Take Action Now

The BlueLeaks documents show the feds spying on movement groups from the time of Obama’s presidency through Trump’s. However, under Trump the spying became much more targeted and significant.

By Jonathan Stribling-Uss, Z Network

“Dissent must never lead to disorder.”
– Joe Biden, 5/2/24, Remarks on recent events on college campuses[1]

“We pledge to you that we will root out the Communists, Marxists, Fascists, and Radical Left Thugs that live like vermin within the confines of our Country…The threat from outside forces is far less sinister, dangerous, and grave, than the threat from within.”
– Donald Trump, Veterans Day speech (2023) and Truth Social Post

homeland surveilance lights on bridge
Image: Joe Brusky

Introduction

President Biden’s recent speech on campus dissent clearly embraced the police crackdown on peaceful protests at US colleges.  Biden said, “Dissent must never lead to disorder,” while supporting violent police attacks on peaceful students. On the other hand, Trump has also increased his threats against “Radical left thugs.”  Trump and the MAGA bloc have made no secret of their plans to enact repressive authoritarianism.[2] Those who recognize that disruptive protest is needed for broader progressive change find ourselves between a rock and a hard place.  Disruptive protests and social movements were critical to Trumps defeat in 2020 and will be crucial to stopping the IDF from continuing to commit genocide against the Palestinians. The surveillance and repression of the organized Left throughout Trump’s first term was carried out by well-established federal forces. Those forces are being engaged against the ceasefire protests. Because of this, it is especially important that we are equipped to maintain disruptive protest and deal with the current wave of repression against university students. In this article, I will use an analysis of the federal government’s Blueleaks documents to look at both Trump’s current run for president and Biden’s embrace of police repression against ceasefire protestors.  This article takes a detailed look at more than 30 documents relating to the federal government’s repression of left protest. Most of them are from Trump’s first term, but some precede that period. This lens gives us a hidden view of the last major wave of police repression against popular yet disruptive protests, the 2020 Black Lives Matter uprisings.

The BlueLeaks archive contains 269 GBs of leaked information from federal Fusion Centers across the country. Hackers gave them to DDOSecrets on June 10, 2020, just after the beginning of the George Floyd Black Lives Matter (BLM) nationwide protests.[3] In BlueLeaks, reports on global and national trends from the Federal Bureau of Investigation (FBI) and the Department of Homeland Security (DHS) sit alongside an endless buzz of “criminal intelligence” on crimes, suspects, and wanted individuals from regional intelligence operations and even municipal police. The files include documents from 251 internal police websites that were administered by a company named Netsential. While some of these documents have been published before, many have not. That is because when they were first leaked in 2020, the BlueLeaks documents were actively seized and taken off the internet by the FBI, which has continued to suppress corporate media reporting on them, including formally banning any mention of them on Twitter/X.

Fusion Centers: nodes of police cooperation

Fusion Centers were officially created in the wake of the 9/11 attacks as part of the PATRIOT Act. They are key sites of police coordination that pull together elements of the FBI, Department of Homeland Security, Drug Enforcement Agency, and local law enforcement. They span the range of police intelligence. More than 30 detailed Fusion Center reports from the past 20 years concern federal government coordination of local police around the suppression of left protest movements. The centers deploy a couple of clear long-standing strategies and tactics that were used by the first Trump administration and will almost certainly be used if Trump takes federal power again. They rely on extensive use of information siphoned from internet sites such as Facebook then de-anonymized—and justify their spying in the name of “preventing domestic extremism.”

Importantly there are many examples of specific types of organizational spying undertaken by the federal Fusion Centers in the BlueLeaks documents. The centers regularly refer to many of the sources of their information as “open-source intelligence.” New revelations from the declassified report on Commercially Available Information by the Office of the Director of National Intelligence (ODNI)  confirm the insidiousness of the term “open source intelligence” for the information Fusion Centers acquire.[4] Most people assume that the definition of “open source intelligence” is “I found information open on the internet” or information related to free and open source licensing. But “open source intelligence” in the context of Fusion Centers means any information a federal agency could have a third party purchase for them from advertisers and social media.

Firms like Bable Street or Dataminr have contracts with the government to buy data from ad brokers.   Ad brokers, like Oracle and Xandr (owned by Microsoft) take data from all the major for-profit tech companies, de-anonymize it, combine it with more detailed personal information, and attach it to individuals and physical locations. [5]  In this way the government can warrantlessly access the information people put on ad platforms like Google, Facebook, and Instagram. In this light it is clear how much detailed information that people think of as private, from Facebook, Google, Slack and other companies, is being used by the federal government to surveil organizations. Sometimes this information can even be used covertly in criminal prosecutions.[6]

Because the US federal government uses ad platforms like Google, Meta and Twitter/X to subject social movements to warrantless mass surveillance, it gathers enough information that the analysis of federal law enforcement is often very nuanced and specific. For example, a key ideological formulation that the Fusion Centers use is that any disruptive left demonstrations are “exploited” by, in their words, “anti-government-anti-authority extremism,” “antifa-affiliated anarchist extremists” or “criminal and malicious actors.” For example, when Fusion Centers assessed the Occupy movement of 2011, while internally conceding that it was a “peaceful” movement they determine that a “key judgment” was:

“The structure and composition of the various Occupy movements, which draw relatively large, disorganized, and impromptu demonstrations, will continue to be exploited by criminal and malicious actors seeking to take advantage of otherwise peaceful protests…”[7]

Fusion Centers often assume an ideological background for a new set of protesters. For example, in 2016 the Democracy Spring was a coalition of “more than 100 progressive groups” which used campaigns of escalating nonviolent civil disobedience to “end the corruption of big money in politics and protect the right to vote for all Americans.”  In a detailed assessment of Democracy Spring’s organizing, Fusion Centers asserted that:

“Democracy in the context of the democracy spring protest refers to a variety of leftist socialist and democratic socialist ideologies.”[8]

Fusion Centers then conduct a detailed reading of protesters’ and organizers’ statements, which they regularly read maliciously to find, in their words, “coded language” even in groups, like Democracy Spring, that put significant effort into an attempt to manage a fully “non-violent” organizational articulation. As the Fusion Center asserted about the Democracy Spring protests:

“Although they posted a statement of nonviolence and rules for protesters, they employ potentially incendiary coded language on their website” [9]

This Fusion Center report includes detailed photos of all possible left organizations or signs related to protesters and a sinister follow-up:

“In the event any of these symbols are observed in conjunction with suspicious activity law enforcement should follow established protocols”[10]

The BlueLeaks documents show the feds spying on movement groups from the time of Obama’s presidency through Trump’s. However, under Trump the spying became much more targeted and significant.

Peaceful protests targeted as “domestic extremism”

The Fusion Centers’ own data showed the generally peaceful character of mass protests of the 15 to 26 million Americans who participated in BLM protests in 2020. This peaceful character did not stop Trump from unleashing a brutal crackdown on BLM George Floyd protesters.[11]  Unlike past responses to national protest, this crackdown was determined nationally. As documented in Movement for Black Lives’ “Struggle for Power” report, “the Trump administration deployed federal law enforcement officers to engage in domestic policing even in cities where protests had remained non-violent and local officials either outright declined that assistance or cautioned against it.”

In order to put down the 2020 BLM protests,  law enforcement arrested more than 13,643 people. The administration facilitated the deployment of 62,000 National Guard military units to more than 30 states, while imposing curfews on more than 200 American cities. More than 326 protesters faced serious federal felony charges, and at least nine people were killed in relation to the nationwide protests. Eventually Trump even took personal credit and praised the US Marshall’s targeted assassination of antifascist BLM activists, such as Michael Reinoehl in Portland, OR.

Trump has often railed against “Antifa,” and during his term he was able to get some Antifa groups branded as “terrorist.” Antifa refers to a network of left groups dedicated to confronting fascism. At this point there is no formal national antifascist organization in the US.  However, the federal government identifies some particular left organizations with Antifa, and defines some of them as “branches.” Some of these are listed in BlueLeaks and were targeted for more extensive forms of surveillance and disruption under Trump.

Authors of Fusion Center documents use an ideology of preventing “domestic extremism” almost identical to the one expounded by Trump in his Veterans Day speech. They use this to target specific protest organizations or to “assess the threat” from community groups. Some of the groups dissected and spied on in the Fusion Center documents include the Industrial Workers of the World, Revolutionary Abolitionist Movement, By Any Means Necessary, Extinction Rebellion[12], Democracy Uprising, Occupy, The Revolutionary Communist Party,[13] Democratic Socialists of America, The RNC Welcoming Committee, NAACP, Border Liberation Front, Land and Liberty,[14] The Black Panthers, and Black Lives Matter. In different reports each one of these organizations is treated as a “threat” needing “Threat Intel,” “Situational Awareness,” or “Be On The Lookout” orders to stop and engage with individuals in an attempt to contain or disrupt such organizations.

For example, as the George Floyd protests were taking off, the Fusion Center agents in Minneapolis began supplying local police with detailed notes of every protest taking place across the state. The vast majority of police agencies were receiving detailed information about timing and expected attendees from the Fusion Centers, which were compiling daily lists of protests in every corner of the country, even those as small as an 80-person “peaceful protest for BLM” or a “We Can’t Breathe” rally with 805 attendees.”[15]

They also provided detail about the movements and behaviors of protest leaders, especially of Black organizations and organizations they identified with Antifa or “extremism.” In one of these “situational awareness” reports they state:

“A Federal partner provided credible information advising that a Minneapolis-based leader of a black separatist group, XXXXXXXX, was in Minneapolis along with other members from the Black Panthers. Reports were that XXXXXX may be armed with a gun. Additional information stated that he participated in the Ferguson demonstrations.”[16]

In these “situational” reports we see that despite denials, and claims that the federal government views Antifa as an ideology, not an organization, the Fusion Centers do have criteria for defining Antifa groups and structures:

“A federal partner advised credible information was found indicating the 4th Precinct was a potential next target for violence….(because) the post belonged to the head of The General Defense Council (GDC), which is a branch of Antifa.”[17]

(This seems to be incorrectly identifying the name of the General Council of the IWW (Industrial Workers of the World) a Union, based in Minneapolis.)

At the height of the protests, Fusion Centers were targeting the communications infrastructure of many of the groups involved with the George Floyd protests. Local Fusion Centers in Minneapolis reported:

“According to the FBI, a revolutionary anti-capitalist group based in Minneapolis, MN has collected intelligence on law enforcement personnel and National Guard personnel…The group had subsections and used the Slack messaging app to pass intelligence to the Antifa portion of the group.”[18]

The Fusion Centers also use BOLOs (Be On the Lookout Orders) to go after people they refer to as “protest agitators” with targeted stops, unproven allegations and possible arrest. BOLOs generally instruct police to stop and detain people suspected of violent crimes. However, the Colorado Fusion Center sent this to all local police:

“BOLO – Potential Protest Agitators… The Colorado Information Analysis Center has learned that a bus carrying approximately 20 passengers may be transiting from Nevada to Colorado….They are traveling in a 1994 Dodge “short” school bus, bearing New York plate XXXXXX, The driver is identified as XXXXXXX and the passengers have not yet been identified.”[19]

Even in times of less intense protest against Trump than the George Floyd protests in 2020, the Fusion Centers attempt to associate left groups with “antifa terrorism.”

For example, in 2017, early into Trump’s presidency, the anti-racist organization By Any Means Necessary was a key subject of a detailed report on Antifa written by a Fusion Center partner and titled “Fighting in the Streets.” In it they identify Yvette Felarca as a leader of BAMN, which they call “an Antifa terrorist organization.” [20]

At times Fusion Centers initiate spying on the Google docs of manuals and emails from disruptive left organizations, like Extinction Rebellion (XRA). The Fusion Centers obtained XRA’s full -page organizing manual and distributed it to thousands of federal agents and cops.[21] They then reported on detailed internal infighting in XRA, such as how often Extinction Rebellion leadership meets and organizational fights between allied Extinction Rebellion groups allegedly poaching each other’s contact lists. For example, Fusion Centers issued a report stating that:

“XRA(international) gained access to XR US’s email distribution list to poach its members, which resulted in XR US deeming XRA illegitimate and encouraging all current XR members to ignore any communications from XRA, as they do not follow the demands and principles”

In Philadelphia the Fusion Center tracked leftist organizing associated with the 2020 May Day protest, including peaceful protests like workers’ strikes and nonphysical protests like boycotts and rent strikes. The Fusion Center reports:

“According to social media, Whole Foods, Amazon, Target, and Instacart workers plan on striking on May 1st. Additionally, groups are calling for a boycott of those businesses….The Philly Tenants’ Union and affiliated groups are calling for a rent strike in Philadelphia on May 1st . While this campaign largely involves forgoing rent payments, it may also include physical strikes or rallies.”

Movements must take digital security seriously

The Fusion Center documents show a small slice of the surveillance and disruption that the federal government attempted against left groups under Trump. Despite these attacks, popular left groups were successful in forcing Trump out of office. It is important that left groups take both Biden and Trump seriously and maintain capacities to maintain protests and respond to the election that are secure from illegal federal Fusion Center spying and control. For many this may require putting internal organizational communications on secure systems unconnected to the spying of advertisers. This is because ad platforms like Google (Alphabet), Meta (FB and Instagram) and Twitter/X regularly sell personal information to federal Fusion Centers.

Social media may be needed for some organizing, but times of heightened attack require platforms like Signal, Cryptpad.fr, Protonmail.com, Tor Browser. Each of these are non-profits that don’t collect or sell user data and also have security measures and privacy protections like end-to-end encryption built into them. Some organizations, like Constitutional Communications, Media Justice and The Electronic Frontier Foundation, work to assist movements with digital security and many others, like the Calyx Institute, provide privacy protecting mobile and cellular infrastructure. (Disclosure: The author is a director of Constitutional Communications)

Thankfully digital security is more widely used and effective than ever before, and this practice should be embraced by mass organizations and small radical groups alike. This combination of secure communications and disruptive protest has already been embraced by many of the Palestinian solidarity organizations. Extending this practice will assist in building disruptive left protest movements that can not only push back on Biden’s embrace of repression, but also beat Trump, and win concrete gains for the majority of working people regardless of who is elected.

[1]    Biden Remarks on recent events on college campuses, The White House,  https://www.whitehouse.gov/briefing-room/speeches-remarks/2024/05/02/remarks-by-president-biden-on-recent-events-on-college-campuses/

[2]   Project 2025 ,How Trump Loyalists and Right-Wing Leaders Are Paving a Fast Road to Fascism, PRA,

https://politicalresearch.org/2024/02/14/project-2025

[3]    For comprehensive list of the reporting on BlueLeaks see, Distributed Denial of

Secrets, “BlueLeaks: Research, https://ddosecrets.com/wiki/BlueLeaks see also Brendan McQuade, Lorax B. Horne, Zach Wehrwein & Milo Z. Trujillo (2021):The secret of BlueLeaks: security, police, and the continuum of pacification, Small Wars & Insurgencies, DOI: 10.1080/09592318.2021.2001409

[4] Office of the Director of National Intelligence, Report on Commercially Available Information https://www.dni.gov/files/ODNI/documents/assessments/ODNI-Declassified-Report-on-CAI-January2022.pdf  See also: Sara Morrison Vox.com, Jun 16, 2023,  https://www.vox.com/technology/2023/6/16/23762403/data-odni-report-wyden or The US Is Openly Stockpiling Dirt on All Its Citizens, Dell Cameron, Wired,  https://www.wired.com/story/odni-commercially-available-information-report/

[5] From “Heavy Purchasers” of Pregnancy Tests to the Depression-Prone: We Found 650,000 Ways Advertisers Label You

By Jon Keegan and Joel Eastwood  https://themarkup.org/privacy/2023/06/08/from-heavy-purchasers-of-pregnancy-tests-to-the-depression-prone-we-found-650000-ways-advertisers-label-you see also Corporate Surveillance in Everyday Life By Wolfie Christl, Cracked Labs, June 2017.https://crackedlabs.org/en/corporate-surveillance

[6] Sarah St.Vincent, The Dark Side: Secret Origins of Evidence in US Criminal Cases, Human Rights Watch (1/9/2018) https://www.hrw.org/report/2018/01/09/dark-side/secret-origins-evidence-us-criminal-cases [https://archive.fo/Wjg5e]) See also Congress’s FISA Re-Authorization Debate Ignores Illegal Law Enforcement Tactics” By Jonathan Stribling-Uss, Znetwork.org, https://znetwork.org/znetarticle/congresss-fisa-re-authorization-debate-ignores-illegal-law-enforcement-tactics/

[7] BlueLeaks, Distributed Denial of Secrets, https://ddosecrets.com/wiki/BlueLeaks. https://data.ddosecrets.com/BlueLeaks/jric/files/DDF/120217 LES Vulnerability Assessment – Vulnerability of Occupy Events to Malicious Actors.pdf

[8] BlueLeaks, Distributed Denial of Secrets, March 30th, 2016, Symbol Intelligence Group,  Democracy Spring Protest Signs and Symbols  https://data.ddosecrets.com/BlueLeaks/arictexas/files/DDF/Symbol Intelligence Group – Situational Awareness  – Democracy Spring Protest Signs and Symbols.pdf

[9] BlueLeaks, Distributed Denial of Secrets, March 30th, 2016, Symbol Intelligence Group,  Democracy Spring Protest Signs and Symbols  https://data.ddosecrets.com/BlueLeaks/arictexas/files/DDF/Symbol Intelligence Group – Situational Awareness  – Democracy Spring Protest Signs and Symbols.pdf – Situational Awareness – Democracy Spring Protest Signs and Symbols.pdf

[10] BlueLeaks, Distributed Denial of Secrets, March 30th, 2016, Symbol Intelligence Group,  Democracy Spring Protest Signs and Symbols  https://data.ddosecrets.com/BlueLeaks/arictexas/files/DDF/Symbol Intelligence Group – Situational Awareness  – Democracy Spring Protest Signs and Symbols.pdf – Situational Awareness – Democracy Spring Protest Signs and Symbols.pdf

[11] BlueLeaks, Distributed Denial of Secrets, https://data.ddosecrets.com/BlueLeaks/jric/files/DDF/171026 FOUO JRIC Bulletin – Individuals May Use Violent Tactics to Disrupt Peaceful Protests.pdf

[12] BlueLeaks, Distributed Denial of Secrets, https://data.ddosecrets.com/BlueLeaks/ciacco/files/DDF/CIAC 20-27157_FOUO_SAB_ExtinctionRebellionManual.pdf

[13] BlueLeaks, Distributed Denial of Secrets, https://data.ddosecrets.com/BlueLeaks/arictexas/files/DDF/SWTFC-LES – Situational Awareness – ANTIFA Event Notification.pdf

[14] BlueLeaks, Distributed Denial of Secrets, https://data.ddosecrets.com/BlueLeaks/jric/files/DDF/190515 FOUO FBI EIN Anarchist Extremists Very Likely Increasing Targeting of US Government Entities in Arizona, Increasing Risk of Armed Conflict.pdf

[15]  BlueLeaks, Distributed Denial of Secrets, https://data.ddosecrets.com/BlueLeaks/dediac/files/EBAT1/Special Bulletin 37-2020 – Planned Protests2.pdf

[16] BlueLeaks, Distributed Denial of Secrets, May 30th 2020, Situation Report, MACC https://data.ddosecrets.com/BlueLeaks/hcsovcp/files/EBAT1/(ULES) MACC 05302020 SitRep #8.pdf

[17] BlueLeaks, Distributed Denial of Secrets, May 30th 2020 Situation Report, MACC https://data.ddosecrets.com/BlueLeaks/hcsovcp/files/EBAT1/(ULES) MACC 05302020 SitRep #8.pdf

[18] BlueLeaks, Distributed Denial of Secrets, June, 6th 2020, Situation Report MACC, https://data.ddosecrets.com/BlueLeaks/hcsovcp/files/EBAT1/(LES) MACC 06062020 SitRep #23.pdf

[19]   BlueLeaks, Distributed Denial of Secrets, https://data.ddosecrets.com/BlueLeaks/ciacco/files/EBAT1/CIAC_20-28130 LES_OFFICER SAFETY_BOLO_Protest_Agitators.pdf

[20]  BlueLeaks, Distributed Denial of Secrets, https://data.ddosecrets.com/BlueLeaks/dediac/files/EBAT1/ANTIFA – Fighting in the Streets.pdf

[21]  BlueLeaks, Distributed Denial of Secrets, https://data.ddosecrets.com/BlueLeaks/ciacco/files/DDF/CIAC 20-27157_FOUO_SAB_ExtinctionRebellionManual.pdf   See Also https://data.ddosecrets.com/BlueLeaks/ciacco/files/DDF/Appendix to CIAC 20-27157_FOUO_ExtinctionRebellion_RebellionManual (1).pdf

Jonathan Stribling-Uss, is the director of Constitutional Communications, an organization that specializes in information security for professionals and civil society organizations. He was a Mozilla and Ford Foundation Media and Democracy Fund Technologist Fellow in the Policy Department of the New York Civil Liberties Union (NYCLU), where he served as a technology expert providing oral and written public testimony to the New York City Council about the risks to undocumented people of adding surveillance technology to the New York City Municipal ID (NYCID). His work has been featured in The ABA Journal, ZNet, The Indypendent, NY Magazine, and The New York Law Journal.

Surveillance and Civil Liberties