ON A FREEZING NIGHT in November, as police sprayed nonviolent Dakota Access Pipeline opponents with water hoses and rubber bullets, representatives of the FBI, the Bureau of Indian Affairs, North Dakota’s U.S. Attorney’s Office, and local law enforcement agencies frantically exchanged emails as they monitored the action in real time.

“Everyone watch a different live feed,” Bismarck police officer Lynn Wanner wrote less than 90 minutes after the protest began on the North Dakota Highway 1806 Backwater Bridge. By 4 a.m. on November 21, approximately 300 water protectors had been injured, some severely. Among them was 21-year-old Sophia Wilansky, who nearly lost her arm after being hit by what multiple sworn witnesses say was a police munition.

The emails exchanged that night highlight law enforcement efforts to control the narrative around the violent incident by spreading propaganda refuting Wilansky’s story, demonstrate the agencies’ heavy reliance on protesters’ social media feeds to monitor activities, and reveal for the first time the involvement of an FBI informant in defining the story police would promote.

The exchange is included in documents obtained by The Intercept that reveal the efforts of law enforcement and private security contractors to surveil Dakota Access Pipeline opponents between October and December 2016, as law enforcement’s outsized response to the demonstrators garnered growing nationwide attention and the number of water protectors living in anti-pipeline camps grew to roughly 10,000. Although the surveillance of anti-DAPL protesters was visible at the time — with helicopters circling overhead, contingents of security officials watching from the hills above camp, and a row of blinding lights illuminating the horizon along the pipeline’s right of way — intelligence collection largely took place in darkness.

---

Support Media for the People! Rise Up Times needs your support to continue to bring you independent analysis and significant commentary about current issues. Learn more about Rise Up Times.

---

In addition to the email communications, The Intercept is publishing 15 internal situation reports prepared by the private security firm TigerSwan for its client, Dakota Access parent company Energy Transfer Partners, as well as three PowerPoint presentations that TigerSwan shared with law enforcement. The documents are part of a larger set that includes more than 100 internal TigerSwan situation reports that were leaked to The Intercept by one of the company’s contractors and more than 1,000 Dakota Access-related law enforcement records obtained via public records request.

Last week, The Intercept published an exclusive report detailing TigerSwan’s sweeping enterprise, over nine months and across five states, which included surveillance of activists through aerial technology, social media monitoring, and direct infiltration, as well as attempts to shift public opinion through a counterinformation campaign. The company, made up largely of special operations military veterans, was formed during the war in Iraq and incorporated its counterinsurgency tactics into its effort to suppress an indigenous-led movement centered around protection of water.

An image of a gorilla overseeing the Standing Rock camp appears in an October 18, 2016, daily intelligence update the private security firm TigerSwan circulated to law enforcement.   Photo: Daily Intelligence Updates

Federal Agencies Circulate Dubious Theories

Roughly eight hours prior to Sophia Wilansky’s injury, Bismarck police officer Lynn Wanner — who, records indicate, acted as a liaison between intelligence agencies and field officers throughout the anti-DAPL protests — alerted local, state, and federal law enforcement partners that an “FBI inside source” was “reporting propane tanks inside the camp rigged to explode.” Wanner’s email about the FBI informant echoes the story the Morton County Sheriff’s Department would later tell journalists about Wilansky’s injury.

“We probably should be ready for a massive media backlash tomorrow although we are in the right. 244 angry voicemails received so far,” wrote Ben Leingang, a North Dakota state official, at about 10 p.m. on November 20. By morning, images of Wilansky’s severely injured arm were circulating online.

TigerSwan fretted about the backlash, too. “Protesters are claiming over 100 injuries associated with the demonstration and will surely contort video of the event into anti-DAPL propaganda,” the security firm noted in its internal report that next morning.

As another day passed, U.S. Attorney’s Office National Security Intelligence Specialist Terry Van Horn sent an email to members of various federal agencies noting the FBI’s claim that “a source from the camp reported people were making IED’s from small Coleman type propane canisters.” Van Horn added that Wilansky “was witnessed throwing an IED while on the bridge, it detonated early and caused the below injuries (see graphic photos).”

Less than an hour later, Van Horn emailed to the thread the text of a Facebook post from the page Netizens for Progress and Justice. “This wasn’t caused by law enforcement, it was caused by dumbass ‘direct action’ protesters that think they are doing the right thing without any consideration for the safety and welfare of honest protesters nearby that are caught up in things,” the post read, going on to describe a theory of the injury that conflicted even with law enforcement’s propane tank theory.

“How can we get this story out?” replied Maj. Amber Balken, a public information officer for the National Guard, which was also involved in policing the protests. “This is a must report,” Balken added, suggesting the name of a local conservative blogger. Cecily Fong, a public information officer with the North Dakota Department of Emergency Services, replied by promising to “get with” the blogger to circulate the article.

As The Intercept reported last week, Netizens for Progress and Justice also frequently published content produced on behalf of TigerSwan, including videos critical of pipeline opponents. Fong declined to comment on the exchange. Neither Van Horn nor Balken replied to a request for comment. The FBI declined to comment on any involvement it had in the protests, and the Bureau of Indian Affairs did not respond to a request for comment.

Ultimately, police promoted a story about the incident that echoed the claims of the FBI informant. On November 22, the Morton County Sheriff’s Department distributed press releases implying that Wilansky’s injury had been caused by a protester’s IED.

The Intercept reached Lauren Regan, an attorney representing Sophia Wilansky, and read the text of Van Horn’s email to her over the phone. “So much of it is totally factually incorrect,” Regan said.

“There has never been any evidence I have seen or heard of that gave any credibility to the allegation that propane tanks were being rigged as explosive devices,” continued Regan, who is a staff attorney at the Oregon-based Civil Liberties Defense Center. “To me, the timing of that revelation, in light of their having just basically blown a white woman’s arm off, always seemed extremely dubious.”

Sophia Wilansky’s father, Wayne Wilansky, agreed that “there’s not a shred of truth” to Van Horn’s account of Wilansky’s injury. “Obviously, disinformation is a major component of how they dealt with the protests,” he told The Intercept.

A water protector loads up on goggles and milk of magnesia in anticipation of a confrontation with police as she prepares to cross the bridge to Turtle Island at Standing Rock on Nov. 24, 2016, during an ongoing dispute over the building of the Dakota Access Pipeline.  Photo: Jessica Rinaldi/The Boston Globe/Getty Images

Surveillance Reports Paint Protesters as Desperate and Deviant

The internal situation reports from around the time of Wilansky’s injury contain their own examples of disinformation, invasive intelligence-gathering practices, and a fixation on the purported violence of DAPL’s opponents. At times, TigerSwan refers explicitly to informants and infiltrators. A document from October 3, for example, explains the ways the company monitored members of the American Indian Movement “mostly through social media” and “informant collection” in order to gauge the effectiveness of their security practices and “develop possible counter-measures moving forward.”

The documents, four of which were first published by Grist, include the names of dozens of pipeline opponents, labeling some as “persons of interest.” They describe meetings with law enforcement, including campus police at the University of Illinois and Lincoln Land College, as well as TigerSwan’s attempts to pressure officers into more aggressive action against protesters.

In the reports, TigerSwan declares success in accessing hard-to-find Facebook content, noting in an October 10 document, “The social media cell has harnessed a URL coding technique to discover hidden profiles and groups associated with the protesters.”

But TigerSwan’s intelligence was far from perfect and its interpretation of events was frequently off. For example, one document referenced a shell necklace that, TigerSwan speculated, marked members of the Mississippi Stand group who “have been arrested for the cause.” Mississippi Stand member Alex Cohen told the Intercept that the necklaces had nothing to do with arrests and were merely gifts given to a number of members by people indigenous to the area of one of their camps.

Overall, TigerSwan depicted the situation on the ground as volatile, at times painting the anti-pipeline camps as rife with drug use and “sexual deviance,” its inhabitants likely to stir violence. The security company found ways to interpret even the most benign social gatherings as potentially dangerous. One document previewed a casino concert featuring Jackson Browne and Bonnie Rait, fretting that it would draw “numerous outside influencers.” The document predicted, “Depending on the progress of drilling by then, the project could be adversely affected if not counter measured.”

After November 8, TigerSwan noted that “the election of President-elect Trump is likely to have a positive effect for the project overall and cooperation from the Federal level will likely improve after 20 JAN.” At the same time, TigerSwan commented on protesters’ post-election “despair,” writing on November 12 that “the DAPL protesters are inherently desperate and are not looking for a peaceful solution regarding the Dakota Access Pipeline (DAPL) in turn we can expect this situation to become more volatile than it has ever become before.”

On November 13, TigerSwan again insisted on the likelihood of violence erupting. “Most locals are now carrying weapons to protect themselves, their families and their property,” that report notes. “They have also expressed frustration with what they see as a lack of action by law enforcement.” Around the same time, TigerSwan and law enforcement expressed concerns about the impact the death of a protester might have on the pipeline project. “The use of force or death of a protester or rioter will result in the immediate halt to DAPL operations, which will likely permanently halt the entire project,” the PowerPoint presentations TigerSwan shared with law enforcement warned.

Weeks later, the Obama administration would deny the pipeline company a key federal permit, putting construction on hold. In January, President Donald Trump revived the project. The pipeline began service to customers last Thursday.

Fusion Centers and the “Surveillance-Industrial Complex”

The email chain from the night of the Backwater Bridge incident and other documents represent detailed illustrations of the work of a so-called fusion center. In 2007, President George W. Bush signed the 9/11 Commission Act, which allocated $300 million to the Department of Homeland Security for the establishment of fusion centers, originally intended to facilitate sharing of anti-terrorism intelligence among different state, local, and federal law enforcement agencies. According to the DHS website, there are currently 77 fusion centers nationwide, with every state home to at least one.

Brendan McQuade, an assistant professor of sociology at the State University of New York, Cortland, who is working on a book on fusion centers, said the records pertaining to the North Dakota State and Local Intelligence Center’s monitoring and repression of Standing Rock demonstrations offer unique insight into how fusion centers are used for political repression. “We’ve seen hints of this monitoring of the online presence of Black Lives Matter and Occupy protests, but never such explicit evidence of it as in the documents you’ve collected,” he told The Intercept after reviewing a selection of the documents.

According to former FBI Special Agent Michael German, who is now with the Brennan Center for Justice at New York University Law School, fusion centers have become part of a broader “surveillance-industrial complex” in which security agencies and the corporate sector merge together in a frenzy of mass information gathering, tracking, and surveillance. Federal support for fusion centers is predicated on increased government access to “non-traditional information sources,” he notes. And one of the goals of fusion centers is to protect the nation’s critical infrastructure, 85 percent of which is owned by private interests.

“The insidious thing is that the role of private-sector entities in fusion centers has grown up without any specific legislation authorizing it,” said German, who co-authored a 2007 report on behalf of the ACLU called “What’s Wrong with Fusion Centers?” “Instead, the development of these techniques and relationships, such as the one involving TigerSwan and North Dakota law enforcement, has occurred within the closed-off world of law enforcement.”

Legal Ambiguity

TigerSwan’s status as a private company has enabled it to operate with virtually no transparency or oversight. The North Dakota Private Investigation and Security Board confirmed in an email to The Intercept this week that TigerSwan still has not obtained a license to work as a private security firm in the state despite nine months on the ground. The company’s close collaboration with law enforcement, to which it has regularly fed intelligence, raises serious questions.

“The line between private security and law enforcement at DAPL has been nonexistent,” Bruce Ellison of the National Lawyers Guild, who also works with the Water Protector Legal Collective, told The Intercept. “They have been one in the same.”

Still, it’s not clear that either TigerSwan or law enforcement crossed a legal line with their surveillance activities. Private companies have few obligations to protect constitutional rights to free speech, association, or privacy. And while public agencies, including law enforcement, do have that obligation, they also have ample leeway to operate in invasive and unethical ways that are nonetheless legal. As The Intercept reported in January, detailed guidelines govern the FBI’s activities involving confidential informants and covert online work. But the guidelines are filled with loopholes that ultimately allow FBI agents to spy on just about anybody if they get the right approvals.

If TigerSwan were meeting regularly enough with the FBI, acting at the bureau’s behest, or even simply feeding agents information, it could represent an end-run around FBI rules. However, as Ramzi Kassem, a law professor at the City University of New York School of Law who directs the Creating Law Enforcement Accountability & Responsibility (CLEAR) project, put it, “The guidelines are one thing, but the legal baseline for what’s constitutional and what’s not constitutional is another.”

To a large degree, unless they were found to be acting at the direction of government, TigerSwan’s agents would likely be held to similar standards as regular citizens, their most likely violations being things like trespassing.

Despite the legal ambiguity, TigerSwan’s actions raise questions. “You have these privatized actors that are performing what are commonly understood to be government functions — whether or not we’ve agreed that these are acceptable government functions,” said Kassem. “Private corporations are taking these actions on a scale that is unheard of before — this isn’t your local private eye investigative service, we’re talking about tactics that the military uses overseas.”

“We need to be looking at whether our laws are sufficient to protect political groups from disruption, interference, and a tax by people who are infiltrating or surveilling their activities,” said Kris Hermes, an author and activist who has worked for years providing legal support at protests as a member of the National Lawyers Guild. “What it has done is thrown a chilling blanket over political organizing today whereby everybody feels that they should be engaging in some kind of security culture to avoid the snooping of law enforcement or private security firms. That has a far-reaching effect that I don’t think is appreciated enough. It prevents people from engaging effectively in First Amendment activity.”

Modern-Day Pinkertons

The privatization of law enforcement and its subjugation to corporate interests are hardly a novelty, though the increased militarism of the domestic policing of dissent has taken on sinister overtones in the wake of the so-called global war on terror.

In the late 19th century, Allan Pinkerton’s National Detective Agency offered private detective and security services to public and corporate clients. The “Pinkertons,” as they were known, relied heavily on undercover agents and often acted as agents provocateur, triggering violence as much as they engaged in surveillance and propaganda.

Through their involvement as armed guards during labor conflicts, the Pinkertons “became a shorthand for the abusive power of unchecked capitalism,” Paul O’Hara, a history professor at Xavier University who wrote a book about them, told The Intercept. To workers, the Pinkertons were “hired thugs for capital” and “a symbol of corporate power,” he wrote. Their activities led to two congressional investigations and the Anti-Pinkerton Act of 1893, which barred the federal government from contracting with the Pinkertons and similar groups. But the act largely failed in its intent, and the Pinkertons set the stage for public partnerships with mercenary groups continuing to this day.

TigerSwan never responded to The Intercept’s repeated requests for comment, oscillating instead between following and blocking these reporters on Twitter. The company did, however, retweet a comment by a reader of The Intercept. He had called TigerSwan “modern day Pinkertons.”

Documents published with this story:

• Law Enforcement Email Thread 2016-11-22

• Intel Group Email Thread 2016-11-20

• Shared Daily Intelligence Update 2016-10-20

• Shared Daily Intelligence Update 2016-10-19

• Shared Daily Intelligence Update 2016-10-18

• Internal TigerSwan Situation Report 2016-12-21

• Internal TigerSwan Situation Report 2016-11-21

• Internal TigerSwan Situation Report 2016-11-19

• Internal TigerSwan Situation Report 2016-11-18

• Internal TigerSwan Situation Report 2016-11-17

• Internal TigerSwan Situation Report 2016-11-13

• Internal TigerSwan Situation Report 2016-11-12

• Internal TigerSwan Situation Report 2016-11-11

• Internal TigerSwan Situation Report 2016-11-10

• Internal TigerSwan Situation Report 2016-11-09

• Internal TigerSwan Situation Report 2016-11-08

• Internal TigerSwan Situation Report 2016-11-07

• Internal TigerSwan Situation Report 2016-11-06

• Internal TigerSwan Situation Report 2016-10-10

• Internal TigerSwan Situation Report 2016-10-03

The Intercept has redacted the names of persons identified in internal TigerSwan and public documents unless those persons have directly communicated their willingness to be included. The names of senior TigerSwan and law enforcement personnel have not been redacted. To search all TigerSwan documents published by The Intercept, go to the TigerSwan project page on DocumentCloud.

Correction: June 3, 2017
This story has been updated to correct Brendan McQuade’s title and the spelling of his name.

PART 3 IS COMING SOON