The following press release and participants list was obtained from the official website of Bilderberg Meetings. Participant lists from nearly every Bilderberg Meeting since 1954 are also available along with a collection of thousands of pages of internal Bilderberg correspondence and meeting reports.

2025 BILDERBERG MEETING

Stockholm, Sweden 12 – 15 June 2025

Abrams, Stacey (USA), CEO, Sage Works Production
Albuquerque, Maria Luís (INT), European Commissioner Financial Services and the Savings and Investments Union
Alcázar Benjumea, Diego del (ESP), CEO, IE University
Alverà, Marco (ITA), Co-Founder, zhero.net; CEO TES
Andersson, Magdalena (SWE), Leader, Social Democratic Party
Applebaum, Anne (USA), Staff Writer, The Atlantic
Attal, Gabriel (FRA), Former Prime Minister
Auchincloss, Murray (CAN), CEO, BP plc
Baker, James H. (USA), Former Director, Office of Net Assessment, Department of Defense
Barbizet, Patricia (FRA), Chair and CEO, Temaris & Associés SAS
Barroso, José Manuel (PRT), Chair International Advisors, Goldman Sachs International
Baudson, Valérie (FRA), CEO, Amundi SA
Beleza, Leonor (PRT), President, Champalimaud Foundation
Birol, Fatih (INT), Executive Director, International Energy Agency
Botín, Ana (ESP), Group Executive Chair, Banco Santander SA
Bourla, Albert (USA), Chair and CEO, Pfizer Inc.
Brende, Børge (NOR), President, World Economic Forum
Brzoska, Rafal (POL), CEO, InPost SA
Busch, Ebba (SWE), Minister for Energy, Business and Industry
Caine, Patrice (FRA), Chair & CEO, Thales Group
Calviño, Nadia (INT), President, European Investment Bank
Castries, Henri de (FRA), President, Institut Montaigne
Chambers, Jack (IRL), Minister for Public Expenditure, Infrastructure, Reform and Digitalisation
Champagne, François-Philippe (CAN), Minister of Finance and National Revenue
Clark, Jack (USA), Co-Founder & Head of Policy, Anthropic PBC
Crawford, Kate (USA), Professor and Senior Principal Researcher, USC and Microsoft Research
Donahue, Christopher (USA), Commander, US Army Europe and Africa
Donohoe, Paschal (INT), President, Eurogroup; Minister of Finance
Döpfner, Mathias (DEU), Chair and CEO, Axel Springer SE
Eberstadt, Nicholas N. (USA), Henry Wendt Scholar in Political Economy, AEI
Ek, Daniel (SWE), CEO, Spotify SA
Ekholm, Börje (SWE), CEO, Ericsson Group
Eriksen, Øyvind (NOR), President and CEO, Aker ASA
Feltri, Stefano (ITA), Journalist
Fentener van Vlissingen, Annemiek (NLD), Chair, SHV Holdings NV
Fraser, Jane (USA), CEO, Citigroup
Freeland, Chrystia (CAN), Minister of Transport and Internal Trade
Friedman, Thomas L. (USA), Foreign Affairs Columnist, The New York Times
Gabuev, Alexander (INT), Director, Carnegie Russia Eurasia Center
Hammer, Kristina (AUT), President, Salzburg Festival
Harrington, Kevin (USA), Senior Director for Strategic Planning, NSC
Hassabis, Demis (GBR), Co-Founder and CEO, Google DeepMind
Hedegaard, Connie (DNK), Chair, KR Foundation
Heinrichs, Rebeccah (USA), Senior Fellow, Hudson Institute
Heraty, Anne (IRL), Chair, Sherry Fitzgerald ana IBEC
Herlin, Jussi (FIN), Vice Chair, KONE Corporation
Hernández de Cos, Pablo (ESP), General Manager Elect, Bank for International Settlements
Hobson, Mellody (USA), Co-CEO and President, Ariel Investments LLC
Hoekstra, Wopke (INT), European Commissioner for Climate, Net Zero and Clean Growth
Hunt, Jeremy (GBR), Member of Parliament
Isla, Pablo (ESP), Vice-Chair, Nestlé SA
Johansson, Micael (SWE), President and CEO, Saab AB
Jonsson, Conni (SWE), Founder and Chair, EQT Group
Karp, Alex (USA), CEO, Palantir Technologies Inc.
Klöckner, Julia (DEU), President Bundestag
Kostrzewa, Wojciech (POL), President, Polish Business Roundtable
Kotkin, Stephen (USA), Senior Fellow, Hoover Institution, Stanford University
Kratsios, Michael (USA), Director, White House Office of Science and Technology Policy
Kravis, Henry R. (USA), Co-Founder and Co-Executive Chair, Kohlberg Kravis Roberts & Co.
Kudelski, André (CHE), Chair and CEO, Kudelski Group SA
Kuleba, Dmytro (UKR), Adjunct Professor, Sciences Po
Leeuwen, Geoffrey van (INT), Director Private Office of the Secretary General, NATO
Lemierre, Jean (FRA), Chair, BNP Paribas
Letta, Enrico (ITA), Dean, IE School of Politics, Economics & Global Affairs
Leysen, Thomas (BEL), Chair, dsm-firmenich AG
Lighthizer, Robert (USA), Chair, Center for American Trade
Liikanen, Erkki (FIN), Chair, IFRS Foundation Trustees
Lundstedt, Martin (SWE), CEO, Volvo Group
Marin, Sanna (FIN), Strategic Counsellor, Tony Blair Institute for Global Change
McGrath, Michael (INT), European Commissioner for Democracy, Justice and the Rule of Law
Mensch, Arthur (FRA), Co-Founder and CEO, Mistral AI
Micklethwait, John (USA), Editor-in-Chief, Bloomberg LP
Minton Beddoes, Zanny (GBR), Editor-in-Chief, The Economist
Mitsotakis, Kyriakos (GRC), Prime Minister
Monti, Mario (ITA), Senator for life
Nadella, Satya (USA), CEO, Microsoft Corporation
Netherlands, H.M. the King of the (NLD), 
O’Leary, Michael (IRL), Group CEO, Ryanair Group
Ollongren, Kajsa (NLD), Fellow, Chatham House; Senior Fellow, GLOBSEC
Özyeğin, Murat (TUR), Chair, Fiba Group
Papalexopoulos, Dimitri (GRC), Chair, TITAN S.A.
Paparo, Samuel (USA), Commander, US Indo-Pacific Command
Philippe, Édouard (FRA), Mayor, Le Havre
Pouyanné, Patrick (FRA), Chair and CEO, TotalEnergies SE
Prokopenko, Alexandra (INT), Fellow, Carnegie Russia Eurasia Center
Rachman, Gideon (GBR), Chief Foreign Affairs Commentator, Financial Times
Rappard, Rolly van (NLD), Co-Founder and Chair, CVC Capital Partners
Reiche, Katherina (DEU), Minister of Economic Affairs and Energy
Ringstad Vartdal, Birgitte (NOR), CEO, Statkraft AS
Roche, Nicolas (FRA), Secretary General, General Secretariat for Defence and National Security
Rutte, Mark (INT), Secretary General, NATO
Salvi, Diogo (PRT), Co-Founder and CEO, TIMWE
Sawers, John (GBR), Executive Chair, Newbridge Advisory Ltd.
Scherf, Gundbert (DEU), Co-Founder and Co-CEO, Helsing GmbH
Schimpf, Brian (USA), Co-Founder & CEO, Anduril Industries
Schmidt, Eric E. (USA), Executive Chair and CEO, Relativity Space Inc
Schmidt, Wolfgang (DEU), Former Federal Minister for Special Tasks, Head of the Chancellery
Šefčovič, Maroš (INT), European Commissioner Trade and Economic Security; Interinstitutional Relations and Transparency
Sewing, Christian (DEU), CEO, Deutsche Bank AG
Sikorski, Radoslaw (POL), Minister of Foreign Affairs
Şimşek, Mehmet (TUR), Minister of Finance
Smith, Jason (USA), Member of Congress
Stoltenberg, Jens (NOR), Minister of Finance
Streeting, Wes (GBR), Secretary of State for Health and Social Care
Stubb, Alexander (FIN), President of the Republic
Suleyman, Mustafa (USA), CEO, Microsoft AI
Summers, Lawrence (USA), Charles W. Eliot University Professor, Harvard University
Thiel, Peter (USA), President, Thiel Capital LLC
Toulemon, Laurent (FRA), Senior Researcher, INED
Uggla, Robert (DNK), Chair, A.P. Møller-Maersk A/S
Valentini, Valentino (ITA), Deputy Minister of Enterprise and Made in Italy
Vassy, Luis (FRA), Director, Sciences Po
Verhoeven, Karel (BEL), Editor-in-Chief, De Standaard
Wallenberg, Jacob (SWE), Chair, Investor AB
Wallenberg, Marcus (SWE), Chair, Skandinaviska Enskilda Banken AB
Weder di Mauro, Beatrice (CHE), President, Centre for Economic Policy Research
Weel, David van (NLD), Minister of Justice and Security
Wilmès, Sophie (INT), Vice-President, European Parliament
Zakaria, Fareed (USA), Host, Fareed Zakaria GPS
Zeiler, Gerhard (AUT), President, Warner Bros. Discovery International

On July 30, 2024, Ronald L. Rowe, Jr., the Acting Director of the USSS, testified in a joint hearing before the Senate Homeland Security and Governmental Affairs Committee (HSGAC) and Judiciary Committee that the attempted assassination “was a failure on multiple levels.” Acting Director Rowe testified before the Committees that he has since initiated several reforms to address clear deficiencies in how USSS provides security for its protectees. During the July 30 hearing, Acting Director Rowe acknowledged USSS responsibility for protecting former President Trump. In a series of transcribed interviews conducted by HSGAC and the Permanent Subcommittee on Investigations, key USSS personnel responsible for planning, coordinating, communicating, and securing the Butler, PA rally on July 13, declined to acknowledge individual areas of responsibility for planning or security as having contributed to the failure to prevent the shooting that day, even when as an agency, the USSS has acknowledged ultimate responsibility for the failure to prevent the former president of the United States from being shot.

…

KEY FAILURES

1. USSS failed to clearly define responsibilities for planning and security at the July 13 rally.

USSS personnel responsible for planning in advance of the July 13 rally denied that they were individually responsible for planning or security failures and deflected blame.

USSS Advance Agents told the Committee that planning and security decisions were made jointly, with no specific individual responsible for approval.

2. USSS failed to ensure the AGR Building was effectively covered.

USSS identified the AGR building as a concern due to the line-of-sight from the roof to the stage, but did not take steps to ensure sufficient security measures were in place.

USSS knew that local snipers planned to set up inside the AGR building and USSS did not express objections or concerns about that placement.

USSS personnel, including the USSS Counter Sniper Team Leader, did not enter the AGR building or go on the roof prior to the shooting.

One USSS Counter Sniper team, whose responsibility included scanning the area around the AGR building for threats, had an obstructed view of the AGR roof.

3. USSS failed to effectively coordinate with state and local law enforcement.

USSS did not give state or local partners specific instructions for covering the AGR building, including the positioning of local snipers.

USSS did not adequately consider state and local law enforcement operational plans.

Communications at the July 13 rally were siloed and USSS did not ensure it could share information with local law enforcement partners in real time.

4. USSS failed to provide resources for the July 13 rally that could have enhanced security.

USSS denied specific requests for additional Counter Unmanned Aircraft Systems (C-UAS) capabilities and a Counter Assault Team liaison.

A USSS Counter Surveillance Unit – which could have helped patrol the outer perimeter that included the AGR building – was not requested by USSS Advance Agents.

5. USSS failed to communicate information about the suspicious person to key personnel, and failed to take action to ensure the safety of former President Trump.

At approximately 5:45 pm, USSS personnel were notified that local law enforcement observed a suspicious person with a rangefinder near the AGR building. By 5:52pm, at least eight USSS personnel had been informed.

Approximately two minutes before shots were fired, the USSS Security Room, located on the rally grounds, was told that there was an individual on the roof of the AGR building.

Shortly before shots were fired, a USSS Counter Sniper observed local officers running towards the AGR building with guns drawn.

…

…

…

…

The J5, a collaborative partnership among tax authorities and law enforcement from five countries, has identified several risk indicators that financial institutions should be aware of. Risk indicators play a pivotal role in enhancing the ability of financial institutions to detect and report money laundering and illicit activities involving crypto assets. To counteract these risks, timely identification allows institutions to intervene and to report to the relevant authorities contributing to the overall integrity of the financial system and ensure compliance with anti-money laundering (AML) regulations.

Detecting signs of money laundering and tax evasion requires the gathering, analysis and reporting of financial data. By disseminating the risk indicators to the financial institutions, valuable insights from law enforcement can be relayed to the financial sector and reporting agencies. This exchange enhances the abilities of reporting entities to detect and report suspicious activity necessary to disrupt illicit financial flows. While risk indicators may vary and not all are covered, the details in this advisory note are commonly observed.

Identifying Crypto Asset Layering

The following risk indicators involve transactions that are designed to conceal the illicit origin of funds, posing a major risk to the financial sector. Financial institutions should prioritize the detection of layering involving crypto assets, the phase in money laundering where transactions are intentionally made intricate to conceal illicit origin of funds, throughout their relationship with their customers. For example, unusually high volumes with rapid movement of funds between digital wallets, especially across multiple jurisdictions can signal potential layering.

To counteract these risks, financial institutions are advised to reference the following risk indicators and behaviors on evolving money laundering techniques.
– Rapid movement of funds between accounts held at crypto exchanges without apparent business rationale.
– The customer is sending or receiving in volumes inconsistent and larger than expected from private wallet addresses.
– Conversion across different crypto assets exploiting the wide range of digital assets to complicate the tracing of funds.
– The customer is sending/receiving in high volumes from peer-to-peer (P2P) platforms which enables a direct transfer between parties but bypasses traditional financial institutions.
– The customer is sending/receiving from crypto mixers.
– The customer is sending/receiving from gambling platforms.
– A disproportionate amount of the customer’s account activity involves the buying and selling of privacy coins or maintains a large portfolio of privacy coins. These crypto assets are designed for enhanced privacy and are commonly employed to conceal transaction details and the identities of the parties involved.
– The customer is sending/receiving cryptocurrency from darknet marketplaces, fraud shops, or high-risk exchanges.
– High volume and frequency of transfers between different types of crypto assets.
– The customer is transacting in round dollar and/or structured amounts to avoid bank reporting requirements.
– The customer’s cryptocurrency transactions flow through several intermediate addresses in a very short period of time prior to being added to a client’s wallet, or just after being withdrawn.
– The customer transfers Bitcoin in large volumes in exchange for privacy coins.

Geographical Risk Indicators

FIUs need to exercise vigilance when dealing with cryptocurrency transactions tied to jurisdictions known for weak regulatory frameworks, inadequate AML controls, or heightened levels of corruption. The following geographical risk indicators may indicate that there is sending and receiving exposure between high-risk exchanges that lack in customer identity verification measures, transactional due diligence, and legal/regulatory compliance measures, or may be in offshore jurisdictions with a history of tax havens and banking secrecy, or foreign countries known for public corruption.
– Transactions involving exchanges operating out of high-risk jurisdictions identified as non-cooperative for AML purposes.
– Changing IP addresses, which also change telephone providers. This could indicate identity concealment through technology.
– Customer accounts being accessed with IP addresses from high risk-jurisdictions. The shared use of an account or access login from devices tracked to IP addresses in high-risk jurisdictions may indicate that the account is part of a larger network of accounts.
– Crypto addresses that match addresses on recognized watch lists such as the list of the Office of Foreign Assets – Control (OFAC) or law enforcement information.

High Risk Counterparties

Customer counterparties and transaction beneficiaries and senders can serve as significant risk indicators for potential money laundering and illicit activities in the realm of crypto assets. Unusual counterparties, particularly if they involve high-risk entities with obscure ownership structures may warrant closer scrutiny. Moreover, transactions where the beneficiary and sender information is obscured or has multiple layers of intermediaries may be indicative of attempts to conceal the true source or destination of funds. Financial institutions and crypto exchanges should closely monitor their customer’s transactions and parties they engage with in the cryptocurrency space.
– The client’s crypto assets originated from an over-the-counter trade broker that advertises its services as privacy-oriented/anonymous.
– Direct sending and receiving from high-risk crypto exchanges which operate in jurisdictions with inadequate AML and regulatory framework.
– Funds or crypto currencies that are added or withdrawn from crypto addresses or wallet with direct and indirect exposure links to known suspicious sources, including darknet marketplaces, mixing/tumbling services, questionable gambling sites, illegal activities (for example, ransomware) and/or theft reports.
– Interaction with financial institutions or individuals subject to sanctions or based in sanctioned states.

New Client Onboarding Risk Indicators

Robust know your customer (KYC) practices enable crypto asset exchanges to identify potential risks associated with crypto asset transactions and ensure compliance with regulatory measures to strengthen the integrity of the financial system. By collecting and maintaining a comprehensive customer profile, financial institutions and crypto exchanges can verify source of crypto assets and transaction history to better establish a baseline understanding of their clients’ crypto exposure and activities.
– Customer attempts to provide as little identity information as possible, including incomplete or insufficient identification information.
– Company beneficial ownership is difficult to establish.
– Customer is difficult to contact, responds only via email or web chat, and at unusual hours.
– The level or volume of transactional activity is inconsistent with the client’s apparent financial profile, their usual pattern of activities, occupational information, or declared business information.
– Clients who register with the exchange within a short period using a shared address, mobile device, phone number, IP addresses and other common identity indicators.
– The customer’s use of an anonymity-oriented email provider.
– A customer’s crypto address appears on public forums related to illegal activities.
– Carrying out transactions with crypto addresses that are connected to public investigations.
– The customer has access to multiple accounts used to purchase crypto. The account set-up access can also be done as an authorized representative or if the customer carries out the transactions himself.
– The client provides an anonymous email address obtained through an encrypted email service.
– Multiple changes to an account’s contact information that could indicate a customer account takeover.
– Account set up where the client has access to multiple bank accounts and/or other people’s accounts may indicate money mule activity.
– The customer’s email address used in the transaction is linked to advertisements for the sale of crypto assets on P2P exchange platforms. These advertisements may suggest that the client is buying and selling crypto assets on a commercial scale through a business as a non-registered money services business.
– An account number in a country other than the customer’s nationality/residential address. This could indicate that the customer is hiding who the true owner of the account is.
– The client is unwilling or unable to provide supporting information about the source of crypto assets or the reasoning behind holding privacy coins.

Ransomware and Cybercriminal Risk Indicators

Crypto exchanges have an important role to detect and report financial flows related to ransomware and stop ransomware payments, because they are a key point where criminals interact with the legitimate financial system. Cybercriminals use many methods to try and conceal the origin and destination of ransomware payments before the digital currency arrives at the final wallet or bank account under their control. Cybercriminals will use sophisticated methods to try and obscure their flow of funds. These risk indicators are to assist financial institutions in identifying potential bad actors or accounts associated with organizations that perpetrate ransomware and cybercrime.
– The customer’s unusual high usage of privacy coins. Privacy coins are digital currencies that provide enhanced anonymity by obscuring the amount, destination, and origin of transactions.
– The customer’s transactions exhibit chain-hopping. This is where one digital currency is exchanged for another. The digital currency is moved from one blockchain to another, hence the term ‘chain-hopping’.
– The account and customer transact with a mixer. Cybercriminals direct ransomware payments through intermediary digital currency addresses, exchanges, and mixers. Mixers increase anonymity by mixing the customer’s digital currency with the transactions of others before being redirected back to the customer.
– Use of mule accounts. A mule account is created using a stolen or fake identity or, a legitimate account held by another party who is complicit in its use.
– Following an initial large digital currency transfer, a customer has little or no further digital currency activity.
– Customer’s digital currency account is linked to or funded by multiple bank accounts at several different institutions.
– A newly on-boarded customer wants to make an immediate and large purchase of digital currency, followed by an immediate withdrawal to an external digital currency address.

The following press release and participants list was obtained from the official website of Bilderberg Meetings. Participant lists from nearly every Bilderberg Meeting since 1954 are also available along with a collection of thousands of pages of internal Bilderberg correspondence and meeting reports.

A. Federal law enforcement used informal meetings and backchannel discussions with financial institutions to devise the best methods for gathering Americans’ private financial information.

Federal law enforcement officials organized Zoom discussions with financial institutions as part of their investigation into the events of January 6, 2021.78 Participants in these meetings included Barclays, U.S. Bank, Charles Schwab, HSBC, BoA, Paypal, KeyBank, Standard Chartered, Western Union, Wells Fargo, Citibank, Santander, JPMorgan Chase, Union Bank, and MUFG. In one meeting, an FBI official from the Washington Field Office reached out to a number of financial institutions to arrange a meeting with the goal of “identifying the best approach to information sharing, both strategic and operational,” in the wake of the events of January 6. At least five other Zoom meetings were scheduled by FinCEN officials and financial institutions and included the subject “Capitol Riots.” Viewed together, these meetings suggest that federal law enforcement officials were brainstorming informal methods—outside of normal legal processes—for obtaining private customer information from financial institutions.

B. Federal law enforcement circulated politicized materials that evidenced hostility towards conservative viewpoints and weaponized financial institutions’ databases by treating lawful transactions as suspicious.

Federal law enforcement circulated materials to financial instih1tions as part of an information sharing operation that alerted financial institutions to the risk of customers and accounts that may be associated with conservative views. In particular, federal law enforcement attempted to cast swaths of lawful and otherwise hai1nless transactions as potentially suspicious. Given that these materials were distributed to some of the largest financial institutions and companies in the world, their reach could potentially impact the transactions and accounts of hundreds of millions of customers without the customers ever knowing it.

…

(U) In response to its lack of state allies and the conventional military capabilities of its neighbors, the United States, and other Western powers, Iran adopted a military paradigm in which it would rely on asymmetric responses, often using unconventional tools, to include terrorism. Iran often employs a paramilitary element of its Revolutionary Guards known as the Quds Force to lead or conduct many of these operations.

(U) This power expansion offers new options for Iran to attack potential adversaries as well as the ability to add strategic depth to its regional defense architecture. Despite renewed international and regional pressure, Tehran shows no sign of ceasing this behavior.

(U) U.S. diplomatic and military personnel will be best able to respond to Iranian threats by understanding the tools at its disposal. The following reference guide provides an excellent overview of the equipment, personnel, and practices which play important roles in Iran’s external power projection. Developing an understanding of these capabilities will enable readers to predict Iranian behavior and understand the weaknesses inherent in its operations.

…

1.3 – (U) Executive Summary

(U) Iran’s objectives are to maintain the recently established land bridge that runs between Iran through Iraq and Syria into Lebanon, limit the influence of Sunni states and Israel, and expel US and Western influence from the region.
(U) Iran’s strategic geographic location enables it to threaten vital US interests in the Strait of Hormuz and the greater Gulf region and influence the Bab al-Mandab and Eastern Mediterranean.
(U) Iran is the world’s largest state sponsor of terrorism and is actively destabilizing the Middle East through its proxy operations.
(U) Iran’s military doctrine focuses on Hybrid Warfare operations and asymmetric response options aimed at reducing the will of the United States and its partners to fight in the region.
(U) Iran’s large military enterprise is split into two separate forces: the Iranian Army and the Iranian Revolutionary Guard Corps (IRGC). Iran maintains the largest ballistic missile program in the region.
(U) Iran’s Islamic Revolutionary Guard’s Qods Corps (IRGC), influences or directs the operations of a network of proxy groups and terrorist organizations referred to hereinafter as the Iranian Threat Network (ITN).
(U) Iran’s distributed network of proxies have reduced Iran’s official footprint while allowing Iran considerable influence in Iraq, Syria, Lebanon, Yemen and western Afghanistan.
(U) Iran has a relatively advanced and capable drone program.
(U) Iran has begun to export advanced missile technology to the Houthis and Lebanese Hezbollah.
(U) Iran has developed signature TTPs that are being used by both its forces and Iranian proxies in Syria, Iraq, and Yemen.
(U) Iran is developing a growing cyber warfare capability and maintains a sophisticated information operations capability.
(U) IRGC Qods Force and Lebanese Hezbollah operatives conduct the majority of their activity in the CENTCOM AOR, but maintain at least a support capacity in every COCOM AOR and have the capacity to deploy personnel, if needed.

…

(U) Iran’s military Doctrine focuses heavily on Asymmetric Warfare and is a hybrid of Western military concepts coupled with Shiite revolutionary ideology. The Western influence is a doctrinal remnant of Iran’s pre-revolution relationship with the U.S. military. In the early 1970s, Iran was aligned against the Soviet Union and the largest purchaser of US military equipment, and received commensurate training and assistance from the United States – the Iranian military still uses a great deal of dated US equipment. Western observers should not make the mistake of dismissing the importance of the Islamic revolution in the doctrine of Iran – the role of Islam in the military is enshrined in the Iranian constitution, and officers are groomed and selected for promotion not only on tactical aptitude but on religious credentials.

…

(U) Iranian Hybrid Warfare

(U) Since 2003, and in large part due to operations in Afghanistan and Iraq, U.S. personnel have been increasingly familiar with the concept of asymmetric warfare as the U.S. faced adversaries unable to confront the U.S. conventionally. In its simplest form, asymmetric warfare is may be described as a competition between adversaries who adjust tactics, techniques and procedures to exploit their respective strengths and opponents’ vulnerabilities. Asymmetric Warfare, as Iran practices it, is a holistic strategy designed to overcome Iran’s inability to match U.S. conventional power and resources by using tactics which exploit perceived Western vulnerabilities. The tools employed in this strategy are described as Hybrid Warfare.

(U) Hybrid war is the combination of activities through attributable but deniable operations, proxies and technologies designed to destabilize a target and achieve objectives short of war; importantly, its techniques can leverage conventional and attributable capabilities in threatening ways that reinforce the attributable but deniable efforts. A fait accompli campaign is intended to achieve military and political objectives rapidly, creating irreversible facts on the ground – before an adversary can respond. In addition to the associated psychological defeat, a successful hybrid warfare campaign can be used to reduce, if not deny, adversary response options. Finally, the costs of hybrid warfare are far less than a conventional conflict, an important advantage for resource-constrained Iran.

…

(U) ITN Proxy Group Development

(U) Iran follows a consistent model in its development of proxy groups and partners. Iran has had its greatest success in areas which enjoy four characteristics: a collapse of the state structure, Shi’a threatened by Sunni extremists, a logistics pipeline through which Tehran may maintain operations, and the absence of significant external powers which will block Iran’s actions.

(U) Iran has also been known to exploit grievances among Shia populations, particularly during situations of real or perceived threats to these populations that play into Iran’s “resistance” narrative. Once an opportunity is identified, Iran will offer training and indoctrination to militant candidates in Iran, and then channel money, arms and/or other forms of support in order to build dependency. As the targeted group demonstrates a capability to conducted more advanced operations and its leadership is trusted by Tehran, Iran is able to gradually begin shaping their operations towards Iranian objectives. As a pragmatic facilitator, Iran is likely to go through this cycle numerous times with various groups, but probably works to maintain at least low-level relations with as many ideologically aligned groups as possible in order to maintain flexibility for future contingencies where a group could suddenly become more important in the scope of Iranian strategy. As Iran’s priorities shifts or global events develop, they may increase or decrease funding and support while still working to maintain their influence.

(U) The Iranian Threat Network is comprised of six distinct elements. The IRGC Qods Force exercises control over proxy operations, reporting only to the Supreme Leader. The Qods Force also controls the remaining five elements, which form the taxonomy of the ITN.
(U) Iran Proxy groups over which Iran exerts preponderant influence, e.g., Lebanese Hezbollah and Kata’ib Hezbollah
(U) Independent proxies, or semi-controlled partners, which have an independent decision-making process but are influenced by Iran, e.g., the Houthis and Taliban
(U) Sunni armed groups that are cobelligerent with Iran, e.g., Hamas
(U) Shia armed opposition movements that oppose Sunni or secular governments and are supported but not fully controlled by Iran, e.g., Bahraini Shia
(U) Shia communities worldwide, which are often supported by Iran in the cultural and religious fields and are viewed by Tehran as potential bases of support for its policies

…

(U//FOUO) Sovereign citizens are US citizens who claim to have special knowledge or heritage that renders them immune from government authority and laws. Although the ideology itself is not illegal, sovereign citizen violent extremists express their anti-government or anti-authority violent extremist beliefs through the use or threat of force or violence, while sovereign citizen criminals use these beliefs to justify non-violent activities, such as fraud and theft. Sovereign citizen violent extremists or sovereign citizen criminals may attempt to frame legal encounters with government officials as negotiable commercial transactions, or claim legal immunity based on “common law rights of man.”

(U) TARGETS and TACTICS

(U//FOUO) Targets: Primary targets of sovereign citizen violent extremists are law enforcement officers, with violence most likely to occur sporadically within the context of law enforcement encounters, including traffic stops.

(U//FOUO) Tactics: Sovereign citizen violent extremist tactics range from threats of violence, including threats to ‘arrest’ officials; physical assaults; and, most significantly, lethal attacks with firearms. Significant sovereign citizen criminal tactics include the fraudulent filings of liens and frivolous lawsuits; financial fraud, including tax and mortgage fraud; and real estate or property theft, including squatting.

(U) INDICATORS

(U//FOUO) Indicators of sovereign citizen violent extremist ideology can include constitutionally protected conduct, and no single indicator should be used as the sole basis for a determination of sovereign citizen violent extremism or criminal activity. The following indicators of sovereign citizen violent extremist ideology might constitute a basis for reporting or law enforcement action when observed in combination with suspicious criminal or potentially violent activity:

(U) Using fraudulent license plates, credentials, driver’s licenses, identification cards, or badges from fictitious republics or indigenous groups
(U) Making claims of sovereignty, often incorporating terms like “freeman,” “traveler,” “natural person,” “flesh and blood,” “artificial person,” “strawman,” or “right to road travel”
(U) Using signatures that are distinguished by odd colons, dashes, brackets, or the copyright symbol ©, or are followed by “under duress,” “without prejudice,” “without recourse,” “Threat, Duress, or Coercion” (TDC), “All Rights Reserved” (ARR), or a red thumb print
(U) Threatening to “arrest” officials or use “common law courts”; making demands for oath of office or “bond”; and making claims of “kidnapping” by officials
(U) Filing fraudulent liens or illegal lawsuits, frequently involving the fraudulent use of government seals or forms, sometimes accompanied by a notary signature

(U) NOTABLE ATTACKS or CRIMINAL ACTS

(U//FOUO) In April 2023, a sovereign citizen violent extremist was convicted on state charges for extortion. The sovereign citizen violent extremist had threatened to place a lien on the residence of a local police officer if his previously impounded vehicle was not returned to him, and he separately made online statements expressing willingness to file liens on individuals if they attempted to foreclose on his home.

(U) In March 2023, a sovereign citizen violent extremist pleaded guilty to five counts of transmitting threats to kidnap government officials and law enforcement. The sovereign citizen violent extremist posted purported “Writs of Execution,” providing instruction on and advocating service of Writs, arrest of public officials, and the need to abolish the government. In August 2023, he was sentenced to 120 months in prison and a 3-year supervised release.

(U//FOUO) In February 2018, a sovereign citizen violent extremist in Locust Grove, Georgia, shot three law enforcement officers while they were attempting to serve an arrest warrant at the extremist’s residence for failure to appear. After killing one police officer and wounding two sheriff’s deputies, the extremist was shot and killed by law enforcement.

(U) KEY TERMS

Accepted for Value (A4V)

Some sovereign citizens annotate bills, traffic tickets, or other official documents with the phrase “Accepted for Value” or “A4V,” meaning the recipient interprets the document as an offer to engage in commerce with a free person who retains his or her rights.

Adhesion Contracts

Official identifications, licenses, or certificates believed to bind individuals unwittingly to the government, in a state of virtual slavery. Individuals might refuse to carry official identity documents and, when asked to present identification, might claim to have none or present documents of their own design, such as badges, credentials, passports, or right-to-travel cards.

Affidavit of Truth

Popular example of a fraudulent sovereign citizen document used for purposes of intimidation or assertions of sovereign citizen beliefs.

Apostille

Legitimate certificate that authenticates documents for use in foreign countries. Sovereign citizen criminals might use apostilles to certify document content fraudulently.

Common Law

Sovereign citizens interpret common law as an alternative legal remedy that can bypass legitimate legal processes, convening false common law “grand juries” or “courts” that can issue fraudulent indictments, arrest warrants, threatening letters or efforts to compel officials to act on their behalf or fulfill oaths of office. All these actions lack legal standing or force of law.

Flesh-and-Blood

Term used to describe free identities whom sovereign citizen adherents believe exist beyond the jurisdiction of the US authority.

14th Amendment

Many sovereign citizens believe passage of the 14th amendment, which granted rights to former slaves following the civil war, resulted in a fictional category of servitude for US citizens, and that the government became a corporation that no longer followed the constitution.

Sheriff’s Posse Comitatus

A militant anti-government, anti-tax movement active in the United States in the 1970s and 1980s, from which many of today’s sovereign citizen beliefs and assertions are derived.

Redemption Theory

Underlies a sovereign citizen criminal fraud scheme to access supposed secret US Treasury accounts worth millions of dollars, which adherents believe the US Government opens for every US citizen upon receipt of a birth certificate. Adherents file fraudulent paperwork with the goal of gaining control of their supposed funds to discharge debts including mortgages, loans, etc.

Sovereign Citizen

The term “sovereign citizen” is used mainly by law enforcement; adherents tend to self-identify as sovereign, freemen, flesh-and-blood persons, living beings, etc. It is not illegal to advocate sovereign citizen beliefs, absent extremist or criminal threats or activities.

Strawman

According to sovereign citizen ideology, the US Government creates a fictitious identity—a “strawman”—in the name of all born or naturalized US citizens. Adherents refer to their supposed secret US Treasury account as a “strawman account.”

Traveling

During traffic stops, sovereign citizen criminals might claim to be “traveling”—versus “driving”—fraudulently claiming to engage in a private, non-commercial activity outside of the authority of officers.

Uniform Commercial Code (UCC)

A legitimate legal code governing commercial transactions. Sovereign citizen criminals use UCC fraudulently as a bridge or remedy for interacting with government agencies and officials, using legitimate UCC forms during illicit financial schemes and fraudulent filings, as part of what they perceive to be transactions with illegitimate government entities.

A full understanding of the response of local, state, and federal law enforcement agencies and personnel is critical for addressing many unanswered questions, identifying crucial lessons learned, enhancing prevention initiatives, and improving future preparation for and responses to mass shootings in other communities. In providing a detailed accounting and critical assessment of the first responder actions in Uvalde, and the efforts since to ameliorate gaps and deficiencies in that response, the CIR is intended to build on the knowledge base for responding to incidents of mass violence. It also will identify generally accepted practices for an effective law enforcement response to such incidents. Finally, the CIR is intended to help honor the victims and survivors of the Robb Elementary School tragedy.

The CIR was led by the Office of Community Oriented Policing Services (COPS Office) with the support of a team of subject matter experts with a wide variety of relevant experience, including emergency management and active shooter response, incident command, tactical operations, officer safety and wellness, public communications, and victim and family support (see “About the Team“). The CIR team collected and reviewed more than 14,100 pieces of data and documentation, including policies, training logs, body camera and CCTV video footage, audio recordings, photographs, personnel records, manuals and standard operating procedures, interview transcripts and investigative files and data, and other documents. The CIR team visited Uvalde nine times, spending a total of 54 days on site. The team conducted over 260 interviews of individuals from more than 30 organizations and agencies who played a role in or had important knowledge or information about areas related to the review. Those interviews included personnel from the law enforcement agencies involved in the response to the mass shooting, other first responders and medical personnel, victims’ family members, victim services providers, communications professionals and public information officers, school personnel, elected and appointed government officials, survivors and other witnesses, and hospital staff.

…

High-Level Incident Summary

Phase I: 11:21 a.m.–11:39 a.m.

Phase I of the incident begins when the subject shoots his grandmother at her residence at approximately 11:21 a.m., and ends after the first arriving officers’ initial approaches to classrooms 111 and 112, at approximately 11:39 a.m.

After shooting his grandmother, the subject messages an acquaintance about the crime he just committed and his plan to “shoot up an elementary school” next. He steals a vehicle from the residence and crashes it just a few blocks away, into a ditch near Robb Elementary. Multiple 911 calls are placed in response to the crash. Meanwhile, the subject exits the vehicle and begins shooting a high-powered, AR-15-style rifle at workers from a nearby funeral home before entering the school grounds and heading toward the West Building of Robb Elementary.

UCISD Staff 1, who is still on the phone with 911 about the crash, witnesses the gunfire and notifies the 911 operator. The UCISD Staff 1 then reenters the West Building and begins lockdown procedures. They completely close the exterior door through which they entered. The door is not propped open but, unbeknownst to them, it is not locked as it should be. 911 dispatch alerts all units to respond. Multiple Uvalde Consolidated Independent School District (UCISD) employees use the school’s emergency alert system, Raptor, to send an alert as the subject reaches the West Building.

As the subject reaches the West Building, he initiates multiple barrages of gunfire along the exterior west wall. Children and teachers are outside on the playground at the time, as the subject then approaches the building. At 11:33 a.m., the subject enters through the northwest door of the West Building via the closed, unpropped, and unlocked exterior door. The subject enters the building approximately five minutes after he crashes into the ravine and 11 minutes after shooting his grandmother. The subject walks directly to adjoining rooms 111 and 112 and begins shooting toward their recessed doors. The subject walks into the vestibule while shooting and appears to try to access and may enter room 112. Approximately 10 seconds later, the subject steps back into the hallway, continuing to shoot, and then appears to enter room 111. The subject then accesses both rooms 111 and 112 through the connecting doors between them.

Within three minutes of the subject entering the building, first responding officers enter from both the south and northwest side entrances while the subject is actively shooting inside rooms 111 and 112. In addition to hearing gunfire, the officers experience smoke from recent gun fire and dust from sheetrock and see shell casings on the floor. Officers quickly identify where the shooting is occurring and run toward rooms 111 and 112.

Responding officers are hit with shrapnel from the shooter’s gunfire from inside the classrooms. After initial approaches toward the doors, the officers retreat, not approaching the doors again until entry is made more than an hour later.

Upon arrival, responding officers also learn of intermittent radio difficulties when inside the hallway. Some officers go outside of the hallway and request a special weapons and tactics (SWAT) team and additional resources over the radio, including shields, flashbangs, and for all units to respond starting at 11:37 a.m. An active school shooting is called out over the radio early on during the incident, but then the terms “contained” and “barricade” are used multiple times to describe the conditions of the incident during Phase I of the event, including over the radio to dispatchers and officers en route (starting at 11:37 a.m.). Also, at 11:37 a.m., Uvalde Consolidated Independent School District Police Department (UCISD PD) Ofc. 1 identifies the room the shooter is in as his wife’s classroom.

Phase II: 11:40 a.m.–12:21 p.m.

Phase II of the incident begins at 11:40 a.m., after the initial response has ended, defined as the last time the first officers on scene retreat from the doorway of classrooms 111/112. Phase II ends when multiple shots are fired again from inside the classrooms at 12:21 p.m. and officers move down the hallway and toward the classrooms.

During this 41-minute period of time, many more officers from a multitude of agencies arrive on scene. There is a great deal of confusion, miscommunication, a lack of urgency, and a lack of incident command. Analysis of how the lack of an incident command structure impedes the overall response is in “Chapter 3. Leadership, Incident Command, and Coordination.”

At 11:40 a.m., UCISD PD Chief Pete Arredondo, who tossed his radios because he stated that he wanted his hands to be free and indicated there were reception and transmission issues inside the building, calls the emergency communications center from inside the West Building and says that he is inside the building with the subject, who is armed with an AR-15. Chief Arredondo says he “needs a lot of firepower” and that he wants “the building surrounded.” As he is on the phone with dispatch, he learns about a call occurring at the same time from a teacher in the building, who states they believe another teacher has been shot. Chief Arredondo asks whether the teacher is with the shooter, but dispatch does not know. He shares the room number of the shooter’s location with dispatch, then asks for SWAT to set up by the funeral home (which is across the street). He states that he needs more firepower because “all we have” in the hallway at that time are handguns.

The scene continues to be largely a bifurcated response on the north and south ends of the hallway. There is some effort to communicate across each side of the hallway, primarily by phone calls between Chief Arredondo and Uvalde County Precinct 1 Constable Johnny Field. Chief Arredondo and Constable Field coordinate the evacuation of rooms in the West Building; however, at no point is there a common operating plan among officers on scene. Inside the building, intermittent radio issues continue, with radios sometimes working and sometimes not. Chief Arredondo is on the south side of the hallway, and many—but not all—officers on both sides of the hallway view him as the incident commander.

As more officers respond to the scene, families and local community members also begin to gather near the school and funeral home, many of whom express concern and fear for their children. As time passes, bystanders grow increasingly upset and even angry about the tragedy unfolding at the school and the lack of information available to them.

There is ongoing discussion among officers on scene about negotiating with the subject in classrooms 111/112. The discussion is often marked by confusion, including the incorrect information that Chief Arredondo is in the room with the subject. This is broadcast over the radio and conveyed in person among officers on scene. Although the misinformation is corrected by some officers, it persists and continues to spread inside and outside the hallway. This misinformation is first stated at 11:50 a.m. and repeated over the radio. At 12:10 p.m., 20 minutes later, the misinformation is still being shared when a TXDPS trooper on scene misinforms TXDPS dispatch. Attempts to begin a dialogue with the shooter by phone and from outside of the room in the hallway are unsuccessful in both English and Spanish.

At approximately 11:56 a.m., UCISD PD Ofc. 1 informs Constable Field, in the presence of several other officers at the T-intersection of the West Building hallway (see figure 1-1 on page 8), that his wife, a teacher in classroom 112, says she has been shot. Uvalde Police Department (UPD) Acting Chief Mariano Pargas guides UCISD PD Ofc. 1 out of the hallway via the northwest door.

Classroom 110 has already been cleared by Chief Arredondo at the onset of the response. Rooms 127 and 126 in the northeast hallway of the building are cleared and evacuated beginning at approximately 11:54 a.m. The classrooms on the west side of the building are cleared and evacuated between 11:58 a.m. and 12:07p.m., and each evacuation is completed in approximately two minutes or less. Officers on scene break the exterior windows to rooms 102, 103, 104, 105, and 106 to evacuate children and teachers.

Students and a teacher in room 108 are evacuated directly out into the hallway and south doorway. One teacher is evacuated from room 116 directly through the hallway and out the west entry door. Room 129 is also found to have one teacher inside, who is evacuated out the east entry door. One child is found inside the boy’s restroom and evacuated out the east entry door. One adult is evacuated from room 132. One adult is evacuated from the library sometime around 12:00 p.m.; however, the exact time is unknown. Evacuated children and staff run to the funeral home, where families also begin to converge. Other rooms in the West Building are cleared and found to be vacant. Some doors are locked, and some are not.

As children and teachers are evacuated from classrooms, there is growing realization that, in addition to the teacher inside classrooms 111/112 with the subject, there are likely children present in these rooms. Chief Arredondo, in attempts to negotiate with the subject, states “these are innocent children.”
10 Uvalde Police Department Body-Worn Camera Footage. A TXDPS sergeant comments to another TXDPS agent on scene that the subject “shot kids.” While assisting with evacuations, UPD Sgt. 1 comments that “there has to be kids everywhere.”

By approximately 12:09 p.m., all classrooms in the hallways have been evacuated and/or cleared except rooms 111/112, where the subject is, and room 109. Room 109 is found to be locked and believed to have children inside.

At the south end of the hallway, the focus on evacuating room 109 sets off a search for master keys and calls for any entry team from the north end of the hallway to wait until that room is evacuated. Uvalde County Precinct 6 Constable Zamora goes to the north side of the hallway and obtains a set of keys from a UCISD PD lieutenant. Concerned about crossfire into room 109, Chief Arredondo says that the team presumed to be entering classrooms 111/112 from the other side of the hallway needs to wait until they are able to evacuate room 109. He says, “Time is on our side right now. I know we got kids in there, but we gotta save the lives of the other ones.” At approximately 12:10 p.m. a child calls 911 from inside classroom 112, stating they are in a room full of victims. The call lasts approximately 16 minutes, through the shots that are fired at 12:21. Dispatch broadcasts over the radio information about the call at approximately 12:12 p.m., and this information is received and disseminated through both sides of the hallway.

Around this time, the CBP Border Patrol Tactical Unit (BORTAC) commander arrives on scene. The BORTAC commander speaks on the phone with a TXDPS sergeant, who relays Chief Arredondo’s direction to wait for entry. Soon after the call started from the child inside classroom 112, word continues to spread to the law enforcement group at the T-intersection that there are victims in room 112. A law enforcement officer states that “an officer heard from his wife who is in the room dying.”

At 12:21, while Constable Zamora is re-trying keys on room 109, the subject fires four shots inside classrooms 111/112. Officers on both sides of the hallway quickly take cover. Some in the T-intersection immediately move into formation without a word. A Zavala County deputy and a CBP agent advance down the hallway toward the shots fired, followed by the CBP BORTAC commander, another CBP agent, a TXDPS special agent, and others trailing behind. The other law enforcement personnel remain at the T-intersection without advancing. At this point, there is an understanding on both sides of the hallway that an entry team has been formed and they are about to make entry into rooms 111/112.

Phase III: 12:22 p.m.–12:49:58 p.m.

Phase III of the timeline begins at 12:22 p.m., immediately following four shots fired inside classrooms 111 and 112, and continues through the entry and ensuing gunfight at 12:49 p.m. During this time frame, officers on the north side of the hallway approach the classroom doors and stop short, presuming the doors are locked and that master keys are necessary. Also during this time, UCISD PD Chief Pete Arredondo calls off the directive to evacuate room 109 through the door using master keys and instead orders that the evacuation be conducted through the windows. When classroom 109 is evacuated, it is discovered that the room has in fact been occupied by numerous students, including a teacher who has been shot in the abdomen and a child who has been hit in the face by shrapnel. They have been inside room 109 bleeding and muffling their cries to avoid detection by the subject.

Chief Arredondo, who is on the phone with another responding officer on the north side of the hallway, gives the go-ahead to make entry into classrooms 111/112. Chief Arredondo states, “What team? Got a team ready to go? Have at it.” He then begins explaining aspects of the building and classroom, stating that the door is probably locked and that he is going to try to find some keys to test.

Law enforcement medics arrive and begin establishing a triage area outside of the restrooms on the north side of the hallway.

The CBP BORTAC commander tries one set of presumed master keys that do not work. After waiting for approximately nine minutes, the BORTAC commander goes to retrieve breaching tools. Shortly after he returns, working master keys arrive at approximately 12:36 p.m. With working keys in hand, officers in the hallway wait to find out whether a sniper can obtain a visual and eliminate the subject through the window. This is unsuccessful.

At around 12:48 p.m., the entry team enters the room. Though the entry team puts the key in the door, turns the key, and opens it, pulling the door toward them, the CIR Team concludes that the door is likely already unlocked, as the shooter gained entry through the door and it is unlikely that he locked it thereafter. The entry team is composed of three BORTAC members, a CBP Border Patrol Search, Trauma, and Rescue Unit (BORSTAR) member, and deputies from two local sheriffs’ departments— Uvalde and Zavala counties. There is one shield in the stack, which had been provided by the U.S. Marshals Service (USMS) and is rifle-rated. As the entry team prepares to move in, the door begins to swing closed. One team member attempts to move a chair against the door to prop it open, but the door is too heavy, and eventually another member of the entry team simply holds it open as the team makes entry.

After a brief pause in action, gunfire erupts from inside the classrooms. The subject is killed by the entry team at approximately 12:49:58. A BORTAC member receives a graze to their head and leg.

VIA ECF

The Honorable Loretta A. Preska
District Court Judge
United States District Court
Southern District of New York
500 Pearl Street
New York, NY 10007

Re: Giuffre v. Maxwell, Case No. 15-cv-7433-LAP

Dear Judge Preska,

Pursuant to the Court’s December 18, 2023, unsealing order, and following conferral with Defendant, Plaintiff files this set of documents ordered unsealed. This filing also excludes documents pertaining to Does 105 (see December 28, 2023, Email Correspondence with Chambers), 107, and 110 (see ECF No. 1319), while the Court’s review of those documents is ongoing. This is the last set of documents to be filed pursuant to the Court’s December 18, 2023, order.

Respectfully,
/s/ Sigrid S. McCawley
Sigrid S. McCawley
cc: Counsel of Record (via ECF)

VIA ECF

The Honorable Loretta A. Preska
District Court Judge
United States District Court
Southern District of New York
500 Pearl Street
New York, NY 10007

Re: Giuffre v. Maxwell, Case No. 15-cv-7433-LAP

Dear Judge Preska,

Pursuant to the Court’s December 18, 2023, unsealing order, and following conferral with Defendant, Plaintiff files this set of documents ordered unsealed. The filing of these documents ordered unsealed will be done on a rolling basis until completed. This filing also excludes documents pertaining to Does 105 (see December 28, 2023, Email Correspondence with Chambers), 107, and 110 (see ECF No. 1319), while the Court’s review of those documents is ongoing.

Respectfully,

/s/ Sigrid S. McCawley
Sigrid S. McCawley
cc: Counsel of Record (via ECF)

VIA ECF

The Honorable Loretta A. Preska
District Court Judge
United States District Court
Southern District of New York
500 Pearl Street
New York, NY 10007

Re: Giuffre v. Maxwell, Case No. 15-cv-7433-LAP

Dear Judge Preska,

Pursuant to the Court’s December 18, 2023, unsealing order, and following conferral with Defendant, Plaintiff files this set of documents ordered unsealed. The filing of these documents ordered unsealed will be done on a rolling basis until completed. This filing also excludes documents pertaining to Does 105 (see December 28, 2023, Email Correspondence with Chambers), 107, and 110 (see ECF No. 1319), while the Court’s review of those documents is ongoing.

Respectfully,
/s/ Sigrid S. McCawley
Sigrid S. McCawley
cc: Counsel of Record (via ECF)

VIA ECF

The Honorable Loretta A. Preska
District Court Judge
United States District Court
Southern District of New York
500 Pearl Street
New York, NY 10007

Re: Giuffre v. Maxwell, Case No. 15-cv-7433-LAP

Dear Judge Preska,

Pursuant to the Court’s December 18, 2023, unsealing order, and following conferral with Defendant, Plaintiff files this set of documents ordered unsealed. The filing of these documents ordered unsealed will be done on a rolling basis until completed. This filing also excludes documents pertaining to Does 105 (see December 28, 2023, Email Correspondence with Chambers), 107, and 110 (see ECF No. 1319), while the Court’s review of those documents is ongoing.

Respectfully,
/s/ Sigrid S. McCawley
Sigrid S. McCawley
cc: Counsel of Record (via ECF)

VIA ECF

The Honorable Loretta A. Preska
District Court Judge
United States District Court
Southern District of New York
500 Pearl Street
New York, NY 10007

Re: Giuffre v. Maxwell, Case No. 15-cv-7433-LAP

Dear Judge Preska,

Pursuant to the Court’s December 18, 2023, unsealing order, and following conferral with Defendant, Plaintiff files this set of documents ordered unsealed. The filing of these documents ordered unsealed will be done on a rolling basis until completed. This filing also excludes documents pertaining to Does 105 (see December 28, 2023, Email Correspondence with Chambers), 107, and 110 (see ECF No. 1319), while the Court’s review of those documents is ongoing.

Respectfully,
/s/ Sigrid S. McCawley
Sigrid S. McCawley
cc: Counsel of Record (via ECF)

VIA ECF

The Honorable Loretta A. Preska
District Court Judge
United States District Court
Southern District of New York
500 Pearl Street
New York, NY 10007

Re: Giuffre v. Maxwell, Case No. 15-cv-7433-LAP

Dear Judge Preska,

Pursuant to the Court’s December 18, 2023, unsealing order, and following conferral with Defendant, Plaintiff files this set of documents ordered unsealed. The filing of these documents ordered unsealed will be done on a rolling basis until completed. This filing also excludes documents pertaining to Does 105 (see December 28, 2023, Email Correspondence with Chambers), 107, and 110 (see ECF No. 1319), while the Court’s review of those documents is ongoing.

Respectfully,
/s/ Sigrid S. McCawley
Sigrid S. McCawley
cc: Counsel of Record (via ECF)

VIA ECF

The Honorable Loretta A. Preska
District Court Judge
United States District Court
Southern District of New York
500 Pearl Street
New York, NY 10007

Re: Giuffre v. Maxwell, Case No. 15-cv-7433-LAP

Dear Judge Preska,

Pursuant to the Court’s December 18, 2023, unsealing order, and following conferral with Defendant, Plaintiff files this set of documents ordered unsealed. The filing of these documents ordered unsealed will be done on a rolling basis until completed. This filing also excludes documents pertaining to Does 105 (see December 28, 2023, Email Correspondence with Chambers), 107, and 110 (see ECF No. 1319), while the Court’s review of those documents is ongoing.

Respectfully,
/s/ Sigrid S. McCawley
Sigrid S. McCawley
cc: Counsel of Record (via ECF)

VIA ECF

The Honorable Loretta A. Preska
District Court Judge
United States District Court
Southern District of New York
500 Pearl Street
New York, NY 10007

Re: Giuffre v. Maxwell, Case No. 15-cv-7433-LAP

Dear Judge Preska,

Pursuant to the Court’s December 18, 2023, unsealing order, and following conferral with Defendant, Plaintiff files this set of documents ordered unsealed. The filing of these documents ordered unsealed will be done on a rolling basis until completed. This filing also excludes documents pertaining to Does 105 (see December 28, 2023, Email Correspondence with Chambers), 107, and 110 (see ECF No. 1319), while the Court’s review of those documents is ongoing.

Respectfully,
/s/ Sigrid S. McCawley
Sigrid S. McCawley
cc: Counsel of Record (via ECF)

…

(U//FOUO) Twenty out of the 22 reports examined by the ARTIC from 2017 to 2019 involved military members allegedly demonstrating support for white supremacist or neo-Nazi ideology and or associating with explicitly white supremacist or neo-Nazi organizations. Two reports involved alleged support for ideology in support of foreign terrorist organizations, namely ISIS. In all 22 reports the suspects were male.

(U//FOUO) Of the 22 cases examined, 13 involved Soldiers, six involved Marines, two involved Airmen, and one involved a member of the Coast Guard. Seven out of the 22 members engaged in, or discussed engaging in, violent acts involving explosives and or firearms.

(U//FOUO) Nine of the cases involved members of “Identity Evropa”, which re-branded as the American Identity Movement (AIM), an alt right white supremacist group; three cases involved members of “Atomwaffen Division” (AWD), a violent anarchist neo-Nazi group that became active in 2016; two cases involved individuals fighting with far-right paramilitary groups in Ukraine; two cases involved supporters of the Islamic State of Iraq and Syria (ISIS); two cases involved individuals belonging to an alleged white supremacist affiliated group called “Ravensblood Kindredone; one case involved a member of the “Patriot Front (PF), a pro-white nationalist, anti-multicultural and anti-immigrant organization; and three were unspecified.

(U//FOUO) It is likely that most if not all service members who embrace extremism were exposed to extremist ideology via the internet or social media applications. While the ARTIC found no evidence of extremist organizations specifically targeting DoD members through social media or other means, according to open source research, social media platforms play an important role in the likely self-radicalization processes of US extremists. According to the National Consortium for the Study of Terrorism and Responses to Terrorism (START), in 2016 alone, social media contributed to the radicalization processes of nearly 90% of extremists contained within their database. Right-wing extremist networks in particular use Twitter, post videos on YouTube, establish Facebook pages, create Instagram accounts, and communicate on social media sites with minimal moderation such as Gab and 8chan.

(U//FOUO) The ARTIC notes that based on investigations conducted by the Army Criminal Investigative Command (CID), CID does not assess a danger of white supremacy or any other form of racially motivated violent extremism becoming a pervasive issue across the Army. According to CID, focused collection on extremist activity within the past year revealed a common thread for the Soldiers identified as participating in extremist groups being that they are commonly isolated in units, failing to fully integrate into Army life, rather than emerging as influential among their Soldier peers. Although the ARTIC has not coordinated with investigative agencies from other military branches, based upon the reporting reviewed, we judge the findings by CID are likely applicable across the military.

…

(U) Atomwaffen Division (AWD)

(U) According to the Anti-Defamation League (ADL), the AWD is a small neo-Nazi group that became active in 2016. The group is believed to have originated online from a now-defunct Neo-Nazi forum called Iron March, which was known for its extreme content and calls for violence. According to the AWD website, they are “a revolutionary national socialist organization centered around political activism and the practice of an autonomous fascist lifestyle.” They promote the idea that societal and governmental “systems” are collapsing and that democracy and capitalism have “given way to Jewish oligarchies and globalist bankers resulting in the cultural and racial displacement of the white race.”

(U) Members train in preparation for an impending race war and promote the use of violence to reach their goal of “uncompromising victory.” In a promotional video published on 21 JAN 18, members, dressed in military-styled camouflaged fatigues, shout “gas the Kikes” and “race war now” as they fire weapons and practice tactical maneuvers.

(U) In December 2017, one of AWD’s leaders, John Cameron Denton (AKA Vincent Snyder), laid out the group’s plans on their Siege Culture website: “Our responsibility right now is resistance, anything that happens after that we’ll simply adapt to it and work with what we have.” Denton, who lives in Texas, has attended white supremacist rallies and events in Houston and Austin alongside members of the White Lives Matter movement and the Aryan Renaissance Society. (ADL, 2019; Open Source, 01 FEB 18)

(U) American Identity Movement (AIM)

(U) According to the ADL, the AIM is an alt right white supremacist group that began in 2019 as a rebranding of Identity Evropa, one of the largest groups within the alt right segment of the white supremacist movement.

(U) On 08 MAR 19, during Identity Evropa’s annual conference, the group’s leader, Patrick Casey, announced the dissolution of Identity Evropa and the creation of AIM. During the conference, all Identity Evropa members in good standing were invited to join AIM. (ADL, 2020)

(U) Azov Regiment (AR)

(U) The Azov Regiment is a combined arms special task unit of the Ukrainian National Guard comprised of contract solders to include foreign fighter volunteers. It was formed in May 2014 as a volunteer military battalion to counter Russian-backed proxy forces fighting in the Azov sea coastal region of Mariupol. In November 2014 it was incorporated into the National Guard and updated to a Regiment in January 2015. The regiment, considered ultra-national, includes elite units trained in Reconnaissance and EOD specialties by former Ukrainian Army Special Forces. According to open source, Azov is rooted in neo-Nazism based on ideologies expressed by leadership and embalms associated with the group. In 2018, US Congress pass legislation blocking military aid to Azov due to suspected white-supremacy goals.

(U) Patriot Front (PF)

(U) The Patriot Front is considered a pro-white nationalist, anti-multicultural, anti-immigrant, and anti-Semitic organization. The Patriot Front broke from the white-nationalist group Vanguard America in August 2017 following the August 2017 Unite the Right rally in Charlottesville, Virginia. The Patriot Front believes the United States’ unique cultural identify was forged by pan-European pioneers, explorers, visionaries, and is being compromised by a dysfunctional and tyrannical government. The Patriot Front claims to seek a return to the traditions and values (political, social, and religious) defined by America’s forefathers. The group embraces imagery depicting American patriotic and traditional fascist themes. The Patriot Front is known to distribute propaganda through fliers and stickers, often at universities and synagogues. During public demonstrations, the Patriot Front has called for the deportation or marginalization of non-whites. Reporting indicates the Patriot Front has not directly engaged in violent activity.

(U) The Base

(U) The Base is identified as a white nationalist survivalist group that proclaims to defend the European race while establishing a network of supporters willing to use violence to overthrow the current social and political order and hasten in a perceived impending race war. The Base was formed in 2018 and operates primarily in the US although reporting indicates some low level activity in Europe. The Base reportedly draws inspiration from the neo-Nazi hate group Atomwaffen Division (AWD) and writings by prominent Neo-Nazi Authors The Base reportedly includes members from the AWD and the far-right environmental groups such as the Eco-Fascist Order. (Open Source, 25 JAN 20; Open Source, 16 NOV 19; Open Source, 2020)

Phase 2 of the research serves to build upon the foundation laid in Phase 1. The Phase 2 research further explores: the criminal groups utilizing digital assets in illegal activities; how these criminal groups are conducting illicit activity and recruiting members; cryptocurrency ATMs and Point-of-Sales illicit uses; generative AI applications in cybercrime; darknet market use of digital assets; the evolving use of cryptocurrencies (especially the year to date change); criminal activity’s impact on government and private sector; and additional policy recommendations. Although illicit use can never be completely eliminated, it can be mitigated by increased consumer knowledge, proactive law enforcement investigations, and better practices and regulations issued by key stakeholders.

…

Russian Intelligence Services Leveraging Cryptocurrency for Operational Purposes

Due to the ability to facilitate clandestine payments through a variety of different tradecraft methods, cryptocurrency has been leveraged by not only Russian-based non-state actors and criminal groups, but also by state-sponsored Russian Government entities and intelligence services. On 9 June 2023, the US Department of Justice (DOJ), released a public statement detailing a variety of unsealed charges related to cryptocurrency exchange hacks, money laundering, and illicit activity conducted by multiple Russian threat actors, with direct ties to Russian intelligence services.

Russian nationals Alexey Bilyuchenko and Aleksandr Verner, were charged with conspiring to launder approximately 647,000 bitcoins over the course of a three-year period, following their hack of major cryptocurrency exchange, Mt. Gox, dating back to 2011. Per the recently unsealed indictment, it was revealed that in 2011, both Bilyuchenko and Verner gained access to Mt. Gox users’ data, transactional database, and the private keys, which were necessary to facilitate all trading movement on the exchange. Between 2011 and 2014, approximately 647,000 bitcoin was moved out of Mt. Gox hosted wallets to other cryptocurrency exchanges, which included BTC-e and TradeHill. Additional assets were also moved to Bilyuchenko’s and Verner’s own Mt. Gox accounts. Notably, the exchange BTC-e was administratively run by Bilyuchenko up until it’s shut down in 2017 by the FBI for illicit activity and money laundering on behalf of Russian-based ransomware gangs. Additional investigative reports unsealed by the Department of Homeland Security (DHS), reveal that Bilyuchenko and Verner moved the bitcoin from Mt. Gox to the exchange BTC-e at the time it was operational, after which it was further transitioned to two now-defunct bitcoin companies, Bitlnstant and Memory Dealers. Bitlnstant was a cryptocurrency exchange that was founded by Charlie Shrem, who in 2014, was sentenced to two years in prison for money laundering.

..

Cartel Finance

Mexican-based drug cartels have historically generated significant amounts of illicit proceeds through their global presence and narcotics distribution rings. A recently released report from the International Narcotics Control Board estimates that Mexican drug cartels are believed to launder approximately $25 billion per year in Mexico. Subsequently, their need to conceal these proceeds and launder their funds is necessary to maintain the success of their operations. In April 2023, the FBI and DEA indicted twelve people associated with the Sinaloa cartel, a transnational criminal organization that allegedly laundered over $16.5 million, a majority of which was moved via large bulk cash drops in hotel rooms and parking lots of various US cities to include Chicago, Boston, New York City, Baltimore, Philadelphia, among many others. The funds would then be laundered through multiple shell companies, after which they were ultimately transferred to bank accounts in Mexico. In a recent investigation led by the US Drug Enforcement Agency (DEA), it was determined that an illicit drug cartel was moving methamphetamine and cocaine across the US, Mexico, Europe, and Australia by leveraging the world’s largest cryptocurrency exchange, Binance. The group allegedly laundered over $40 million in illicit proceeds via this exchange.

…

Terrorist Financing

Terrorist organizations rely on a consistent influx of funds in order to carry out and plan their operations. Historically, they have leveraged donations and the religious obligation of tithe in order to raise money. Other forms of revenue generation include illegal drug and arms dealing, with a combined need to finance their own members and associates. In recent years, this tradecraft has shifted to a reliance on cryptocurrency for fundraising, financing attacks, purchasing equipment, supporting fighters and their families, among other purposes. Jihadi blogs alone, have become the source of millions of dollars in bitcoin in the form of donations to ISIS, Al-Qaeda, Hamas, and the Muslim Brotherhood. In conjunction with all the aforementioned threat actors, these groups also significantly leverage social media platforms for the purpose of soliciting donations from their followers. They will utilize communication platforms such as the messaging app Telegram, which allows for encrypted and clandestine messaging. They will utilize Facebook and Twitter for the purposes of posting their wallet addresses to receive donations, as well as provide their supporting base with PDF and video guides for how to obtain, and donate cryptocurrency. Bitcoin is the most frequently used due to liquidity, alongside AEC’s such as Monero, Z-Cash and Dash, among others.

…

Money Laundering

Money laundering traditionally begins with ill-gained fiat currency that criminals wish to make usable. One strategy is to have money mules transfer these funds into bank accounts for later transfer/withdrawal. Cryptocurrency has opened new avenues for money launderers utilizing bank deposits by mules who then purchase cryptocurrency. Bitcoin ATMs are another popular method for money mules to convert fiat currency into cryptocurrency. Bitcoin ATMs are physical machines where people can buy cryptocurrency with cash, requiring varying amounts of personal information to use. Once the fiat currency is converted into cryptocurrency, there are multiple ways it can be laundered, making it difficult for law enforcement to track.

Cryptocurrency mixers, for example, aid in obfuscating the origins of the processed cryptocurrency. This happens by rapidly pooling currency streams into many small transactions across many wallets. Mixers allow illicit actors to launder high amounts very conveniently and are not inherently illegal. The co-founder of Tornado Cash, a popular cryptocurrency mixer, told Bloomberg in March 2022 that their service can be defined as an “anonymizing software provider” which does not subject them to money transmitter regulations in the U.S. Our group examined some of the most popular and common mixers/tumblers used today and our findings are reviewed in the chart below.

…

Pseudo-Anonymity and Weaknesses in KYC

Pseudo-anonymity is a key factor in propelling the use of cryptocurrencies and other emerging digital assets for illicit purposes. Bitcoin is the original catalyst for this element due to its pseudo-anonymous nature. A person’s identity is tied to a fake name or pseudonym in using bitcoin which serves as their public key and bitcoin address. Bitcoin has never been truly anonymous because all transactions are available on the public network leaving anyone easily being able to see records of all transactions a bitcoin address has conducted. It is up to the bitcoin address holder to prevent their actual identity from being linked to their pseudonym in bitcoin. As other cryptocurrencies have emerged the same principles have applied in that they provide pseudo-anonymity and a means for people to make transactions that aren’t under their true identity. As we’re entering a new phase of digital assets, they are taking it a step further by providing complete anonymity or near complete anonymity which is discussed with Monero and NFTs in a later section. However it has largely been a misconception that cryptocurrencies are completely anonymous and even with their pseudo-anonymous nature, illicit actors have not been able to hide from authorities.

…

NFTs and Other Blockchain Applications Risk of Illicit Use

Other, emerging blockchain applications such as NFTs and digital payment services such as gaming currency and P2P services present a great risk of illicit use. While these forms are just starting to emerge in criminal cases, they have the potential for large-scale mis-use by illicit actors. The first U.S. federal criminal case involving NFTs occurred in March 2022 and provides a great case study into how this class of digital assets can be misused.

Case Study – NFT “Rug Pull Scheme”

Ethan Vinh Nguyen and Andre Marcus Quiddaeon were both arrested in Los Angeles in March 2022 after they were charged with conning buyers of NFTs worth 1.1 million. They were charged with both wire fraud and conspiracy to commit money laundering after issuing a set of NFTs known as “Frosties”. The purchasers of “Frosties” were supposed to be eligible for exclusive hodler rewards including early access to a meta verse game and giveaways. These types of NFTs which offer special bonuses are specifically known as utility NFTs. Nguyen and Quiddaeon subsequently ditched the project after selling out just hours after launching and transferred the money earned from the sales of the NFTs to multiple cryptocurrency wallets under their control. They started their project under pseudonyms which further demonstrates the pseudo-anonymity involved in online blockchain applications. Criminals can hide behind online identities while promoting their NFTs and ultimately perform a “rug pull” leaving any investors defrauded.

Fentanyl/Heroin

• Crystal Methamphetamine/Methamphetamine
• Cocaine/Crack Cocaine
• Prescription Drugs
• Marijuana

(U//FOUO) Therefore, based on 2022 reporting, the Michigan HIDTA has identified the following key findings:

Fentanyl/Heroin

• (U//FOUO) According to the drug teams surveyed, 55% indicated fentanyl is their most significant threat in 2022 compared to 53% in 2021. Additionally, 21% of drug teams surveyed reported heroin as their second most significant threat, which is a decrease from 44% in 2021.
• (U//FOUO) Fentanyl is identified as the most lethal threat within the State of Michigan.
• (U//FOUO) Michigan HIDTA task forces seized roughly 123 kilograms of fentanyl in 2022, compared to 211 kilograms in 2021, which is roughly a 42% decrease.
• (U//FOUO) Michigan State Police forensic laboratory data, identifying the predominant drug type in tested samples, showed roughly a 14% decrease in the presence of fentanyl from 2021 to 2022.

Crystal Methamphetamine/Methamphetamine

• (U//FOUO) According to the drug teams surveyed, 39.5% indicated crystal methamphetamine, also known as ICE, is their most significant threat in 2022, with 97% reporting it is available within their AOR.
• (U//FOUO) Michigan HIDTA task forces seized 288 kilograms of methamphetamine powder/ICE in 2022, compared to 597 kilograms in 2021, which is a 51% decrease in seizures.
  • (U//FOUO) A reason for this decrease is due to two HIDTA initiative’s investigative efforts, resulting in the seizure of 260 kilograms of crystal methamphetamine in 2021.
• (U//FOUO) According to the Michigan State Police Michigan Incident Crime Reporting (MICR), methamphetamine incidents were the highest among drug-related arrests in 2022 and accounted for roughly 34% of total narcotic arrests.
• (U//FOUO) Michigan State Police forensic laboratory data, identifying the predominant drug type in tested samples, showed roughly a 7% decrease in the presence of methamphetamine from 2021 to 2022.

Cocaine/Crack Cocaine

• (U//FOUO) Michigan HIDTA task forces seized 5,727 kilograms of cocaine/crack in 2022, compared to 272 kilograms in 2021, which is a 2,005% increase.
  • (U//FOUO) A reason for this increase is due to one HIDTA initiative’s investigative efforts, resulting in the seizure of 4,930 kilograms of cocaine in 2022.
• (U//FOUO) The availability of cocaine increased with 97% of drug teams reporting the drug is readily available compared to 91% in 2021.

Prescription Drugs

• (U//FOUO) Michigan is a source state for diverted prescription drugs in Indiana, Kentucky, North Dakota, Ohio, Pennsylvania, Tennessee, and West Virginia.
• (U//FOUO) Michigan HIDTA task forces seized 559 kilograms of prescription drugs in 2022, compared to 117 kilograms in 2021, which is a 378% increase.
  • This increase is likely due to the spike in counterfeit pharmaceutical tablets in Michigan as there is no separate reporting category for counterfeit pills.

Marijuana

• (U//FOUO) Michigan HIDTA task forces seized 3,878 kilograms of processed marijuana/plants in 2022, compared to 6,406 kilograms in 2021, which is a 65% decrease.
• (U//FOUO) Marijuana continues to be the most readily available drug in the State of Michigan due to the legalization of recreational and medical marijuana. However, black market marijuana is still being trafficked.
• (U) According to the Cannabis Regulatory Agency (CRA), Michigan’s cannabis market has grown to a powerhouse status with nearly $2.3 billion in sales for 2022.

Emerging Trends

• (U//FOUO) According to Michigan State Police forensic laboratory data; aside from heroin and fentanyl, the most common drug mixture in 2022 was fentanyl and fluorofentanyl (215 identifications).
• (U//FOUO) According to drug teams surveyed, 76% reported counterfeit pills are available within their AOR compared to 62% in 2021.

Drug Trafficking Organizations

• (U//FOUO) In 2022, Michigan HIDTA task forces investigated 264 Drug Trafficking Organizations (DTOs) and Money Laundering Organizations (MLOs) compared to 270 DTOs/MLOs in 2021, which is a 2% decrease. Of the 264 investigated, 108 DTOs/MLOs were dismantled or disrupted, which is indicative of the strong DTO/MLO presence in the region and a strong, organized law enforcement response.
• (U//FOUO) The most notable sources of narcotics supply for Michigan are Mexican drug cartels, specifically the Sinaloa Cartel and Jalisco New Generation Cartel (CJNG).

…

…

(U//FOUO) Antiregime militia groups were responsible for more than 60 percent of all the attacks in Burma in 2022, according to the NCTC database. Terrorists or militants also conducted multiple attacks in Afghanistan, Burkina Faso, Libya, and Turkey in 2022, probably to undermine government legitimacy.

(U//FOUO) More than 70 percent of terrorist and militant attacks against electric power infrastructure from 2015 through 2022 involved explosives, probably because of the easy access to explosive material in conflict zones. In Western countries, violent extremists have more frequently advocated for firearms attacks on electricity infrastructure, according to a DHS report.

(U//FOUO) Since 2015, almost two-thirds of terrorist and militant attacks have hit soft energy targets, such as offices, personnel, and low- and high-voltage transmission towers and lines, according to the NCTC database. In 2021-22, attacks on critical components of the grid, such as substations and power plants, increased by more than 200 percent.

…

The key finding of the COTE response is that, broadly, COTE plan requirements included in the FY 2021 NDAA are addressed through existing authorities, policies, plans, and frameworks. Creation of a COTE plan with a singular economic focus, coupled with new response frameworks, has the potential to create confusion and duplicate existing response and recovery mechanisms. However, the fundamentally important concept of economic recovery and response detailed in the COTE requirement should be deeply integrated within existing incident response frameworks to avoid creating an additional layer of potentially divergent planning and response activities operating in parallel to already established procedures. In lieu of developing a standalone COTE plan, the federal government should continue to refine and strengthen existing authorities, policies, plans, and frameworks for Federal Mission Resilience and domestic incident preparedness, response, and recovery. This COTE response provides several specific recommendations for how the federal government can continue to enhance the ability to maintain and restore the U.S. economy in response to a significant event.

…

To support development of the COTE response, CISA identified seven key priority critical infrastructure sectors for focus when reviewing plans and procedures. This determination is based on research, interagency and private sector stakeholder discussions, survey responses, and advice from subject matter experts. The seven key critical infrastructure sectors are: Energy, Communications, Information Technology, Financial Services, Food/Agriculture, Transportation, and Water/Wastewater. These priority sectors should be validated and updated via existing risk management forums and councils after the further analysis called for in Recommendations 1.1 and 1.2.

…

(U//FOUO) The New Mexico All Source Intelligence Center (NMASIC) recognizes individuals have constitutionally protected rights to assemble, speak and petition the government. The NMASIC safeguards these rights and only reports on First Amendment-protected activities for operational planning in the interest of public safety.

(U) Synopsis

Peace In Ukraine protest is scheduled to take place March 18, 2023 at San Mateo and Gibson in Albuquerque at 1400 hrs.. This protest is hosted by the Party for Socialism and Liberation. There are no known numbers at this time, however based on historical events with PSL, they tend to have 50-150 people show up depending on the cause.
Albuquerque
• Who: Party for Socialism and Liberation
• What: Peace in Ukraine
• When: Saturday, March 18, 2023,
at 2 pm
• Where: San Mateo and Gibson, Albuquerque, NM

(U//FOUO) A People’s Republic of China (PRC) municipal government-controlled media outlet is very likely directing a cluster of English-language, coordinated inauthentic Twitter accounts that posted content denigrating the United States (see graphics). The cluster of accounts, which we have dubbed SPICYPANDA, has been active from at least January 2021 and has published sophisticated content, but it failed to grow a follower base thus far. DHS attributed SPICYPANDA to the municipal media entity Chongqing International Communications Center (CICC) based on its leadership’s creation of SPICYPANDA’s anti-US messaging campaign, its overt ties to a website promoted by the accounts, and its Western social media messaging accolades and capabilities.

…

(U//FOUO) Overview of DRAGONBRIDGE and its Narratives

(U//FOUO) Some of the identified inauthentic Twitter accounts are part of both the SPICYPANDA cluster and a larger network known as DRAGONBRIDGE. DRAGONBRIDGE has been tracked for the past three years by private sector researchers, but it has not been previously attributed—in whole or in part—to a specific person or group.

(U//FOUO) DRAGONBRIDGE (also known as SPAMOUFLAGE DRAGON) is a large network of social media accounts first observed on Facebook, Twitter, and YouTube in 2019 criticizing pro-democracy protests in Hong Kong. Since then, accounts in the network have been observed posting in seven languages on 20 social media platforms and on over 40 other websites. The network is comprised of many clusters of co-managed accounts that seemingly operate independently of each other, judging from two private sector analytic reports on the network and a DHS review of identified and suspected accounts. DRAGONBRIDGE has employed at least 100,000 accounts in its history on a single social media platform, according to the identified platform, and we assume it has employed similar numbers of accounts on other major platforms. Despite the size of the network, it rarely engages with authentic social media users; however, it has had some limited success in reaching individuals recently.

(U) Since 2019, DRAGONBRIDGE has posted content regarding Hong Kong, COVID-19, the US withdrawal from Afghanistan, Taiwan, the 2022 Beijing Olympics, rare earth mineral mining companies, the 2022 US midterm election, and many other topics. Content promoted by the network is consistently aligned with Beijing’s interests.

…

..

…

(U//FOUO) Historically, the prevailing drivers for most anarchist violent extremist-related criminal activity had been motivated by anti-capitalist and anti-law enforcement sentiment, with a small percentage of incidents motivated by anti-racism or anti-fascism. More recently, the latter has been a driver for some anarchist violent extremist-related criminal activity.

(U) TARGETS and TACTICS

(U//FOUO) Targets: Anarchist violent extremists generally target perceived symbols of capitalism, globalization, authoritarianism, and environmental exploitation. Examples include multinational corporations; financial institutions; political, economic, or social issue events; and government, military, and law enforcement property. Anarchist violent extremists also have targeted individuals with ideologies contrary to their own, to include perceived racists/fascists and law enforcement.

(U//FOUO) Tactics: Typical criminal tactics used by anarchist violent extremists include arson, physical assault, vandalism, graffiti, improvised incendiary devices (IIDs) or improvised explosive devices (IEDs), including fireworks and flares, and weapons of opportunity or those easily accessible such as bricks, rocks, bike racks, baseball bats, wooden sticks, lead pipes, brass knuckles, hammers, axe handles, bear/pepper spray, metal chains, batteries, quick-drying cement in containers, frozen water bottles, and construction materials. To hide their identities during criminal activity, anarchist violent extremists sometimes use “black bloc” tactics in which they dress in black or dark clothing and cover their faces with bandanas, balaclavas, costume masks, or gas masks. By employing black bloc tactics, anarchist violent extremists express solidarity with one another, impart a daunting physical group presence, and provide possible anonymity from identification.

(U//FOUO) Anarchist violent extremists are likely to continue operating independently; however, a local or national issue may motivate some extremists to act collectively, locally or regionally. Although they are loosely affiliated nationally, anarchist violent extremists have shown the ability to mobilize in an organized manner quickly, sometimes forming non-hierarchical local groups, in response to issues or events in conflict with their ideology. The degree of hierarchy, autonomy, locality, and affiliation among anarchist violent extremist actors varies.

(U) INDICATORS

(U//FOUO) Indicators of anarchist violent extremist ideology may comprise constitutionally protected conduct, and no single indicator should be the sole basis for a determination of anarchist violent extremism or criminal activity. The following indicators of anarchist violent extremist ideology may constitute a basis for reporting or law enforcement action when observed in combination with suspicious criminal or potentially violent activity:
(U//FOUO) Creating anti-capitalist or anti-law enforcement graffiti
(U//FOUO) Conducting pre-operational surveillance of government buildings or symbols of capitalism, such as multinational corporations, commercial businesses, or financial institutions
(U//FOUO) Making claims of or calling for criminal action against business, government, or law enforcement entities on extremist websites
(U//FOUO) Seeking or acquiring materials to construct IIDs or IEDs

(U) NOTABLE ATTACKS or CRIMINAL ACTS

(U//FOUO) In late August 2020, a now-deceased anarchist violent extremist allegedly fatally shot a man in Portland, Oregon, during an event that included individuals with opposing ideologies.

(U//FOUO) In July 2019, an anarchist violent extremist set fire to a detention center and a vehicle using IIDs in Tacoma, Washington. He engaged responding police officers with an AR style rifle and was killed during the encounter.

(U//FOUO) In June 2019, violence between individuals with opposing ideologies occurred in Portland, Oregon. Multiple assaults occurred and items were reportedly thrown at demonstrators and law enforcement, to include items that looked like milkshakes but contained quick-dry concrete. As a result of the violence, eight law enforcement officers were injured and local police arrested three individuals.

(U//FOUO) In April 2019, an anarchist violent extremist rammed a vehicle with stolen plates into a building occupied by a cleared defense contractor in San Diego, California. After the vehicle hit the building, the perpetrator was observed opening the back hatch of the vehicle and shortly thereafter a fireball shot out from the vehicle. Law enforcement investigation identified the subject and he was taken into federal custody.

(U//FOUO) In December 2018, federal authorities arrested two anarchist violent extremists plotting a terrorist attack targeting a bar in Toledo, Ohio, after the two individuals purchased materials to carry out the attack. Searches recovered multiple weapons including an AK-47, a tactical vest with two loaded magazines for an AK-47, two loaded magazines for a pistol, a gas mask, and printed instructions on how to construct bombs.

(U//FOUO) In June 2018, an anarchist violent extremist in Missouri received a federal prison sentence of 30 months incarceration for unlawful possession of firearms. The previously convicted felon was arrested in September 2017 following law enforcement reporting he was in possession of a firearm and was planning to obtain additional firearms.

(U) KEY TERMS

ACAB

An acronym for “All Cops Are B*stards.” It is sometimes used by anarchist violent extremists and others as a slogan or graffiti to express anti-law enforcement sentiment. Instead of the letters, the numbers “1312” may also be used. It can also be an abbreviation for “All Capitalists are B*stards.”

Black Bloc

A tactic often used by anarchist violent extremists during mass mobilizations. Those who are part of a “Black Bloc” generally dress in dark clothing covering their heads to their feet and cover their faces with bandanas, balaclavas, costume masks, or gas masks. It is believed anarchist violent extremists use this tactic to express solidarity with one another, impart a daunting physical presence as a group, and provide for anonymity against identification. The dark clothing may be hidden under street clothing and quickly discarded prior to engaging in criminal actions or extremists may remove and discard black clothing and reveal street clothing in order to blend in with lawful protesters.

Circled-letter A

A well-known symbol or representation associated with anarchism, world-wide, and often seen spray-painted or as graffiti. It is said to represent French anarchist Pierre-Joseph Proudhon’s maxim “Anarchy is Order,” with the letter “A” for anarchy, or without rulers, and the circle as a symbol of order. The symbol was reportedly used by anarchists during the Spanish Civil War and is said to symbolize what anarchists desire: an organized society free of external authority.

Green Anarchy
An anarchist school of thought focused on environmental issues. Green anarchist violent extremists contend capitalists’ pursuit of profit and expansion is detrimental and contributes to the destruction of the environment. The target for a green anarchist violent extremist can may be viewed as a symbol of capitalism and an agent of environmental harm.

May Day

On May 1, anarchists around the world often gather to commemorate International Workers’ Day. This date also coincides with the 1886 McCormick Harvester Works strike in Chicago, Illinois, which turned violent and became known as the Haymarket Square riot. While most gatherings are peaceful, some incidents of property damage by anarchist violent extremists and confrontations with law enforcement have occurred.

No Gods, No Masters

An anarchist and labor slogan which originated in Europe and has been used by anarchists since the late 19th century. The phrase appears in anarchist literature as well as graffiti.

No War But The Class War

A phrase used by anarchists to express opposition to capitalism and anarchist class struggle against authority and oppression.

Three Arrows/Three Arrows in a Circle

A symbol believed to have originated as a social-democratic political symbol in Germany against Nazism and designed to easily cover over swastikas. More recently it may be seen displayed on flags or as graffiti associated with anti-fascist anarchists with the arrows representing unity, activity, and discipline.

(U//FOUO) Some MVEs call themselves III%ers (Three Percenters), based on their belief that only three percent of American colonists took up arms against the British Government during the Revolutionary War. Some III%ers regard the present-day US Government as analogous to the British monarchy during the 18th century in terms of its infringements on civil liberties. The term generally represents the perception that a small force with a just cause can overthrow a tyrannical government if armed and prepared.

(U//FOUO) Some MVEs use the term “Boogaloo,” which references a violent uprising or impending civil war. The term has particularly resonated with MVEs, who have adopted it to reference an impending politically-motivated civil war or uprising against the government following perceived incursions on Constitutional rights—including the Second Amendment—or other perceived government overreach.

(U) TARGETS and TACTICS

(U//FOUO) Targets: Traditionally, MVEs have targeted government and law enforcement personnel and facilities, which they regard as threatening the rights of American citizens. MVEs have also targeted entities that they perceive as posing national security and social threats to the United States, such as undocumented immigrants and suspected drug traffickers along the southwest border; Muslims, Islamic centers, and mosques; and suspected looters and individuals whose ideologies they oppose, including perceived anti-fascists. Extremist members of armed militias that patrol the US-Mexico border, purportedly to assist authorities, have threatened violence against and detained migrants, and their operations increase the possibility of violent encounters with law enforcement. Some MVEs have plotted attacks on critical infrastructure in order to provoke a civil war between citizens and the government.

(U//FOUO) Tactics: Some MVEs form or become members of groups in order to advance violent plots against their targets or to prepare for emergency contingencies that they believe would require a militia. Some of these groups focus recruitment efforts on current/former law enforcement and military personnel for their weapons skills, training, and potential access to restricted databases. MVEs often subject prospective members to background checks and interviews. MVEs in various geographic locations use the Internet and encrypted applications to plot criminal activity, transmit ideology, solicit donations, recruit members, plan meetings or training events, and display training videos. MVEs conduct paramilitary training, often called field training exercises, which involves the use of firearms and sometimes explosives and often incorporates US military tactics, such as combat techniques, hand signals, security detail operations, and survival skills. MVEs often use legally purchased firearms in their illegal activities. In some cases, they seek to purchase firearms from gun shows and associates rather than traditional dealers in order to avoid documentation of their purchases. Some MVEs acquire illegal guns or firearms and components for which they are not licensed, including automatic weapons and suppressors, or circumvent firearms regulations and background checks by assembling firearms from components, or by modifying otherwise legal guns, such as converting semiautomatic firearms to fully automatic. MVEs sometimes seek to acquire or produce explosives to use in violent plots or stockpile for later use. MVEs generally attempt to manufacture improvised explosive devices using commercially available materials, though some also attempt to obtain military-grade or industrial explosives.

(U) INDICATORS

(U//FOUO) Indicators of militia violent extremist ideology may comprise constitutionally protected conduct, and no single indicator should be the sole basis for a determination of militia violent extremism or criminal activity. The following indicators of militia violent extremist ideology may constitute a basis for reporting or law enforcement action when observed in combination with suspicious criminal or potentially violent activity:

(U//FOUO) MVEs often reference the Second Amendment, allegations of tyranny, and historic grievances, such as federal law enforcement’s handling of the raids in Ruby Ridge, Idaho, in 1992 and Waco, Texas, in 1993.

(U//FOUO) Some MVEs highlight the deaths of other likeminded individuals involved in encounters with the government and law enforcement, including US persons LaVoy Finicum, Duncan Lemp, and others.

(U//FOUO) Rhetoric, imagery, and attire referencing the III% are possible indicators of MVE activity, although not all MVEs ascribe to the concept.

(U//FOUO) Some MVEs have used the terminology and imagery associated with the “boogaloo” concept to network in person and online based on shared grievances with the government and law enforcement. Rhetoric, imagery, and attire referencing the “Boogaloo” are possible indicators of MVE activity, although not all MVEs ascribe to the concept. The term is also used to a lesser extent by other actors, including racially or ethnically motivated violent extremists (RMVEs) who advocate superiority of the white race. Some RMVEs have used the term to reference an impending race war or other conflict that will lead to the collapse of the “system,” to include the US Government and society, and allude to it using shorthand such as “big igloo” or “big luau” and imagery such as igloos or Hawaiian shirts.

(U//FOUO) Some MVEs may form paramilitary style organization and use paramilitary style tactical equipment in accordance with their interpretation of the Second Amendment and the social nature of the movement.

(U) NOTABLE ATTACKS or CRIMINAL ACTS

(U//FOUO) In April and June 2019, FBI and law enforcement partners arrested two MVEs who led militias that detained undocumented migrants along a portion of the US-Mexico border in New Mexico. One MVE pleaded guilty to a felony charge of possession of a firearm, and the other MVE was convicted of false impersonation of a Border Patrol agent.

(U) In August 2017, the FBI arrested an MVE on federal charges of plotting a VBIED attack on a bank in downtown Oklahoma City, Oklahoma. The MVE initially wanted to blow up the Federal Reserve Building in Washington, DC with a device similar to that used in the 1995 Oklahoma City bombing because he was upset with the US Government. The MVE was convicted for attempted use a weapon of mass destruction and sentenced to 25 years imprisonment.

(U) In October 2016, FBI and law enforcement partners arrested three MVEs who were planning to conduct IEDs on an apartment complex in Garden City, Kansas, where Muslim immigrants from Somalia loved and worshipped. The three MVEs were convicted on federal charges and received sentences of 25 to 30 years imprisonment.

(U) KEY TERMS

2nd Amendment (2A)

Refers to the Second Amendment to the Constitution of the United States: “A well regulated Militia, being necessary to the security of a free State, the right of the people to keep and bear Arms, shall not be infringed.” MVEs and others within the militia movement often
reference and interpret the Second Amendment to justify private militia activities and their opposition to gun laws.

Agenda 21

A nonbinding United Nations (UN) agreement that advocated for international environmental responsibility. MVEs sometimes regard Agenda 21 as a globalist conspiracy to seize rural lands prior to a UN takeover and the implementation of the New World Order.

Boogaloo

A term some MVEs use to describe the notion of, and sometimes a desire for, a second American Civil War between citizens and the government. “Big igloo,” “Big luau,” “Boog Bois,” “Boojahideen,” and other associated word-play in addition to imagery such as igloos, Hawaiian shirts, and leis, are used as coded references to the larger boogaloo phenomenon on- and offline. Because some people use the term jokingly and RMVEs who advocate the superiority of the white race sometimes use the term to refer to a race war, the context of the use of the term should be considered carefully.

Bug Out

A phrase used by MVEs and non-extremist preppers to reference emergency contingency planning, usually involving weapons, supplies, evacuation procedures, and rendezvous locations.

False Flag

A conspiracy theory alleging the government carries out plots, often violent actions like terrorist attacks or mass shootings, in order to manipulate the public through fear into placing blame for the violent action, on an innocent third party. Some MVEs believe the government uses such covert actions to promote its unconstitutional agenda, including sweeping military and law enforcement action or encroachments on gun rights and other civil liberties.

Federal Emergency Management Agency (FEMA) Camps

Some MVEs believe under the guise of humanitarian projects, FEMA intends to gather Americans in concentration camps in conjunction with the suspension of civil liberties and the establishment of the New World Order.

Field Training Exercise (FTX)

A term used to describe tactical training. MVEs often use the phrase to describe drills in which participants train with weapons and practice tactics. These often occur on private property or in government-owned parks and forests.

Killdozer

A meme used to reference a 4 June 2004 incident in which an individual used a bulldozer he had armored to demolish multiple buildings in the town in Granby, Colorado, in response to his grievances with local government. The individual killed himself at the end of the rampage.

Martial Law

Exists when military authorities carry on government or exercise various degrees of control over civilians or civilian authorities in domestic territory. MVEs have justified some violent plots and made threats based on a belief the implementation of martial law was imminent.

Molon labe (ΜΟΛΩΝ ΛΑΒΕ)

An ancient Greek expression translating roughly to “come and take them,” which some MVEs use to communicate their willingness to violently resist gun control.

New World Order (NWO)

A term some MVEs and other conspiracy theorists use to describ ea supposed international plot to suspend American citizens’ civil liberties and institute a global, socialist government.

Oath Breaker

A phrase some MVEs use to describe law enforcement and government officials whom they believe have violated their oaths to uphold the Constitution, often related to gun rights and civil liberties.

Patriot Movement

A general term sometimes used to describe the loose affiliation between the militia movement, some members of the sovereign citizen movement, and tax protesters. Participation in the movement is not it itself sufficient basis for investigation.

Patriot Political Prisoner (P3)

A term some MVEs use to describe subjects who they believe have been unjustly prosecuted and incarcerated for engaging in MVE activities.

Prepping

A term used to describe the stockpiling of supplies, often including food, water, medical equipment, and weapons, in preparation for a major manmade or natural crisis. While this can include illegal explosives and illegally modified firearms, prepping is generally legal and is not in itself an indicator of militia violent extremism.

Quick Reaction Force (QRF)

A term MVEs sometimes adopt in order to describe their capability and willingness to respond to encounters or incidents between fellow MVEs and perceived adversaries such as law enforcement, often with the expectation that they will engage in violence to protect each other.

Red Flag

Red flag laws or extreme risk protection orders (ERPO) allow courts to issue orders temporarily confiscating firearms from individuals deemed to be a risk to themselves or others, typically at the petition of law enforcement or family members, but sometimes other individuals such as educators or health professionals. MVEs often regard such measures as unconstitutional and indicate they will respond violently if they or their companions are “red flagged.”

Shit Hits the Fan (SHTF)

An acronym MVEs and others often use referring to the major military, economic, political, or social crisis that militia organizations anticipate and prepare for as justification for their existence.

Three Percent and Three Percenter (III%, 3% or III%er, 3%er)

Refers to a militia-movement based on the myth that only three percent of Americans fought against the British during the American Revolutionary War. Adherents use the myth to pledge or justify their willingness to use force to resist restrictions on firearms or civil liberties against the present-day US Government and other government entities, which are viewed as akin to the British during the Revolution. Self-identification as a III%er or use of III% symbols should not independently be considered evidence of militia affiliation or illegal activity.

Unorganized Militia

A term used to describe the “Reserve Militia,” one of the two classes of the militia defined under The Militia Act of 1903, which some MVEs use to justify their activity. The other class is the “Organized Militia,” which consists of the National Guard and the Naval Militia.

Lisbon, Portugal, 18 May – 21 May 2023

Abrams, Stacey (USA), CEO, Sage Works Production
Achleitner, Paul M. (DEU), Chair, Global Advisory Board, Deutsche Bank AG
Agrawal, Ajay (CAN), Professor of Economics, University of Toronto
Albares, José Manuel (ESP), Minister of Foreign Affairs
Altman, Sam (USA), CEO, OpenAI
Alverà, Marco (ITA), Co-Founder, zhero.net; CEO TES
Andersson, Magdalena (SWE), Leader, Social Democratic Party
Applebaum, Anne (USA), Staff Writer, The Atlantic 
Arnaut, José Luís (PRT), Managing Partner, CMS Rui Pena & Arnaut
Attal, Gabriel (FRA), Minister for Public Accounts
Balsemão, Francisco Pinto (PRT), Chair, Impresa Group
Barbizet, Patricia (FRA), Chair and CEO, Temaris & Associés SAS
Barroso, José Manuel (PRT), Chair, International Advisors, Goldman Sachs
Baudson, Valérie (FRA), CEO, Amundi SA
Beaune, Clément (FRA), Minister for Transport 
Benson, Sally (USA), Professor of Energy Science and Engineering, Stanford University
Beurden, Ben van (NLD), Special Advisor to the Board, Shell plc 
Borg, Anna (SWE), President and CEO, Vattenfall AB
Borrell, Josep (INT), Vice President, European Commission
Botín, Ana P. (ESP), Group Executive Chair, Banco Santander SA
Bourla, Albert (USA), Chair and CEO, Pfizer Inc.
Braathen, Kjerstin (NOR), CEO, DNB ASA
Brende, Børge (NOR), President, World Economic Forum
Brink, Dolf van den (NLD), CEO, Heineken NV
Brudermüller, Martin (DEU), CEO, BASF SE
Buberl, Thomas (FRA), CEO, AXA SA
Byrne, Thomas (IRL), Minister for Sport and Physical Education
Carney, Mark (CAN), Vice Chair, Brookfield Asset Management
Cassis, Ignazio (CHE), Federal Councillor, Federal Department of Foreign Affairs
Castries, Henri de (FRA), President, Institut Montaigne
Cavoli, Christopher (INT), Supreme Allied Commander Europe
Ceylan, Mehmet Fatih (TUR), President, Ankara Policy Center
Chhabra, Tarun (USA), Senior Director for Technology and National Security, National Security Council
Creuheras, José (ESP), Chair, Grupo Planeta and Atresmedia
Debackere, Koenraad (BEL), Chair, KBC Group NV
Deese, Brian (USA), Former Director, National Economic Council
Donohoe, Paschal (INT), President, Eurogroup
Döpfner, Mathias (DEU), Chair and CEO, Axel Springer SE
Easterly, Jen (USA), Director, Cybersecurity and Infrastructure Security Agency
Economy, Elizabeth (USA), Senior Advisor for China, Department of Commerce
Ehrnrooth, Henrik (FIN), Chair, Otava Group
Émié, Bernard (FRA), Director General for External Security, Ministry of the Armed Forces
Empoli, Giuliano da (ITA), Political Scientist and Writer, Sciences Po
Entrecanales, José M. (ESP), Chair and CEO, Acciona SA
Eriksen, Øyvind (NOR), President and CEO, Aker ASA
Ferguson, Niall (USA), Milbank Family Senior Fellow, Stanford University
Fleming, Jeremy (GBR), Former Director, GCHQ
Frederiksen, Mette (DNK), Prime Minister
Freeland, Chrystia (CAN), Deputy Prime Minister
Garijo, Bélen (DEU), Chair and CEO, Merck KGaA
Gentiloni, Paolo (INT), Commissioner for Economy, European Commission
Gonzáles Pons, Esteban (ESP), Vice Chair, European People’s Party
Gosset-Grainville, Antoine (FRA), Chair, AXA
Goulimis, Nicky (GRC), Board Member and Co-Founder, Nova Credit Inc.
Griffin, Kenneth (USA), Founder and CEO, Citadel LLC
Gruber, Lilli (ITA), Anchor, La7 TV
Gürkaynak, Refet (TUR), Professor of Economics, Bilkent University
Haines, Avril D. (USA), Director of National Intelligence
Halberstadt, Victor (NLD), Professor of Economics, Leiden University
Hassabis, Demis (GBR), CEO, DeepMind
Hedegaard, Connie (DNK), Chair, KR Foundation
Hofreiter, Anton (DEU), MP; Chair Committee on European Affairs
Holzen, Madeleine von (CHE), Editor-in-Chief, Le Temps
Jensen, Kristian (DNK), CEO, Green Power Denmark
Joshi, Shashank (GBR), Defence Editor, The Economist
Kaag, Sigrid (NLD), Minister of Finance; Deputy Prime Minister
Karp, Alex (USA), CEO, Palantir Technologies Inc.
Kasparov, Garry (USA), Chair, Renew Democracy Initiative
Kieli, Kasia (POL), President and Managing Director, Warner Bros. Discovery Poland
Kissinger, Henry A. (USA), Chairman, Kissinger Associates Inc.
Koç, Ömer (TUR), Chair, Koç Holding AS
Kolesnikov, Andrei (INT), Senior Fellow, Carnegie Endowment for International Peace
Kostrzewa, Wojciech (POL), President, Polish Business Roundtable
Kotkin, Stephen (USA), Senior Fellow, Hoover Institution, Stanford University
Kravis, Henry R. (USA), Co-Chairman, KKR & Co. Inc.
Kravis, Marie-Josée (USA), Chair, The Museum of Modern Art
Kudelski, André (CHE), Chair and CEO, Kudelski Group SA
Kuleba, Dmytro (UKR), Minister of Foreign Affairs
Lammy, David (GBR), Shadow Secretary of State for Foreign Affairs, House of Commons
Leysen, Thomas (BEL), Chair, Umicore and Mediahuis; Chair DSM-Firmenich AG
Liikanen, Erkki (FIN), Chair, IFRS Foundation Trustees 
Looney, Bernard (GBR), CEO, BP plc
Marin, Sanna (FIN), Prime Minister
Metsola, Roberta (INT), President, European Parliament
Micklethwait, John (USA), Editor-in-Chief, Bloomberg LP
Minton Beddoes, Zanny (GBR), Editor-in-Chief, The Economist
Moreira, Duarte (PRT), Co-Founder and Managing Partner, Zeno Partners
Moyo, Dambisa (GBR), Global Economist; Member, House of Lords
Mundie, Craig J. (USA), President, Mundie & Associates LLC
Nadella, Satya (USA), CEO, Microsoft Corporation
O’Leary, Michael (IRL), Group CEO, Ryanair Group
Orida, Deborah (CAN), President and CEO, PSP Investments
Özel, Soli (TUR), Professor, Kadir Has University
Papalexopoulos, Dimitri (GRC), Chair, TITAN Cement Group; Treasurer Bilderberg Meetings
Philippe, Édouard (FRA), Mayor, Le Havre
Pottinger, Matthew (USA), Distinguished Visiting Fellow, Hoover Institution
Pouyanné, Patrick (FRA), Chair and CEO, TotalEnergies SE
Rachman, Gideon (GBR), Chief Foreign Affairs Commentator, The Financial Times
Ramírez, Pedro J. (ESP), Director, El Español
Rappard, Rolly van (NLD), Co-Founder and Co-Chair, CVC Capital Partners 
Reynders, Didier (INT), European Commissioner for Justice
Röttgen, Norbert (DEU), MP, German Bundestag
Rutte, Mark (NLD), Prime Minister
Salomon, Martina (AUT), Editor-in-Chief, Kurier
Sawers, John (GBR), Executive Chair, Newbridge Advisory Ltd. 
Schadlow, Nadia (USA), Senior Fellow, Hudson Institute
Schallenberg, Alexander (AUT), Minister for European and International Affairs
Schmidt, Eric E. (USA), Former CEO and Chair, Google LLC
Schmidt, Wolfgang (DEU), Head of the Chancellery, Federal Minister for Special Tasks
Sebastião, Nuno (PRT), Chair and CEO, Feedzai
Sikorski, Radoslaw (POL), MEP, European Parliament
Silva, Filipe (PRT), CEO, Galp
Stilwell de Andrade, Miguel (PRT), CEO, EDP
Stoltenberg, Jens (INT), Secretary General, NATO
Subramanian, Arvind (INT), Senior Fellow in International and Public Affairs, Brown University
Tellis, Ashley J. (USA), Tata Chair for Strategic Affairs, Carnegie Endowment
Thiel, Peter (USA), President, Thiel Capital LLC
Tsu, Jing (USA), Professor of East Asian Languages and Literatures, Yale University
Tugendhat, Tom (GBR), Minister of State for Security
Vadera, Shriti (GBR), Chair, Prudential plc
Vassilakis, Eftichios (GRC), Chair, Aegean Group
Waldron, John (USA), President and COO, The Goldman Sachs Group, Inc.
Wallenberg, Marcus (SWE), Chair, Skandinaviska Enskilda Banken AB
Wennink, Peter (NLD), President and CEO, ASML Holding NV
Wright, Thomas (USA), Senior Director for Strategic Planning, National Security Council
Yang, Yuan (GBR), Europe-China Correspondent, Financial Times
Yergin, Daniel (USA), Vice Chair, S&P Global    
Yinanç, Barçin (TUR), Journalist, T24 News Website

…

…

(U//FOUO) EXAMPLES OF OPERATIONAL TECHNIQUES AVES EMPLOYED TO ILLEGALLY DISRUPT POLITICAL AND ECONOMIC EVENTS, AND EVENTS RELATED TO SOCIAL ISSUES

(U) Targets (U) Political and economic events, and events related to social issues; Perceived racists and fascists; Law enforcement; and Property (commercial, government, law enforcement, and personal)

(U) Objectives (U) Event disruption; Confrontations; Challenging and attempting to undermine law enforcement authority; To cause an economic impact

(U) Tactics (U) Black Bloc: tactic often used during mass mobilizations to hide one’s identity during criminal activity by dressing in black or dark clothing and covering one’s face with bandanas, balaclavas, costume masks, or gas masks.

(U) Grey Bloc: a means to blend into a crowd by dressing in or donning street clothing before or after criminal activity. AVEs often break away from the main group to participate in criminal activity.

(U) “Be Water” or “Be Like Water:” phrase to encourage others to move quickly and fluidly to evade law enforcement detection.

(U) “No Cameras/No Press:” used as a reminder to avoid or limit the chance for photographic or video evidence of criminal activity that may later be used in arrests or for prosecution.

(U) Doxing: is the research and public release of personal identifiable information obtained through social media or open sources. (Note: Some doxing may be legal, and may be First Amendment protected-speech, depending on the specific communication and context.)

(U) Weapons (U//FOUO) Improvised incendiary devices (IIDs) and improvised explosive devices (IEDs) including flares, fireworks (legal and illegal), and Molotov cocktails, etc. Some may carry lawfully owned firearms.

(U//FOUO) Improvised or Weapons of Opportunity: Baseball bats, bear or pepper spray, bike racks, brass knuckles, bricks, construction materials, edged weapons or knives, flag poles, frozen water bottles, hammers, makeshift shields with protruding screws, lead pipes, metal chains with locks, rocks, umbrellas, wooden dowels with bolts, wooden sticks, and bottles filled with irritants, such as bleach and urine, etc.

(U) Communication (U) Encrypted applications, code words, flags, hand held radios, hand signals, in-person meetings, megaphones, private messaging, etc.

(U) Monitoring of police radio frequencies to determine areas to avoid or redirect others away from law enforcement.

(U) Criminal Activity (U) Physical assaults, property damage, vandalism, arson, inciting riot, etc.

(U) Some potential applicable federal statutes include: Title 18 USC 33; Title 18 USC 111; Title 18 USC 115; Title 18 USC 231; Title 18 USC 372; Title 18 USC 844; Title 18 USC 1361; Title 18 USC 1951; Title 18 2101; Title 26 USC 5861; Title 26 USC 5845

…

…

(U//FOUO) COMMON PHRASES AND REFERENCES

(U) “When tyanny becomes law, rebellion becomes duty,” and variations.
(U) “We are everywhere” and “expect us,” “I will not comply,” and “All enemies foreign and domestic.”
(U) “The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.”
(U) “I became unreasonable”
(U) “His name was Duncan Lemp”
(U) “Well Regulated American Militia”

(U) MVEs consider the following individuals to be Martyrs:
• (U) Vicki Weaver (Ruby Ridge 1992)
• (U) Marvin Heemeyer (Killdozer 2004)
• (U) LaVoy Finicum (MNWR 2016)
• (U) Duncan Lemp (2020)
• (U) Ashli Babbitt (Capitol Siege 2021)

…

…

(U//FOUO) SIGNIFICANT EVENTS MVEs MAY REFERENCE

(U) Ruby Ridge: (U) 21 August 1992, 11-day armed siege at the Weaver residence, Naples, Idaho.

(U) Waco: (U) 28 February 1993, Armed siege at the Branch Davidian Compound, Waco, Texas.

(U//FOUO) NOTABLE ATTACKS OR CRIMINAL ACTIVITY THAT INSPIRE MVEs

(U) Timothy McVeigh: (U) 19 April 1995, in Oklahoma City, Oklahoma, bombing of the Alfred P. Murrah building. Targeting the US government, killed 168, several hundred injured.
(U) The Crusaders: October 2016, three MVEs were arrested for planning to conduct an IED attack on an apartment complex in Garden City, Kansas, where Muslim immigrants from Somalia lived and worshipped.
(U) Steven Carrillo: (U) In late May and early June 2020, two ambush-style attacks by alleged MVE occurred against security personnel and law enforcement officers. 2 were killed and 3 injured.

• Violent extremists use these six elements to argue that the world has gone wrong because of the actions of an enemy who hates or threatens what is good. Now is the time when violence is necessary to prevent catastrophe. If we stay true to our righteous course, we will prevail.

The chart below outlines each of these elements, what they provide to a violent extremist’s rationale, and what the rationale lacks once each element is removed.

(U //FOUOl Disengagement is a complex process in which an individual typically goes through five stages, from harboring initial doubts to seeking out and weighing alternatives to making a decision to leave a group. Once such a decision is made, an individual needs to exit the group, define new behaviors and roles, and become resocialized. This is a non-linear process driven by a number of factors-societal, organizational, social, and personal. An individual may take any length of time to progress through each stage, may remain at any one stage for a length of time, may move back and forth between each stage before proceeding to the next, or may skip some stages entirely. In this graphic, we highlight only those efforts that facilitate the disengagement process.

(U) Experiencing Common Catalysts for Disengaging from Violent Extremism

(U//FOUO) The individual experiences a disconnect between what he envisioned to be a violent extremist’s role and what actually occurs. This feeling commonly is caused by the individual :
• (U//FOUO) Objecting to violence;
• (U//FOUO) Recognizing inconsistencies in ideology;
• (U//FOUO) Feeling burned out or exhausted; and/or
• (U//FOUO) Being threatened by disruption or prosecution of the violent extremist or his associates.

(U) CVE Efforts:

(U//FOUO) Law enforcement pressure on the individual or his extremist associates can spark initial doubts, but continued lawful pressure, monitoring, and support from nonviolent individuals will be needed. CVE efforts are likely to be effective after an individual experiences initial doubts by reinforcing those doubts, and helping the individual rethink his commitment to violence, develop nonviolent response patterns, and sustain that commitment for the long term.

(U) Reinforcing Initial Doubts to Find Alternatives

(U//FOUO) The individual has experiences that reinforce his doubts, particularly by receiving support from others who are aware of these feelings and who support the individual’s disengagement.

(U) CVE Efforts:

(U//FOUO) Supportive family members and friends can reinforce the extremist’s doubts and help the individual start to progress through the disengagement process.

(U) Deliberating Options to Finalize Decision to Leave

(U//FOUO) The more self-aware the individual is of his reasons for dissatisfaction and the more control he feels over leaving violent extremism, the shorter the deliberation stage. Individuals who perceive a lack of options outside violent extremism or who feel they need to remain engaged to survive spend more time engaged in violent extremism because they see few alternatives. Social and organizational factors are important at this stage.

• (U//FOUO) Group disengagement can accelerate an individual’s disengagement because the social structure of the group falls apart and the individual is forced to weigh alternatives.
• (U//FOUO) Even time in prison, which often reinforces an individual’s commitment to violence, can sometimes encourage transformation by providing an environment for contemplation and reflection, especially if psychological or soc ial services support the individual’s disengagement

(U) CVE Efforts:

(U//FOUO) CVE efforts can be most effective when family members and close friends of violent extremists remain engaged throughout the process because of their ability to encourage, support, and offer nonviolent options to the individual.

(U) Acting on the Decision to Leave to Start a New Life

• (U//FOUO) The individual’s decision to disengage is dependent on perceived support for his role change, as well as the ability to envision a life after exit. The decision to leave provides the opportunity to eliminate his initial doubts, announce the exit to others, and mobilize resources to support the exit.
• (U//FOUO) Opportunities for change influence the speed of deliberation. Those who have few nonviolent outlets typically prove most receptive to intervention, probably because they have less to lose by disengaging. Those who have the most positive alternatives to violent extremism prior to their involvement spend the most time deliberating their exit because they have more to rethink.
• (U//FOUO) The individual’s prominence and position influence whether he announces the intention to leave violent extremism; the higher the position or more public the role, the more likely an individual is to publicly announce his departure, probably because he feels a high degree of obligation to the violent extremist group.

(U) CVE Efforts:

(U//FOUO) The individual’s new nonviolent role may require a new environment. Facilitating the individual’s removal from the violent extremist environment while enabling the individual to maintain close contact with a support network would help strengthen CVE efforts.

(U) Taking on New Nonviolent Role to Resocialize into Society

(U //FOUO) Individuals who disengage often undergo a lengthy, stressful role change to resocialize as nonviolent individuals. A number of personal , social, and societal factors support the individual’s sustained disengagement from violent extremism:

• (U//FOUO) Families who support their loved one in the disengagement process are central to reinforcing the individual’s decision and can provide opportunities to resocialize into society.
• (U//FOUO) Education- for personal growth or professional development-facilitates resocialization.
• (U//FOUO) Professional support from social workers, psychologists, or probation officers provides an outlet for the difficult life transition and can help the individual develop healthy, nonviolent coping strategies to remain disengaged.
• (U//FOUO) After an individual has decided to disengage, if he has contact with his former enemies, he is more likely to perceive these interactions as positive, which could lead to deradicalization.
• (U//FOUO) For some former extremists, a complete environment change is necessary; they need to end relationships with violent extremists, form new ones with nonviolent individuals, and develop healthy daily habits in order to sustain disengagement.

(U) CVE Efforts:

(U//FOUO) Many former violent extremists are motivated to “right wrongs” and some may be persuaded to work on CT efforts, helping to reinforce their new nonviolent role. Former violent extremists can offer support to others going through the disengagement process by acting as credible voices against the violent extremist group and its ideology.

Chinese military writings are replete with references to making HEMP attacks against the United States as a means of prevailing in war. The foremost People’s Liberation Army textbook on information warfare, Shen Weiguang’s World War, the Third World War—Total Information Warfare, explicitly calls upon China to be prepared to exploit HEMP offensively—and to defend against it:

With their massive destructiveness, long-range nuclear weapons have combined with highly sophisticated information technology and information warfare under nuclear deterrence….Information war and traditional war have one thing in common, namely that the country which possesses the critical weapons such as atomic bombs will have ‘first strike’ and ‘second-strike retaliation’ capabilities….As soon as its computer networks come under attack and are destroyed, the country will slip into a state of paralysis and the lives of its people will ground to a halt. Therefore, China should focus on measures to counter computer viruses, nuclear electromagnetic pulse…and quickly achieve breakthroughs in those technologies in order to equip China without delay with equivalent deterrence that will enable it to stand up to the military powers in the information age and neutralize and check the deterrence of Western powers, including the United States.”

China’s military doctrine closely associates cyber-attacks with nuclear HEMP attack, as part of a combined operation in what they call Total Information Warfare. Cyber bugs and hacking are the tip of the spear, the functional equivalent of scouts and sappers who do reconnaissance and secretly prepare the beaches for the arrival of D-Day, or like the motorcycle troops that preceded the heavy armored divisions in Germany’s Blitzkrieg.

…

HEMP appears to be the key to victory in China’s military doctrine against U.S. aircraft carriers and Taiwan. For example, from the official newspaper of the Shanghai Communist Party Central Committee:

“The weak points of a modern aircraft carrier are: 1) As a big target, the fleet is easy for a satellite to reconnoiter and locate it, and for missiles to conduct saturation attacks; 2) A high degree of electronization is like an ‘Achilles’ heel’ for an aircraft carrier fleet, which relies heavily on electronic equipment as its central nervous system. These two characteristics determine one tactic…Electromagnetic pulse bombs (missiles) bear the characteristics that meet those requirements: 1) The strong magnetic field and electromagnetic pulse caused by an explosion can destroy all important integrated circuits and chips…thus paralyzing the radar and telecommunications system of the aircraft carrier and vessels around it as well as the ship-mounted missiles and aircraft. 2) The scope of demolition and effective action are wide, reaching dozens of kilometers. 3) The equipment is damaged without casualties. 4) An electromagnetic pulse bomb…does not have to hit the aircraft carrier but only needs to explode within dozens of kilometers around the aircraft carrier…As long as an electromagnetic pulse bomb can successfully explode, an aircraft carrier will be paralyzed. 5) If the central nervous system of an aircraft carrier is paralyzed, even a comparatively backward naval vessel or aircraft…will be able to aim at the aircraft carrier as a conventional target, thereby thoroughly changing the balance between the strong and the weak.”

“The possession of electromagnetic pulse bombs (missiles) will provide the conditions to completely destroy an aircraft carrier fleet, and the way to complete victory in dealing with aircraft carrier fleets,” according to “Using A-Bomb To Deal With Aircraft Carrier.”

…

• (U) The mass shooting last month targeting Black people in Buffalo, New York, was allegedly perpetrated by a racially or ethnically motivated violent extremist (RMVE) driven by a belief in the superiority of the white race. The RMVE was charged with federal hate crimes and using a firearm to commit murder in June 2022. This attack underscores how RMVEs—who have been responsible for a majority of DVE-related deaths since 2010—pose a significant threat of lethal violence against civilians, particularly of racial, ethnic, and religious minorities.

• (U) The lethal threat from militia violent extremists (MVEs) remains elevated, primarily toward government and law enforcement personnel, as MVEs remain willing to use violence to redress perceived government overreach and other sociopolitical grievances, judging from an increase in MVE plotting, disruptions, and FBI investigations since 2020. Anarchist violent extremists (AVEs) present a threat of sporadic violent physical assaults and property crimes impacting the efficient operation of critical infrastructure; developments that heighten perceptions of inequality or social injustice might further embolden AVEs to commit acts of violence.

• (U) Several DVEs motivated by perceptions of fraud in the 2020 general election were arrested in 2021 and 2022 for plotting or threatening violence against federal, state, and local officials and political party representatives, highlighting the elevated threat posed to elected officials countrywide. In November 2021, a New York–based MVE was sentenced to 19 months in prison for threatening to assault and murder members of the US Congress.

• (U) A wide-ranging set of DVEs have shared their perceptions of government overreach on COVID-19 pandemic mitigation efforts and anger at government responses to immigration issues in person and online and have encouraged one another to act violently. Anger at the mitigation efforts of businesses and federal, state, and local governments motivated several DVE attacks, plots, and calls for violence against health care workers and mobile vaccine clinics in 2020 and 2021. In 2021, some DVEs visited the US-Mexico border with the intention of detaining those crossing into the United States.

…

(U) Developments related to midterm elections, immigration, perceptions of government overreach or social injustice, and other flashpoint events will probably motivate some DVEs across ideologies to plot or attempt violence in the coming months. In the context of these events, some DVEs might promote or exploit the public prevalence of violent extremist narratives to encourage violence. DVE attackers and plotters are typically lone actors—individuals acting without the direct support of others—who plot or conduct attacks on soft targets using easily accessible weapons. The persistent difficulty of detecting threats from such actors underscores the value of the public’s assistance in identifying people who might be mobilizing to violence and in reporting concerning behavior to authorities before violence occurs.

…

(U) RMVEs Driven by Belief in the Superiority of the White Race Present Enduring Lethal Threat

(U) We assess that RMVEs who are driven by a belief in the superiority of the white race continue to pose the primary threat among DVEs of committing lethal violence against civilians, based on their ideology and attack history. These RMVEs advocate and commit violence in support of a transnational movement whose adherents believe that white people of European descent are superior to and threatened by minority populations, as well as by other whites whom they perceive as supporting these populations. Some of these RMVEs promote accelerationist thinking, which advocates committing violence to precipitate a large-scale conflict, often framed as a “race war,” in the United States and other Western democracies that these RMVEs believe will result in a white ethnostate.

…

(U) MVEs Pose Heightened Lethal Threat to Law Enforcement and Symbols of Government

(U) The lethal threat level from MVEs to law enforcement and government personnel will almost certainly remain elevated in the coming months because some of these actors are willing to use violence to redress perceived government overreach and other sociopolitical issues. Some MVEs will almost certainly continue to harbor grievances over their perceptions of fraud during the 2020 election and government measures related to the COVID-19 pandemic. Some MVEs might also mobilize to violence in response to the enactment of any legislation that they perceive as restricting access to firearms, expanding immigration, or managing public land that MVEs might view as unacceptable infringements on civil liberties or harmful to the security of the United States.

…

(U//FOUO) Chinese state media continued July’s heavy shift to Taiwan issues—away from significant focus on Ukraine or COVID-19—while also claiming that several US domestic controversies show a failing democracy. Outlets denounced visits to Taiwan by US politicians as political grandstanding, and as attempts to undermine the One‑China policy.

(U//FOUO) Iranian state media focused on long-standing narratives. Outlets praised Tehran’s purported efforts to revitalize the Joint Comprehensive Plan of Action (JCPOA), while criticizing Washington’s negotiating stance, and pushed stories of US social discord, including inflation and the search of the former president‘s property.

(U//FOUO) Russian state media and proxy websites continued their heavy focus on Ukraine by blaming global economic, energy, and food insecurity on the Western response. They also alleged that Ukrainian military actions endangered the Zaporozhye nuclear power plant. Moscow further highlighted its support for Beijing after the Taiwan visits of US Congressional delegations.

…

• Individuals are detained and taken to filtration waypoints, or stopped at filtration checkpoints.
• Individuals are temporarily detained and evaluated for their perceived threat.
• Those deemed most threatening probably are detained and imprisoned in eastern Ukraine or Russia. Little is known about their fates.
• Those deemed less threatening but still hostile probably are forcibly deported to Russia.
• Those deemed non-threatening probably are either issued documentation and permitted to remain in Ukraine or forcibly deported to Russia.

…