Category: threat assessment

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters. 

FEMA lifts freeze on Nonprofit Security Grant Program reimbursements

FEMA has lifted its freeze on reimbursements for the Nonprofit Security Grant Program (NSGP), a critical source of funding for at-risk nonprofits to bolster their security infrastructure. The freeze, which lasted at least two months, was part of a broader review of FEMA grant programs initiated by the Trump administration.

The resumption of reimbursements follows concerted advocacy efforts fromorganizations and bipartisan members of Congress. Karen Paikin Barall, vice president for government relations at the Jewish Federations of North America (JFNA), confirmed that State Administrative Agencies can now process payment requests from nonprofits. Nathan Diament of the Orthodox Union emphasized the NSGP’s role as “the biggest single resource the federal government provides to keep American Jews safe in the face of antisemitism”

In a related development, over 130 House lawmakers have submitted a bipartisan request for $500 million in NSGP funding for fiscal year 2026, nearly doubling the current allocation.

The lifting of the freeze ensures that previously approved nonprofits can now receive reimbursements for their security investments, providing much-needed relief amid ongoing concerns about targeted violence.

Analyst Comments: The reinstatement of NSGP reimbursements reinforces efforts to protect vulnerable “soft targets” such as houses of worship and community centers, locations that face growing risks from domestic threats including rising antisemitism. FEMA’s decision demonstrates an acknowledgment of the critical need for security readiness across the nonprofit sector, extending beyond traditional government sites.

Related Articles: Federal security grants to synagogues are resuming after two-month Trump freeze

SW Portland preschool security guard injures man in shooting; children unharmed, police say

On Thursday, May 8, 2025, a security guard at The Gan, a Jewish preschool in Southwest Portland, shot and seriously injured a man in a parking lot shared with the nearby Fanno Creek Medical Clinic. No children or staff were harmed. The preschool stated that the guard was “threatened and assaulted” and acted in self-defense, though police have not yet confirmed this. The injured man underwent surgery and survived. The incident took place amid heightened security at Jewish institutions in the wake of global antisemitic threats. Authorities are still investigating the circumstances and whether the man had a weapon or posed a threat.

Analyst Comments: This incident highlights ongoing concerns about safety at religious institutions, especially Jewish schools and centers alongside how have established safety protocols is important. The children and staff remained safe, and the emergency response was swift. One of the first questions that many houses of worship ask in relation to physical security is whether or not it is appropriate to have armed guards. GuideOne Insurance has produced a resource that helps answer some of those questions. Additionally, the FB-ISAO resource library provides resources on securing school facilities and students.

What Is the Goal of an Insider Threat Program?

The primary goal of an Insider Threat Program is to proactively identify and mitigate risks posed by individuals within an organization such as employees, contractors, or partners—who may intentionally or unintentionally compromise security. These threats can arise from malicious intent, negligence, or compromised credentials.

Key objectives of such a program include:

• Early Detection: Utilizing behavioral analytics and user activity monitoring to identify unusual activities that may indicate potential threats.
• Risk Mitigation: Implementing strategies to prevent data breaches, intellectual property theft, and other security incidents before they occur.
• Incident Response: Establishing protocols to respond swiftly and effectively to insider threats, minimizing potential damage.

By focusing on these areas, organizations aim to protect sensitive information, maintain operational integrity, and uphold trust with stakeholders.

Analyst Comments: Proofpoint’s emphasis on swift incident response is vital, as insider threats often develop gradually and may go undetected until significant harm occurs. Establishing clear response procedures including legal and reputational safeguards is critical to limiting the overall impact. FB-ISAO regularly reports on incidents where employees and volunteers of faith-based organizations have abused their positions to steal money. We encourage members to review their internal controls to ensure they don’t fall victim of similar illicit activity. Gate15 Weekly Security Sprint has a podcast discussing DOGE, CISA, and insider threat, you can find the podcast here.

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters. 

Hack Exposed Data in Catholic Church Sex-Abuse Cases

A recent cyberattack on the financial advisory firm Berkeley Research Group (BRG) has compromised sensitive data related to multiple Catholic Church bankruptcy cases across the United States, including information on sexual abuse victims. The breach, detected in early March 2025, involved a hacker posing as an internal IT worker on Microsoft Teams to access a BRG employee’s laptop. Once inside the attacker deployed a variant of Chaos ransomware and demanded payment in exchange for deleting the stolen data. BRG paid the ransom and received assurances from the hacker that the data had been deleted though the firm has not detected any evidence of the data being distributed.

The compromised data pertains to bankruptcy filings from dioceses in cities including New Orleans, Baltimore, San Francisco, and San Diego. These filings often contain detailed information about sexual abuse claims, including victims’ names and the nature of their allegations. The U.S. Department of Justice’s Office of the U.S. Trustee has expressed deep concern over the potential exposure of such sensitive information and has criticized BRG for the delay between detecting the breach and notifying the public. The agency is also questioning whether BRG’s continued involvement in these bankruptcy proceedings presents a conflict of interest given the firm’s role in managing confidential data.

In response to the breach BRG has taken several steps to enhance its cybersecurity measures. The firm has taken its systems offline, reset passwords, and deployed advanced threat detection software. Additionally, BRG has enlisted the assistance of cybersecurity experts from Booz Allen Hamilton and has notified the Federal Bureau of Investigation. The incident underscores the critical importance of robust data protection protocols, especially when handling information related to sensitive legal matters such as sexual abuse cases.

Analyst Comments: The WSJ article on the Berkeley Research Group data breach is a clear and troubling example of the risks posed by third-party data handlers in sensitive legal matters. Despite BRG’s role as a trusted financial adviser in high-profile Catholic Church bankruptcy cases the breach highlights a significant lapse in cybersecurity preparedness specifically in vetting and managing internal security protocols.

This incident reinforces a critical lesson for organizations across all sectors: entrusting sensitive information to third parties without rigorous vetting and oversight creates a substantial risk exposure. BRG was responsible for safeguarding deeply personal and legally protected data, yet single social engineering tactic impersonating IT personnel led to ransomware deployment and a mass data compromise. Organizations will want to consider utilizing a third party risk management questionnaire (like this example from SecurityScorecard) to help evaluate potential vendors.

Also see:

Data Breach Notification: Roman Catholic Bishop of San Diego

500th Catholic church attack since 2020: Man detonates explosive on perpetual adoration chapel altar 

On May 6, 2025, a man detonated a quarter-stick of dynamite on the altar of the perpetual adoration chapel at St. Teresa of Calcutta Church in Mahanoy City, Pennsylvania. The explosion damaged the monstrance, broke glass candle holders, and shattered irreplaceable stained-glass windows. The suspect, 32-year-old Kyle Kuczynski, was arrested and charged with ethnic intimidation, arson, reckless endangerment, and risking catastrophe. Security footage revealed he had entered the chapel multiple times in the week prior, suggesting premeditation.

This incident marks the 500th documented attack on a Catholic church in the U.S. since 2020, according to CatholicVote’s tracker. The organization has criticized federal authorities for inadequate responses to such acts and is urging the Department of Justice to investigate and prosecute these attacks as federal crimes.

Analyst Comments: The attack using an explosive device in a sacred space represents a serious escalation in the type of vandalism and violence Catholic churches in the U.S. have experienced since 2020. The choice of the Perpetual Adoration Chapel, a space meant for continuous prayer and Eucharistic devotion, amplifies the symbolic weight of the attack. This being the 500th documented attack suggests a sustained pattern, not isolated incidents. There will be growing pressure on agencies like the DOJ to treat these as hate crimes or acts of domestic terrorism when warranted.

Leader of FEMA Is Dismissed as Trump Administration Takes Aim at the Agency

Cameron Hamilton, a former Navy SEAL and business executive, served as the acting Administrator of FEMA from January 22 to May 8, 2025. Appointed by President Donald Trump, Hamilton’s tenure was marked by a departure from the traditional appointment of disaster management professionals to lead FEMA. Prior to this role, he held positions in emergency management at the Department of State and the Department of Homeland Security.

On May 7, 2025, Hamilton testified before a U.S. House Appropriations subcommittee on Homeland Security, advocating for the agency’s continued operation. He stated, “I do not believe it is in the best interest of the American people to eliminate the Federal Emergency Management Agency.” The following day, he was dismissed from his position and replaced by David Richardson as acting administrator.

Analyst Comments: The rapid turnover in FEMA leadership Hamilton serving less than four months raises concerns about continuity in emergency preparedness. Emergency management agencies rely on stable leadership to coordinate across federal, state, and local partners, particularly during planning phases outside of active disaster seasons. Public trust in FEMA depends on the agency’s ability to deliver timely and coordinated responses to disasters. Leadership changes, if perceived as disruptive or frequent, can undermine public confidence, especially during high-stakes events like hurricanes, wildfires, or pandemics. Members are encouraged to review yesterday’s Weekly Report of Hurricane Preparedness ahead of the upcoming hurricane season.

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters. 

COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs

Google’s Threat Intelligence Group (GTIG) has identified a new malware strain named LOSTKEYS, attributed to the Russian-backed cyber espionage group COLDRIVER (also known as UNC4057, Star Blizzard, or Callisto). This malware represents a significant evolution in COLDRIVER’s toolkit enabling the theft of specific file types and directories along with the exfiltration of system information and active processes from compromised devices.

COLDRIVER has a history of targeting high-profile individuals and organizations, including NATO affiliates, non-governmental organizations (NGOs), journalists, and former intelligence and diplomatic personnel. Their operations are primarily aimed at intelligence collection to support Russian strategic interests. Recent campaigns observed in early 2025 have continued to target individuals connected to Ukraine as well as advisors to Western governments and military entities.

The infection chain for LOSTKEYS begins with a deceptive website presenting a fake CAPTCHA. Upon user interaction, malicious PowerShell scripts are executed, leading to the download and activation of the LOSTKEYS malware. This method of delivery is part of a broader strategy known as “ClickFix,” where attackers manipulate users into executing harmful commands.

To mitigate risks associated with such threats, Google recommends that at-risk users enroll in the Advanced Protection Program, enable Enhanced Safe Browsing in Chrome, and ensure all devices are regularly updated.

Related article: Google identifies new malware linked to Russia-based hacking group

Analyst Comments: COLDRIVER’s ongoing efforts to target high-profile Western organizations, NGOs, and individuals suggest that their activities are driven by geopolitical goals particularly the advancement of Russian interests. The consistent targeting of those connected to Ukraine and Western military and intelligence sectors highlights the group’s role in state-sponsored cyber espionage likely aimed at intelligence gathering and strategic disruption. The recommendation to enroll in Google’s Advanced Protection Program and to enable Enhanced Safe Browsing reflects best practices for mitigating the risks of targeted cyberattacks. Such measures should be encouraged for individuals and organizations in high-risk areas to reduce exposure to sophisticated cyber threats like COLDRIVER’s.

New York Man Charged with Federal Hate Crimes After Repeatedly Assaulting Jewish Victims

On May 8, 2025, an indictment was unsealed in the Southern District of New York charging Tarek Bazrouk, 20, of New York City, with three federal hate crimes for assaulting Jewish individuals at pro-Israel protests between April 2024 and January 2025. Each assault occurred at a protest related to the Israel/Gaza war, where the victims were visibly Jewish wearing kippahs, Israeli flags, or other symbols of Jewish identity.

Despite being arrested after the first two incidents Bazrouk allegedly continued his pattern of targeted antisemitic violence culminating in a third assault in January 2025. A search of Bazrouk’s phone revealed numerous antisemitic messages and propaganda supporting terrorist groups like Hamas and Hezbollah, including self-identification as a “Jew hater” and glorification of anti-Jewish violence.

If convicted, Bazrouk faces up to 30 years in federal prison (10 years per count). The case is being prosecuted by the DOJ Civil Rights Division and the U.S. Attorney’s Office for the Southern District of New York.

Analyst Comments: The repeated targeting of Jewish individuals at public protests has deep emotional and psychological consequences for the broader Jewish community, particularly students. Such assaults reinforce fears of identity expression, and communal safety in public spaces. Jewish organizations especially on college campuses are likely to call for increased security, clear policy enforcement, and strong statements of support. This case may prompt schools, law enforcement, and civic leaders to reassess how they protect Jewish students at public events.

Resources:

• Know Your Rights Protesters’ Rights
• Tips for Preparedness, Peaceful Protesting, and Safety

80 Years After WWII, Seven Largest Jewish Communities Report Unprecedented Global Antisemitism

The J7 Task Force Against Antisemitism, representing the seven largest Jewish diaspora communities (Argentina, Australia, Canada, France, Germany, the UK, and the US), released its first Annual Report on Antisemitism documenting a dramatic and unprecedented surge in antisemitic incidents globally especially following the October 7, 2023 terrorist attacks in Israel.

Key Highlights:

• Australia saw the largest spike with a 317% increase in antisemitic incidents in 2024.
• Germany had over 38 antisemitic incidents per 1,000 Jewish residents the highest per capita.
• Other countries reported continuing or historic highs, including the US (5% rise) and Canada, France, UK remaining at elevated levels.

Analyst Comments: The marked rise in antisemitic incidents across multiple global regions, especially in countries with substantial Jewish populations like Germany, the UK, and the US, reflects a deeply worrying trend of escalating violence. The data highlights that the level of hostility is no longer limited to isolated incidents but has reached a concerning pattern of systemic aggression and intimidation. Antisemitic violence has increasingly targeted institutions of Jewish life—schools, synagogues, and community centers, signaling that Jewish communities are under direct attack, not only ideologically but physically.

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters. 

Weekly Security Sprint EP 110. Disrupted attacks, hurricane preparedness, and cyber reviews

The Gate 15 Security Sprint is a weekly rundown of the week’s notable all-hazards security news, risks and threats and some of the key focus areas for organizations to consider behind the headlines. Gate 15 team members discuss physical security, cybersecurity, natural hazards, health threats and other issues across our environment.

In this week’s Security Sprint Dave and Andy covered the following topics:

• Physical security
• Severe weather
• Cybersecurity

Information on other Gate 15 podcasts can be found here.

Conflict Prevention Webinar Series

Introduction to Conflict Prevention Techniques and Resources

• Date: May 14, 2025
• Time: 1:30 PM ET
• Register Here

During this 30-minute webinar attendees will receive a brief introduction to CISA’s Conflict Prevention techniques and resources which can be used to enhance the safety and security of people, facilities, and communities by empowering users to prevent incidents of targeted violence.

Conflict Prevention Strategies to Deter Acts of Targeted Violence

• Date: May 28, 2025
• Time: 1:30PM ET
• Register Here

During this 60-minute webinar attendees will become familiar with the principles of conflict prevention and gain a more in-depth understanding of effective de-escalation approaches which can be used to help diffuse a volatile situation.

In first, US Jewish security outfit opens boot camp for volunteer synagogue guards

In response to escalating antisemitic threats, the Community Security Service (CSS), a U.S.-based Jewish security nonprofit, has initiated a specialized training program for volunteer synagogue guards. This program, held at a retreat in rural Pennsylvania, aims to equip synagogue members with the skills necessary to protect their communities from both violent attacks and harassment.

The training includes realistic simulations, such as mock protests and staged attacks, to prepare volunteers for high-pressure situations. Participants learn threat assessment, crowd control, Krav Maga self-defense, and emergency lockdown procedures. The program emphasizes de-escalation and prevention, ensuring that volunteers can maintain safety without escalating tensions.

Since the October 7 Hamas attacks in Israel, CSS has expanded its reach, now working with over 400 synagogues nationwide, up from 300 prior to the attacks. The organization has trained approximately 4,000 volunteers and is extending its programs to cities like Los Angeles and Miami.

CSS’s approach is rooted in community empowerment, training synagogue members to recognize and respond to threats effectively. This model not only enhances security but also fosters a sense of responsibility and vigilance within the Jewish community.

Analyst Comments: By equipping community members with the skills to protect their own institutions rather than depending entirely on outside law enforcement, CSS promotes a sense of collective responsibility and heightened awareness. This approach aligns with community-driven security models used in other high-risk regions around the world. Personnel training is a key part to any security plan. FB-ISAO encourages members to take advantage of offerings similar to CSS to help raise the individual capacity of their security team members, and thus raising the overall resilience of the entire organization. As a reminder, FB-ISAO will be holding our 2024 Threat Data Review for members starting at 12:00pm ET today.

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters. 

Reports: Arrested Iranian suspects may have been ‘hours away’ from ‘major attack’ on UK synagogue

Reports indicate that Iranian suspects were arrested in the UK just hours before allegedly carrying out a major attack on a synagogue or other Jewish site. The suspects were reportedly in the final stages of planning, suggesting a high level of threat. This incident is being investigated as a potential act of terrorism, possibly with international ties, and raises serious concerns about the safety of Jewish communities and foreign influence in domestic security matters.

Analyst Comments: The foiled attack which reportedly targeted a synagogue underscores the ongoing vulnerability of faith-based organizations. Synagogues, mosques, and churches are frequently viewed as symbols of religious identity, making them prime targets for politically or ideologically driven violence. It is crucial for faith-based institutions to stay alert and prioritize security measures to protect against threats from both domestic and international terror groups. In light of increasing threats, faith-based organizations particularly those with high public visibility should review and update their security protocols.

The FB-ISAO continues to track trends related to attacks on houses of worship. As a reminder, tomorrow 07 May we will be hosting a members only briefing to review the 2024 data on “Incidents Affecting Houses of Worship” which will begin at 12pm ET. Interested members can Register Here.

Related Articles:

• How ‘SAS swooped on Iran-backed terror cell’: Special Forces troops joined police on UK streets to arrest suspects ‘who were HOURS away from major terror attack on UK synagogue’
• Four Iranian men questioned over alleged major terror plot against British target

House members put forward highest-ever request for nonprofit security funding for 2026

A bipartisan group of 145 U.S. House members is advocating for a significant increase in funding for the Nonprofit Security Grant Program (NSGP) in fiscal year 2026, requesting $500 million the highest amount ever proposed for the program. This initiative, led by Representatives Bill Pascrell (D-NJ) and Michael McCaul (R-TX) aims to address the escalating threats faced by religious and nonprofit institutions, particularly Jewish organizations, in the wake of rising antisemitic incidents following the October 7 Hamas attacks on Israel.

The NSGP, administered by the Department of Homeland Security, provides critical funding to nonprofits and faith-based organizations to enhance their security infrastructure. Despite previous increases, the program has been unable to meet the growing demand; in 2024, only 43% of applications were funded leaving many institutions vulnerable. Advocates argue that the proposed $500 million is essential to ensure the safety and security of communities at risk.

This push for increased funding reflects a broader concern among lawmakers and community leaders about the adequacy of current security measures for vulnerable populations. The proposed increase would not only bolster physical security but also provide training and resources to better prepare organizations against potential threats.

Analyst Comments: The growing demand for NSGP funding indicates that faith-based organizations are becoming more aware of their vulnerability to physical threats, such as hate-motivated incidents and targeted violence. This has led to a more proactive approach to risk management including the use of surveillance technology, access control measures, and staff preparedness training signaling a broader trend toward operational readiness within the nonprofit sector. Investing in physical security measures such as cameras and reinforced entry points is important but their effectiveness increases significantly when paired with initiatives like security awareness training, emergency drills, and clear communication procedures. Grant programs that support both infrastructure and preparedness efforts offer more comprehensive protection, helping faith-based organizations respond effectively to a variety of threats from targeted violence to natural disasters.

FEMA Is Ending Door-to-Door Canvassing in Disaster Areas

The Federal Emergency Management Agency (FEMA) is discontinuing its longstanding practice of door-to-door canvassing in disaster areas, a shift outlined in a May 2 memo obtained by WIRED. Instead, FEMA will focus on providing assistance through fixed facilities and by collaborating more closely with state, local, tribal, and nonprofit partners. This change is part of broader reforms aimed at streamlining disaster response efforts for the 2025 hurricane and wildfire season.

While FEMA officials argue that this move will enhance efficiency and empower local entities, critics including FEMA employees and emergency management experts express concern that eliminating door-to-door outreach may hinder aid accessibility for vulnerable populations, such as the elderly and disabled, who may face challenges reaching fixed Disaster Recovery Centers. The decision also follows past controversies including allegations of political bias during previous canvassing efforts, although internal investigations found no systemic misconduct.

As FEMA reduces its direct outreach operations amid broader federal budget cuts, questions arise about the capacity of smaller states and communities to fill the service gaps left by the agency’s withdrawal. The effectiveness of this new approach will likely depend on the strength of local infrastructures and the availability of resources to support disaster survivors.

Analyst Comments: FEMA’s decision to end door-to-door canvassing reflects a shift toward more centralized and cost-efficient disaster response. While this may improve operational efficiency it also raises concerns about accessibility for individuals who may struggle to reach fixed Disaster Recovery Centers such as older adults, people with disabilities, and low-income residents. The success of this new approach will largely depend on the ability of local partners to identify and assist those with the greatest needs. As a reminder, members will be receiving our Weekly Report on Thursday which will focus on Hurricane Preparedness, as we observe Hurricane Preparedness Week. To learn more about membership perks like our Weekly Reports and special threat briefings, visit our membership page.

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters. 

Presentation of Incidents Affecting Houses of Worship in 2024

Member ONLY Event.

Join a presentation of the much-anticipated cumulative data on attacks on houses of worship in 2024.

The presentation will take place on 07 May 2025 at 12pm ET.

Register Here

Disturbing details revealed in New River pastor’s homicide case

On April 28, 2025, 76-year-old Pastor William “Bill” Schonemann of New River Bible Chapel was found dead in his home near 13th Avenue and Circle Mountain Road in New River, Arizona. The Maricopa County Medical Examiner’s Office confirmed his death as a homicide. Sources indicate that he was discovered lying on his bed with his arms spread out and hands pinned to the wall, bearing significant injuries.

The Maricopa County Sheriff’s Office has not disclosed whether a suspect is in custody, nor have they revealed the official cause of death or a motive. They have described the case as involving “unique, specific circumstances” but assured the public that there is no ongoing threat to the community.

An autopsy was scheduled for May 2, 2025, to further investigate the circumstances surrounding his death.

Analyst Comments: The crime scene with the victim’s arms spread and hands pinned to the wall indicates not just a brutal act, but one that may have been meant to convey a symbolic or deeply personal message. This is yet another example of what appears to be targeted violence of a prominent community figure. As faith-based communities work to boost the security and resiliency of their places of worship, they should also consider how to best protect high-profile community leaders that may be more likely to be targeted with acts of violence. CISA has previously published a Personal Security Considerations Action Guide which may be of interest to security leaders.

Hurricane Prep: social media

The National Oceanic and Atmospheric Administration (NOAA) has launched its 2025 Hurricane Preparedness Week (May 4–10) with a comprehensive social media campaign aimed at educating the public on proactive hurricane readiness. The initiative provides daily themes, shareable content, and actionable guidance to help individuals and communities prepare for the upcoming season.

NOAA’s social media plan outlines daily focus areas to build a Weather-Ready Nation:

• May 4 — Know Your Risk: Wind & Water
  Understand the types of wind and water hazards that could affect your area, including storm surge, flooding, and tornadoes.
• May 5 — Prepare Before Hurricane Season
  Take early action by assembling disaster supplies, reviewing insurance policies, and creating an evacuation plan.
• May 6 — Understand Forecast Information
  Learn how to interpret forecasts and alerts to stay informed about storm developments.
• May 7 — Get Moving When a Storm Threatens
  Know the steps to take when a storm is imminent, including evacuation procedures and safety measures.
• May 8 — Stay Protected During Storms
  Implement safety protocols to protect yourself and your property during a hurricane.
• May 9 — Use Caution After Storms
  Exercise caution when returning home and assess potential hazards such as flooding and structural damage.
• May 10 — Take Action Today
  Encourage immediate preparedness actions to ensure readiness for the hurricane season.

Analyst Comments: The emphasis on educating the public about all facets of hurricane preparedness from interpreting forecast data to post-storm safety is essential. This approach not only meets immediate needs but also builds long-term resilience. By offering content in various formats, including videos and social media posts, NOAA ensures that the information is accessible to a wide range of audiences. With hurricane season coming it is important to be prepared and have access to valuable information, hurricanes and natural disasters can be unpredictable so it is important to always have a plan and be prepared. On Thursday, FB-ISAO will publish our Weekly Report which will be focused on hurricane preparedness.

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters. 

Review of Security Teams in Light of Recent Legislation in California 

Member ONLY Event.  

Join a discussion on the effects to security teams, how they operate, and what requirements they may need to meet pursuant to a bill that was just passed in the state of California.  

Due to scheduling conflicts, the event date had to be changed from 06 May to 22 May. We apologize for the inconvenience and hope that you can still join us! 

Register Here 

Presentation of Incidents Affecting Houses of Worship in 2024 

Member ONLY Event.  

Join a presentation of the much-anticipated cumulative data on attacks on houses of worship in 2024.  

The presentation will take place on 07 May 2025 at 12pm ET. 

Register Here 

Florida Man Arrested in Foiled Mass Shooting Plot – Church Listed Among Targets 

A 22-year-old Florida man, Damien Blade Allen, was arrested after authorities uncovered a detailed plan to carry out seven mass shootings including an attack on a church. A tip from the FBI led Palm Beach County Sheriff’s Office to search Allen’s home, where they found 18 firearms, 12,000 rounds of ammo, police and military uniforms, fake IDs, and tactical gear. 

Investigators linked Allen to Natalie Rupnow, a teen who committed a deadly school shooting in Wisconsin in 2024. The two exchanged messages discussing attacks and shared extremist and racist content online. Allen had posed as a deputy on social media using fake gear and posted videos in imitation police vehicles. 

Allen faces charges for making mass shooting threats, unlawful communication, and impersonating law enforcement. The case highlights growing concerns about online radicalization, impersonation tactics, and the specific targeting of faith communities. 

Key Takeaways for Church Security: 

• Attackers often reveal their intent online. 
• Impersonation of law enforcement is a rising threat. 
• Churches should maintain visible security and build relationships with local law enforcement. 
• Vigilance and reporting suspicious behavior can save lives. 

Analyst Comments: This incident highlights the growing complexity of the domestic threat environment where individuals can become self-radicalized through online platforms, acquire tactical skills, and loosely coordinate with others who share similar extremist views across state lines. Allen’s connection to the Wisconsin shooter points to a likely ideological motive with signs of a broader intent to carry out coordinated, multi-target acts of violence. The targeting of a church reflects growing concerns about the vulnerability of houses of worship. While often seen as apolitical and community-centered, these spaces are not exempt from ideologically driven threats. It is important for faith-based institutions to be prepared, FB-ISAO has a resource library on Securing Facilities and People. 

Related Articles:

• Arrest in Florida reveals love link, conspiracy between man and Wisconsin school shooter 
• Man posing as deputy fantasized about attacks with teen who killed 2 at school, PBSO says 
• Sheriff: Mass shooting averted after Palm Beach County man found armed, ‘ready to go’  

2 kids, 1 adult struck by car outside church preschool in Sullivan’s Island, South Carolina 

On May 1, 2025, a man drove into two children and one adult outside Sunrise Presbyterian Church on Sullivan’s Island, South Carolina, in what authorities say may have been an intentional act. The incident occurred around 1 p.m. near the church’s preschool. After a five-hour manhunt involving local police, the FBI, and U.S. Marshals, the suspect was found hiding in a boat behind a house across the street and taken into custody without incident. 

The suspect reportedly fled the scene on foot, possibly armed with a knife. Law enforcement conducted grid searches, deployed drones, and established checkpoints. 

One child and one adult were hospitalized but are expected to be released soon. The third victim was treated at the scene. The Charleston County Sheriff’s Office is now leading the investigation, and charges against the suspect are pending. Authorities have not confirmed whether the crash was deliberate but say the investigation is ongoing. 

Analyst Comments: This incident highlights serious concerns about the vulnerability of soft targets such as preschools and houses of worship. The suspect’s alleged use of a vehicle to carry out an attack near a church-affiliated preschool potentially with intent reflects patterns observed in both domestic and global acts of violence where easily accessible and symbolically significant locations are chosen to inflict widespread harm. For security professionals this incident emphasizes the need for thorough threat assessments in both public and faith-based institutions, the importance of increased surveillance in school zones, and the growing significance of identifying behavioral indicators of potential threats. 

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters. 

Review of Security Teams in Light of Recent Legislation in California 

• Member ONLY Event.
• Join a discussion on the effects to security teams, how they operate, and what requirements they may need to meet pursuant to a bill that was just passed in the state of California.  

Due to scheduling conflicts, the event date had to be changed from 06 May to 22 May. We apologize for the inconvenience and hope that you can still join us!

Register Here 

Presentation of Incidents Affecting Houses of Worship in 2024 

• Member ONLY Event.  
• Join a presentation of the much-anticipated cumulative data on attacks on houses of worship in 2024.  

The presentation will take place on 07 May 2025 at 12pm ET. 

Register Here 

Map and List of Cities Hosting 50501 Protests Against Trump on May 1 

50501, a prominent grassroots organization, is leading a nationwide protest movement on today May 1, 2025 (May Day) in opposition to President Donald Trump’s second term. The protests are being held across all 50 states, highlighting concerns about democracy, labor rights, and authoritarianism. 

Key Details: 

• Organizing Group: 50501 (named for 50 protests in 50 states on one day) 
• Focus: Peaceful resistance to Trump’s leadership and policies, using May Day’s symbolism of worker solidarity. 
• Support: Backed by immigrant rights and civil rights groups. 
• Participation: Events range from large city rallies to smaller rural gatherings. 

Analyst Comments: The use of May Day ties the protests to historical labor movements, signaling solidarity with working-class, immigrant, and marginalized communities. Events are taking place in all 50 states, including rural and suburban areas, while largely peaceful the decentralized nature can lead to variations in tone and crowd dynamics, potentially increasing risk for disruption in some locations. It is important to monitor local protest schedules, coordinate with local law enforcement, lock secondary entrances, communicate a plan, and use community engagement.  

Happy Password Day! Yes, That’s a Thing – And It’s More Fun Than It Sounds 

The SANS Institute’s blog post, “Happy Password Day! Yes, That’s a Thing – And It’s More Fun Than It Sounds,” emphasizes the critical role passwords play in safeguarding our digital lives. While passwords can be cumbersome, they are essential for protecting access to sensitive information like banking, email, and social media accounts. 

Key Takeaways: 

• Long and Unique Passwords: It’s crucial to create long, unique passwords for each account. Using passphrases combinations of random words can enhance security and memorability.  
• Password Managers: Utilizing password managers can help generate, store, and manage complex passwords, reducing the burden of remembering multiple credentials.  
• Multi-Factor Authentication (MFA): Enabling MFA adds an extra layer of security, making it significantly harder for unauthorized users to gain access, even if a password is compromised. 

Analyst Comments: The SANS Institute’s Password Day blog delivers an essential, timely reminder about the foundational role passwords still play in cybersecurity. While newer authentication methods are gaining popularity, passwords remain a first line of defense for most users and organizations. Password Day is a great hook for launching or reinvigorating employee cybersecurity awareness efforts. Organizations should use it to promote internal password best practices and training. As cyber threats evolve, the fundamentals matter more than ever. Security leaders should leverage this moment to reinforce good password hygiene, introduce tools like password managers, and double down on MFA across all user tiers. 

Resources:

• Create and use strong passwords
• Use Strong Passwords 

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters. 

Weekly Security Sprint EP 109. Cybersecurity reports, Casino blended threat, and vehicle ramming

The Gate 15 Security Sprint is a weekly rundown of the week’s notable all-hazards security news, risks and threats and some of the key focus areas for organizations to consider behind the headlines. Gate 15 team members discuss physical security, cybersecurity, natural hazards, health threats and other issues across our environment.

In this week’s Security Sprint Dave and Andy covered the following topics:

• Big 3
• Casino Hackers
• Vancouver Vehicle Ramming

Information on other Gate 15 podcasts can be found here.

UK Crossbow Attack Suspect put ‘Massacre’ Plans Online

On the evening of April 26, a 38-year-old man in West Yorkshire, England, attacked two women with a crossbow and firearm during the busy Otley Run pub crawl. Both victims were seriously injured. Police apprehended the suspect, who later died from self-inflicted injuries. The attack occurred amid large crowds celebrating a local soccer team’s season. The UK’s Counter Terrorism Policing is investigating and has stated there is no indication anyone else was involved.

Analyst Comments: In a Facebook post, the attacker referenced a “manifesto” written by the man who killed 51 people during shootings at a mosque and Islamic center in Christchurch, New Zealand, in 2019. We continue to see extremist use past attacks as inspiration. While local authorities noted that the pub crawl is not a formal event, it is well known to draw large crowds both making it an enticing target, as well as difficult to secure. We have uploaded to the FB-ISAO Slack Workspace an (U//FOUO) document about the attack which is available for members to view. You can learn more about FB-ISAO membership here.

A Bomb Was Found Near a Church. Was It Targeted?

The article titled “A Bomb Was Found Near a Church. Was It a Warning?” from Christian Warrior Training discusses a bomb threat incident at Hartford Memorial Baptist Church in Detroit. On December 4, 2023, police received a call about a bomb threat at the church, leading to an evacuation. The threat was ultimately deemed unfounded. However, during the investigation, a man’s body was discovered nearby, adding complexity to the situation

Christian Warrior Training uses this incident to highlight the increasing threats faced by churches and emphasizes the importance of preparedness. The organization, led by retired police sergeant Keith Graves, offers free online courses and resources aimed at equipping church security teams with the necessary skills to protect their congregations. ​

The article underscores the need for heightened vigilance and proactive measures in church security, suggesting that such threats, even if unfounded, serve as warnings that should not be ignored.

Analyst Comments: The article looks at the growing concerns around security threats to religious institutions. It allows readers to position places of worship not just as places of worship but also as potential soft targets in an increasingly unstable environment. This piece bridges two worlds: spiritual leadership and tactical defense. As always FB-ISAO has resources on Securing Facilities and People as well as hosted a series on Standing up Teams for places of worship.

Threat Actors Use “Swatting” to Target Victims Nationwide

The FBI has identified a recent rise in “swatting” incidents. This Public Service Announcement (PSA) aims to inform the public about the nature of swatting, offer guidance on how to protect against it, and explain how to report suspected cases. The FBI treats these threats with utmost seriousness and works closely with federal, state, local, tribal, and territorial law enforcement agencies to respond to and investigate such events.

What is swatting?

Swatting is a dangerous and criminal act where someone makes a fake emergency call often claiming a life-threatening situation to provoke a heavy law enforcement response, such as a SWAT team, at a victim’s location. These hoaxes can cause panic, injury, or even death, and divert resources from real emergencies.

Victims can include public figures, schools, hospitals, places of worship, and transportation hubs, though anyone can be targeted. Swatting is typically used to harass, intimidate, or retaliate.

Criminals often gather personal information from public sources and use spoofing technology to hide their identity or make it seem like the victim made the call. Some even exploit compromised smart home devices to carry out the attack.

Ways to Protect Yourself:

The FBI urges the public to consider the following measures:

• Review your online presence for sensitive personal information that could enable malicious actors to conduct a swatting attack.
• Exercise care when posting content (including photos and videos) or sharing it with individuals online. Although seemingly innocuous, images and videos can be exploited or manipulated by malicious actors for criminal activity.
• Consider online resources and services that may aid in reducing or removing sensitive publicly available information.
• Use strong, unique passwords, and multi-factor authentication on all devices and accounts, including smart home devices.
• Discuss swatting with your family members or colleagues and have a plan in place in the event of law enforcement contact at your residence, business, or other location.

For someething like this, we can probably find an OSINT story to link to. Then we can include details that are in that story, and mention we’ve uploaded an FOUO doc to Slack, and when we do that we can indicate that is a member perk and link to where they can learn more about membership.

Since this has come up a few times recently, I just want to note that since this resrouce does specifically talk about providing resources for churches, it’s fine to use “church” as opposed to something more generic.

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters. 

Networking with the Planners of the FB-ISAO Monthly Education 

• Time: Apr 30, 2025 12:00 PM Eastern Time (US and Canada) 
• Join Zoom Meeting 
• Learn more here.  

Nerd Out EP 57. Drone deep-dive, plus talk on Daredevil and Andor 

The Gate 15 Nerd Out! Security Panel Discussion, moderated by Dave Pounder, focuses on physical security topics including terrorism, extremism, hostile events, and other security-focused topics. 

In the latest episode of Nerd Out, Dave is joined by Alec Davison to talk about the latest in drone news and the way threat actors exploit them from a cyber and physical security perspective as well as mitigation strategies.  

Information on other Gate 15 podcasts can be found at Podcasts.  

‘Scorched Earth’: Study looks at reasons behind rise in arson attacks on churches 

The “Scorched Earth” study by the Macdonald-Laurier Institute investigates the sharp rise in arson attacks on Canadian churches since 2021, linking the increase primarily to public reactions over unverified claims of unmarked graves at former Indigenous residential schools rather than anti-religious sentiment. 

Key points: 

• Incidents doubled since 2021, with nearly 100 churches damaged or destroyed by 2023. 
• Only 4% of arson cases resulted in charges, leaving most motives and perpetrators unidentified. 
• Statistical analysis found no strong evidence of religious motivation; the surge aligns with the timing of grave site announcements beginning in May 2021. 
• Public and political responses to these claims (many later debunked) may have indirectly fueled the attacks. 
• The report warns that law enforcement failures and public apathy could harm Indigenous reconciliation efforts. 
• It proposes a three-part plan: 
• A specialized national investigative unit for religious arsons 
• Strengthening Indigenous emergency services 
• Improving Canada’s fragmented fire-data collection systems 

Analyst Comments: There is a growing recognition of the need for a more unified and proactive strategy to safeguard faith-based communities in Canada, particularly in response to the alarming rise in church arsons since 2021. The creation of a dedicated national task force to investigate hate crimes targeting religious institutions. At present, enforcement efforts vary widely across provinces, and a significant number of these crimes remain unresolved. The authors believe that establishing a specialized investigative unit similar to those used in cases of terrorism or organized crime would enhance the consistency and effectiveness of responses, while also signaling that attacks on religious communities are taken with the utmost seriousness. 

RE-ISAC encourages organizations that have not yet reviewed CISA’s Fire as a Weapon Action Guide to do so to help identify both protective measures, and mitigation strategies. 

Cops probing threats, harassment against 2 women during protest outside NYC synagogue after vile video circulates online & Mob of Orthodox Jewish men chases woman after protest at Brooklyn synagogue 

In Brooklyn, New York, a woman was chased, kicked, spat on, and pelted with objects by a mob of Orthodox Jewish men who mistook her for a pro-Palestinian protester. The incident occurred near the Chabad Lubavitch headquarters in Crown Heights, following a protest against Israeli far-right security minister Itamar Ben-Gvir. The woman, a neighborhood resident in her 30s, had covered her face with a scarf to avoid being filmed, which led to her being surrounded by the mob. She reported that the group shouted threats and chants, including “death to Arabs,” and that a lone police officer attempted to escort her to safety but was unable to prevent the harassment. The incident has raised concerns about the safety of individuals during politically charged demonstrations and the adequacy of law enforcement responses in such situations.  

In a separate incident in Manhattan, two women were arrested after assaulting a Jewish woman who had confronted them for tearing down “Missing Persons” posters related to Israelis kidnapped by Hamas. The victim, who had recorded the confrontation on her cellphone, was attacked by the suspects, who knocked her phone out of her hand and caused minor injuries. The NYPD Hate Crime Task Force is investigating the incident, which is part of a broader pattern of antisemitic acts in the city. Mayor Eric Adams condemned the actions as a “deeply misguided act of disrespect to victims of terrorism.” 

Analyst Comments: Both the mob harassment of a woman in a Jewish neighborhood and the assault on another Jewish woman over posters related to the Israel-Hamas conflict reveal an increasing vulnerability of faith-based communities to acts of retaliatory aggression. These incidents are not isolated outliers they signal a wider decline in public tolerance and a disturbing willingness to target individuals based on their perceived religious or ethnic identities. As international tensions intensify, it is essential that our domestic response centers on safeguarding freedom of religion and belief for all, regardless of political viewpoints.