EXPERT Q&A – As the FBI investigates the reasons why 20-year-old suspect Thomas Matthew Crooks may have targeted former president Donald Trump at a campaign rally in Pennsylvania on Saturday night, largely uninformed social media speculation is driving a dangerous narrative intended to exploit existing political divides.
“The lethality of the anti-government, anti-authority movement has really increased on both sides, and I think that is showing in this attack,” former FBI Executive Assistant Director Jill Sanborn told The Cipher Brief just hours after the attack. “Unfortunately, while I’m a little bit shocked, this attack also corroborates what we’ve been seeing.”
The Cipher Brief spoke with Sanborn and her husband, retired FBI Agent Mike Sanborn – who was a lead investigator on an attempted assassination of then-President Barack Obama at the White House in 2011. We asked them both about Saturday’s attack, the FBI’s investigative responsibilities and how we should be thinking about what may be coming on the domestic terrorism front.
The Cipher Brief: The FBI is doing a deep-dive into the suspect’s background, trying to determine what may have prompted him to do something like this. How do all the agencies come together to do this quickly?
Jill Sanborn: You can’t understate the power of the partnerships and the importance of the task force environment in today’s law enforcement community. Everybody often thinks of the Joint Terrorism Task Forces (JTTF) when something like this happens, but it really transcends all threats. I think what you’ll see in this investigation is the power of those task forces. Everybody brings a unique capability or a unique database to the game. You’ll also see a lot of state and local partners and a lot of federal agencies working together to support the investigation here.
And you hit the nail on the head here when you said they are focused on the shooter’s background. That is priority, both for the Secret Service, who’s now asking, ‘How do we move forward and make sure that our candidate, our protectee, is protected given today’s environment? and then, the FBI, which will be the organization responsible for the actual investigation, is looking at who the shooter is. Does he have friends and associates? Is there a bigger threat out there? Is this a movement or is this a lone offender?
So, those will be things that are paramount in the FBI and its partners’ minds right now. And all that’ll be done with search warrants, and social media scrubs, and interviewing family, friends, associates. This will be sort of all people on deck to get to the bottom of this for sure.
The Cipher Brief: A 24/7 operation?
Jill Sanborn: 100%. You’ll see that both in field offices and at headquarters where they set up command posts focused only on this incident.
Mike Sanborn: This is the biggest case in the FBI right now. I was a lead on the assassination attempt against former President Barack Obama in 2011. So, I’m pretty well-versed in this. This is now the FBI’s jurisdiction.
Jill Sanborn: You also have a secondary investigation of a law enforcement shooting there that’s also going to have to be happen which occurs anytime a law enforcement officer engages their weapon, that investigation kicks off too. So, you really will have two entities trying to do two similar things with preserving the crime scene and interviewing witnesses.
Mike Sanborn: One of the first things you do in a situation like this – once the scene has been secured – is to start ballistically recovering the bullets and other evidence. When the shooter on November 11, 2011, fired 13 shots into the White House from the Ellipse, which is south of the White House, we had to secure the White House and conduct a crime scene investigation there. We actually found a bullet six months later that had skipped over the White House and had landed on the roof of a church. This is going to be a long, arduous process that’s not going to happen overnight. This is going to take weeks.
It’s not just for the President anymore. Are you getting your daily national security briefing? Subscriber+Members have exclusive access to the Open Source Collection Daily Brief, keeping you up to date on global events impacting national security. It pays to be a Subscriber+Member.
Jill Sanborn: And the first inclination is to assume that there are others out there because the cost of getting the follow on threat wrong is so grave that you are almost looking to prove that assumption wrong rather than immediately assuming he acted alone.
The Cipher Brief: What about security around the Republican National Convention, which starts on Monday?
Jill Sanborn: I’ve worked numerous Republican and Democratic Conventions, and in general, those are pretty robust. So, they will have already been preparing for tons of people coming in to work those conventions to make sure the event goes off without any violence. They may add to that, given the shooting this weekend. But it’s almost standard operating procedure that when those conventions happen, it’s all hands-on deck. You have FBI, state, and local partners, everybody coming together to make sure it’s as safe as possible.
Mike Sanborn: There could also be a congressional hearing on this down the road. There was one on the White House shooting. How does a person with a high-powered rifle, assuming it was a high-powered rifle, get close to a leading presidential candidate’s rally?
The Cipher Brief: Can you offer some perspective that gives us an idea of how things work relative to the relationship between law enforcement and social media in a situation like this, which is not always a close relationship.
Jill Sanborn: I’ve always felt like the relationship between law enforcement and every social media company is not exactly what is portrayed in the news. The relationship is good when it needs to be. I think that they’re great at preserving information. They know that we will be investigating here. And so, if they see something in their system, they’ll be preserving it so that we can follow up with subpoenas and search warrants. I’ve never had a negative experience with a social media company. They are trying to do the right thing within what they believe is their privacy role with their customer.
Mike Sanborn: Most investigators have the contacts already there, and they’ve probably already reached out and said, “Look, paper’s coming. It’s not going to happen today, but we need to get in and do a deep dive right now.” And they understand that. The important thing is to follow up with that paperwork.
Jill Sanborn: That’s really where the sticking point is. All that information is valuable, but we need to get it using the right processes and procedures versus a mechanism that then makes people uncomfortable about how the government got the information.
The Cipher Brief: The FBI defines domestic terrorism as “violent, criminal acts committed by individuals and/or groups to further ideological goals stemming from domestic influences, such as those of a political, religious, social, racial, or environmental nature. How do instances like this change the terrorism landscape?
Jill Sanborn: We’re at an interesting time where the terrorism threat overall – where the homegrown violent extremists and the lone offender, whether it be on the domestic side or the international terrorism side – has been what we were worried about the most over the last couple of years. Listening to the warnings that FBI Director Christopher Wray has raised in recent hearings and listening to others, I think the international terrorism threat is at a point where it’s higher than it’s been in the last 15 years. The terrorism threat now is elevated on both fronts, the domestic terrorism side and the international terrorism side.
Mike Sanborn: In 2011, the attempt against President Obama was treated as a criminal investigation, not as terrorism, but we charged him with acts of terrorism because he was trying to do a violent act to change somebody’s political views which is by definition, “terrorism”.
Jill Sanborn: You really have two ways that this will be potentially handled. It could be handled like in 2011, where the criminal agents do the investigation, but DOJ still has all those tools in their toolbox. You still have all the statutes out there that apply, regardless of who does the actual investigative work. Or it could be investigated by terrorism agents. And again, you still have those same statutes out there that can apply.
The Cipher Brief: U.S. adversaries are quick to jump on things that are already happening to try to inflame and misinform. What do you say to help people stay calm and understand the pace of how this is going to develop and when to accept something as real? How should we be thinking about something like this in an era when the country is so divided? Certain adversaries, Russia in particular, never waste an opportunity to take something that’s already happening and just mess with America with it? How do you guys think about that?
Jill Sanborn: The world today is just so used to the 24/7 news cycle. We’re so used to instant information that it’s really hard to tell people, “Until you hear the actual information from the sources that are responsible for the investigation, you have to be suspect.” Until the FBI or some law enforcement agency at a press conference tells me this is the fact, you really have to be suspect. As frustrating as it is, we have to wait for those press conferences where we hear from authorities who have done the investigative work. All of what we see as information rolls out is interesting. And it’s always interesting to see if that then pans out. But until some law enforcement agency or prosecutor gets in front of the camera and really tells us what they know factually, what they can prove with evidence, you just have to take it as, “Hey, this could be true, this could be false,” unfortunately.
The Cipher Brief: One fear that partial information, inflamed by misinformation is that people will begin to feel outrage and might actually act on that outrage, before having all the facts. How does the FBI stay on top of that anger – misguided or not – to prevent more acts of violence as ‘retribution’?
Jill Sanborn: Trying to predict somebody’s mobilization is so hard. And it’s so controversial with what the FBI should or shouldn’t do with social media, right? Half the country thinks we ‘Hoover up’ the internet and are ready for anybody that does something. And half the country thinks that we shouldn’t be able to look at any communications that are out there. So, making sure that we have the right authorized purpose, and that we’re looking because somebody’s already given us an allegation, is really important because it can go bad either way. It could appear that we either don’t do enough or we’re infringing on rights, unfortunately.
Who’s Reading this? More than 500K of the most influential national security experts in the world. Need full access to what the Experts are reading?
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.
