DHS Labels Common Protest Activities as 'Violent Tactics,' Raising Civil Liberties Alarms

The landscape of protest in the United States is undergoing a subtle yet significant transformation, driven by shifts in how federal agencies perceive and communicate potential threats to local law enforcement. At the heart of this change are intelligence bulletins issued by the Department of Homeland Security (DHS), which, according to documents obtained through public records requests, are urging local police to view a wide array of common protest activities not as expressions of dissent or documentation, but as potential 'violent tactics.' This reclassification includes seemingly innocuous acts like riding a bike, skateboarding, wearing masks, or even livestreaming a police encounter, effectively turning everyday behavior into a potential pretext for police intervention and escalating confrontations.

These bulletins, first brought to light by the national security nonprofit Property of the People, emerged in the context of last month’s “No Kings” protests, which saw demonstrations against aggressive immigration raids conducted by Immigration and Customs Enforcement (ICE). DHS analysts predicted that the agency's enforcement actions were likely to fuel domestic unrest, anticipating a “high likeliness” that more Americans would turn against ICE, potentially leading to confrontations near federal facilities. The agency specifically blamed intense media coverage and public backlash, including the controversial deployment of US military personnel in Los Angeles, for the expected surge in demonstrations. They foresaw protests continuing and expanding nationwide, with activists focused on other issues pivoting to immigration, driven by a broad “embracement of anti-ICE messaging.”

While the bulletins did warn of genuine threats, such as potential assaults using fireworks, improvised weapons like paint-filled fire extinguishers, smoke grenades, and projectiles including bottles and rocks, they simultaneously blurred the lines between violent acts and constitutionally protected behaviors. The guidance explicitly advised officers to prepare “from the point of view of an adversary,” framing common protest gear and activities through a lens of potential hostility.

Redefining 'Violent Tactics': Everyday Behaviors Under Scrutiny

One of the most concerning aspects of these bulletins is the inclusion of nonviolent, often lawful activities within lists of potential threats or indicators of hostile intent. Protesters utilizing bicycles or skateboards, or even those simply “on foot,” are characterized as potential “scouts” engaged in reconnaissance or searching for “items to be used as weapons.” This interpretation ignores the common use of bikes and skateboards for mobility within large crowds or for transportation to and from protest sites. Similarly, being “on foot” is the fundamental mode of participation for the vast majority of demonstrators.

Livestreaming, a crucial tool for transparency and accountability in the digital age, is listed alongside “doxxing” as a “tactic” for “threatening” police. This conflation is particularly troubling. While doxxing (publishing private information with malicious intent) can be a form of harassment, livestreaming is a form of public documentation and journalism. It allows citizens and journalists to record events in real-time, providing an unedited view of interactions between protesters and law enforcement. Framing livestreaming as inherently threatening chills free speech and the public's right to document events in public spaces.

The bulletins also scrutinize efforts by protesters to avoid identification, such as wearing masks (often used for health, anonymity, or as a form of expression), alongside efforts to identify police officers (a practice often undertaken for accountability, especially when officers do not display badge numbers). One list of “violent tactics” shared by the Los Angeles–based Joint Regional Intelligence Center (JRIC), a component of the post-9/11 fusion center network, included both these categories. The memo also made the unsubstantiated claim that face recognition technology, typically a tool employed by law enforcement for surveillance, was being used *against* officers by protesters.

Vera Eidelman, a senior staff attorney with the American Civil Liberties Union (ACLU), sharply criticized this approach. She emphasized that the government should not treat constitutionally protected activities, such as observing or documenting police conduct in public, as justification for suspicion or adverse action. Labeling something as harmless as skateboarding at a protest as a violent threat is “disturbing and dangerous,” she stated, warning that it could “easily lead to excessive force against people who are simply exercising their First Amendment rights.”

Ryan Shapiro, executive director of Property of the People, echoed these concerns, arguing that the DHS report “repeatedly conflates basic protest, organizing, and journalism with terroristic violence, thereby justifying ever more authoritarian measures by law enforcement.” He found it “sobering, if unsurprising,” that the government's response to mass criticism of its policing tactics was to escalate those very tactics.

The Role of Fusion Centers and Post-9/11 Policing

Fusion centers like JRIC are central to the dissemination of intelligence to local law enforcement agencies across the United States. Established in the wake of the September 11, 2001, terrorist attacks, these centers were intended to improve information sharing between federal, state, and local authorities to prevent terrorism. However, their scope has expanded significantly over the years, and they now frequently focus on domestic issues, including monitoring and analyzing protest movements.

The intelligence produced by fusion centers often relies heavily on open-source data, including social media, news reports, and other publicly available information. While this can be a valuable source of information, it is also susceptible to bias, misinterpretation, and the inclusion of unverified or fragmentary data. Critics argue that in the absence of concrete evidence of criminal plots, bulletins from these centers often resort to analyzing ideological language and social media activity, flagging lawful expression as potential evidence of emerging risks.

DHS’s risk-based approach, as evidenced in these bulletins, reflects a broader transformation in US law enforcement since 9/11. This shift prioritizes perceived intent and potential risk over demonstrable wrongdoing. It utilizes behavioral cues, affiliations, and other potentially predictive indicators to justify early intervention, increased surveillance, and a more aggressive posture towards potential dissent. This contrasts sharply with earlier models of protest policing that emphasized de-escalation, communication, and facilitating the right to assemble.

A year prior to the “No Kings” bulletins, DHS had already warned that grievances related to immigration policy were fueling an increase in threats against judges, migrants, and law enforcement personnel. They predicted that new laws and high-profile enforcement actions would further radicalize individuals. In February, another fusion center report cited renewed calls for violence against police and government officials, linking them to backlash against perceived federal overreach and identifying upcoming protests and court rulings as potential triggers.

From Forecasting to Framing: Shaping Police Mindset and Public Perception

Law enforcement agencies increasingly rely on this type of intelligence forecasting to identify groups or individuals perceived as ideologically subversive or tactically unpredictable in advance of protests. Demonstrators labeled as “transgressive” may face heightened surveillance, detention without charges, or a disproportionate use of force. This preemptive approach marks a departure from late-20th-century policing strategies that aimed to manage protests with minimal intervention, focusing instead on maintaining order while respecting the right to assemble.

The infrastructure initially developed for counterterrorism purposes is now routinely applied to monitor street-level protests. Virtual investigations units within law enforcement agencies use high-tech tools to scrutinize demonstrators based on their online expression. Fusion centers, funded partly through DHS grants, have been documented issuing bulletins that flag protest slogans, references to police brutality, and solidarity events as potential signs of violence, disseminating these assessments to police without requiring clear evidence of criminal intent.

Surveillance efforts have included the creation of detailed dossiers, sometimes referred to as “baseball cards,” on individuals. Analysts compile information from various sources, including subjects’ social media posts, affiliations, personal networks, and public statements critical of government policy. A DHS dossier on Mahmoud Khalil, a former Columbia graduate student and anti-war activist, exclusively obtained by WIRED, revealed that analysts incorporated information from Canary Mission. Canary Mission is a shadowy online blacklist that anonymously profiles critics of Israeli military action and supporters of Palestinian rights. In federal court, a senior DHS official later acknowledged that material from Canary Mission had been used in over 100 dossiers on students and scholars, despite the site's clear ideological bias, anonymous funding, and lack of verifiable sourcing.

Threat bulletins also play a crucial role in shaping the mindset of officers on the ground, potentially priming them to anticipate conflict and react more aggressively. Following the violent protests of 2020, the San Jose Police Department (SJPD) in California cited the “numerous intelligence bulletins” received from its local regional fusion center, DHS, and the FBI as central to understanding “the mindset of the officers in the days leading up to and throughout the civil unrest.” The SJPD's response to these protests later resulted in a $620,000 settlement over police brutality claims.

Specific bulletins cited by the SJPD framed the demonstrations as potential cover for “domestic terrorists,” warned of opportunistic attacks on law enforcement, and promoted an “unconfirmed report” alleging the use of U-Haul vans to transport weapons and explosives. Subsequent reporting, based on the BlueLeaks data dump (a collection of internal police documents published by Distributed Denial of Secrets), revealed that federal bulletins were often filled with unverified claims, vague threat language, and outright misinformation. This included alerts about a parody website that supposedly paid protesters to set cars on fire, despite the site clearly labeling itself as “FAKE.” The BlueLeaks data highlighted how easily unverified information can enter official intelligence channels and influence policing decisions.

Beyond influencing police actions, threat alerts, which are often unclassified and accessible to the press, can also help law enforcement agencies shape public perception of protests before they even occur. By publicly echoing unverified warnings about domestic terrorists infiltrating demonstrations, as the acting DHS secretary did on Twitter in 2020, agencies can lay the groundwork to legitimize aggressive police responses in the eyes of the public. These warnings were widely circulated and amplified in media coverage, contributing to a narrative that framed protesters as inherently dangerous.

Research suggests that public support for aggressive protest crackdowns is often driven by fear, rather than objective assessments of protester behavior. Experimental studies indicate that support for coercive police tactics hinges less on what protesters actually do and more on how they are portrayed by officials, the media, and through existing racial and ideological biases. By labeling common activities as “violent tactics,” DHS bulletins contribute to a narrative that demonizes protesters and justifies a more heavy-handed police response, potentially eroding public support for the fundamental right to peaceful assembly and dissent.

Implications for Civil Liberties and the Future of Protest

The DHS approach, as revealed in these bulletins, raises profound questions about the balance between security and civil liberties. Framing lawful activities like documenting police or using common forms of transportation as indicators of violent intent creates a chilling effect on free expression and assembly. Protesters may become hesitant to record police actions, wear masks for protection or anonymity, or even use bikes or skateboards for fear of being labeled as potential threats and facing increased scrutiny or force.

The reliance on open-source intelligence, while potentially useful, becomes problematic when it incorporates biased or unverified information and is used to justify surveillance and preemptive action against individuals based on their political views or associations, rather than concrete evidence of criminal activity. The use of information from sources like Canary Mission in federal dossiers exemplifies the dangers of this practice.

Furthermore, the dissemination of vague and potentially misleading intelligence through fusion centers can contribute to a climate of fear and suspicion among law enforcement officers, potentially leading to overreactions and the use of excessive force against peaceful demonstrators. The San Jose case, where police cited intelligence bulletins to explain their mindset during protests that led to brutality claims, underscores this risk.

The redefinition of protest activities as “violent tactics” represents a significant challenge to the right to protest, a cornerstone of democratic societies. It suggests a governmental perspective that views dissent not as a legitimate form of political expression, but as a potential security threat to be managed and suppressed. This approach risks criminalizing protest itself, making it more difficult for citizens to hold power accountable and advocate for social and political change.

Civil liberties advocates argue that a more appropriate approach to protest management would focus on de-escalation, communication, and facilitating the safe exercise of First Amendment rights, while reserving law enforcement intervention for genuine instances of violence or criminal activity. They call for greater transparency and accountability in the intelligence-gathering and dissemination processes used by agencies like DHS and fusion centers, particularly concerning the monitoring of domestic political activity.

The revelations from these DHS bulletins serve as a stark reminder of the ongoing tension between national security priorities and fundamental civil liberties in the post-9/11 era. As protests continue to be a vital mechanism for public expression and political engagement, how law enforcement agencies are advised to perceive and respond to them will have a critical impact on the future of dissent and the health of democracy in the United States.

Examining Specific 'Tactics' and Their Context

Let's delve deeper into some of the specific activities flagged by DHS and understand why their inclusion in a list of 'violent tactics' is problematic from a civil liberties perspective.

Skateboarding and Biking

As mentioned, the bulletins suggest protesters on skateboards or bikes could be acting as 'scouts' or searching for weapons. While it's conceivable that any object could potentially be used as a projectile, framing the mere presence of a skateboard or bike as an indicator of hostile intent is a significant leap. Skateboards and bikes are common modes of urban transportation. They allow individuals to move through crowds and cover ground more quickly than walking. Their use in protests is often practical, enabling participants to keep up with moving demonstrations or navigate city streets. To label them as inherently tied to violence is to criminalize mobility during protest.

Livestreaming and Documentation

The conflation of livestreaming with 'doxxing' and 'threatening' police is perhaps the most direct assault on transparency and the right to document public events. Citizen journalism and the ability to record interactions with law enforcement in public spaces have become essential tools for accountability in the digital age. Platforms like YouTube, Facebook Live, and X (formerly Twitter) allow individuals to broadcast events in real-time, providing a counter-narrative to official accounts and serving as crucial evidence in cases of alleged police misconduct. Framing this act as a 'tactic' for 'threatening' police suggests an official desire to prevent documentation, which is a core component of a free press and public oversight.

Furthermore, the bulletin's mention of 'surveillance sharing' among protesters, while potentially referring to sharing information about police movements or tactics, is framed negatively. Yet, protesters sharing information about the location and actions of law enforcement is a natural response to potential risks and a way to ensure safety and coordination within a demonstration. This information sharing is distinct from malicious surveillance or doxxing.

Masks and Anonymity

Wearing masks at protests has multiple legitimate purposes. In the era of widespread surveillance, including facial recognition technology, masks can be a means of protecting privacy and anonymity. They can also be worn for health reasons (e.g., during a pandemic or in dusty environments) or as a form of symbolic expression. While masks can, of course, be used by individuals seeking to conceal their identity while engaging in illegal activity, classifying the act of wearing a mask itself as an indicator of violent intent is overly broad and infringes upon legitimate reasons for covering one's face in public, particularly in a protest context where participants may fear retaliation or surveillance.

The Intelligence Cycle and the Risk of Bias

The process by which intelligence is gathered, analyzed, and disseminated within the fusion center network is critical to understanding how these problematic assessments arise. Fusion centers collect information from a vast array of sources, including traditional law enforcement channels, federal agencies, and increasingly, open-source intelligence (OSINT). The reliance on OSINT, while providing access to a wealth of information, also introduces significant challenges related to verification, context, and bias.

The case of Mahmoud Khalil and the use of information from Canary Mission is a stark example of how biased or unreliable sources can infiltrate official intelligence products. Canary Mission operates anonymously, lacks transparency regarding its funding and methodology, and is widely criticized for targeting individuals based on their political views, particularly those critical of Israeli government policies. Incorporating information from such a source into federal dossiers on students and scholars demonstrates a failure in vetting and highlights the risk of intelligence being used to target individuals based on their political speech rather than credible evidence of threats.

The pressure to produce intelligence, coupled with the inherent uncertainty of predicting human behavior, can lead analysts to connect disparate pieces of information and draw conclusions based on weak signals or perceived patterns. When this process is influenced by a pre-existing framework that views protest and dissent through a security lens, common behaviors can easily be misinterpreted as indicators of malicious intent.

The Impact on Policing and Civil Liberties

The dissemination of bulletins that frame common protest activities as 'violent tactics' has several detrimental effects:

• **Increased Likelihood of Confrontation:** By priming officers to view peaceful demonstrators as potential adversaries engaged in 'violent tactics,' the bulletins increase the likelihood of police adopting an aggressive posture from the outset. This can escalate tensions and turn potentially peaceful demonstrations into confrontations.
• **Justification for Excessive Force:** When officers are led to believe that behaviors like skateboarding or livestreaming are indicators of violent intent, they may feel justified in using higher levels of force preemptively or in response to perceived threats that are not actually present. The San Jose case provides a troubling example of how intelligence framing can influence officer mindset during civil unrest.
• **Chilling Effect on Free Speech and Assembly:** Knowing that common, lawful activities might lead to increased police scrutiny, surveillance, or intervention can discourage individuals from participating in protests or engaging in documentation. This chilling effect undermines the fundamental rights to free speech and peaceful assembly.
• **Erosion of Trust:** When law enforcement treats peaceful protesters as potential domestic terrorists or adversaries based on flimsy pretexts, it erodes trust between police and the communities they serve. This is particularly damaging in marginalized communities that already experience disproportionate policing.
• **Misallocation of Resources:** Focusing intelligence resources on monitoring and analyzing lawful protest activities based on speculative interpretations of behavior diverts attention and resources away from identifying and addressing genuine threats.

Historical Context and the Evolution of Protest Policing

Understanding the current approach requires looking at the evolution of protest policing in the US. Historically, protest management has varied widely, from outright suppression to more permissive approaches. The late 20th century saw a trend towards negotiated management, where police would communicate with organizers, facilitate marches, and prioritize de-escalation. This model aimed to minimize conflict and protect the right to protest while maintaining public order.

The post-9/11 era, however, ushered in a new paradigm heavily influenced by counterterrorism strategies. The focus shifted to intelligence gathering, surveillance, and preemptive intervention. Fusion centers became key nodes in this new network, integrating intelligence from various sources and pushing it down to the local level. This shift has been criticized for applying counterterrorism tools and mindsets to domestic dissent, leading to the surveillance of political activists and the framing of protest through a security threat lens.

Scholars of social movements have documented this transition, noting the increased emphasis on controlling public space, monitoring organizers, and responding proactively based on perceived risks rather than actual conduct. This preemptive policing model, fueled by intelligence bulletins like those from DHS, stands in contrast to approaches that prioritize de-escalation and the facilitation of constitutional rights.

The Path Forward: Transparency, Accountability, and Respect for Rights

Addressing the concerns raised by these DHS bulletins requires a multi-faceted approach. First and foremost, there needs to be greater transparency regarding the criteria used by DHS and fusion centers to classify behaviors as potential threats. The public and civil liberties advocates should have a clearer understanding of how intelligence is gathered, vetted, and disseminated, particularly when it pertains to domestic political activity.

Second, there must be increased accountability for the accuracy and reliability of intelligence products. Mechanisms should be in place to challenge assessments based on biased or unverified information. The acknowledgment by a senior DHS official about the use of Canary Mission data, while a step towards transparency, highlights the need for stricter vetting processes to prevent the incorporation of ideologically driven or unreliable sources into official intelligence.

Third, law enforcement training should emphasize the distinction between lawful protest activities and genuine threats. Officers need to be trained to respect the rights to free speech, assembly, and documentation, and to employ de-escalation techniques rather than defaulting to an adversarial posture based on broad threat assessments.

Finally, there needs to be a societal conversation about how we balance security concerns with the fundamental right to dissent. Framing peaceful protest activities as 'violent tactics' not only misrepresents the nature of most demonstrations but also undermines the democratic process itself. Protecting the space for robust public debate and peaceful assembly is essential for a healthy democracy.

The revelations about DHS bulletins are a critical reminder that the tools and strategies developed in the name of national security can easily be turned inward, impacting the rights and freedoms of citizens engaged in lawful political expression. Ensuring that intelligence practices respect constitutional rights is an ongoing challenge that requires vigilance from civil liberties advocates, oversight bodies, and the public alike.