2021 © Allied Universal Prepared January 11, 2021

EXAMINING THE JANUARY 6TH, 2021

UNREST DURING THE

INAUGURATION SEASON

Intelligence Report

Intelligence Report

© 2021 Allied Universal

P a g e | 2

SUMMARY

This report examines the events of January 6, 2021, in Washington D.C., in which a large

demonstration in support of the outgoing presidential administration became a violent riot,

culminating with the storming of the U.S. Capitol building and the deaths of five individuals. The

demonstration on January 6 was not the first such demonstration to breach the Capitol’s

security; however, it was one of the more violent instances in recent memory. In 1971, an anti-

war group detonated a bomb near the Senate facilities inside the Capitol, causing thousands of

dollars' worth of damages without casualties. In a similar incident in 1983, a bomb was

detonated outside the Senate chambers, causing internal damage without casualties. In 1998, a

gunman stormed past security, killing two law enforcement officers before being subdued,

following an exchange of gunfire. There have also been breaches without violence, such as the

2018 Women’s March in which thousands of activists marched on the Capitol in a show of civil

disobedience; the protest resulted in the arrests of nearly 600 participants, including prominent

celebrities and politicians, after demonstrators pushed past security and conducted a "sit-in"

inside the Senate chambers. While security points were breached at each of these events, none

featured the level of violence and force experienced in the storming of the Capitol on January 6.

The breach of security by thousands of demonstrators marked the first such event since 1958

when a group of protestors forced their way into the Capitol with violent intent.

Intelligence Report

© 2021 Allied Universal

P a g e | 3

KEY FINDINGS OF THE JANUARY 6 CAPITOL RIOT On January 6, 2021, thousands of demonstrators gathered in Washington D.C. to voice their

support for the outgoing presidential administration and to protest the November 2020

presidential election results. Significant chatter forecasting the demonstration appeared in

social media in the days leading up to the demonstration. On Wednesday, January 6, the

Senate and the House of Representatives would convene to debate objections to the count of

Electoral College votes. Shortly after arriving at the Capitol, demonstrators became more

aggressive toward Capitol Police posted outside as Senate and House procedures were

underway. At approximately 2:15 PM EST, Capitol Police notified members of Congress that no

entry or exit from the building was allowed due to an "external security threat," as demonstration

participants had broken through physical security barriers. Roughly fifteen minutes later,

legislators inside and their staffs were forced to take refuge in secure locations as

demonstrators rushed through the House chambers and police reportedly deployed tear gas in

the Capitol Rotunda. The incident was declared an unlawful assembly and a riot, and

demonstrators remained inside until National Guard, FBI Tactical Teams, and Capitol Police

could secure the building at approximately 5:40 PM EST. Congress reconvened that evening to

continue with deliberations. The incident resulted in the deaths of five individuals, including a

Capitol Police officer (1).

In response to the incident, Washington, D.C. Mayor Muriel Bowser imposed a 6:00 PM EST

curfew which was echoed by Virginia Governor Ralph Northam for Arlington and Alexandria

counties, resulting in a heightened police presence and the early closure of local businesses. (2)

Even as they had staged outside of the Capitol building in preparation for the day's

demonstrations, law enforcement officers ultimately appeared to be underprepared and

underequipped. Demonstrators became aggressive, and law enforcement officers appeared

overwhelmed as police barricades were overcome at multiple points around the building and as

protesters scaled walls and scaffolding emplaced for Inauguration Day (3).

By all accounts, U.S. Capitol police were underequipped and under-resourced to prevent

thousands of demonstrators from breaching the building. Despite the urgency, reportedly three

hours passed before reinforcements arrived, well after demonstrators had overrun the Capitol’s

security barriers. Approximately three additional hours were needed to clear the building and

secure the chambers to allow Congress to resume deliberations. Suspicious packages were

discovered on Capitol grounds, and pipe bombs were found at the headquarters of the

Republican and Democratic National Committees. All of the devices were safely detonated and

neutralized by law enforcement (4).

The national capital was not the only city that experienced demonstrations related to the

certification of Electoral College votes in Congress. Protests were held in Georgia, Hawaii,

Oklahoma, Arizona, Washington, Utah, California, Ohio, Kansas, Nevada, Colorado, Minnesota,

Oregon, New Mexico, Texas, South Carolina, Nebraska, and Arkansas (5). While rallies at

several state capitals were relatively peaceful, protests in several other cities became violent.

Demonstrators and counter-demonstrators clashed in Oregon, Ohio, and California, and

Intelligence Report

© 2021 Allied Universal

P a g e | 4

participants were subject to riot control measures

like tear gas and pepper spray. In New Mexico and

Georgia, the state capitols were evacuated. Armed

demonstrators appeared outside the statehouses in

Georgia, Oregon, Washington, Oklahoma, Arizona,

and Colorado, but no gun violence was experienced

at any of these locations (6).

As news of the unfolding events at the U.S. Capitol

broke, a few demonstrations turned volatile. In

Salem, Oregon, elements reportedly associated with

The Proud Boys became aggressive and clashed

with both police and counter-demonstrators, causing

injuries. Additionally, armed activists stormed the

Washington State Governor's Mansion grounds after

breaching exterior fencing (7) before being escorted

from the grounds by Washington State Troopers.

Between December 23rd and January 7th, several

non-governmental sources published nearly two-

dozen articles warning of the impending unrest.

These organizations followed the individuals

involved in the planning as they openly discussed

storming Congress and encouraged participants to

carry zip-ties to seize politicians whom they may

encounter.

SECURITY RESPONSE In response to the potential for violent unrest at the

U.S. Capitol and at state capitol buildings across the

country, several states have activated their National

Guard units to help secure state and federal

facilities. On Monday, January 11, the chief of the

National Guard Bureau, General Hokanson,

announced approximately 10,000 National

Guardsmen would be activated and deployed to

Washington D.C. in preparation for the Presidential

Inauguration. Guardsmen from Maryland, Pennsylvania, Virginia, and New York will join D.C.

guardsmen and law enforcement officers to augment security in the nation's capital (8). Nearly

6,000 guardsmen arrived in D.C. during the weekend, and another 4,000 are set to arrive by the

weekend of January 16 and 17. The FBI has released a statement indicating that armed

demonstrations are expected at all 50 state capitols, starting as early as January 16.

Intelligence Report

© 2021 Allied Universal

P a g e | 5

In Olympia, Washington, the Washington State National Guard was mobilized on January 10 in

preparation for the reconvening of the Washington State Legislature, and demonstrations were

expected at the state capitol building. Demonstrations over the weekend remained peaceful, as

guardsmen stood watch outside the state legislature. The governor activated roughly 750

members of the National Guard following the Governor's Mansion's demonstrations and breach

on January 6 (9).

The Proud Boys and other extremist groups are reportedly planning to conduct armed protests

in as many state capitals as possible on Sunday, January 17, according to multiple sources.

Although a broad statement, these announced plans should be taken seriously by residents and

businesses near state capitol buildings. As seen during the demonstrations in the summer of

2020 in cities like Seattle, Portland, Atlanta, and Washington D.C., local businesses and

storefronts are highly susceptible to vandalism (10 | 11).

In Utah and Texas, there were gatherings of several hundred supporters of the outgoing

administration at each statehouse. There were minor scuffles with law enforcement in both

cases that resulted in the use of pepper spray and pepper balls. Since January 6, we have also

seen rallies in Cleveland, OH, St. Louis, MO, and Austin, TX. All three of these demonstrations

were organized and had a few hundred participants. In Cleveland, there was a protest against

the outgoing administration. In St. Louis, the focus was a call for Senator Josh Hawley to resign.

In Austin, the rally called for State Attorney General Ken Paxton to resign. (12).

At least nine protests under the banner "TRUMP/PENCE OUT NOW!" were planned through

refusefacism.org and occurred on January 9th and 10th (13). Thus far, some of the

refusefascism.org demonstrations have seen counter-demonstrations in response. A

demonstration in San Diego, CA clashed with counter-protestors and resulted in the arrests of

three individuals (14).

Antifa held a demonstration in Portland, OR on January 6 that quickly turned destructive.

Participants attempted to burn down a police precinct building and damaged the exteriors of

local businesses that they deemed had ties to fascist local politicians or policies (15). Antifa has

been consistently promoting almost daily rallies in Portland for nearly a year. The threat of

damage to local businesses and government structures in Portland is elevated.

Intelligence Report

© 2021 Allied Universal

P a g e | 6

SOCIAL MEDIA INFLUENCERS Open-source chatter has frequently preceded large-scale demonstrations, as it did before the

January 6 riots. Many posts discuss planned activities for not only Inauguration Day but also the

weekend prior. Social media discussions on open sites such as Facebook and Twitter have

been more frequent, especially regarding potential unrest on the weekend of January 16 and 17

(16). As a result, Washington, D.C., Mayor Muriel Bowser has requested assistance from the

Department of Homeland Security to increase security presence in the Capitol area and the

cancellation of all requests for demonstration permits (17). Business owners and D.C. residents

have begun posting the hashtag "#DontRentDC" to deter property managers from granting

short-term rentals unwittingly to individuals traveling from out of town with an intent to participate

in civil unrest.

Of particular concern is the so-called "Million Militia March." Vows by extremist groups to return

to the Capitol on Election Day are posted on multiple social media forums and call for armed

marches and violence. T-shirts and posters for the event have been made and published on

numerous social media platforms. Other locations mentioned in social media posts include Salt

Lake City, Utah, state buildings in Pittsburgh, Pennsylvania, and Columbus, Ohio (18). Given

the many posts calling for action on various social media and blog sites, the likelihood is high

that demonstrations will turn violent.

The recent removal of Parler - an application that advertises a strict adherence to the right to

free speech - from Apple and Google app stores and Amazon Web Servers may increase the

likelihood of demonstrations at the sites of these companies’ offices in the coming days. News

of these companies' decisions was followed by posts on various social media and blogging

platforms inciting violence against tech company employees. However, the likelihood of crowd

sizes similar to those seen in D.C. on January 6 for any potential anti-tech demonstrations is low

(19).

Intelligence Report

© 2021 Allied Universal

P a g e | 7

CONSIDERATIONS

It is recommended that businesses in the vicinity of government buildings track demonstration

activity in and around their locations and opt for early closures over the next ten days.

Additionally, it is recommended that employees living in the immediate areas of planned

demonstrations limit movement.

Businesses should consider risk-ranking locations based upon proximity and likelihood of unrest

nearby. Specifically, businesses and assets near state capitol buildings, government facilities,

and law enforcement agencies should observe the following considerations.

In addition to minimizing personnel working on-site, companies whose essential workers must

attend sites near demonstrations should develop and implement contingency plans in case

evacuation becomes necessary. Ensure your business continuity plan is reviewed and up to

date.

Utilizing professional intelligence monitoring and reporting resources will provide businesses

with the most up-to-date information and allow management to make informed decisions to help

ensure the safety of staff and facilities and the integrity of their brand. Intelligence monitoring

services and threat intelligence analysis identify specific threats that may be announced online

before incidents take place. The storming of the U.S. Capitol was discussed extensively online

for several weeks before January 6. Professional intelligence services that monitor social media

sites, forums, and blogs can allow for early warning and increased reaction times to mitigate

potential threats.

Employing physical security professionals is another protective measure to ensure the safety of

personnel and facilities. Private security serves as a deterrent to opportunistic criminal activity

and acts as emergency response. With law enforcement departments focused primarily on the

epicenters of unrest, opportunistic criminal activity may go unchecked. Businesses should

consider the employment of protective teams with at least one individual with emergency

medical training, given potential delays in response times from law enforcement and emergency

medical services.

COMMERCIAL SECURITY CONSIDERATIONS

1. Have a robust intelligence capability in place. Intelligence support during a time of unrest will

allow local operations or security managers to have a near-real-time overview of the local

climate and operating environment should tensions rapidly escalate.

2. Minimize presenting facilities as a soft target for opportunistic criminal activity. Having a

proactive plan in place to deter criminal activity will aid in protecting employees and assets.

These measures include:

Intelligence Report

© 2021 Allied Universal

P a g e | 8

→ Early identifying and procuring security services.

→ Conducting security system tests to confirm that all CCTV, communication, barrier, fire

suppression, and alarm systems are fully operational or otherwise make any necessary

repairs.

→ Conducting table-top and operational exercises and training for security and GSOC

operators to ensure that they are fully prepared for potential threats and emergency

situations.

→ To avoid complacency, ensuring security personnel are briefed and remain alert for

potential threats and known risks associated with civil unrest in their local area.

→ Ensuring applicable environment security concerns such as afterhours lighting, lighting

for parking areas, and perimeter fencing are inspected and operational.

→ Evaluating placement of high-value assets to limit ease of access if unrest occurs (i.e.,

nothing of high-value next to the front door or visible through windows) and confirming

the proper security storage of high-value assets.

→ Working with operations and facilities to source vendors to respond in the event

immediate physical repairs for the locations are needed. The client should determine

the most vulnerable locations and proactively secure these repair services before

damage occurs.

→ Working with the business operations team and HR to determine process to secure the

locations in the event immediate evacuation is needed:

o Key control

o Securing locations via alarm activation

o Contact protocols

o Notification process for all employees

o Return to work protocols

3. Ensuring emergency kits are fully stocked, operational, and in an easily accessible location.

4. If possible, having employees return home prior to darkness and avoid coming into office

locations during periods of civil unrest.

EXECUTIVE AND RESIDENTIAL SECURITY CONSIDERATIONS

1. Clients continue to request protective agent resources, including critical incident response

teams at office locations and residences. Protective agents patrolling or conspicuously

standing by a site act as a strong deterrent to opportunistic criminal activity.

2. Consider adding EMT and medical personnel to existing support teams. With decreased

response times from emergency services due to demonstrations or potential riots, having

medically trained personnel on site will decrease reliance on first responders for medical

emergencies.

Intelligence Report

© 2021 Allied Universal

P a g e | 9

Some recommendations provided to clients are as follows:

→ If a location is not a priority or if it is near a potential demonstration, shut and board up

the office location on the day prior to the planned demonstration activity.

→ Corporate locations: Provide critical incident response teams prioritized for internal

employee support and evacuation – not to fend off intruders.

→ Residential locations: Provide additional support for executives during a time of high

stress.

→ Ensure emergency kits are fully stocked, operational, and in an easily accessible

location.

SECURITY PLANNING CONSIDERATIONS

1. Review current crisis plan. Review current crisis planning documentation including

→ Closing procedures

→ Evacuation procedures

→ Communication protocols

→ Exercises or drills to ensure that all relevant personnel are fully aware of current policies

for emergency preparedness and business continuity, especially as it relates to closing

and evacuation procedures.

2. Establish and maintain communication. Ensure there is an established plan that provides

positive communication processes during critical incidents to facilitate effective emergency

notifications and responses among employees, executives, and clients.

→ A reliable means of information dissemination is critical during times of crisis.

→ Communication should occur at regular intervals to ensure a consistent flow of

information.

→ A formalized plan should include built-in redundancies for primary and alternate

communication methods in the event that digital and cellular systems are disrupted.

3. Social media/local media/open source intelligence monitoring for location and brand

threats. Opportunists, criminals, and influencers have continued to use social media to

communicate, coordinate, and disseminate information. These individuals use simple words

or phrases to create a “trending” topic that allow others the ease of access to current

information ranging from demonstration locations to police responses.

→ Monitoring social media or online forums and acting upon credible threats and trends will

allow security details and site managers to adequately prepare to deter any threats.

→ Subscribe to local, state, and federal governmental outreach programs and intelligence

products such as OSAC, DSAC, and State Intelligence Fusion Centers.

Intelligence Report

© 2021 Allied Universal

P a g e | 10

→ Meet with local, state, and federal law enforcement personnel for intelligence and

information sharing.

→ Participate in Business Alliance Groups for intelligence and information sharing.

→ Monitoring for the following will provide advanced warning and the time needed to

mitigate the threats and risk to your people, facilities, assets, operations, and reputation:

o Public sentiment

o Brand, company, facility, locations, and personnel mentions

o Known and evolving influencer hashtags

o Protest announcements and updates

→ Trending political, and social justice mentions and hashtags

→ Local news coverage should also be monitored to stay up to date on protests and any

breaking events.

www.aus.com