President Trump and the Secret Service have experienced more than a 40% increase in protective intelligence threat cases this year. That increase is due in part to social media, lone actors, foreign threats, ideological grievances and a surge in mental health-related cases.
For the Secret Service, that translates into a more complex threat environment that must be monitored, assessed and addressed every day.
While the increase has captured headlines, the public rarely sees what happens after a threat is reported. Every protective intelligence case begins with one objective: determine whether a person has the intent and capability to carry out violence — and intervene before that threat reaches a protectee.
Today, threats have evolved and are often made anonymously online, making them more difficult to identify, assess and track.
Protective intelligence starts long before an event
Protective intelligence threat cases are best handled through the identification, investigation and intervention of a threat before it becomes a kinetic action at a Secret Service-protected event.
Protective intelligence drives much of the Secret Service’s protective methodology and mitigation measures. Every protective mission includes a protective intelligence advance component.
That advance component works with other intelligence and federal agencies, as well as state and local law enforcement, to assess and understand the local threat environment that could affect a Secret Service-protected site. The same process occurs overseas, where the State Department’s Diplomatic Security Service and foreign intelligence and law enforcement agencies help assess localized threat information.
How a threat investigation begins
Typically, when a threat is reported, the Secret Service Protective Intelligence Division receives and assesses it.
The first step is checking the agency’s internal Protective Threat Management System (PTMS), which maintains historical and active threat case information. Investigators compare the new threat against previous cases to determine whether it is consistent with a known individual, group or prior behavior pattern.
An investigation then includes criminal, intelligence and database searches, information obtained from social media or online providers, and interviews with people in the subject’s orbit, including medical and mental health providers and, most importantly, local and state law enforcement agencies that may already have history with the individual.
This process helps investigators build a more complete picture of the person or group involved. In cases involving foreign actors, it also helps determine whether another intelligence agency is already investigating the individual or organization.
Why local law enforcement is essential
For the Secret Service, collaboration with local and state agencies is imperative. Those agencies are often closest to the individual who made the threat and are best positioned to respond, assess the situation and gather information under the guidance of a Secret Service protective intelligence investigation.
This coordination helps ensure everyone is working from the same investigative approach while paying attention to the nuanced behavioral indicators that are often critical in protective intelligence cases. It also gives investigators access to local information that may never appear in a federal database. Together, those efforts create a much more complete picture of an individual or group.
Local agencies also help determine whether a threat is credible or whether it stems from a mental health crisis, intoxication or another behavioral incident. In those cases, they can work with the Secret Service to determine the most appropriate response, whether that involves a mental health commitment, arrest or prosecution.
Recent cases show the process in action
A recent Illinois case illustrates how the Secret Service works with local agencies to quickly investigate and mitigate potential threats.
The suspect was arrested by the Secret Service and a Lake County SWAT team after posting a video stating that President Trump should be executed. The case demonstrated how federal and local agencies can rapidly coordinate to investigate a potential threat before it escalates.
If a threat is determined to be actionable, the Secret Service Advanced Threat Interdiction Unit may become involved. The unit brings together the agency’s investigative assets and resources, enabling it to rapidly investigate and mitigate emerging threats.
The recent UFC drone threat investigation provides another example.
The rapidly evolving case involved the Advanced Threat Interdiction Unit working with multiple federal, state and local agencies. The Secret Service managed the investigation while collaborating with partner agencies to identify the suspects, gather localized information and mitigate the threat before it reached the event.
It was another example of how protective intelligence depends on close coordination across multiple agencies.
An evolving mission
As threats continue to evolve, so does the Secret Service’s protective intelligence missio
n. Rising threat volumes, increasingly anonymous online activity and complex behavioral investigations require close coordination between the Secret Service and its federal, state and local partners.
Protective intelligence has always been about preventing attacks before they occur. As today’s threat environment grows more challenging, that mission increasingly depends on strong partnerships that help investigators identify, assess and mitigate threats before they ever reach a protectee.
| WATCH: The creation and evolution of the FBI
