RSG #340: How To Investigate Intelligence Bulletins About Lawful Protesters

Law enforcement agencies sometimes create intelligence bulletins before demonstrations, marches, strikes, public meetings, and political actions. A legitimate bulletin may address a documented threat, planned violence, traffic control, emergency access, or credible risks to participants.

The problem begins when an agency treats lawful political activity as intelligence simply because officials dislike the politics, fear criticism, or become emotionally unsettled by people holding signs in public.

An August 2026 investigation by 404 Media found that government surveillance centers monitored online opposition to automated license plate readers and warned police about planned DeFlock events. The reported activity included lawful political organizing, information sessions, and marches.

This Resistance Survival Guide explains how to locate intelligence bulletins, identify who created them, reconstruct their evidence, trace their distribution, and determine whether officials documented an actual public safety concern or merely placed civic participation inside a suspicious looking PDF.

What Counts as an Intelligence Bulletin

The document may be called an intelligence bulletin, situational awareness report, officer safety notice, event assessment, threat assessment, intelligence note, protest update, special event report, daily intelligence summary, information sharing report, or public safety advisory.

It may originate with a police intelligence unit, fusion center, Joint Terrorism Task Force, state police agency, emergency operations center, homeland security office, university police department, private contractor, or federal agency.

Some bulletins remain restricted to law enforcement. Others travel through mailing lists, intelligence portals, task forces, emergency management systems, or informal email chains. A bulletin created by one analyst can influence patrol assignments, surveillance, database entries, interviews, vehicle stops, and future reports across several jurisdictions.

Government loves information sharing right up until the public asks what was shared.

Lawful Monitoring and Protected Activity

The First Amendment protects speech, peaceful assembly, association, religion, press activity, and petitioning the government. Police may prepare for legitimate safety concerns surrounding a public event. However, participation in a protest does not automatically establish reasonable suspicion of criminal conduct.

For criminal intelligence systems covered by 28 CFR Part 23, agencies generally may retain information about an individual only when reasonable suspicion connects that person to criminal activity and the information is relevant to that activity. The regulation also restricts collecting or maintaining information about political, religious, or social views and associations unless it directly relates to suspected criminal conduct.

Not every police record or intelligence system falls under that regulation. State law, local policy, federal guidance, court orders, consent decrees, and agency rules may provide additional protections.

The central question is not whether police knew a protest would happen. The question is what they collected, why they collected it, how they described participants, where the information traveled, and what officials did with it.

Step by Step Guide

Step One: Identify the Event and Every Involved Agency

Record the event name, location, date, organizer, stated purpose, permits, announced route, participating groups, police presence, arrests, and known government response.

List every likely agency, including local police, sheriff, state police, transit police, university police, emergency management, fusion centers, homeland security offices, and federal task forces.

Do not assume the uniform visible at the protest identifies the agency writing the intelligence. The author may be sitting several counties away with six monitors and a heroic opinion of keyword searches.

Step Two: Search for the Bulletin

Search public records portals, council packets, police transparency pages, court filings, civil rights litigation, leaked document archives, and independent reporting.

Use the event name with terms such as bulletin, assessment, situational awareness, threat, intelligence, protest, demonstration, civil disturbance, special event, officer safety, and public order.

Search distinctive phrases from public statements or police briefings. Government documents are frequently copied into emails, operational plans, and later reports even when the original bulletin remains hidden.

Step Three: Request the Complete Document Family

Request the bulletin and every draft, attachment, source note, cover email, distribution list, revision, correction, approval record, and withdrawal notice.

Ask for the original electronic format when possible. Metadata may identify the author, creation date, editing history, file name, and software used.

A polished final bulletin can hide uncertainty that appeared in earlier drafts. “No verified threat” has a curious habit of disappearing during management review.

Step Four: Identify the Author and Approval Chain

Record the author, analyst, supervisor, issuing office, approving official, and agency responsible for the document.

Request applicable training records, job descriptions, analytical standards, review procedures, and records showing whether a privacy or civil liberties officer examined the bulletin.

Determine whether the author relied on independent analysis, another agency, a vendor, an informant, social media monitoring, or an earlier bulletin. Intelligence copied from intelligence is not corroboration. It is a government group chat.

Step Five: Reconstruct Every Source

Create a table listing each factual claim and the source cited for it. Locate the original post, article, video, police report, tip, public announcement, or previous assessment.

Check whether the bulletin preserved context. Distinguish an organizer’s statement from a stranger’s reply, a confirmed plan from online speculation, and protected rhetoric from a credible threat.

Record claims with no identifiable source. Anonymous sourcing may occasionally be necessary, but a bulletin should still explain reliability, relevance, and corroboration without exposing a protected source.

Step Six: Compare the Bulletin With What Actually Happened

Build a timeline using organizer announcements, permits, public video, dispatch logs, arrest records, court files, independent reporting, and official incident reports.

Compare predicted threats with documented outcomes. Record violence, property damage, medical emergencies, arrests, charges, dismissed cases, and peaceful activity.

Do not treat the absence of violence as proof that the bulletin was improper. Preparation may prevent harm. Instead, examine whether the original claims had a factual basis and whether officials corrected the record afterward.

Step Seven: Examine the Language

Highlight labels such as extremist, radical, agitator, anarchist, domestic threat, outside actor, anti government, or suspicious.

Determine whether the bulletin defines those terms and connects them to specific conduct. Look for political opinions presented as risk indicators, symbols treated as evidence, and lawful organizing described in criminal language.

A tactical heading does not convert a criticism of police technology into a terrorism plot. Fonts remain tragically powerless under constitutional law.

Step Eight: Trace Surveillance Before the Event

Request search terms, monitored accounts, keyword alerts, geographic searches, undercover account approvals, screenshots, watchlists, and communications with private surveillance vendors.

Determine whether analysts monitored public announcements or collected identities, relationships, photographs, vehicle information, and personal histories about participants.

Ask when monitoring began, who authorized it, what investigative purpose was recorded, and when collection was supposed to end.

Step Nine: Map the Distribution Network

Request every recipient, portal, mailing list, task force, private partner, and agency that received the bulletin.

Determine whether recipients downloaded, forwarded, edited, or entered information into other systems. Ask whether the bulletin reached schools, employers, military offices, federal agencies, private security companies, or immigration authorities.

One local report can acquire a federal afterlife long after the folding tables and protest signs have gone home.

Step Ten: Trace Operational Consequences

Request records showing how the bulletin affected staffing, patrols, surveillance, equipment, road closures, interviews, traffic stops, arrests, database entries, or communications with organizers.

Compare the response with similar events involving different political views. A stronger response may reflect genuine differences in risk. It may also reveal selective treatment.

Document the connection carefully. Timing alone is not proof. Look for orders, briefings, emails, operational plans, and testimony connecting the bulletin to government action.

Step Eleven: Examine Retention and Correction

Request retention schedules, review dates, purge logs, correction procedures, database policies, and records showing whether inaccurate information was amended or recalled.

Under 28 CFR Part 23, covered systems must follow rules concerning information quality, dissemination, review, and destruction. Other systems may operate under different requirements, so identify the exact database before applying a legal standard.

Ask whether every recipient received the correction. Fixing the original file does little when twenty agencies saved the inaccurate version.

Step Twelve: Publish Without Expanding the Surveillance

Separate confirmed facts, agency claims, disputed statements, reasonable inferences, and unanswered questions.

Publish the issuing agency, event, stated threat, supporting evidence, distribution, operational consequences, retention, and documented inaccuracies.

Protect private individuals who committed no crime. Redact addresses, telephone numbers, private account information, medical details, and unnecessary identifying information.

The investigation should expose government surveillance. It should not provide the bulletin with a larger and more enthusiastic distribution list.

Red Flags That Demand Closer Review

Major warning signs include no documented criminal predicate, political beliefs treated as threat indicators, unsupported extremist labels, monitoring that began before any reported danger, and lawful organizers placed in intelligence databases.

Other concerns include missing source records, social media posts stripped of context, surveillance vendors shaping the assessment, bulletins distributed beyond law enforcement, no expiration date, no correction process, and reports that predict violence but remain unchanged after events conclude peacefully.

A bulletin can also create its own evidence loop. One agency repeats another agency’s unsupported claim. A third agency cites both reports. By lunchtime, an unverified statement has acquired three logos and a security marking.

Turning the Findings Into Accountability

Send documented findings to civil liberties groups, public defenders, inspectors general, legislative oversight bodies, privacy commissions, independent journalists, and affected organizers.

Ask the issuing agency to publish its intelligence standards, approval process, retention rules, correction procedures, aggregate protest monitoring statistics, and audits involving protected activity.

Recommend a documented criminal predicate, supervisory approval, source verification, short retention periods, mandatory corrections, recipient recall notices, and independent review of bulletins involving political or religious activity.

Public safety planning does not require building secret dossiers on people who criticize the government. If an agency has evidence of a threat, it should document the evidence. If it has only political discomfort, it can purchase a journal.

Closing RK Thoughts

An intelligence bulletin can influence how hundreds of officers perceive a demonstration before the first participant arrives. Unsupported labels can shape surveillance, enforcement, media statements, and future intelligence records.

That power demands evidence, context, necessity, and oversight.

Find the bulletin. Reconstruct the sources. Trace the recipients. Measure the consequences. Then determine whether officials identified a genuine threat or simply became alarmed that citizens were exercising the rights officials swore to protect.

Resistance Kitty supports careful public safety planning. She merely objects when the government files peaceful dissent under suspicious because democracy made somebody nervous.