DHS’s risk-based approach reflects a broader shift in US law enforcement shaped by post-9/11 security priorities—one that elevates perceived intent over demonstrable wrongdoing and uses behavior cues, affiliations, and other potentially predictive indicators to justify early intervention and expanded surveillance.

A year ago, DHS warned that immigration-related grievances were driving a spike in threats against judges, migrants, and law enforcement, predicting that new laws and high-profile crackdowns would further radicalize individuals. In February, another fusion center reported renewed calls for violence against police and government officials, citing backlash to perceived federal overreach and identifying then-upcoming protests and court rulings as likely triggers.

At times, the sprawling predictions may appear prescient, echoing real-world flashpoints: In Alvarado, Texas, an alleged coordinated ambush at a detention center this week drew ICE agents out with fireworks before gunfire erupted on July 4, leaving a police officer shot in the neck. (Nearly a dozen arrests have been made, at least 10 on charges of attempted murder.)

In advance of protests, agencies increasingly rely on intelligence forecasting to identify groups seen as ideologically subversive or tactically unpredictable. Demonstrators labeled “transgressive” may be monitored, detained without charges, or met with force.

Social movement scholars widely recognize the introduction of preemptive protest policing as a departure from late-20th century approaches that prioritized de-escalation, communication, and facilitation. In its place, authorities have increasingly emphasized control of demonstrations through early intervention, surveillance, and disruption—monitoring organizers, restricting public space, and responding proactively based on perceived risks rather than actual conduct.

Infrastructure initially designed to combat terrorism now often serves to monitor street-level protests, with virtual investigations units targeting demonstrators for scrutiny based on online expression. Fusion centers, funded through DHS grants, have increasingly issued bulletins flagging protest slogans, references to police brutality, and solidarity events as signs of possible violence—disseminating these assessments to law enforcement absent clear evidence of criminal intent.

Surveillance of protesters has included the construction of dossiers (known as “baseball cards”) with analysts using high-tech tools to compile subjects’ social media posts, affiliations, personal networks, and public statements critical of government policy.

Obtained exclusively by WIRED, a DHS dossier on Mahmoud Khalil, the former Columbia graduate student and anti-war activist, shows that analysts drew information from Canary Mission, a shadowy blacklist that anonymously profiles critics of Israeli military action and supporters of Palestinian rights.

In federal court Wednesday, a senior DHS official acknowledged that material from Canary Mission had been used to compile more than 100 dossiers on students and scholars, despite the site’s ideological slant, mysterious funding, and unverifiable sourcing.

Threat bulletins can also prime officers to anticipate conflict, shaping their posture and decisions on the ground. In the wake of violent 2020 protests, the San Jose Police Department in California cited the “numerous intelligence bulletins” it received from its local regional fusion center, DHS, and the FBI, among others, as central to understanding “the mindset of the officers in the days leading up to and throughout the civil unrest.”

Specific bulletins cited by the SJPD—whose protest response prompted a $620,000 settlement this month—framed the demonstrations as possible cover for “domestic terrorists,” warned of opportunistic attacks on law enforcement and promoted an “unconfirmed report” of U-Haul vans purportedly being used to ferry weapons and explosives.

Subsequent reporting in the wake of BlueLeaks—a 269-gigabyte dump of internal police documents obtained by a source identifying as the hacktivist group Anonymous and published by transparency group Distributed Denial of Secrets—found federal bulletins riddled with unverified claims, vague threat language, and outright misinformation, including alerts about a parody website that supposedly paid protesters and accepted bitcoin to set cars on fire, despite a clear banner labeling the site “FAKE.”

Threat alerts—unclassified and routinely accessible to the press—can help law enforcement shape public perception of protests before they begin, laying the groundwork to legitimize aggressive police responses. Unverified DHS warnings about domestic terrorists infiltrating demonstrations in 2020, publicly echoed by the agency’s acting secretary on Twitter, were widely circulated and amplified in media coverage.

Americans are generally opposed to aggressive protest crackdowns, but when they do support them, fear is often the driving force. Experimental research suggests that support for the use of forces hinges less on what protesters actually do than on how they’re portrayed—by officials, the media, and through racial and ideological frames.