Page 1 of 46

Federal Bureau of Investigation

Department of Homeland Security

Strategic Intelligence Assessment and Data on 

Domestic Terrorism 

Submitted to the Permanent Select Committee on Intelligence, the Committee on 

Homeland Security, and the Committee of the Judiciary of the United States House 

of Representatives, and the Select Committee on Intelligence, the Committee on 

Homeland Security and Governmental Affairs, and the Committee of the Judiciary 

of the United States Senate

June 2023
Page 2 of 46

Table of Contents

I. Overview of Reporting Requirement.............................................................................................2

II. Executive Summary.........................................................................................................................2

III. Domestic Terrorism: Definitions, Terminology, and Methodology ............................................3

IV. Strategic Intelligence Assessment...................................................................................................6

V. Discussion and Comparison of Investigative Activities..............................................................11

VI. Data on Domestic Terrorism ........................................................................................................23

VII. Recommendations..........................................................................................................................30

Appendix A.................................................................................................................................................33

Appendix B.................................................................................................................................................40

I. Overview of Reporting Requirement

Pursuant to Section 5602(a) and (b) of the National Defense Authorization Act for Fiscal Year 

(FY) 20201(hereafter “the Act”), the Federal Bureau of Investigation (FBI) and the Department 

of Homeland Security (DHS), in consultation with the Office of the Director of National 

Intelligence (ODNI), including the National Counterterrorism Center (NCTC), and the 

Department of Justice (DOJ), jointly produce a report containing a strategic intelligence 

assessment and data on domestic terrorism (DT). The Act requires the report to contain a 

strategic intelligence assessment, a discussion of specified activities, certain data on DT matters, 

and recommendations. Section 5602(d) of the Act requires the Director of the FBI and the 

Secretary of Homeland Security, in consultation with the Director of National Intelligence (DNI) 

in a manner consistent with the authorities and responsibilities of such Director, to jointly submit 

to the appropriate Congressional committees annual updates to those reports. This report 

constitutes the annual updates for FY 2022.

2

II. Executive Summary

Preventing terrorist attacks remains a top priority for both the FBI and DHS, and the FBI serves 

as the lead investigative agency on terrorism matters. The threat posed by international and 

domestic threat actors has evolved significantly since 9/11. One of the most significant terrorism 

threats to the United States we face today is posed by lone actors

3

and small groups of 

individuals who commit acts of violence motivated by a range of ideological beliefs and/or 

personal grievances. Of these actors, domestic violent extremists represent one of the most 

persistent threats to the United States today. These individuals are often radicalized online and 

1 Public Law 116-92, enacted 20 December 2019.

2 Consistent with Congressional direction, as of December 2022, NCTC has limited its work to the transnational and 

international dimensions of the terrorism threat against the United States. Because this report covers the prior FY 

2022 period, it includes descriptions of NCTC’s involvement in lines of effort and assessments during that period.

3 The FBI and DHS define a lone actor as an individual motivated by one or more violent extremist ideologies who, 

operating alone, supports or engages in acts of unlawful violence in furtherance of that ideology or ideologies that 

may involve influence from a larger terrorist organization or a foreign actor. The mere advocacy of political or 

social positions, political activism, use of strong rhetoric, or generalized philosophic embrace of violent tactics does 

not constitute violent extremism, and is constitutionally protected.
Page 3 of 46

look to conduct attacks with easily accessible weapons. Many of these violent extremists are 

motivated and inspired by a mix of ideological, socio-political, and personal grievances against 

their targets. This report provides our strategic intelligence assessments on DT, a detailed 

discussion of our procedures and methods to address DT threats, as well as data on DT incidents 

and FBI investigations.

III. Domestic Terrorism: Definitions, Terminology, and Methodology

Section 5602(a) of the Act requires the Director of the FBI and the Secretary of Homeland 

Security, in consultation with the DNI, to jointly develop, to the fullest extent feasible and for 

purposes of internal recordkeeping and tracking, uniform and standardized definitions of the 

terms “domestic terrorism,” “act of domestic terrorism,” “domestic terrorism groups,” and any 

other commonly used terms with respect to DT; methodologies for tracking incidents of DT; and 

descriptions of categories and subcategories of DT and ideologies relating to DT; and to jointly 

submit the information in a report to the appropriate Congressional committees. 

Definitions

For the FBI’s purposes, “domestic terrorism” is defined by 18 USC § 2331(5), as activities:

• Involving acts dangerous to human life that are a violation of the criminal laws of the United 

States or of any State;

• Appearing to be intended to:

o Intimidate or coerce a civilian population;

o Influence the policy of government by intimidation or coercion; or

o Affect the conduct of a government by mass destruction, assassination or kidnapping; 

and

• Occurring primarily within the territorial jurisdiction of the United States.

DHS derives its definition of “domestic terrorism” from the Homeland Security Act definition of 

“terrorism,” 6 USC § 101(18), which is similar, but not identical, to the 18 USC § 2331(5) 

definition. Under the Homeland Security Act of 2002, “terrorism” is defined as any activity that:

• Involves an act that:

o Is dangerous to human life or potentially destructive of critical infrastructure or key 

resources; and

o Is a violation of the criminal laws of the United States or of any State or other 

subdivision of the United States; and

• Appears to be intended to:

o Intimidate or coerce a civilian population;

o Influence the policy of a government by intimidation or coercion; or

o Affect the conduct of a government by mass destruction, assassination, or kidnapping.

Both references in the US Code are definitions and not federal criminal charging statutes for DT.
Page 4 of 46

Terminology

The FBI and DHS use the term “domestic violent extremism” to refer to DT threats. The word 

“violent” is important because the mere advocacy of political or social positions, political 

activism, use of strong rhetoric, or generalized philosophic embrace of violent tactics does not 

constitute violent extremism and is constitutionally protected. The FBI and DHS do not 

investigate, collect, or maintain information on US persons solely for the purpose of monitoring 

activities protected by the First Amendment. Under FBI policy and federal law, no investigative 

activity may be based solely on activity protected by the First Amendment, or the apparent or 

actual race, ethnicity, national origin, religion, gender, sexual orientation, or gender identity of 

an individual or group. Similarly, DHS’s Office of Intelligence and Analysis (I&A) is prohibited 

from engaging in any intelligence activities for the purpose of affecting the political process in 

the United States or for the sole purpose of monitoring activities protected by the First 

Amendment or the lawful exercise of other rights secured by the Constitution or laws of the 

United States, and DHS policy prohibits any intelligence activities based solely on an 

individual’s or group’s race, ethnicity, gender, religion, sexual orientation, gender identity, 

country of birth, or nationality. 

A “domestic violent extremist” (DVE) is defined as an individual based and operating primarily 

within the United States or its territories without direction or inspiration from a foreign terrorist 

group or other foreign power who seeks to further political or social goals, wholly or in part, 

through unlawful acts of force or violence dangerous to human life.

The US Government, including the FBI and DHS, continually reviews and evaluates intelligence 

and information from multiple sources to ensure it appropriately identifies and categorizes 

national security threats, including those that are criminal in nature, to the United States. As part 

of this continual internal review, the FBI and DHS prioritize threat categories, which are further 

described below, as needed, and as threats evolve. While categories help the FBI and DHS better 

understand threats associated with broad categories of DT-related criminal actors, the FBI and 

DHS recognize motivations vary, are nuanced, and sometimes are derived from a blend of 

ideologies. Categories also inform our intelligence and prevention efforts.

Since 2019, the US Government uses the following five threat categories to understand the 

DT threat: 

(1) Racially or Ethnically Motivated Violent Extremism: This threat category 

encompasses threats involving the potentially unlawful use or threat of force or 

violence, in violation of federal law, in furtherance of political or social agendas 

which are deemed to derive from bias, often related to race, held by the actor against 

others, including a given population group. Racially or ethnically motivated violent 

extremists (RMVEs) use both political and religious justifications to support their 

racially- or ethnically-based ideological objectives and criminal activities. One set of 

RMVE threat actors use their belief in the superiority of the white race to justify their 

use of violence to further their political, cultural, and religious goals. A separate and 

distinct set of RMVE threat actors use real or perceived racism or injustice in 

American society, their desire for a separate Black homeland, and/or violent 
Page 5 of 46

interpretations of religious teachings to justify their use of violence to further their 

social or political goals.

(2) Anti-Government or Anti-Authority Violent Extremism: This threat category 

encompasses the potentially unlawful use or threat of force or violence, in violation 

of federal law, in furtherance of political and/or social agendas, which are deemed to 

derive from anti-government or anti-authority sentiment, including opposition to 

perceived economic, social, or racial hierarchies, or perceived government overreach, 

negligence, or illegitimacy. This threat category typically includes threats from 

anarchist violent extremists (AVEs), militia violent extremists (MVEs), sovereign 

citizen violent extremists (SCVEs), and anti-government or anti-authority violent

extremists-other (AGAAVE-Other).

(3) Animal Rights or Environmental Violent Extremism: This threat category 

encompasses the potentially unlawful use or threat of force or violence, in violation 

of federal law, in furtherance of political and/or social agendas by those seeking to 

end or mitigate perceived cruelty, harm, or exploitation of animals and/or the 

perceived exploitation or destruction of natural resources and the environment. 

(4) Abortion-Related Violent Extremism: This threat category encompasses the 

potentially unlawful use or threat of force or violence, in violation of federal law, in 

furtherance of political and/or social agendas relating to abortion, including 

individuals who advocate for violence in support of either pro-life or pro-choice 

beliefs.

(5) All Other Domestic Terrorism Threats: This threat category encompasses threats 

involving the potentially unlawful use or threat of force or violence, in violation of 

federal law, in furtherance of political and/or social agendas which are not otherwise 

exclusively defined under one of the other threat categories. Such agendas may derive 

from, but are not limited to, a mixture of personal grievances and beliefs, political 

concerns, and aspects of conspiracy theories, including those described in the other 

DT threat categories. Some actors in this category may also carry bias related to 

religion, gender, or sexual orientation. Several DVEs have combined components of 

different ideologies to develop a personalized belief system that they use to justify 

violent, criminal action.

Methodology

The FBI defines a “DT incident” as a criminal act, including threats or acts of violence to 

specific victims, made in furtherance of a domestic political and/or social goal, which has 

occurred and can be confirmed. The FBI defines a “DT plot” as a combination of criminal 

activity and planning that collectively reflect steps toward criminal action in furtherance of a 

domestic political or social goal. “Disrupted DT plots” are plots which, absent law enforcement 

intervention, could have resulted in a DT incident.
Page 6 of 46

DHS I&A defines a “DT attack” as an incident motivated by a DVE ideology in which a weapon 

or tactic is purposefully deployed against a target for the purpose of causing injury, death, or 

property destruction. DHS I&A defines a “DT plot” as an incident motivated by a DVE ideology 

in which a specific target is identified, and significant steps have been taken to acquire weapons 

or plan the tactics intended to be used against the target. For DHS, these ideologically driven 

criminal acts must be dangerous to human life or potentially destructive to critical infrastructure

or key resources to meet the definition of DT. A single incident may be part of a spree of

criminal or violent activity conducted by the same perpetrator(s) using the same tactic(s), which 

are carried out against multiple locations in short succession.

The FBI and DHS I&A make every effort to document lethal and non-lethal DT incidents, but 

there is no mandatory incident reporting requirement for state, local, tribal, and territorial (SLTT) 

law enforcement agencies to report criminal activity that appears to be motivated by a social or 

political goal and is mitigated at the SLTT level. As such, some DT incidents likely go 

unreported by other law enforcement agencies. These factors make it difficult for the FBI and 

DHS I&A to identify every DT incident that has occurred in the United States. DHS I&A 

complements the FBI’s effort to document DT incidents through I&A’s ongoing DT incident 

tracking initiative, which is informed by I&A’s intelligence officers deployed to fusion centers, 

engagement with SLTT law enforcement and homeland security partners, review of DHS 

Component information and US Intelligence Community reporting, and open source research. 

The results of DHS’s incident tracking efforts are also shared with the FBI, SLTT, and private 

sector partners. Therefore, Appendix A provides information that represents significant DT 

incidents and disrupted plots that have occurred in the United States, of which the FBI and DHS 

I&A have knowledge, but not a comprehensive listing of all incidents.

IV. Strategic Intelligence Assessment

The FBI, in coordination with prosecutors in the US Attorneys’ Offices (USAOs) and DOJ’s 

National Security Division (NSD), continues to successfully investigate and disrupt DVE 

activities, plots, and threats. The FBI and DHS I&A continue to provide strategic warnings and 

analysis of the heightened DT threat, and Appendix B provides a strategic intelligence 

assessment authored by the FBI, DHS, and NCTC, titled Wide-Ranging Domestic Violent 

Extremist Threat to Persist, published on 17 June 2022. Analytic overviews of the current state 

of the various DVE threats can be found below. DVE lone offenders and small groups motivated 

by a range of ideological beliefs and personal grievances continue to pose a persistent and lethal 

threat to the Homeland. 

Racially or Ethnically Motivated Violent Extremism

Throughout 2022, RMVEs driven by a belief in the superiority of the white race remained among 

the FBI’s highest priority threats. RMVEs continued to pose the most consistent threat of lethal 

and non-lethal violence against religious, cultural, and government targets. The FBI, in 

conjunction with state and local partners, disrupted RMVEs based on a number of criminal 

violations. This RMVE movement remained fluid and decentralized, consisting of both 

organized groups and individuals. Nearly all those in this RMVE movement engaged heavily 

online across a variety of different platforms, which continues to contribute to some RMVEs 
Page 7 of 46

coalescing online; the creation of new, primarily online groups; and the fragmentation of other 

groups. While RMVEs used the internet to spread propaganda for many years, 2022 saw a 

significant shift in some RMVEs’ coordinated efforts to spread overtly violent and racist 

propaganda within encrypted chat applications, specifically to encourage others to engage in 

violence. RMVE lethal attacks also continued in 2022, including one in the United States and 

another abroad. In May 2022, an RMVE conducted an attack at a grocery store in Buffalo, New 

York, resulting in the deaths of 10 individuals, most of whom were Black. Before the attack, the 

RMVE posted a manifesto online which aligned with that of Australian RMVE attacker Brenton 

Tarrant, who attacked two mosques in New Zealand in 2019. In November 2022, an RMVE 

conducted an attack in Slovakia which resulted in two fatalities outside an LGBTQ+ bar. The 

attacker also authored a manifesto; referenced past attackers, including the recent Buffalo, New 

York, RMVE attacker; and lauded other RMVEs’ propaganda and efforts to incite others to 

violence. These RMVEs’ behavior, and their attacks, signify the influence overtly violent 

propaganda and manifestos continue to have on this RMVE movement in the United States and 

abroad.

During 2022, other RMVEs, such as those motivated by perceptions of racial injustice in 

American society, the desire for a separate Black homeland, or violent interpretations of 

religious teachings, posed a generally low threat of lethal and non-lethal violence. These RMVEs

are characterized by disparate motivating ideologies and grievances that target a range of 

perceived ideological opponents, including law enforcement, the Jewish community, and 

individuals of the white race. While some RMVEs advocate for a separate Black homeland or 

starting a “race war,” many broadly target law enforcement and the US Government. Retaliation 

and retribution for perceived or actual color of law violations and the perception of unjust legal 

proceedings surrounding the officers involved are among the organizing drivers for some 

RMVEs. RMVEs who adhere to violent interpretations of Black Hebrew Israelite religious 

teachings use anti-Semitic rhetoric as justification for violence. Although violent rhetoric and 

threats of violence by these RMVEs remained consistent, there were minimal observed acts of 

violence in 2022.

Anti-Government or Anti-Authority Violent Extremism

Anarchist Violent Extremism

Anarchist violent extremists (AVEs) are a subset of the anti-government or anti-authority 

extremism threat category. The FBI and DHS I&A continue to assess the most serious threat 

AVEs pose likely will continue to be their use, or potential use, of improvised incendiary devices 

(IIDs) or improvised explosive devices (IEDs); their injury of law enforcement and others during 

confrontations; and their access and occasional intent to illegally use firearms. Throughout FY 

2022, AVEs continued to oppose government and corporate policies perceived to infringe on 

individual freedoms referencing anti-capitalism, anti-fascism, anti-gentrification, antigovernment, and anti-law enforcement sentiment, and social justice issues related to the 

environment, immigration, reproductive rights, and Indigenous Peoples’ rights as justification for 

criminal activity. 
Page 8 of 46

For example, on several occasions throughout 2022, AVEs and others opposed to construction of 

a public safety training facility in Atlanta, Georgia, committed numerous crimes to include 

vandalizing construction equipment and personal property, and using IIDs to damage law 

enforcement vehicles, construction equipment, and business property. Law enforcement 

authorities continue to investigate these and other related incidents throughout the country to 

identify perpetrators. Most AVE-related criminal activity continues to involve physical assaults 

and property crimes, often committed by self-directed or small groups of AVEs. While most 

crimes violate state or local laws, some crimes such as arson, acts of sabotage, and threats of 

violence are investigated by the FBI and may be prosecuted at the federal level. 

Militia Violent Extremism

In late 2021 and throughout 2022, militia violent extremists (MVEs), a subset of the antigovernment or anti-authority extremism threat category, more frequently cited singular 

sociopolitical issues as their justifications for violence or criminal activity. These increasingly 

diffuse grievances contrasted with the compounding grievances of 2020 surrounding civil unrest, 

COVID-19-related restrictions, election issues, and the deaths of individuals in encounters with 

law enforcement, which led to a surge in MVE activity and, to a degree, centralization within the 

movement. As the overlapping grievances of 2020 faded, MVEs began citing standalone issues 

that often did not have movement-wide appeal but that individual MVEs still perceived to 

indicate the movement’s longstanding narratives surrounding government overreach, abuse of 

power, and incompetence. 

Additionally, lack of a high-profile, public leader within the MVE movement; prominent law 

enforcement arrests and disruptions of MVE actors; and absence of a galvanizing event to unite

MVEs contributed to the increasingly diffuse nature of the MVE threat from late 2021 through 

2022. Issues MVEs most frequently cited as potential mobilizers to violence included 

immigration and southern border policy; potential changes to firearms laws; conspiratorial 

perceptions about the tax enforcement provisions of the Inflation Reduction Act of 2022; and 

perceived government inaction or overreach related to child welfare issues, including crimes 

against children or Child Protective Services matters. Despite MVE grievances being more 

disjointed than in previous years, the most likely targets for MVE violence very likely continue 

to be government officials, facilities, law enforcement personnel, and specific populations. 

Barring unifying events or figures reminiscent of 2020, the FBI and DHS I&A assess that 

through 2023, the MVE threat likely will be defined by lone actors and small cells who cite

singular sociopolitical issues in their mobilization to violence.

Sovereign Citizen Violent Extremism

Sovereign citizen violent extremists (SCVEs), a subset of the anti-government or anti-authority 

extremism threat category, posed a threat of ideologically motivated violence and crimes through 

FY 2022 and into recent months, continuing to target law enforcement, government officials, and 

court personnel. SCVE violence occurs most commonly during law enforcement encounters. 

SCVEs threaten and harass officials and personnel with threats of kidnapping and criminal acts 

including filing of fraudulent liens and illicit monetary or tax claims. Individuals also use the 

ideology to justify criminal acts and use of force related to loss of, or infringement upon, 
Page 9 of 46

perceived rights. SCVE incidents, threats, and criminal acts in the past two years remained 

rooted in grievances and perceptions of infringed rights, or claims of immunity from government 

actions, frequently emanating from responses and circumstances relating to the COVID-19 

pandemic. 

SCVEs range from lone actors to loose networks and small groups. Disruption and prosecution 

of SCVEs occurs on an ongoing basis, frequently in coordination with federal, state, and local 

law enforcement partners. The FBI and DHS I&A assess SCVE and ideologically motivated 

threats and crimes of fraud or theft may increase if economic circumstances within the United 

States result in widespread housing or property losses, to include widespread evictions. 

Historically, periods of major economic downturns with broad scale negative impacts on the 

housing sector have borne an attendant rise in SCVE and other sovereign citizen crimes 

involving property.

Anti-Government or Anti-Authority Extremism-Other

AGAAVEs citing anti-government or anti-authority motivations for violence or criminal activity 

not otherwise defined include, but are not limited to, those motivated by a desire to commit 

violence against individuals or entities they perceive to be associated with a specific political 

party or faction thereof. AGAAVE-Others do not fit within the AVE, MVE, or SCVE threat 

subcategories.Threats from these DVEs have increased in the last two years, and any further 

increases in threats likely will correspond to potential flashpoints, such as high-profile elections 

and campaigns or contentious current events. 

Historically, these DVEs have conducted or plotted attacks targeting perceived political 

opponents, including elected officials, other government officials and law enforcement, 

candidates for public office, political party offices, and members of the media. In 2018, a DVE 

mailed 16 IEDs packed with explosive material and glass shards to victims including prominent 

figures in the media and Democratic Party; he pleaded guilty to 65 felony counts and was 

sentenced to 20 years in federal prison. In 2017, a now-deceased DVE injured several 

Republican members of Congress, staffers, and responding officers after opening fire at a charity 

baseball event in Alexandria, Virginia. 

More recently, an AGAAVE-Other subject was indicted in November 2022 on charges related to 

breaking into the residence of the then-Speaker of the House and assaulting the Speaker’s 

husband. Since FY 2022, at least six other AGAAVE-Other subjects were arrested for 

threatening government or law enforcement officials to whom they were ideologically opposed. 

These DVEs likely will continue to pose a heightened threat as they plot or threaten violence to 

redress political and/or social grievances and continue to draw inspiration from conspiracy 

theories surrounding a range of current events.

Investigations, arrests, and prosecutions related to the 6 January 2021 breach of the US Capitol 

are ongoing, and dozens of these subjects are categorized as AGAAVE-Other. For example, in 

March 2022, an AGAAVE-Other subject was arrested in Miami, Florida, for alleged activity 

related to the Capitol breach; in June 2022, he and four associates were charged in a superseding 

indictment with seditious conspiracy and other counts. 
Page 10 of 46

Abortion-Related Violent Extremism

Abortion-related violent extremists (AbRVEs) – both pro-life and pro-choice – have threatened, 

vandalized, and impeded access to facilities that provide reproductive health services or 

counseling, which can violate the Freedom of Access to Clinic Entrances Act (FACE Act). 

FACE Act violations can be jointly investigated as civil rights violations and as domestic violent 

extremism. AbRVE violence can be connected to flashpoint events such as abortion-related 

legislation or court proceedings. One such flashpoint was the leak of the draft opinion and the 

subsequent decision by the US Supreme Court in Dobbs v. Jackson Women’s Health 

Organization. Prior to the Dobbs decision, the majority of abortion-related violence was 

perpetrated by pro-life aligned AbRVEs. However, the FBI and DHS I&A assess the Dobbs

decision exacerbated the grievances of pro-choice aligned AbRVEs, resulting in an increase in 

violent activity. 

Animal Rights or Environmental Violent Extremism

The FBI and DHS I&A assess the animal rights violent extremism threat remained persistent 

throughout FY 2022. Animal rights violent extremists (ARVEs) continued to target entities 

perceived to be harming or exploiting animals through crimes such as vandalism, trespassing, 

and threats of violence. Typical targets included individuals and entities involved in animal 

research; the fur industry; and businesses selling animal products or involved in concentrated 

animal feeding operations. ARVEs operated and likely will continue to operate in individual or 

small groups when committing criminal acts. ARVEs used vitriolic rhetoric and threats of 

violence as a means to intimidate or coerce those perceived as harming or exploiting animals. 

ARVEs often communicate threats of violence by telephone or email, or by posting threatening 

language on social media. The FBI and DHS I&A assess ARVEs in FY 2023 likely will continue 

to pose a persistent threat, and likely will commit actions intended to cause financial losses, 

intimidation, and heightened awareness of animal rights-related issues.

The FBI and DHS I&A assess environmental violent extremists (EVEs) in FY 2022 continued to 

commit criminal actions intended to cause financial loss or operational damage and disruption 

against entities perceived to be exploiting or contributing to destruction of the environment or 

natural resources. Criminal acts continued in the form of property destruction, acts of vandalism, 

and threats of violence. Although federal criminal activity associated with EVEs has decreased in 

the last several years, some crimes, such as threats of violence or destruction of property are 

investigated by the FBI and may be prosecuted at the federal level. However, most EVE-related 

criminal activity in the last few years has violated state or local laws. The FBI and DHS I&A 

assess opposition to oil and natural gas infrastructure developments or expansion projects –

particularly those near perceived ecologically sensitive habitats or waterways or in close 

proximity to farmlands, urban, or Native American lands – and issues related to the 

environmental impact of climate change and deforestation likely will remain drivers for criminal 

actions in FY 2023. Criminal acts likely will continue to include acts of vandalism or arson to 

delay or disrupt construction projects and cause financial loss.
Page 11 of 46

All Other DT Threats

DVEs motivated by a personalized ideology, or an ideology that does not fit within the US 

Government’s identified categories, continue to pose an intermittent threat of lethal violence. 

DVEs within this broad category include involuntary celibate violent extremists (IVEs) and 

DVEs with a personalized mix of various DVE ideologies. IVEs continue to consume online 

rhetoric supporting their personal grievances against women who reject them or against men 

whom they deem as more romantically successful. IVEs have targeted both men and women for 

violence in an attempt to either promote awareness of IVE grievances or punish populations for 

their own perceived romantic failures. Generally, IVE violence is rarely connected to current 

events or environmental variables. 

V. Discussion and Comparison of Investigative Activities

The Act calls for a discussion and comparison of the following activities:

• The criteria for opening, managing, and closing DT and international terrorism (IT) 

investigations.

• Standards and procedures for the FBI with respect to the review, prioritization, and 

mitigation of DT and IT threats in the United States.

• The planning, development, production, analysis, and evaluation of intelligence and 

intelligence products relating to terrorism, noting any differences with respect to DT and IT.

• The sharing of information relating to DT and IT by and between the federal government,

SLTT and foreign governments, the appropriate Congressional committees,

nongovernmental organizations, and the private sector.

• The criteria and methodology used by the FBI to identify or assign terrorism classifications

to DT investigations.

• Compliance with privacy, civil rights, and civil liberties policies and protections, including 

protections against the public release of names or other personally identifiable information 

of individuals involved in incidents, investigations, indictments, prosecutions, or convictions 

for which data is reported under the Act.

• Information regarding any training or resources provided to assist federal and SLTT law 

enforcement agencies in understanding, detecting, deterring, and investigating acts of DT, 

including the date, type, subject, and recipient agencies of such training or resources.

Criteria for Opening, Managing, and Closing DT and IT Investigations

The FBI’s criteria for opening, managing, and closing DT and IT investigations stem from 

agency authorities outlined in the Attorney General’s Guidelines for Domestic FBI Operations 

(AGG-Dom) and are implemented through FBI policy, referred to as the Domestic Investigations 
Page 12 of 46

and Operations Guide (DIOG). Consistent with those policies, the following outlines the criteria 

and methodology the FBI utilizes when conducting both DT and IT investigations: 

Opening: The FBI opens a full investigation4 predicated on an “articulable factual basis” that 

reasonably indicates the existence of federal criminal activity or a threat to national security, or 

to protect against such activity or threat. The opening of a full investigation must be approved by 

a Supervisory Special Agent and notice to the responsible Headquarters unit must be provided 

within 15 days of opening. The FBI may open a preliminary investigation5 on the basis of any 

“allegation or information” indicative of possible criminal activity or threats to the national 

security.6 The opening of a preliminary investigation by a Field Office requires the approval of a 

Supervisory Special Agent, but does not require notice to the DOJ, unless it involves a sensitive 

investigative matter (SIM).

7

The opening of an investigation involving a SIM must be reviewed by the Field Office’s Chief 

Division Counsel (CDC), approved by the Special Agent in Charge, and provided to the 

responsible Headquarters Unit Chief within 15 days of opening as notice to Headquarters. The 

Field Office must notify the USAO within 30 days unless inappropriate and, in that case, 

Headquarters must notify and provide an explanation to DOJ within 30 days.

No investigation may be opened based solely on activities protected by the First Amendment or 

the lawful exercise of rights secured by the Constitution or laws of the United States.

Opening a preliminary or full investigation classified as one of the identified DT threat 

categories must be approved by the Field Office’s CDC; however, the opening of a full 

investigation classified as an IT matter does not have the same requirement. 

Managing: The AGG-Dom authorizes all lawful investigative methods in the conduct of a full 

investigation; however, the AGG-Dom requires that the “least intrusive” means or method of 

4 A full investigation may be opened if there is an “articulable factual basis” for the investigation that reasonably 

indicates one of the following circumstances exists: an activity constituting a federal crime or a threat to the national 

security has or may have occurred, is or may be occurring, or will or may occur, and the investigation may obtain 

information relating to the activity or the involvement or role of an individual, group, or organization in such 

activity. An enterprise investigation is a type of full investigation that examines the structure, scope, and nature of 

the group or organization.

5 A preliminary investigation is a type of predicated investigation that may be opened (predicated) on the basis of 

any “allegation or information” indicative of possible criminal activity or threats to the national security. 

Preliminary investigations may be opened to detect, obtain information about, or prevent or protect against federal 

crimes or threats to the national security. Enterprise investigations cannot be conducted as preliminary investigations 

or assessments, nor may they be conducted for the sole purpose of collecting foreign intelligence.

6 The significance of the distinction between the full and preliminary investigation is in the availability of 

investigative tools. A preliminary investigation, which is based on the lesser factual predicate, limits the 

investigative tools and methods available, while the full investigation, which is based on the more robust factual 

predicate, permits the full range of legally available investigative tools and methods. In some instances, cases 

opened as preliminary investigations may be converted to full investigations based on the development of additional 

facts during the course of the investigation.

7 A SIM involves the activities of a domestic public official or political candidate (involving corruption or a threat to 

the national security), religious or political organization or individual prominent in such an organization, or news 

media, or any other matter which, in the judgment of the official authorizing an investigation, should be brought to 

the attention of FBI Headquarters and other DOJ officials.
Page 13 of 46

investigation be considered and, if reasonable based on the facts and circumstances of the 

investigation, that investigative method should be used to obtain information in lieu of other 

more intrusive methods. The FBI requires file reviews of full investigations every 90 days. Some 

investigative methods the FBI is authorized to use differ between DT and IT investigations, 

based on the differences in statutory investigative authorities available in criminal matters, such 

as DT investigations, and in foreign intelligence matters, such as IT investigations. For example, 

a full investigation of a DT matter may conduct electronic surveillance, if authorized, pursuant to 

Title III of the Omnibus Crime Control and Safe Streets Act of 1968. A full investigation of an 

IT matter may also conduct electronic surveillance, as authorized, pursuant to the Foreign 

Intelligence Surveillance Act of 1978, as amended. Additionally, investigations of DT and IT 

matters may make use of federal grand jury subpoenas to compel the disclosure of records and 

other relevant information, but investigations of IT matters may also use a National Security 

Letter8to compel defined categories of records from certain businesses. Finally, investigations of

DT matters must be periodically reviewed by the Field Office’s CDC, and investigations of IT 

matters do not have the same requirement. 

Closing: A Supervisory Special Agent must approve the closure of both full and preliminary 

investigations. A preliminary investigation must be closed within six months of its opening but 

may be extended for an additional six months. At the conclusion of either type of investigation, 

each of the following items must be documented: 

• A summary of the results of the investigation.

• Whether logical and reasonable investigation was completed.

• Whether all investigative methods/techniques initiated have been completed and/or 

discontinued.

• Whether all set leads have been completed and/or discontinued.

• Whether all evidence has been returned, destroyed, or retained in accordance with evidence 

policy.

• A summary statement of the reason the full investigation will be closed.

At the conclusion of a full investigation, the Field Office must also document whether sufficient 

personnel and financial resources were expended on the investigation, or an explanation or 

justification for not expending sufficient resources.

There are no substantive differences in how the FBI closes full investigations of DT or IT 

matters.

8 A National Security Letter is a statutorily-created administrative tool that allows investigators to issue a demand

for documents or records that are relevant to a predicated investigation to protect against international terrorism or 

clandestine intelligence activities.
Page 14 of 46

The following chart presents a comparison of FBI policies for both DT and IT preliminary and 

full investigations.

PRELIMINARY INVESTIGATION FULL INVESTIGATION

PREDICATION

Information or an allegation indicating the 

existence of federal criminal activity or a 

threat to national security (or to protect 

against such activity or threat)

Articulable factual basis that reasonably 

indicates the existence of federal criminal 

activity or a threat to national security (or 

to protect against such activity or threat) 

APPROVAL TO 

OPEN

• Supervisory Special Agent (SSA)

• If a Domestic Terrorism (DT) matter, Field 

Office (FO) Chief Division Counsel (CDC)

• SSA

• Notice to the responsible Headquarters 

(HQ) unit must be provided within 15 

days of opening

• If a DT matter, FO CDC

APPROVAL TO 

OPEN: SENSITIVE 

INVESTIGATIVE 

MATTER (SIM)

• FO CDC

• FO Special Agent in Charge (SAC)

• Notice to responsible HQ Unit Chief 

within 15 days of opening

• Notice to the US Attorney’s Office (USAO) 

within 30 days unless inappropriate, HQ 

must notify the Department of Justice 

(DOJ) within 30 days

• FO CDC

• FO SAC

• Notice to responsible HQ Unit Chief 

within 15 days of opening

• Notice to the USAO within 30 days unless 

inappropriate, HQ must notify DOJ within 

30 days

FILE REVIEW Every 90 calendar days Every 90 calendar days

EXAMPLES OF 

AUTHORIZED 

INVESTIGATIVE 

METHODS

In a DT Matter:

• Obtain public information

• Physical surveillance 

• Federal grand jury subpoenas

In an International Terrorism (IT) Matter: 

• Obtain public information

• Physical Surveillance 

• Federal grand jury subpoenas and 

National Security Letters (NSLs)

In a DT Matter:

• Obtain public information

• Physical surveillance 

• Federal grand jury subpoenas

• Electronic surveillance pursuant to Title 

III of the Omnibus Crime Control and Safe 

Streets Act of 1968

In an IT Matter: 

• Obtain public information

• Physical Surveillance 

• Federal grand jury subpoenas and NSLs

• Electronic surveillance pursuant to 

Foreign Intelligence Surveillance Act of 

1978, as amended

CLOSURE Must be closed within six months but may 

be extended for an additional six months

No duration limit

APPROVAL TO 

CLOSE

• SSA

• Notice to the responsible HQ unit must 

be provided prior to closing

• SSA

• Notice to the responsible HQ unit must 

be provided prior to closing

APPROVAL TO 

CLOSE: SIM

SSA, with SAC approval SSA, with SAC approval
Page 15 of 46

Standards and Procedures for Reviewing, Prioritizing, and Mitigating DT and IT Threats

The FBI uses the Threat Review and Prioritization (TRP) process as a standardized method for 

reviewing and prioritizing threats within operational programs to inform threat strategies, 

mitigation plans, and resource allocation. Headquarters operational divisions use the TRP 

process to uniformly define threat issues for the organization, determine their prioritization at the

national level, establish FBI National Threat Priorities (NTPs), and develop national threat 

strategies for those threats for the FBI enterprise. Field Offices then cascade the results of the 

national-level TRP process to prioritize threat issues and create threat strategies to mitigate 

threats based on the threat landscape of their specific areas of responsibility (AORs). The FBI 

conducts the TRP process on a biennial basis, but it may be conducted annually at the discretion 

of the Field Office or Headquarters operational division head. For DT and IT threats, DOJ 

Counterterrorism Section (CTS) attorneys offer prosecutorial views during the national-level 

TRP process. 

The TRP process seeks to build consensus, and includes applicable USAO(s) and stakeholders, 

such as NSD/CTS, to determine prioritization (banding) and to develop threat strategies for 

mitigation of threat issues. Headquarters operational divisions develop national threat strategies 

for each threat issue to guide enterprise-wide mitigation efforts. Field Offices develop threat 

strategies annually for all threat issues they band, and they detail the particular steps the Field 

Office plans to take to mitigate each banded threat issue in their AOR. These threat strategies 

must be used to guide mitigation of each threat issue for the upcoming fiscal year, unless a 

change in threat banding or threat strategies occurs during midyear negotiations. The TRP of the 

FBI is classified as it incorporates sources and methods as a basis of strategic alignment of 

national security resources. 

There are no differences in how the FBI reviews and prioritizes DT and IT threats, and each 

threat issue is reviewed independently; however, the threat band dictates priorities within these 

programs. Investigative methods the FBI is authorized to use differ between DT and IT 

investigations, and DT investigations may be subject to additional legal review. 

Planning, Development, Production, Analysis, and Evaluation of Intelligence and Intelligence 

Products Relating to DT and IT

The FBI intelligence cycle for both DT and IT matters consists of planning intelligence efforts 

around priorities based on national or Field Office threat strategies, collecting raw intelligence 

information, processing and synthesizing data, analyzing and crafting assessments into analytic 

intelligence products, disseminating those products, briefing analysis to decision makers, and 

evaluating disseminated products and the production process to inform future efforts.

Similarly, DHS began Intelligence Threat Banding in 2019, a process in which DHS intelligence 

leadership, in coordination with the Homeland Security Intelligence Council, prioritizes threat 

topics. The process is informed by DHS’s execution of the intelligence cycle – development of 

requirements, collection through field operations or open source collectors, and analysis to 
Page 16 of 46

produce finished intelligence in the DT space. DHS implements Intelligence Threat Banding 

across its mission areas. Results are used to inform and drive the Department’s collection and 

analysis efforts for maximum impact against the “high banded” topic areas; develop cross 

component programs, projects, and activities; and inform intelligence resource allocation 

decisions.

During the planning phase of the intelligence cycle, both the FBI and DHS consider the National 

Intelligence Priorities Framework, which documents the US Intelligence Community’s priorities; 

the FBI also considers its own standing intelligence and investigative responsibilities, which are 

addressed and prioritized in the TRP process. During the TRP process, the FBI identifies 

intelligence needs related to threat priorities, and those intelligence needs drive subsequent 

stages of the intelligence cycle. Meanwhile, DHS also addresses any additional priorities and/or 

requirements identified by the Secretary of Homeland Security or the Under Secretary of 

Homeland Security for Intelligence and Analysis, the latter of whom serves as the DHS Chief 

Intelligence Officer. 

During the collection and processing phases of the intelligence cycle, both the FBI and DHS 

obtain raw intelligence from lawful collection methods consistent with their respective 

authorities and then synthesize this data into a form intelligence personnel can use. In the 

analysis and evaluation phases, analysts examine and evaluate all source intelligence, including 

collected information; add context, as needed; and integrate the information into finished

intelligence assessments. Analysts make assessments about information implications for national 

security.

Legal review is required for any FBI intelligence product, such as an Intelligence Information 

Report (IIR),9related to a potential SIM or other sensitive information, in accordance with the 

guidelines in the FBI’s DIOG and identified “legal review triggers.” One such legal review 

trigger is information related to DT. Similarly, in accordance with DHS I&A policy, I&A’s 

finished intelligence products undergo a rigorous review prior to dissemination to ensure 

compliance with all legal requirements; policies for the protection of privacy, civil rights, and 

civil liberties; and oversight principles, guidelines, and procedures. 

Finally, intelligence analysis is disseminated in either a written intelligence product or a verbal 

briefing during the production phase. Intelligence analysis customers for both the FBI and DHS 

include leadership, policymakers, military leaders, other federal and SLTT government officials, 

private sector partners, and operational counterparts who then make decisions informed by that 

information. For DHS, the Homeland Security Information Network is the primary platform for 

disseminating unclassified raw intelligence reporting and finished intelligence products to 

authorized federal and SLTT partners.

DHS also maintains a mobile application to enhance our SLTT and federal government partners’ 

ability to consume intelligence information from their mobile devices. The DHS Intel App was a 

collaborative effort, which enables a secure way for approved users to access and view

9 An IIR is the FBI’s primary document used to share raw, non-compartmented FBI intelligence information.
Page 17 of 46

intelligence information produced across the country, receive alerts on new intelligence products, 

and search key topics related to homeland security. 

To support and improve intelligence and information sharing efforts nationwide, DHS, in 

coordination with federal and SLTT law enforcement, intelligence, and homeland security 

organizations, sponsored an Intelligence Summit (Summit) in August 2022. Senior leaders and 

stakeholders across federal, SLTT, and campus communities participated to discuss existing 

intelligence and information sharing issues and gaps, as well as focus areas requiring action and 

resolution to address the evolving threat environment. The Summit served as a forum to 

galvanize and unify collaboration, with senior leaders reaffirming commitments to discovering 

new opportunities and improving existing avenues to enhance information sharing between and 

across all levels of government, while ensuring the protection of privacy, civil rights, and civil 

liberties of US citizens.

Sharing of Information Relating to DT and IT

The FBI’s National Strategy for Information Sharing and Safeguarding provides the common 

vision, goals, and framework needed to guide information sharing initiatives with our federal and 

SLTT partners, foreign government counterparts, and private sector stakeholders. The FBI shares 

information consistent with the Privacy Act, FBI policy, and any other applicable laws and 

memoranda of understanding or agreement with other agencies.

The FBI works closely with our federal and SLTT law enforcement partners to investigate and 

disrupt both DT and IT. The FBI also has a strong working relationship with DOJ’s CTS, which, 

as of June 2022, includes a Domestic Terrorism Unit. 

Drawing on expertise across NSD and the DOJ more broadly, the DOJ’s Domestic Terrorism 

Unit has several functions: prosecuting and coordinating DT cases, developing training and 

policies on DT matters, and supporting the work of the Department in implementing a whole-ofgovernment strategy on countering DT. This structure preserves flexibility, while allowing CTS 

to better support the FBI. Recognizing that countering DT must be a whole-of-Department effort, 

the unit will include liaisons from components outside of NSD, including the Civil Rights 

Division and the Tax Division, among others, to marshal Department-wide expertise and 

resources and offer a mechanism for DOJ components to assess collaboratively and bring to bear 

all available tools to hold violent extremists accountable. It will also leverage the strong work by 

our SLTT law enforcement partners. The unit will engage in outreach to these partners to share 

lessons learned, increase information sharing, and ensure that we are bringing all available tools 

– state and federal – to bear against violent extremism.

The front line of the counterterrorism mission in the United States is the FBI-led Joint Terrorism 

Task Forces (JTTFs). The FBI maintains about 56 JTTFs nationwide spanning over 100 

locations, with representation in all 56 FBI Field Offices and satellite Resident Agencies. The 

JTTFs have participation of over 50 federal and over 500 SLTT agencies. These relationships are 

critical to effective information sharing and the leveraging of local expertise and experience in 

FBI investigations. The FBI also shares intelligence products with federal and SLTT partners, as 
Page 18 of 46

appropriate, to inform them of the current threat environment and these products are posted on 

portals like the Law Enforcement Enterprise Portal. 

The FBI and DHS I&A, in coordination with NCTC, produce Joint Intelligence Bulletins (JIBs) 

and other products that communicate updated threat information and assessments to our federal,

SLTT, and private sector partners at the Unclassified//For Official Use Only (FOUO) or Law 

Enforcement Sensitive (LES) levels. JIBs alert our partners to significant arrests – including 

those accomplished through collaboration among different law enforcement entities – and trends 

we have observed in both the DT and IT arenas. Additionally, in early 2022, the FBI, DHS I&A, 

and NCTC began producing tri-seal domestic violent extremism-focused intelligence products 

under the auspices of a Joint Analytic Cell (JAC). The JAC ensures close collaboration among 

the three agencies, as appropriate, to provide more data-informed strategic analysis of the DT

threat environment and better inform policymakers and state and local law enforcement agencies 

of changes in the threat landscapes. NCTC will ensure any continued collaboration and 

contributions through the JAC, or otherwise, are consistent with recent Congressional direction, 

limiting its contributions to these intelligence products to analysis concerning terrorism threats 

with an identified foreign nexus. 

DHS products within the DT and IT spaces are shared with authorized federal, SLTT, and 

private sector partners, including the National Network of Fusion Centers, private sector security 

officials, and other customers. For those operating at primarily the unclassified level, products at 

the FOUO and LES levels are shared via the Homeland Security Information Network.

Criteria and Methodology to Identify or Assign Terrorism Classifications to FBI DT

Investigations 

While classifications, or categories, help the FBI better understand the criminal actors we pursue, 

we recognize actors’ motivations vary, are nuanced, and sometimes are derived from a blend of 

socio-political goals or personal grievances. Regardless of the classification, the FBI follows the 

facts and evidence of the case to carry out our investigations. Currently, the US Government

broadly refers to the DT threat by using the following threat categories, which are further defined 

in the “Definitions, Terminology and Methodology” section of this report: (1) racially or 

ethnically motivated violent extremism; (2) anti-government or anti-authority violent extremism; 

(3) animal rights or environmental violent extremism; (4) abortion-related violent extremism; 

and (5) all other DT threats.

In addition to conducting investigative activity in response to the DT threats described above, the 

FBI also conducts civil unrest and anti-riot investigations under its DT Program. Although civil 

unrest and anti-riot investigations may not be directly aligned to the DT threat categories, these 

investigations are part of the FBI’s DT Program for multiple reasons, including: because 

investigation of these matters may be closely related to separate terrorism investigations; because 

this criminal activity may be motivated by similar ideologies as those that appear in the DT 

threat categories; and/or for other administrative or organizational matters.

The FBI conducts civil unrest investigations to address violations of federal criminal law 

involving a civil disturbance, and the FBI conducts anti-riot investigations to address violations 
Page 19 of 46

of federal criminal law in which an individual uses force or violence during a public gathering.

For both civil unrest and anti-riot investigations, the FBI provides information or assistance to 

other federal, state, or local authorities.

Compliance with Privacy, Civil Rights, and Civil Liberties Policies and Protections

The FBI is responsible for protecting the security of our nation and its people from crime and 

terrorism while maintaining rigorous obedience to the Constitution and compliance with all 

applicable statutes, regulations, and policies. The AGG-Dom establishes a set of basic principles 

that serve as the foundation for all FBI mission-related activities. These principles demonstrate 

respect for civil liberties and privacy as well as adherence to the Constitution and laws of the 

United States.

One of the most important principles in the AGG-Dom is the threshold requirement that all 

investigative activities be conducted for an authorized purpose, which under the AGG-Dom

means an authorized national security, criminal, or foreign intelligence collection purpose. The 

authorized purpose must be well-founded and well-documented, and the information sought and 

investigative method used to obtain it must be focused in scope, time, and manner to achieve the 

underlying purpose. Furthermore, the Constitution sets limits on what that purpose may be. It 

may not be solely to monitor the exercise of constitutional rights, such as the free exercise of 

speech, religion, assembly, press and petition; and, equally important, the authorized purpose 

may not be based solely on the race, ethnicity, gender, national origin, religion, disability, sexual 

orientation, or gender identity of an individual, group, or organization, or a combination of only 

those factors.

The AGG-Dom authorizes all lawful investigative methods in the conduct of a full investigation. 

These methods, which range in intrusiveness, consider the effect on the privacy and civil liberties 

of individuals and the potential to cause harm to, or otherwise damage the reputation of 

individuals. According to policy, the least intrusive method should be used, based upon the 

circumstances of the investigation, but the FBI may use any lawful method consistent with the 

AGG-Dom. A more intrusive method may be warranted in light of the seriousness of a criminal 

or national security threat or the importance of a foreign intelligence requirement, and the 

options available to obtain the intelligence, information, or evidence.

By emphasizing the use of the least intrusive means to obtain intelligence, information, or 

evidence, FBI employees can effectively execute their duties while mitigating the potential 

negative impact on the privacy and civil liberties of all people encompassed within the 

investigation, including targets, witnesses, and victims. 

As a matter of FBI policy, law enforcement activities within the scope of DT investigations are 

particularly subject to close internal legal review and supervisory approvals to ensure 

constitutional rights, privacy, and civil liberties are protected at each juncture. DT investigations 

undergo numerous legal reviews due to the likelihood these investigations may touch upon First 

Amendment-protected activities, and/or other Constitutional rights, civil liberties and privacyrelated considerations. 
Page 20 of 46

DHS is committed to ensuring activities are conducted in a manner that is consistent with the 

Constitution; applicable statutes, including the Privacy Act; applicable executive orders and 

Presidential Directives, including Executive Order 12333, United States Intelligence Activities, 

as amended; and other applicable law, policies, and procedures pertaining to the appropriate 

handling of information about US persons (as defined in Executive Order 12333) and other 

individuals protected by US law and Department policy.10 DHS I&A is also governed by its

Intelligence Oversight Guidelines, approved by the Attorney General in 2017.11 These guidelines 

reflect I&A’s legal authorities and policy protections for privacy, civil rights, and civil liberties. 

Countering domestic violent extremism is a vital part of the Department’s broader obligation to 

help ensure the security of our nation, and DHS recognizes that our mission can succeed only if 

the Department respects and protects the our national values. DHS prioritizes rigorous 

safeguarding civil rights, civil liberties, and individual privacy protections across all its domestic 

counterterrorism efforts, including those related to countering DT. 

In confronting the threat of domestic violent extremism, DHS focuses on threats related to 

individuals, groups, and/or events that meet national and Departmental intelligence requirements. 

It does not engage in any intelligence activity for the sole purpose of monitoring activities 

protected by the First Amendment or the lawful exercise of other rights secured by the 

Constitution or laws of the United States, or for the purpose of retaliating against a whistleblower 

or suppressing or burdening criticism or dissent. Further, as a matter of internal DHS policy, 

I&A personnel are not permitted to engage in intelligence activities based solely on an 

individual’s or group’s race, ethnicity, gender, religion, sexual orientation, gender identity, 

country of birth, or nationality. 

How DHS identifies and detects DT requires faithful adherence to fair information practice 

principles and privacy-focused departmental policies. DHS always incorporates privacy 

protections in information technology systems, technologies, rulemakings, programs, pilot 

projects, and other activities that involve the planned use of personally identifiable information. 

DHS’s Office for Civil Rights and Civil Liberties, Privacy Office, and Office of the General 

Counsel are involved in all of its counterterrorism and prevention missions, and DHS I&A’s 

intelligence activities are further reviewed by its internal Privacy and Intelligence Oversight 

Branch. These offices continue to help oversee and train DHS intelligence personnel on how to 

respect the privacy, civil rights, and civil liberties of all people and communities. 

NCTC supports the FBI and DHS, as appropriate, including through analytic work focusing on 

the transnational dynamics of violent extremist movements and threats and by identifying 

linkages to international or transnational terrorism. NCTC ensures these efforts are fully 

consistent with NCTC’s authorities and undertaken in accordance with the ODNI Intelligence 

Activities Procedures Approved by the Attorney General Pursuant to Executive Order 12333

(ODNI Guidelines) for the protection of US person information. NCTC has issued procedures to 

10 Executive Order 12333 defines a US person as a US citizen, an alien known by the intelligence element concerned 

to be a permanent resident alien, an unincorporated association substantially composed of US citizens or permanent 

resident aliens, or a corporation incorporated in the United States, except for a corporation directed and controlled 

by a foreign government or governments.

11 The Intelligence Oversight Guidelines are available via: www.dhs.gov/publication/office-intelligence-andanalysis-intellience-oversight-program-and-guidelines.
Page 21 of 46

implement the ODNI Guidelines requirements and established additional prudential safeguards to 

inform the Center’s support to the FBI and DHS in this area. These safeguards include prior 

supervisory approval and completion of training on domestic counterterrorism authorities prior 

to undertaking queries designed to retrieve domestic counterterrorism intelligence. 

Consistent with Congressional direction, NCTC’s support to the FBI and DHS focuses on 

transnational threats and trends, and when assessing individual actors to identify any connections 

to international or transnational terrorism, NCTC relies on FBI and DHS determinations of 

whether specific individuals are DVEs. Legal, privacy, civil rights, and civil liberties officers 

advise on all aspects of NCTC’s support to the FBI and DHS related to domestic violent 

extremism. NCTC is not authorized to and does not collect, access, obtain, or maintain 

information concerning US persons solely for the purpose of monitoring activities protected by 

the First Amendment or the lawful exercise of other rights secured by the Constitution or laws of 

the United States.

Training or Resources Provided to Federal, State, Local, and Tribal Law Enforcement 

Agencies

The FBI takes a leadership role in identifying and addressing emerging threats and, as such, 

actively engages with its federal and SLTT law enforcement partners through the JTTFs. The 

FBI shares and encourages the sharing of intelligence and participates in multi-agency command 

posts to ensure maximum coordination. In order to proactively address threats, especially during 

ongoing incidents, the FBI has developed and shared best practices that are implemented across 

the nation.

The FBI’s Behavioral Threat Assessment Center (BTAC), housed within the FBI’s Critical 

Incident Response Group, supports the FBI JTTFs, as well as state and local law enforcement 

partners by providing operational support in the form of tailored threat management strategies in 

complex threat and terrorism investigations. The BTAC is the only national-level, multi-agency, 

multidisciplinary federal task force focused on the prevention of terrorism and targeted violence 

through the application of behaviorally-based operational support, training, and research. The 

BTAC trains internally and externally on lessons learned from operational experience and 

research to better inform violence prevention efforts. The BTAC is leading an unfunded national 

Threat Assessment and Threat Management (TATM) initiative to organize, coordinate, and 

synchronize the FBI’s enterprise-wide strategy to incorporate TATM principles, which 

endeavors to build operational response capabilities within all FBI Field Offices and develop 

stronger partnerships across all levels of government, with local mental health practitioners, and 

other relevant stakeholders in an effort to prevent acts of terrorism and targeted violence. 

Since 2018, the FBI’s BTAC has established designated Threat Management Coordinators 

(TMCs) in each Field Office, provided advanced training to 115 TMCs, hosted a Mental Health 

Practitioners Conference to inform and educate FBI mental health partners on TATM-related 

topics, and commenced training of FBI Task Force Officers to work as liaison counterparts 

within state and local governments. The BTAC and local Field Office TMCs have identified 12 

active local or regional TATM teams with FBI participation, and an additional five FBI-led 

TATM teams. The 12 local/regional teams are in/around and have participation from FBI Field 
Page 22 of 46

Offices in Baltimore, Buffalo, Las Vegas, Los Angeles, Miami, Minneapolis, New Haven, New 

York, Phoenix, Pittsburgh, San Antonio, and Washington, DC; the five FBI-led teams are run by 

the FBI Boston, Denver, Honolulu, Oklahoma City, and Philadelphia Field Offices. There has 

been great interest from the FBI Field Offices on helping establish and support local/regional 

teams. Given this interest, we expect these local/regional TATM teams to increase in 2023. In 

addition, during 2022 the FBI established the Behavioral Analysis Unit-Counterterrorism 

Division Threat Management Alliance, which aims to expand implementation of the BTAC’s 

TATM initiative to mitigate terrorism threats, particularly in relation to challenging 

investigations involving subjects who are juveniles, young adults, or persons with severe mental 

health challenges.

In 2021, the FBI, DHS I&A, and NCTC jointly updated the booklet, US Violent Extremist 

Mobilization Indicators, which contains observable indicators to help bystanders or observers 

recognize behaviors that may indicate mobilization to violence. Unlike prior editions – which 

focused entirely on foreign terrorist-inspired, homegrown violent extremists – the 2021 edition 

was expanded to include indicators that apply across US-based ideologically motivated violent 

extremists, including indicators validated as relevant for DVEs.12 The booklet was published to 

help law enforcement and first responder partners and the public at large recognize potentially 

dangerous behaviors that may indicate individuals are preparing to engage in violent extremist 

activities. It is important to note some behavioral indicators may relate to constitutionallyprotected or otherwise lawful activities. Law enforcement action should never be taken solely on 

the basis of constitutionally-protected activities; therefore, the FBI considers the totality of the 

circumstances in determining whether there is a lawful basis for investigative activity.

The FBI also maintains the eGuardian system as a resource to facilitate sharing of suspicious 

activity reports for terrorism or other threat-related information by federal and SLTT law 

enforcement agencies, to include 80 state and local fusion centers and the Department of 

Defense. Partners in all 50 states, four US Territories, and the District of Columbia currently use 

eGuardian.

Specific to formalized training, the FBI offers the Counterterrorism Baseline Operational 

Learning Tool (CT BOLT) course to all new counterterrorism employees, including Task Force 

Officers supporting the JTTFs. In addition to operational training and instruction, the course 

provides training on applicable privacy and civil liberties law and policy and the fundamentals of 

protecting First Amendment rights during the course of FBI investigations. The FBI conducts the

CT BOLT course on a monthly basis and, during 2022, more than 220 students completed the 

course.

DHS I&A’s National Threat Evaluation and Reporting (NTER) program, established in 2019, 

provides law enforcement and homeland security partners with resources and training to assist in 

identifying and preventing targeted violence and mass casualty incidents, including terrorism. 

NTER leads the Nationwide Suspicious Activity Reporting (SAR) Initiative, which assists 

partners in identifying, reporting, and sharing suspicious activity. Additionally, NTER’s Master 

12 The 2021 edition served as an update to a prior version published in 2019, and it was published on the ODNI’s 

public website.
Page 23 of 46

Trainer Program trains federal and SLTT partners in behavioral threat assessment and 

management techniques to assist local communities in implementing a behavioral approach to 

violence prevention by identifying and assessing risk and warning signs, and managing potential 

threat of future, targeted violence, regardless of motive.

The DHS Office for State and Local Law Enforcement (OSLLE) is a headquarters-level 

organization created on the recommendation of the 9/11 Commission. OSLLE’s mission is to 

lead DHS coordination, liaison, and advocacy for SLTT and campus law enforcement by 

building and cultivating strong partnerships. The office executes its mission by sharing timely 

and pertinent information and resources with SLTT and campus partners; advising the Secretary 

and DHS components on the issues, concerns, and recommendations of SLTT and campus law 

enforcement during policy, program, and initiative development; and ensuring that DHS law 

enforcement and terrorism focused grants are appropriately focused on terrorism prevention 

activities. To efficiently and effectively share many of the resources readily available to SLTT 

and campus law enforcement, including training and grant opportunities, OSLLE maintains the 

DHS Law Enforcement Resource Guide,

13 and works to share these resources with SLTT campus 

law enforcement and other related stakeholders through various forums. When a SLTT and 

campus law enforcement request for resources cannot be fulfilled by existing DHS resources, 

OSLLE works with intra- and interagency partners to develop customized solutions.

The US Secret Service National Threat Assessment Center (NTAC), within DHS, is authorized 

by the Presidential Threat Protection Act of 200014 to conduct research, training, and 

consultation on threat assessment and the prevention of targeted violence. NTAC is comprised of 

a multidisciplinary team of social science researchers and regional program managers who 

support and empower our partners in law enforcement, schools, government, and other public 

and private sector organizations to combat the ever-evolving threat of targeted violence 

impacting communities across the United States. NTAC publishes operationally relevant 

research examining all forms of targeted violence and produces guides for establishing proactive, 

targeted violence prevention programs. NTAC staff provide training on threat assessment and the 

prevention of targeted violence, by request, to public safety audiences, which often include 

SLTT law enforcement, schools, universities, and other agencies and organizations with public 

safety responsibilities. NTAC is authorized to provide consultation on the development of threat 

assessment policies and protocols, as well as on complex threat assessment cases.

VI. Data on Domestic Terrorism 

The Act calls for annual updates to the following data and information, and this report provides 

an annual update, to include data and information for FY 2022:

15

• For each completed or attempted DT incident that has occurred in the United States: a 

description of such incident; the date and location of such incident; the number and type of 

completed and attempted federal nonviolent crimes committed during such incident; the 

13 The DHS Law Enforcement Resource Guide is available via: https://www.dhs.gov/sites/default/files/2023-

01/23_0126_OSLLE_LE-resource-guide-signed_508.pdf.

14 Public Law 106-544, enacted 19 December 2000.

15 For data related to investigations, DHS defers to the FBI.
Page 24 of 46

number and type of federal and state property crimes committed during such incident, 

including an estimate of economic damages resulting from such crimes; and the number and 

type of completed and attempted federal violent crimes committed during such incident, 

including the number of people killed or injured as a result of such crimes.

• An identification of each assessment,16 preliminary investigation, full investigation, and 

enterprise investigation with a nexus to DT opened, pending, or closed by the FBI; and the 

number of assessments, preliminary investigations, full investigations, and enterprise 

investigations associated with each DT investigative classification.

• The number of assessments, preliminary investigations, full investigations, and enterprise 

investigations with a nexus to DT initiated as a result of a referral or investigation by a 

federal, SLTT, or foreign government of a hate crime.

• The number of federal criminal charges with a nexus to DT, including the number of 

indictments and complaints associated with each DT investigative classification; a summary 

of the allegations in each such indictment; the disposition of the prosecution; and, if 

applicable, the sentence imposed as a result of a conviction on such charges.

• Referrals of DT incidents by or to SLTT or foreign governments, to or by departments or 

agencies of the federal government, for investigation or prosecution, including the number 

of such referrals associated with each DT investigative classification, and a summary of 

each such referral that includes the rationale for such referral and the disposition of the 

applicable federal investigation or prosecution. 

• The number of intelligence products associated with each DT investigative classification.

• With respect to the FBI, the number of staff working on DT matters and a summary of time 

utilization by and recordkeeping data for personnel working on such matters, including the 

number or percentage of such personnel associated with each DT investigative classification 

in the FBI’s Headquarters Operational Divisions and Field Divisions.

• With respect to DHS I&A, the number of staff working on DT matters.

• With respect to NCTC, the number of staff working on DT matters and the applicable legal 

authorities relating to the activities of such staff.

Completed or Attempted DT Incidents in the United States 

Appendix A provides information that represents significant DT incidents and disrupted plots 

that have occurred in the United States during FY 2022. Many DT incidents are rooted in state 

and local level criminal activity. While the FBI and DHS I&A make every effort to document 

16 An assessment is an investigative activity, which requires an authorized purpose and articulated objective(s). 

Assessments may be carried out to detect, obtain information about, or prevent or protect against federal crimes or 

threats to the national security or to collect foreign intelligence.
Page 25 of 46

lethal and non-lethal DT incidents, there is currently no mandatory incident reporting 

requirement for reporting these incidents by SLTT law enforcement to the federal government. 

As such, some DT incidents likely go unreported by other law enforcement agencies, which 

makes it difficult for the FBI and DHS I&A to identify every DT incident that has occurred in 

the United States.

Identification and Number of Each FBI Investigation in the DT Program

As of the end of FY 2022, the FBI’s DT Program included approximately 2,700 pending 

investigations. Approximately half of the FY 2022 investigations were directly related to the

unlawful activities during the January 2021 breach of the US Capitol. The following table 

presents the percentage breakout of investigations within the FBI’s DT Program by investigative 

case classification as of the end of FY 2022.

Percentage Breakout of Investigations within the FBI’s Domestic Terrorism Program, by 

Investigative Case Classification

Investigative Classification End of FY 2022

Racially or Ethnically Motivated Violent Extremism 19%

Anti-Government or Anti-Authority Violent Extremism 31%

Animal Rights or Environmental Violent Extremism 1%

Abortion-Related Violent Extremism 1%

All Other DT Threats 13%

Anti-Riot Laws/Civil Unrest* 35%

*Non-DT threat category case classifications that are covered under the DT Program

Identification of FBI DT Assessments and Investigations as a Result of a Hate Crime 

Hate crimes and DT are not mutually exclusive. A hate crime is targeted violence motivated by 

the offender’s bias against a person’s actual or perceived characteristics, while a DT incident

involves acts dangerous to human life that are in violation of criminal laws and in furtherance of 

a social or political goal. The FBI’s Domestic Terrorism-Hate Crimes Fusion Cell helps to 

address the intersection of the FBI counterterrorism and criminal investigative missions to 

combat DT and provide justice to those who are victims of hate crimes.

The Hate Crime Statistics Program of the FBI’s Uniform Crime Reporting (UCR) Program 

collects data regarding criminal offenses motivated, in whole or in part, by the offender’s bias 

against a person’s actual or perceived race/ethnicity, gender, gender identity, religion, disability, 

or sexual orientation, and committed against persons, property, or society. The FBI publishes an 

annual report of hate crime statistics and, in 2021, law enforcement agencies participating in the 

UCR Program reported 9,065 hate crime incidents.17

17 The FBI’s Hate Crime Statistics, 2021, released Fall 2022, and updated in March 2023. As of the date of this 

report, the FBI has not yet published the annual report for 2022.
Page 26 of 46

While the FBI collects and reports hate crime statistics, there is no mandatory reporting 

requirement to identify hate crime incidents that are also considered criminal activity that 

appears motivated by a political and/or social goal consistent with the DT threat categories. In 

instances of a potential hate crime, the FBI opens a civil rights investigation. If throughout the 

investigation a DT ideology is identified, the Criminal Investigative Division and 

Counterterrorism Division work together through the Domestic Terrorism-Hate Crimes Fusion 

Cell to determine the best path forward. This may include, but is not limited to, converting the 

investigation to a DT case, assigning a DT agent to the case, or developing regular 

communication between the two programs. In cases involving DVEs where a potential hate 

crime is identified, the Counterterrorism Division’s DT Program coordinates with the Criminal 

Investigative Division’s Civil Rights Program and the local USAO to assess the potential for a 

hate crimes charge. In certain instances, based on the specific context of the investigation, 

parallel DT and hate crimes cases are opened. 

Number of Federal Charges with a DT Nexus

A litany of federal and state charges are used to charge DT subjects for applicable criminal 

violations. Federal charges include those related to weapons, explosives, threats, attacks on 

federal officials or facilities, hate crimes, arson, violence against animal enterprises, and material 

support to terrorists. Under 18 USC § 2339A, it is a crime to provide material support or 

resources to another knowing or intending they will be used in preparation for or carrying out 

certain terrorism-related offenses. Unlike a violation of 18 USC § 2339B, the recipient of 

material support need not be a designated foreign terrorist organization. 

In FY 2022, the FBI, often in coordination with partner agencies, arrested over 400 subjects 

included within the domestic terrorism program. 

Individuals whose conduct involves DT or a threat thereof may be prosecuted by any USAO 

under a wide range of criminal statutes, some of which on their face relate to DT, and others of 

which do not.18 While the criminal code includes a definition of DT, see 18 USC § 2331(5), there 

is no standalone federal DT statute. For example, the DOJ has prosecuted cases against such 

individuals using weapons charges, e.g., 18 USC §§ 922, 924; charges relating to use or 

possession of destructive devices, e.g., 26 USC §§ 5845, 5861;19 threat, hoax, or riot charges, 

e.g., 18 USC §§ 871, 875, 876, 1038, 2101; and charges proscribing attacks on federal officials 

or facilities, e.g., id. § 111, 115, 351, 844, 930, 1114, 1361, 1751. DOJ has also prosecuted cases 

involving DT using the material support to terrorist activity statute at 18 USC § 2339A. Hate 

crimes charges, e.g., id. § 249, may be appropriate where individuals engage in DT that is 

motivated by biases against a race, religion, ethnicity, or other specified factors. However, not all 

hate crimes cases involve DT. Arson, id. § 844, or specific charges relating to violence against 

18 Several statutes reach conduct that may be associated with terrorism, without regard to whether the offense itself 

involves domestic or international terrorism. These include statutes relating to aircraft sabotage, id. § 32; weapons of 

mass destruction, e.g., id. §§ 175, 175b, 175c, 229, 831, 832, 2332a, 2332h, 2332i; arson and bombing of federal 

property, e.g., id. §§ 844, 2332a, 2332f; and causing injury or death to a federal official, e.g. id. §§ 111, 115, 351, 

1114, 1751; among others. It is also a crime to provide material support or resources to another knowing or 

intending that they be used in preparation for or carrying out certain terrorism-related offenses. Id. § 2339A.

19 Offenses under the Gun Control Act of 1968 and National Firearms Act of 1934 are primarily investigated and 

enforced by DOJ’s Bureau of Alcohol, Tobacco, Firearms and Explosives.
Page 27 of 46

animal enterprises, id. § 43, may apply to animal rights or environmental violent extremists. In 

some cases, drug trafficking, tax, or state and local charges could also provide a lawful basis to 

disrupt an individual believed to be planning or pursuing acts of DT. Finally, in some DT cases, 

DOJ seeks the use of the terrorism sentencing enhancement.20

DOJ recognizes the need for coordination and consistency in DOJ and FBI efforts to hold 

accountable DVEs who engage in criminal conduct. An important part of achieving those goals 

is to have the ability to identify and internally track investigations and prosecutions involving 

conduct related to domestic violent extremism, and the Department is implementing changes that 

will allow us to better identify and track such cases. In March 2021, the Acting Deputy Attorney 

General issued guidance to all USAOs to provide information to NSD on DT investigations and 

prosecutions. This directive not only highlighted the need for effective coordination, but also 

implemented a plan for better tracking of the important DVE-related work being done by federal 

investigators and prosecutors around the country. In November 2022, an update to the Justice 

Manual codified these notification and coordination requirements and made additional changes 

to promote consistency and appropriate coordination and oversight of DVE-related matters.

Referrals of DT Incidents to the FBI

The eGuardian system is the FBI’s case management system for handling suspicious activity 

reports from federal and SLTT law enforcement agencies and the Department of Defense related 

to counterterrorism, counterintelligence, cyber incidents, criminal complaints, and weapons of 

mass destruction. These reports are then migrated to the FBI’s internal Guardian system where 

they are further evaluated by the appropriate squad or JTTF for any action deemed necessary. 

In FY 2022, the FBI had approximately 5,772 total Guardians on possible DT incidents. In 

FY 2022, the FBI received approximately 3,440 referrals of possible DT incidents from federal 

and/or SLTT partners. In FY 2022, the FBI referred approximately 1,118 possible DT incidents 

to federal and/or SLTT partners. The FBI refers incidents to partner agencies for multiple 

reasons. For example, the incident may not have a federal criminal nexus or the incident may be 

the statutory responsibility of another law enforcement organization. In addition, the FBI may 

refer an incident to a partner agency, but continue to investigate the incident jointly. In FY 2022, 

the FBI converted approximately 394 Guardians on possible DT incidents to preliminary or full 

investigations.

DT Intelligence Products

During FY 2022, the FBI produced approximately 3,000 DT-related intelligence products. A

single intelligence product often contains threat reporting or case information from subjects 

associated with multiple investigative classifications and, as such, the FBI does not have the data 

to determine the number of intelligence products associated with each DT investigative 

20The Sentencing Guidelines provide a significant sentencing enhancement for offenses that involve, or are intended 

to promote, a “federal crime of terrorism” – often increasing the guideline range to the statutory maximum. See 

USSG § 3A1.4. “The Sentencing Guidelines also provide for a similar upward departure for other offenses that were 

calculated to influence or affect the conduct of government by intimidation or coercion, to retaliate against 

government conduct, or to intimidate or coerce a civilian population.” See id. cmt. n.4.
Page 28 of 46

classification. FBI intelligence products incorporate collection, domain, targeting, or threat 

analysis and are written at the tactical, operational, and strategic levels. FBI intelligence products 

are prepared for both internal and external audiences.

During FY 2022, DHS I&A produced over 200 DT-related raw intelligence reports (IIRs, Open 

Source Intelligence Reports, and Field Intelligence Reports) and produced, jointly produced, or 

contributed to approximately 100 finished intelligence products related to DT, with the majority 

of these products released at the Unclassified//FOUO level to better inform SLTT partners. The 

finished intelligence products are available to appropriate Congressional partners via CapNet.

In NCTC’s support role to FBI and DHS on DT, the Center regularly partnered during FY 2022 

with these organizations on joint analytic products related to this topic – particularly as part of 

the FBI-DHS-NCTC JAC. The JAC particularly focused on publishing broad, strategic analytic 

products on DT trends.

Number of Staff Working DT Matters 

One of the FBI’s most vital assets in the counterterrorism fight is our ability to remain agile in 

combatting the threats we face. Staffing for the FBI’s counterterrorism mission is aligned based 

on threat priorities and, as is true across the FBI, can and does realign in response to the 

evolution of the threats and any critical incidents.

The front line of the counterterrorism mission in the United States is represented by the FBI-led 

JTTFs, which investigate both DT and IT matters. The FBI leads approximately 56 JTTFs 

spanning over 100 locations nationwide and across all 56 Field Offices, including our satellite 

Resident Agencies, with participation of over 50 federal and over 500 SLTT agencies. The 

JTTFs are comprised of approximately 4,400 investigators, including FBI special agents and task 

force officers, and additional analysts and professional staff who support these JTTF members 

and the investigations they lead. The JTTF partnerships at the federal and SLTT levels are force 

multipliers leveraging local expertise, experience, and resources in FBI counterterrorism 

investigations.

In FBI Field Offices, squads are dedicated to the counterterrorism mission and not necessarily 

assigned specifically to investigate DT or IT matters. This is significant because the motivation 

behind an alleged threat or act of terrorism may not be immediately apparent. Additionally, when 

an incident occurs, Field Office personnel from all operational programs – for example, criminal 

or counterintelligence – may respond. 

Similar to our posture against the IT threat, the FBI’s Counterterrorism Division at Headquarters 

has a dedicated Domestic Terrorism Operations Section (DTOS), comprised of special agents,

intelligence analysts, and professional staff. The FBI’s DTOS oversees and provides operational 

and tactical intelligence support to all 56 Field Offices and their Resident Agencies in 

investigating the use of violence by individuals to further political and/or social goals in violation 

of federal criminal statutes. The DTOS oversees the Domestic Terrorism-Hate Crimes Fusion 

Cell, which creates more opportunities for investigative creativity, provides multi-program 
Page 29 of 46

coordination, helps ensure seamless information sharing, and enhances investigative resources to 

combat the DT threat. 

The FBI’s Counterterrorism Division also has specialized intelligence and targeting units that 

work to combat DT specifically, as well as additional units that provide support across the FBI’s

counterterrorism mission, not exclusive to DT or IT matters. The FBI conducts national-level 

strategic analysis of the DT threat through the Counterterrorism Analysis Section. This dedicated 

body of intelligence analysts focuses on providing strategic assessments of the IT and DT threat 

and actively works with DHS and NCTC to provide accurate intelligence on the threat picture.

Further, all FBI counterterrorism investigations are led by Counterterrorism Division Deputy 

Assistant Directors, who have unique vantage points from which to assess the terrorism threat 

around the globe and prioritize investigations and operations across the country. Additionally, 

the FBI’s Office of the General Counsel employs in-house attorneys within the National Security 

and Cyber Law Branch that are dedicated to providing legal assistance on DT operations at FBI 

Headquarters. This aligns with the legal counsel represented in all 56 FBI Field Offices. 

As indicated above, DOJ/NSD also recently established a Domestic Terrorism Unit within the 

CTS with several functions: prosecuting and coordinating DT cases, developing training and 

policies on DT matters, and supporting the work of the Department in implementing a whole-ofgovernment strategy on countering DT. The Department believes that this change best enables us 

to respond to the evolving and persistent DT threat.

DHS I&A’s Counterterrorism Mission Center (CTMC) leads I&A’s analysis of DT issues. 

CTMC provides intelligence support and analysis that focuses on domestic threat actors, 

including DVEs, consistent with the Department’s statutory charges to identify priorities for 

protective and support measures regarding terrorist and other threats to homeland security. In 

2021, DHS I&A created a Domestic Terrorism Branch, housed within CTMC, consisting of 

intelligence personnel solely dedicated to focusing on the DT landscape. These analysts have 

enabled DHS I&A to increase its production and sharing of information on DT threats, 

engagement with FBI and NCTC counterparts to jointly author strategic DT intelligence 

products, briefings to government and private sector customers, and interactions with subject 

matter experts outside government. This branch currently consists of ten full time DHS 

intelligence analysts and one manager. Additionally, DHS I&A maintains a presence at state and 

major urban area fusion centers through its Office of Regional Intelligence,21 and DHS I&A 

analysts at DHS Headquarters work with those individuals to author joint products and share 

threat-related information on issues relevant to their regions, including domestic violent 

extremism and physical threats to critical infrastructure. 

In addition, DHS I&A maintains the Open Source Intelligence Division with a branch of open 

source collection officers that research and report on publicly available information sources 

online within the DT space, consistent with I&A’s Intelligence Oversight Guidelines.

DHS I&A’s Office of Regional Intelligence has over 130 personnel deployed to field locations 

across the United States, primarily in state and major urban area fusion centers. These officers 

21 The Office of Regional Intelligence was formerly the Field Operations Division.
Page 30 of 46

work across a range of threat issues and actors, including the DVE mission space. DHS I&A’s 

field-deployed intelligence officers collect and report intelligence information in serialized raw 

intelligence reports and provide regionally-focused analysis, which may include DVE topics.

DHS I&A’s Engagement and Liaison Office has one person detailed to FBI Headquarters to 

serve as the senior DHS Intelligence representative to the FBI responsible for improving the 

multi-directional information flow by meeting mutual intelligence needs of the Department and 

FBI. The Liaison Officer works across a range of threat issues and actors, including the DVE 

mission space.

All of the DHS staff mentioned are specific to DHS I&A, in accordance with reporting 

requirements. Similar to FBI, DHS added personnel and resources to counter DT in response to

the evolution of the threat and to support implementation of the June 2021 National Strategy for 

Countering Domestic Terrorism. These personnel span the breadth and depth of the DHS 

mission set, including but not limited to DHS representatives to JTTFs. DHS is the largest and 

longest standing federal contributor to the JTTFs nationwide and those personnel are closely 

involved with countering DT through the JTTFs. 

While NCTC’s primary missions are focused on the threat posed by IT, the Center provides 

domestic counterterrorism support, where appropriate and consistent with Congressional 

direction, to the FBI and DHS, which are the lead domestic counterterrorism agencies. NCTC 

identifies and monitors international and transnational trends across a range of violent extremist 

actors and looks for and analyzes transnational linkages. NCTC defers to the FBI and DHS 

regarding assessments of the overall threat posed by DVEs and determinations of whether 

specific individuals are DVEs. NCTC does not have analysts focused exclusively on domestic 

violent extremism threats.

VII. Recommendations

The Act requires the Director of the FBI and the Secretary of Homeland Security, in consultation 

with the DNI, to jointly submit to the appropriate Congressional committees a report on DT 

containing recommendations with respect to the need to change authorities, roles, resources, or 

responsibilities within the federal government to more effectively prevent and counter DT 

activities, and measures necessary to ensure the protection of privacy and civil liberties.

Implementation of the National Strategy for Countering Domestic Terrorism

In June 2021, the White House released the first-ever National Strategy for Countering Domestic 

Terrorism, which provides a government-wide strategy to counter domestic violent extremism. 

The national strategy references the March 2021, US Intelligence Community intelligence 

assessment titled, Domestic Violent Extremism Poses Heightened Threat in 2021, and lays out a 

comprehensive strategy to address the DT threat, building on a foundation of US Government

collaboration on programmatic aspects of countering DT – such as information sharing, training, 

prevention, and intervention efforts – while fostering a broader community that extends beyond 

the US Government to critical partners. The national strategy also reinforces the US 

Government’s commitment to approaching this important work while avoiding unlawful 
Page 31 of 46

discrimination, bias, and stereotyping and the protection of American civil rights and civil 

liberties, including preserving and safeguarding constitutionally protected freedom of speech and 

association, while focusing on addressing unlawful violence. The strategy also includes 

prevention efforts to enhance community resilience against DT and the provision of available 

resources.

The FBI and DHS, with support from NCTC, remain dedicated to working with our partners on 

the effective implementation of the national strategy and continue to evolve our response to this 

threat. 

As part of the national strategy, the FBI has increased intelligence production regarding the DT 

threat; continued to develop and implement TATM teams throughout the country; enhanced 

engagement with private sector partners; and developed and provided unclassified resources –

such as the US Violent Extremist Mobilization Indicators booklet, which was jointly developed 

with DHS and NCTC – to multiple audiences, including law enforcement partners, first 

responders, and the American public.

Importantly, DHS plays a key role in this whole-of-government effort, and DHS I&A has 

undertaken a number of actions and initiatives to support the national strategy, in line with 

broader Departmental efforts. As noted above, in 2021, DHS I&A established a Domestic 

Terrorism Branch solely focused on analyzing threats from domestic violent extremism. Since 

January 2021, DHS I&A also regularly delivered in-person and virtual briefings to a variety of 

partners regarding the DVE movements and various trends impacting homeland security, and 

DHS I&A contributed to the development of seven National Terrorism Advisory System 

bulletins, which provide the public awareness of the current threat environment in the Homeland.

DHS continues to enhance the role of its Counterterrorism (CT) Coordinator. As the principal 

counterterrorism official at DHS, the CT Coordinator is responsible for the Department’s 

counterterrorism-related activities ensuring they are appropriately developed, coordinated, 

integrated, aligned, and implemented. 

DHS’s Center for Prevention Programs and Partnerships (CP3) also continues to expand its 

efforts to prevent terrorism and targeted violence by providing partners at the state and local 

level with tools to prevent violence. Through technical, financial, and educational assistance, 

CP3 is leveraging community-based partnerships to enhance local capabilities and help ensure

individuals receive help before they radicalize to violence. CP3 also partners with DHS’s Federal 

Emergency Management Agency to administer the Targeted Violence and Terrorism Prevention 

(TVTP) Grants Program, which provides funding to enhance and expand prevention capabilities. 

The TVTP grant program complements existing programs that enhance the preparedness of our 

nation, including the Nonprofit Security Grant Program which provides support for target 

hardening and other physical security enhancements at nonprofit organizations, as well as the 

State Homeland Security Program and Urban Area Security Initiative grant programs, which 

have prioritized combatting domestic violent extremism as a “National Priority Area” in both 

FY 2021 and FY 2022.
Page 32 of 46

DHS’s Office for Civil Rights and Civil Liberties (CRCL) conducts extensive engagement with 

diverse communities across the country, including communities threatened by targeted violence, 

and frequently facilitates direct engagement between senior DHS leadership and these 

communities. CRCL partners with DOJ and other federal agencies to provide information to 

communities on federal efforts to prevent violent extremism and hear directly from communities 

about concerns they need to address. Trusted partnerships built as a result of these CRCL 

engagements enable DHS to work closely with diverse communities on DT prevention efforts.

Legislative Initiatives 

DOJ continually assesses whether additional legislative authorities would improve our efforts to 

combat DT and other national security threats. The FBI is actively working with DOJ on some 

broader legislative initiatives that can benefit both federal investigations and prosecutions, 

including those relating to DT. For example, there are ongoing discussions about adjusting 

legislation in response to the challenges in disrupting juvenile threat actors via federal law 

enforcement actions. We will inform and work with the Congress and the Office of Management 

and Budget in the event we identify any critical gaps in our authorities that may negatively 

impact our ability to accomplish our mission.

Resource Enhancements

To close the gaps in the FBI’s ability to disrupt and deter DT threats, the DOJ and FBI have 

continuously engaged with Congress and the Office of Management and Budget to appropriately 

allocate resources towards combatting the DT threat.

Meanwhile, DHS is committed to expanding its ability to collect domestic violent extremism 

information obtained overtly or from publicly available sources, consistent with its authorities, 

while simultaneously safeguarding privacy, civil rights, and civil liberties of all persons. We are 

enhancing DHS’s ability to rapidly analyze and communicate DT threats and inform 

policymakers’ and its homeland security partners’ decisions and actions, designed to prevent acts 

of terrorism and targeted violence.
Page 33 of 46

Appendix A

Significant Domestic Terrorism Incidents in the United States from Fiscal Year 202222

This appendix includes domestic terrorism (DT) incidents from fiscal year 2022 that FBI and 

DHS Office of Intelligence and Analysis identify as significant, including high-profile attacks, 

plots, threats of violence, arrests, and disruptions. To be considered a DT incident, the incident 

must involve the use or threat of force or violence, have the potential for a federal violation, and 

appear intended to further social or political goals. These incidents are typically investigated by 

the FBI for a variety of potential federal criminal activities, including hate crimes, and/or 

22 Unless otherwise noted, some of these matters are active/pending. All defendants are presumed innocent unless 

and until proven guilty in a court of law.
Page 34 of 46

investigated by state and local law enforcement for criminal violations in their respective 

jurisdictions.
Page 35 of 46

Date and Location Description

October 2021:

Missouri

Two anarchist violent extremists (AVEs) were convicted and sentenced to 

prison related to their June 2020 attempt to set fire to a convenience store 

during the 2020 civil disorder. In September 2021, one AVE pleaded guilty to a 

federal charge of possessing a firearm as a convicted felon and intentionally 

demonstrating a technique that would be unlawfully employed in furtherance 

of a civil disorder and was sentenced to 36 months in prison. In October 2021, 

the second AVE was arrested on a federal charge of conspiracy to commit 

arson, and in February 2022, the AVE pleaded guilty. In August 2022, the AVE 

was sentenced to 27 months in prison.

October 2021:

Michigan

Approximately 10 masked individuals claiming association with environmental 

groups broke into a pipeline facility and used tools and equipment to close an 

emergency shut-off valve on the pipeline. The event was livestreamed and 

posted to multiple social media accounts. This incident remains under 

investigation as potential environmental violent extremism.

November 2021:

Arkansas

Four racially or ethnically motivated violent extremists (RMVEs) were arrested 

and federally charged with unlawful possession of, and conspiracy to sell, a 

firearm to a prohibited person. This case is pending.

November 2021:

Ohio

An RMVE was arrested and federally charged with possession of a firearm by 

a convicted felon. This arrest disrupted the movement of illegally purchased 

firearms to numerous individuals, some of whom are known felons. In 

April 2023, the RMVE pleaded guilty, and is awaiting sentencing.

November 2021:

Virginia

An RMVE was arrested and federally charged with possession of a firearm by 

an unlawful user of controlled substances. In January 2022, the RMVE 

pleaded guilty and in July 2022, was sentenced to four years and nine months 

in prison.

November 2021:

Pennsylvania

An AVE was arrested and federally charged with interstate threats after

placing telephone calls threatening violence against law enforcement officers 

following an officer involved shooting. In March 2022, the AVE pleaded guilty, 

and in June 2022, was sentenced to seven months time served.

November 2021:

New York

An RMVE was arrested and federally charged with unlawful possession of a 

firearm and ammunition by a convicted felon. This case is pending.

December 2021:

Washington

An AVE was arrested and federally charged with unlawful possession of 

destructive devices in connection with a September 2020 plot to burn the 

Seattle Police Officers Guild building. In September 2022, the AVE pleaded 

guilty, and is awaiting sentencing.

December 2021 and 

January 2022:

Washington

Two militia violent extremists (MVEs) were arrested and federally charged 

with conspiracy to make or possess an unregistered destructive device, which 

they planned to use to attack law enforcement officers. In March 2023, both

MVEs pleaded guilty, and are awaiting sentencing.
Page 36 of 46

January 2022:

Texas

An MVE, who identifies as the founder and leader of the Oath Keepers, was 

arrested and federally charged with seditious conspiracy and other charges 

related to the breach of the US Capitol on 6 January 2021. In November 2022, 

the MVE was found guilty, and in May 2023, was sentenced to 18 years in 

prison.

January 2022:

North Carolina

An MVE was arrested and federally charged with teaching the making of an 

explosive device weapon of mass destruction for use in furtherance of a 

federal crime of violence and possession of unregistered firearms and 

destructive devices. The MVE owned a tactical training company and provided 

instructions for the manufacture and sale of improvised explosive devices.

This case is pending.

January 2022:

Texas

An AVE was arrested and federally charged with attempt to destroy property 

that affects interstate or foreign commerce by means of explosive. The AVE 

attempted to detonate a device to damage or destroy a portion of a natural 

gas pipeline in Texas as part of his fight against capitalism and climate change. 

In October 2022, the AVE pleaded guilty, and in February 2023, was 

sentenced to five years in prison.

February 2022:

Alabama, Mississippi

Eight AVEs were arrested and federally charged with conspiracy to maliciously 

destroy by fire in connection with a series of fires set at four Walmart stores –

two in Alabama and two in Mississippi – in May and June 2021. During 2022, 

all eight AVEs pleaded guilty. In May 2023, one was sentenced to 18 years; a 

second was sentenced to 15 years; and a third was sentenced to three years. 

In June 2023, two others were sentenced to four years; and the sixth was 

sentenced to two years. The remaining two AVEs are awaiting sentencing.

February 2022:

Florida

A DVE with a personalized ideology was arrested and federally charged with 

transmitting interstate threatening communications after posting a video

online in February 2021, threatening to kill an FBI special agent attempting to 

interview the DVE in furtherance of an investigation into the 6 January 2021

breach of the US Capitol. In July 2022, the DVE was found guilty, and in 

April 2023, was sentenced to 18 months in prison.

March 2022:

New York

An anti-government or anti-authority violent extremist-other (AGAAVE-Other)

was arrested and federally charged with transmitting interstate threatening 

communications after sending voicemails threatening violence against a 

member of Congress due to a dislike of public statements by the 

Congressperson. This case is pending.

April 2022:

New York

An RMVE was arrested and federally charged with committing a terrorist 

attack or other violence against a mass transportation vehicle after 

conducting a shooting attack on the New York City subway in Brooklyn, New 

York, resulting in dozens of gunshot wounds and other injuries. In January 

2023, the RMVE pleaded guilty, and is awaiting sentencing.
Page 37 of 46

April 2022:

Utah

Two environmental violent extremists (EVEs) were arrested on state charges

in connection with the May 2020 purposeful damaging or sabotaging of 

several pieces of heavy operating machines used in construction. Losses were 

estimated in excess of $500,000. In September 2022, one EVE pleaded guilty, 

and in November 2022, was sentenced to a suspended prison term of one to 

15 years and 120 days of home confinement. In January 2023, the second EVE 

pleaded guilty, and in March 2023, was sentenced to a suspended prison term 

of one to 15 years, with one year prison.

April 2022:

Oklahoma

An AVE was arrested and federally charged with illegal possession of a 

machine gun and possession of numerous firearms and ammunition by a 

convicted felon after making threatening statements to law enforcement. In 

July 2022, the AVE pleaded guilty, and is awaiting sentencing.

May 2022:

New York

An RMVE was arrested on state charges following a mass shooting attack, 

which targeted victims because of their actual or perceived race or color, at a 

grocery store, and which killed 10 individuals and injured three others. The 

RMVE was subsequently federally charged with a hate crime resulting in 

death, use of a firearm to commit murder, and use and discharge of a firearm 

during and in relation to a crime of violence. The RMVE posted a manifesto on 

social media outlining violent extremist views, including self-identified white 

supremacist ideology, and livestreamed the shooting on social media. In 

November 2022, the RMVE pleaded guilty to state charges of murder 

motivated by hate, and is awaiting sentencing. The federal case is pending.

May 2022:

Nevada

A sovereign citizen violent extremist (SCVE) was arrested and federally 

charged with prohibited person in possession of a firearm after threatening

Douglas County court personnel – including a judge, defense attorney, district 

attorneys, and county sheriff – in furtherance of his SCVE ideology. The SCVE

filed false legal documents alleging violations of federal statutes, threatening 

the individuals with arrest and death. This case is pending.

May 2022:

Illinois

An SCVE was arrested on state charges of aggravated battery to a peace 

officer and resisting arrest following a traffic stop during which the SCVE

refused to recognize the authority of the law enforcement officers,

proclaimed himself to be a “nationalist,” and fought the officers while being 

extracted from the vehicle. In March 2023, the presiding judge in the state 

trial declared a mistrial with prejudice.

June 2022:

Louisiana

An RMVE was arrested and federally charged with possession of firearms by a 

convicted felon. The RMVE posted threats to kill preachers on a social media 

platform, and was apparently motivated in part by violent interpretations of 

Black Hebrew Israelite teachings. This case is pending.
Page 38 of 46

June 2022:

New York

An RMVE was arrested and federally charged with aiding and abetting the 

making of a false statement to a federal firearm licensee that was material to 

the lawfulness of the sale of a firearm and pertained to information required 

to be kept by the licensee in connection with purchase of a firearm, and 

conspiring to do the same. This case is pending.

June 2022:

Maryland

An abortion-related violent extremist (AbRVE) was arrested and federally 

charged with attempting to kidnap or murder a US Supreme Court Justice 

following the leak of a draft opinion in the US Supreme Court case, Dobbs v. 

Jackson Women’s Health Organization, regarding federal abortion 

protections. This case is pending.

June 2022:

Oregon

An AVE was arrested on state charges for attempting to build a destructive 

device. The arrest followed information the AVE was constructing Molotov 

cocktails and may have been planning to use them at a protest; search 

warrants resulted in seizure of material consistent with manufacture of 

destructive devices.

June 2022: 

Ohio

An RMVE was arrested on multiple federal charges related to making and 

selling untraceable homemade weapons using a 3D printer. While employed 

to provide security services at local synagogues and Jewish schools, the RMVE 

threatened to commit a shooting attack at a synagogue. Prior to the federal 

arrest, the RMVE was arrested by local law enforcement on state charges 

including making terroristic threats. In February 2023, the RMVE was 

sentenced in federal court to 71 months in prison, and was sentenced in 

county court to six years in prison, to be served concurrently with the federal 

term.

July 2022:

Texas

An MVE was arrested and federally charged with unlawful possession of a 

firearm by a felon. The MVE conducted armed patrols of the US-Mexico 

border. This case is pending

July 2022:

South Dakota

One or more unknown individuals fired multiple gunshots into a substation 

that powers the Keystone Pipeline. The damages resulted in lost production 

and physical property damage to the transformer and pump station. This 

incident remains under investigation as potential environmental violent 

extremism.

July 2022: 

Tennessee

An AbRVE was arrested and federally charged with destruction of government 

property related to a drive-by shooting, which struck the windows of an 

occupied federal courthouse in Knoxville, Tennessee. The AbRVE also 

allegedly fired at and set fire to a reproductive health services facility.

July 2022:

Multiple states

A juvenile RMVE was formally petitioned after calling in a false active shooter 

threat to a middle school and making threatening calls and swatting incidents 

targeting historically Black colleges and universities. In October 2022, after 

pleading guilty to a state charge of conspiracy to make false threats, the 

RMVE was sentenced to nine months’ probation, including a juvenile 

assessment, counseling, and behavior program.
Page 39 of 46

August 2022:

Oklahoma

Two alleged SCVEs were arrested and federally charged with kidnapping 

following the abduction of a minor and refusal to comply with law 

enforcement. In March 2023, the charges were dismissed without prejudice.

August 2022:

Ohio

An AGAAVE-Other attempted to breach the FBI’s Cincinnati Field Office with 

the intention of killing FBI personnel. The AGAAVE-Other fled the area and 

was fatally wounded after an hours-long standoff with law enforcement.

August 2022:

Pennsylvania

An MVE was arrested and federally charged with making interstate threats 

and influencing or retaliating against a federal officer by threat for making 

threats of violence against the FBI following the FBI’s execution of a federal 

search warrant at a former President’s Florida home. In June 2023, the MVE 

pleaded guilty, and is awaiting sentencing.

August 2022:

Pennsylvania

One or more unknown individuals vandalized construction vehicles in a state 

park and left warning signs that trees had been “spiked,” and cutting the 

trees could result in damage or injury. This incident remains under 

investigation as potential anarchist violent extremism.

August 2022:

Florida

An AGAAVE-Other was arrested and federally charged with mailing 

threatening communications after sending nine threatening letters to 

individuals who participated in, or were linked to, the 6 January 2021 breach 

of the US Capitol. In October 2022, the AGAAVE-Other pleaded guilty, and in 

February 2023, was sentenced to time served.

September 2022:

North Carolina

An SCVE was arrested and federally charged with transmission of threats in 

interstate or foreign commerce after sending multiple purported “Writs of 

Execution,” all of which threatened to arrest county officials, law 

enforcement, and others. In January 2023, the SCVE pleaded guilty, and is 

awaiting sentencing.

September 2022:

North Carolina

An RMVE was arrested and federally charged with receiving, possessing, 

transferring, or manufacturing an unregistered firearm. In April 2023, the 

RMVE pleaded guilty, and is awaiting sentencing.

September 2022:

Texas

An RMVE was arrested and federally charged with interstate threatening 

communications and threatening a federal officer after posting threatening 

statements against law enforcement officers, government officials, and racial 

and religious groups on a social media platform. In June 2023, the RMVE 

pleaded guilty, and is awaiting sentencing.
Page 40 of 46

Appendix B
Page 41 of 46
Page 42 of 46
Page 43 of 46
Page 44 of 46
Page 45 of 46
Page 46 of 46