the use of weapons and aimed at law enforcement and the United States Capitol Building,” in a shared document. . Analysts found that some people online claimed that they would sacrifice themselves in the violence that had taken place.

But according to the inspector general, “we did not find any evidence that the five collectors drafted a [report] on any of the threats listed in its document “.

During his investigation, the watchdog found that collectors were “hesitant” to issue intelligence products, given an earlier scrutiny of the Intel Office’s controversial response. and Analysis of DHS Protests in Portland, Oregon, Summer 2020.

An internal DHS review found that staff gathered and disseminated information about American journalists there, after members of their poorly trained workforce assisted in gathering intelligence.

The DHS inspector general found that the Office of Intelligence and Analysis “hired inexperienced open source collectors during the months leading up to January 6, 2021,” and then did not offer the courses. appropriate training.

“On January 6, 2021, 16 out of 21 collectors had less than 1 year of experience, and some of these new collectors said they were not properly trained to help determine when to had to report threat information, “the report said.

“Instead, collectors were trained informally by working alongside more experienced colleagues,” the inspector general noted, an impromptu set-up that was made more difficult by remote work during the pandemic.

At the conclusion of his report, the Inspector General issued five recommendations, including providing improved training annually and creating a process for requesting and receiving timely open source intelligence bulletins when they are related to upcoming events.

DHS agreed with all five recommendations.

In a note to the workforce on Tuesday, John Cohen, head of the Office of Intelligence and Analysis since July, told staff he was “totally in agreement” with the suggestions and had worked with the staff to ensure that the recommendations were being implemented.

In a statement to CBS News, a DHS spokesman said that “for the past fourteen months, [DHS] it has strengthened intelligence analysis, information exchange and operational readiness to help prevent violence and keep our communities safe. “

Tuesday’s report followed that of the Government Accountability Office 115-page US Capitol Police Review which found that law enforcement did not provide adequate intelligence to officers on the ground, before January 6th.