DHS Tells Police That Common Protest Activities Are ‘Violent Tactics’

The Department of Homeland Security is urging local police to consider a wide range of protest activity as violent tactics, including mundane acts like riding a bike or livestreaming a police encounter, WIRED has learned.

Threat bulletins issued during last month’s “No Kings” protests warn that the US government’s aggressive immigration raids are almost certain to accelerate domestic unrest, with DHS saying there’s a “high likeliness” more Americans will soon turn against the agency, which could trigger confrontations near federal sites.

Blaming intense media coverage and backlash to the US military deployment in Los Angeles, DHS expects the demonstrations to “continue and grow across the nation” as protesters focused on other issues shift to immigration, following a broad “embracement of anti-ICE messaging.”

The bulletins—first obtained by the national security nonprofit Property of the People through public records requests—warn that officers could face assaults with fireworks and improvised weapons: paint-filled fire extinguishers, smoke grenades, and projectiles like bottles and rocks.

At the same time, the guidance urges officers to consider a range of nonviolent behavior and common protest gear—like masks, flashlights, and cameras—as potential precursors to violence, telling officers to prepare “from the point of view of an adversary.”

Protesters on bicycles, skateboards, or even “on foot” are framed as potential “scouts” conducting reconnaissance or searching for “items to be used as weapons.” Livestreaming is listed alongside “doxxing” as a “tactic” for “threatening” police. Online posters are cast as ideological recruiters—or as participants in “surveillance sharing.”

One list of “violent tactics” shared by the Los Angeles–based Joint Regional Intelligence Center—part of a post-9/11 fusion network—includes both protesters’ attempts to avoid identification and efforts to identify police. The memo also alleges that face recognition, normally a tool of law enforcement, was used against officers.

Vera Eidelman, a senior staff attorney with the American Civil Liberties Union, says the government has no business treating constitutionally protected activities—like observing or documenting police—as threats.

DHS did not respond to a request for comment.

“Exercising those rights shouldn't be justification for adverse action or suspicion by the government,” Eidelman says. Labeling something as harmless as skateboarding at a protest as a violent threat is “disturbing and dangerous,” she adds, and could “easily lead to excessive force against people who are simply exercising their First Amendment rights.”

“The DHS report repeatedly conflates basic protest, organizing, and journalism with terroristic violence, thereby justifying ever more authoritarian measures by law enforcement,” says Ryan Shapiro, executive director of Property of the People. “It should be sobering, if unsurprising, that the Trump regime’s response to mass criticism of its police state tactics is to escalate those tactics.”

Fusion centers like JRIC play a central role in how police understand protest movements. The intelligence they produce is rapidly disseminated and draws heavily on open-source data. It often reflects broad, risk-averse assumptions and includes fragmentary and unverified information. In the absence of concrete threats, bulletins often turn to ideological language and social media activity as evidence of emerging risks, even when tied to lawful expression.

DHS’s risk-based approach reflects a broader shift in US law enforcement shaped by post-9/11 security priorities—one that elevates perceived intent over demonstrable wrongdoing and uses behavior cues, affiliations, and other potentially predictive indicators to justify early intervention and expanded surveillance.

A year ago, DHS warned that immigration-related grievances were driving a spike in threats against judges, migrants, and law enforcement, predicting that new laws and high-profile crackdowns would further radicalize individuals. In February, another fusion center reported renewed calls for violence against police and government officials, citing backlash to perceived federal overreach and identifying then-upcoming protests and court rulings as likely triggers.

At times, the sprawling predictions may appear prescient, echoing real-world flashpoints: In Alvarado, Texas, an alleged coordinated ambush at a detention center this week drew ICE agents out with fireworks before gunfire erupted on July 4, leaving a police officer shot in the neck. (Nearly a dozen arrests have been made, at least 10 on charges of attempted murder.)

In advance of protests, agencies increasingly rely on intelligence forecasting to identify groups seen as ideologically subversive or tactically unpredictable. Demonstrators labeled “transgressive” may be monitored, detained without charges, or met with force.

Social movement scholars widely recognize the introduction of preemptive protest policing as a departure from late-20th century approaches that prioritized de-escalation, communication, and facilitation. In its place, authorities have increasingly emphasized control of demonstrations through early intervention, surveillance, and disruption—monitoring organizers, restricting public space, and responding proactively based on perceived risks rather than actual conduct.

Infrastructure initially designed to combat terrorism now often serves to monitor street-level protests, with virtual investigations units targeting demonstrators for scrutiny based on online expression. Fusion centers, funded through DHS grants, have increasingly issued bulletins flagging protest slogans, references to police brutality, and solidarity events as signs of possible violence—disseminating these assessments to law enforcement absent clear evidence of criminal intent.

Surveillance of protesters has included the construction of dossiers (known as “baseball cards”) with analysts using high-tech tools to compile subjects’ social media posts, affiliations, personal networks, and public statements critical of government policy.

Obtained exclusively by WIRED, a DHS dossier on Mahmoud Khalil, the former Columbia graduate student and anti-war activist, shows that analysts drew information from Canary Mission, a shadowy blacklist that anonymously profiles critics of Israeli military action and supporters of Palestinian rights.

In federal court Wednesday, a senior DHS official acknowledged that material from Canary Mission had been used to compile more than 100 dossiers on students and scholars, despite the site's ideological slant, mysterious funding, and unverifiable sourcing.

Threat bulletins can also prime officers to anticipate conflict, shaping their posture and decisions on the ground. In the wake of violent 2020 protests, the San Jose Police Department in California cited the “numerous intelligence bulletins” it received from its local regional fusion center, DHS, and the FBI, among others, as central to understanding “the mindset of the officers in the days leading up to and throughout the civil unrest.”

Specific bulletins cited by the SJPD—whose protest response prompted a $620,000 settlement this month—framed the demonstrations as possible cover for “domestic terrorists,” warned of opportunistic attacks on law enforcement and promoted an “unconfirmed report” of U-Haul vans purportedly being used to ferry weapons and explosives.

Subsequent reporting in the wake of BlueLeaks—a 269-gigabyte dump of internal police documents obtained by a source identifying as the hacktivist group Anonymous and published by transparency group Distributed Denial of Secrets—found federal bulletins riddled with unverified claims, vague threat language, and outright misinformation, including alerts about a parody website that supposedly paid protesters and accepted bitcoin to set cars on fire, despite a clear banner labeling the site “FAKE.”

Threat alerts—unclassified and routinely accessible to the press—can help law enforcement shape public perception of protests before they begin, laying the groundwork to legitimize aggressive police responses. Unverified DHS warnings about domestic terrorists infiltrating demonstrations in 2020, publicly echoed by the agency’s acting secretary on Twitter, were widely circulated and amplified in media coverage.

Americans are generally opposed to aggressive protest crackdowns, but when they do support them, fear is often the driving force. Experimental research suggests that support for the use of coercive tactics hinges less on what protesters actually do than on how they’re portrayed—by officials, the media, and through racial and ideological frames.