This DAP highlights – FB-ISAO: What We Learned About Ransomware Resilience / Six things we learned from the LockBit takedown / FRC Publishes New Edition of Hostility Against Churches Report Indicating a Doubling of Attacks / Nonprofit Security Grant Program Webinar Series info from FEMA Bulletin. Every DAP also has More Faith-Based Stories and Select All-Hazard Stories. These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters.
FB-ISAO has assessed the Physical Threat Level for the US faith-based community is “GUARDED.” As per FB-ISAO’s definitions of the Physical Threat Levels, “GUARDED” means FB-ISAO is unaware of any specific threats but a general risk of incidents exists. This has not changed after Saturday’s mass shooting. There is no known credible reporting indicating any broader threat to religious facilities or any known connection between the suspect and other extremist or terrorist groups. The incident is being investigated by the FBI is investigating the shooting as a hate crime.
On Saturday, our nation saw another horrific attack aimed at people of faith, this time in the form of a brutal assault on Jewish congregants at the Tree of Life Synagogue in Pittsburgh. The attacker stated, “I Just Want to Kill Jews.” While his ire was aimed at the Jewish people, this attack, and last week’s murders in Lexington, serve as stark reminders of how houses of worship and people of faith can easily be targeted and underscore the importance of reasonable preparedness.
- The attack at the Tree of Life synagogue in Pittsburgh has left eleven dead and more injured, including congregants and responding police officers. Fox News has summarized the incident, some of the actions taken during the attack and the attacker’s online comments articulating his anti-Semitic views. The entire article is worth reviewing – some notable excerpts follow:
“The suspect in Saturday’s mass shooting at a Pittsburgh synagogue repeatedly expressed anti-Semitic views as he traded gunfire with responding officers, at one point flatly stating: ‘I just want to kill Jews…’”
- Robert G. Bowers’ “assault on the Tree of Life synagogue in Pittsburgh’s Squirrel Hill neighborhood began at approximately 9:50 a.m., when all three congregations housed in the building were holding Sabbath services…
- “Bowers was armed with three Glock .357 handguns and an AR-15 rifle…
- “multiple calls reporting an active shooter were made from the synagogue at 9:54 a.m. The first two officers to arrive on the scene exchanged fire with Bowers…
- “Rabbi Jonathan Perlman shepherded some of the congregants behind a steel door in the basement of the building, likely saving their lives…
- “Bowers had made his way to the third floor of the synagogue. After SWAT team members found him there, the document said Bowers shot two team members multiple times leaving one officer in critical condition. The remaining team members exchanged fire with Bowers, eventually wounding him and capturing him.
- “During this period, according to the federal affidavit, Bowers ‘repeated comments regarding genocide, his desire to kill Jewish people, and that Jewish people needed to die.’ He also accused Jews of ‘committing genocide to my people,’ a comment that echoes those Bowers is believed to have made on the social media site Gab…”
“if our procedures were not already at the level they should be before this incident, then we would be doing our congregants a disservice” – Chris Morris, Cornerstone Chapel
In isolation, the mass shooting is a horrific event. Taken in with last week’s other notable incidents – including the mail campaign and the murder in Kentucky after the possible attempt to target a predominantly black church congregation, several key considerations stand out.
- Hometown Security. DHS has promoted the idea of developing “hometown security.” For houses of worship, that can occur at both the real, physical, level in our communities, and virtually, with communities of trusted partners, including other faith-based organizations, public sector homeland security and law enforcement partners, and others. Building relationships and developing security coordination before an incident can help mitigate the impacts of an attack, should one occur. From the DHS website, members can find resources on several relevant areas, including:
- Securing Soft Targets and Crowded Spaces. “Soft Targets and Crowded Places, such as sports venues, shopping venues, schools, and transportation systems, are locations that are easily accessible to large numbers of people and that have limited security or protective measures in place making them vulnerable to attack.”
- Connect, Plan, Train, Report. “The Department encourages businesses to Connect, Plan, Train, and Report. Applying these four steps in advance of an incident or attack can help better prepare businesses and their employees to proactively think about the role they play in the safety and security of their businesses and communities.”
- Behavioral Indicators. Attacks don’t “just happen.” Hostile Events rarely occur as spur-of-the-moment incidents. Whether hate crimes, terrorism, or other extremist attacks – attackers routinely follow a deliberate process referred to as the Hostile Events Attack Cycle. This process both exposes opportunities for interdiction and addresses the transition from a potential attacker’s transition from the “fantasy stage” to the “planning stage.” Along this progression, a would-be attacker demonstrates indicators of their possible intent. DHS has developed a useful infographic that may be of interest and DHS active shooter documents address behavioral indicators. Additionally, as demonstrated by both the Florida and Pennsylvania arrests, in today’s social media abundance, potential attackers may articulate their extremist views and ill-intentions online, as noted in recent articles including:
- Preparedness. When extremists or unhealthy individuals seek to cause harm, if genuinely determined, they can be successful. Whether with a gun, an edged-weapon, explosives, vehicles, or any number of potential weapons, once an attacker has determined that they will attack there will always be the possibility that an unexpected hostile event can occur. At that point, individuals in the immediate area will have minutes – typically in the area of five minutes based on FBI data – in which their immediate actions can make critical differences. Organizational preparedness for the immediate response to a hostile event can save the lives of personnel – staff, congregation members and other guests. As the Pittsburgh synagogue attack and failed incident in Lexington demonstrate, an attack can occur anywhere, including your facility.
The Hostile Events Attack Cycle details a process that attackers go through when preparing for an attack. Whether they knowingly or unknowingly go through this process, elements of the cycle are identified during the subsequent investigations and analysis of the event. The attack cycle begins with target selection and all the steps that go into identifying, surveilling, validating and ultimately confirming the target. It’s followed by attack planning steps which incorporate finalizing the plan, acquiring weapons and supplies needed to carry out and possibly escape from the attack, pre-attack checks to ensure everything is working as expected, and finally, rehearsals/walk throughs of the attack (which may be on a map, on a table with representations of the target and locations, or in their mind). Finally, they are ready for the attack, and possibly an escape. “Possibly” because some attacks are not designed for an escape. So, for some attacks, the physical attack will be the last act, while in others, there will be an escape.
from: “Hostile Events: Deliberate Planning and Escape,” 05 Nov 2017
Following incidents as we saw this weekend – or after the Sikh temple shooting in Wisconsin, the Charleston church shooting, or the more recent Baptist church shooting in Sutherland Springs – there is often an increased level of anxiety and a desire by both those involved in securing facilities – to include houses of worship – and patrons of those facilities (to include those attending for worship and other faith-based activities) to want to “do something.”
That is admirable, but the reality is these tend to be isolated incidents that can occur anytime, and too often do occur at houses of worship. Therefore, it’s not about doing something in response to a single attack, but rather, baking good preparedness practices into daily operations. When being prepared is part of what we do every day, then our houses of worship, and those we invite to join in the praise of God and the celebration of faith, will be more ready to respond should a hostile event occur. As FB-ISAO Board Member Chris Morris, with Cornerstone Chapel in Leesburg, Virginia recently stated, “As we were preparing for Sunday services, I was asked if we would be increasing security because of the tragedy that happened on Saturday. I responded ‘no’ and explained that if our procedures were not already at the level they should be before this incident, then we would be doing our congregants a disservice.” Chris has baked security and preparedness into his organization’s day-to-day, and as such can avoid knee-jerk reactions and impromptu security measures.
Following the arrest of the suspect behind the recent mail threats. in remarks Friday, the FBI stated though the suspect had been detained there was a continuing threat. Similarly, though the Pittsburgh attack is over, there is an enduring threat of hostile events facing houses of worship and people of faith. Speaking to the mail threat but applicable to faith-based preparedness as well, FBI Director Wray stated, “…we need the help of everyone out there—every citizen, every law enforcement partner, everyone we’ve got…” If you see something that looks awry, a potential threat, a suspicious package, threatening remarks, etc. “(no) piece of information is too small; every tip could be the one that leads to something very important. And of course, if you see any suspicious activity, please call your local authorities. We need all hands on deck. We need to stay vigilant.”
In the months ahead, FB-ISAO looks forward to introducing tools to help members better communicate, alert, and share with other members, and to begin our routine offering of hostile events preparedness education (via webinar). In the meanwhile, please contact our team to join the developing FB-ISAO community.
Want to learn more about Hostile Events? Faith-Based ISAO analyst Dave Pounder wrote a short series for Homeland Security Today:
- Picking Target, Surveillance Begin the Hostile Events Attack Cycle, 24 Jun 2018
- Hostile Events Attack Cycle from Target Selection Through Rehearsal Stage, 16 Jul 2018
- Spotting Pre-Attack Planning Indicators to Disrupt the Hostile Events Cycle, 11 Aug 2017
Dave will be updating this series for FB-ISAO members early next year. Understanding indicators and the hostile events attack cycle can help leaders and staff potentially spot concerning activities and potentially allow the prevention of an actual attack.