Super Bowl Threat Asessment

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE
(U) Super Bowl LV

Tampa, Florida
(U) Scope Note
(U//FOUO) This Joint Special Event Threat Assessment (JSETA) addresses threats to Super
Bowl LV, taking place at Raymond James Stadium in Tampa, Florida, on 7 February 2021. This
JSETA does not address acts of non-violent civil disobedience (for example, protests without a
permit), which are outside the scope of federal law enforcement jurisdiction.
(U//FOUO) This product is intended to support federal, state, local, tribal, and territorial
government authorities in identifying priorities for protective
and support measures against terrorism and other existing or emerging threats to homeland
security. Information in this assessment is current and accurate as of 2 January 2021.
(U) Key Findings
(U//FOUO) As of 2 January 2021, the FBI, DHS, Tampa Police Department (TPD),
Hillsborough County Sheriff s Office (HCSO), Tampa Bay Regional Intelligence Center
(TBRIC), and the US Department of Agriculture (USDA) have no information to indicate a
specific, credible threat to or associated with Super Bowl LV or related events in the surrounding
area. However, the FBI and DHS remain concerned about potential retaliatory attacks conducted
by or on behalf of the Government of Iran (GOI) following the 3 January 2020 US drone strike
that killed Iranian Islamic Revolutionary Guard Corps-Quds Force (IRGC-QF) Commander
Qassem Soleimani. Additional areas of continuing concern include international terrorism and
domestic violent extremists (DVEs); unmanned aircraft systems (UAS); cyber security; local
critical infrastructure; criminal activity; and the potential use of crude, simple weapons of mass
destruction (WMDs).a
a (U//FOUO) The FBI and DHS define domestic violent extremists (DVEs) as individuals based and operating primarily
within the United States or its territories without direction or inspiration from a foreign terrorist group or other foreign power
who seek to further political or social goals, wholly or in part, through unlawful acts of force or violence. The mere advocacy of
political or social positions, political activism, use of strong rhetoric, or generalized philosophic embrace of violent tactics may
not constitute violent extremism, and may be constitutionally protected.
(U) LAW ENFORCEMENT SENSITIVE: The information marked (U//LES) in this document is the property of FBI and TBRIC and may be distributed
within the Federal Government (and its contractors), US intelligence, law enforcement, public safety or protection officials, and individuals with a need to
know. Distribution beyond these entities without FBI and TBRIC authorization is prohibited. Precautions should be taken to ensure this information is
stored and/or destroyed in a manner that precludes unauthorized access. Information bearing the LES caveat may not be used in legal proceedings
without first receiving authorization from the originating agency. [Recipients are prohibited from subsequently posting the information marked LES on a
website on an unclassified network.]
(U) US person information has been minimized. Should you require the minimized US person information on weekends or after normal weekday hours
during exigent and time sensitive circumstances, contact the Current and Emerging Threat Watch Office at 202-447-3688, CETC.OSCO@hq.dhs.gov.
For all other inquiries, please contact the Homeland Security Single Point of Service, Request for Information Office at DHS-SPS-RFI@hq.dhs.gov, DHS-
SPS-RFI@dhs.sgov.gov, DHS-SPS-RFI@dhs.ic.gov.

(U) International Terrorism Concerns
(U//FOUO) We remain concerned about sustained interest by foreign terrorist organizations

(FTOs) in targeting mass gatherings such as Super Bowl LV despite the restricted attendance of
this year s game and associated events. Al-Qa‘ida, the Islamic State of Iraq and ash-Sham (ISIS),
and their affiliates remain intent on attacking Western targets and continue to call on individuals
to conduct independent attacks in the United States using a range of weapons, including
improvised explosive or incendiary devices (IEDs/IIDs), vehicles, firearms, and edged weapons.
The GOI could direct retaliatory attacks in the environs of the Super Bowl; Soleimani s death
could also provoke a violent extremist GOI supporter to conduct an attack to avenge the death.
(U) On 6 January 2021, Federal Aviation Administration (FAA) air traffic controllers in
New York received a threat from an unidentified radio broadcast to fly a plane into the
US Capitol Building in order to avenge the death of IRGC-QF Commander Qassem
Soleimani, according to US government officials. The FAA referred the matter to the FBI
for investigation, though US government officials do not regard the threat as credible.
(U//FOUO) Although security measures will be in place around Super Bowl LV and adjacent
areas on the day of the game, Super Bowl LV and associated events are likely an attractive target
due to the relatively high concentration of attendees, symbolism of the event, and the significant
national media attention the event will receive. We assess the most vulnerable targets of
opportunity for a physical attack during Super Bowl LV will be outside the security perimeter
around the stadium and at associated venues where crowds will gather or where less stringent
security measures are in effect.
(U//FOUO) Attacks targeting highly populated areas in Europe and the United States over the
past three years underscore our heightened concern about the potential for attackers to exploit
security vulnerabilities at stadiums, arenas, confined outdoor spaces, and mass transportation
systems. Tactics used in these attacks also highlight how areas at or just beyond security
perimeters, such as police and traffic checkpoints, parking lots, attendee lines, and entry and exit
points, remain vulnerable and difficult to secure.
(U) On 2 November 2020, Kujtim Fejzullai, an ISIS supporter who had tried to join the
group in Syria, opened fire with a rifle in six places at Innere Stadt, Vienna, Austria,
killing four civilians and wounding 23 others. The perpetrator was killed by police while
wearing a fake suicide vest, according to open source reporting.
(U) On 29 October 2020, Tunisian violent extremist Brahim Aouissaoui stabbed and
killed three people at Notre-Dame de Nice, a Roman Catholic Basilica in Nice, France.
The attacker was shot by police and taken into custody, according to open source
reporting.
2
(U) On 25 September 2020, two people were injured in a stabbing outside the former
headquarters of the French satirical magazine Charlie Hebdo in Paris, France, which had
previously been the site of a terrorist attack in 2015. A man from Pakistan suspected of
carrying out the attacks was arrested near the scene, and six other suspects were
subsequently arrested in Paris in connection with the attack, according to open source
reporting.
(U) On 2 February 2020, Sudesh Mamoor Faraz Amman, a convicted terrorist who was
recently released from prison, stabbed three people in Streatham, London, seriously
wounding one. The perpetrator was shot dead by police outside of a retail store near the
scene of the attack, according to open source reporting.
(U//FOUO) ISIS and other FTOs routinely promote attacks in Europe and the United States in
their online messaging videos and publications. This violent extremist online media continues to
incite supporters, including individuals in the Tampa area, to attempt acts of violence.b
(U//FOUO) On 25 August 2020, the ISIS media publication Voice of Hind called on
violent extremist supporters to copy the January 2015 Paris attacks, claiming
governments should take more action to punish treacherous individuals. The article
specifically referenced the attack on the Paris offices of the French magazine Charlie
Hebdo, stating that the perpetrators left “a clear path for others to follow,” arguing
supporters should race each other to fulfill this goal. The call for violence was issued
shortly before the start of the trial in France of 14 suspected accomplices in the attack and
in advance of a decision by Charlie Hebdo to republish satirical cartoons of the Prophet
Muhammad, according to open source reporting.
(U) On 26 July 2020, ISIS s al-Hayat Media Center released its first English-language
video in 18 months, urging lone offenders to carry out arson attacks in the West.c The
narrator described fire as “a weapon which is within the reach of every hand,” and
highlighted the material and human losses caused by naturally occurring fires each year,
citing fatalities from wildfires in Australia, Greece, and California. The narrator
instructed viewers to select their targets carefully, ideally where fires would not attract
suspicion. The video also emphasized the disposal of evidence after igniting a fire,
possibly to allow supporters to avoid arrest and conduct multiple, separate attacks over a
prolonged period, according to open source reporting.
b (U//FOUO) US persons linking, citing, quoting, or voicing the same arguments raised by these foreign influence activities
likely are engaging in First Amendment-protected activity, unless they are acting at the direction or control of a foreign threat
actor. Furthermore, variants of the topics covered in this product, even those that include divisive terms, should not be assumed to
reflect foreign influence or malign activity absent information specifically attributing the content to malign foreign actors. This
information should be considered in the context of all applicable legal and policy authorities to use open source information
while protecting privacy, civil rights, and civil liberties.
c (U//FOUO) The FBI and DHS define a lone offender as an individual acting alone or without the witting support of others to
further social or political goals, wholly or in part, through activities that involve unlawful acts of force or violence. Lone
offenders may act within the context of recognized domestic violent extremist ideologies, their own interpretation of those
ideologies, or personal beliefs. The mere advocacy of political or social positions, political activism, use of strong rhetoric, or
generalized philosophic embrace of violent tactics may not constitute violent extremism, and may be constitutionally protected.

3
(U//FOUO) On 24 May 2020, FBI Tampa arrested a subject who was allegedly planning
to carry out an attack in the Tampa Bay area. Investigators determined the
subject acquired multiple firearms and firearm parts through online purchases. On 26
June 2020, the suspect was indicted for attempting to provide material support or
resources to a designated FTO, namely ISIS, and violations of the National Firearms Act.
The suspect remains in custody pending trial, according to a DOJ press release.
(U) Lone Offender and Homegrown Violent Extremist Concerns
(U//FOUO) Of particular concern are unaffiliated lone offenders and homegrown violent
extremists (HVEs) due to their ability to remain undetected until operational;d willingness to
attack civilians and soft targets; ability to inflict significant casualties with weapons that do not
require specialized knowledge, access, or training; and unpredictability. International terrorists,
lone offenders, and HVEs may also be encouraged or inspired to act during Super Bowl week
due to the symbolism and large crowds associated with the Super Bowl, as well as the media
attention given to recent attacks in the West.
(U) On 25 December 2020, a suicide bomber detonated a recreational vehicle (RV)

bomb in downtown Nashville, Tennessee, injuring eight people and damaging dozens of
buildings. The incident occurred at 166 Second Avenue North between Church Street and
Commerce Street at 6:30 am, adjacent to a telecommunications company network hub,
resulting in days-long communication service outages, according to FBI and open source
reporting.
(U//FOUO) On 3 October 2019, Tampa area law enforcement was contacted by the
parents of a subject after finding pipe bombs, bomb making paraphernalia, and various
forms of media regarding mass shooters, known domestic terrorists, and weapons and
tactical instruction/training manuals in the subject s bedroom. A search warrant was
executed and the following items were located: 24 partially constructed pipe bombs;
bomb making materials (smokeless pistol powder, motor oil, fuse material, various sizes
of BB pellets, screws, duct tape); 23 knives; two hatchets; a set of nun-chucks; two BB
pellet rifles; six BB pellet handguns; a crossbow with arrows; and several books and
DVDs about murder, mass killings, domestic terrorism, and bomb making. The subject
stated that she made the devices with the intent to hurt people. Local authorities arrested
and charged the suspect with 24 counts of making a destructive device with the intent to
do bodily harm or property damage. The suspect remains in custody pending trial,
according to FBI, local law enforcement, and open source reporting.
d (U//FOUO) The FBI and DHS define a homegrown violent extremist (HVE) as a person of any citizenship who has lived or
operated primarily in the United States or its territories who advocates, is engaged in, or is preparing to engage in ideologically
motivated terrorist activities (including providing support to terrorism) in furtherance of political or social objectives promoted
by a foreign terrorist organization, but is acting independently of direction by a foreign terrorist organization. HVEs are distinct
from traditional domestic terrorists who engage in unlawful acts of violence to intimidate civilian populations or attempt to
influence domestic policy without direction from or influence from a foreign actor.
4
(U//FOUO) On 1 June 2019, a Pinellas County Florida subject was arrested after leaving
a makeshift bomb outside of a local Veterans Affairs facility. Approximately two weeks
earlier, this subject left a non-functioning bomb outside the same facility, possibly in an
effort to test the response by law enforcement and/or other emergency personnel. A
federal court sentenced the perpetrator to a five-year prison term after he pleaded guilty
to attempting to destroy US government property with an IED, according to FBI, local
law enforcement, and open source reporting.
(U) Domestic Violent Extremist Concerns
(U//FOUO) There is currently no reporting that indicates an active, credible, or specific plot to
attack Super Bowl LV; however, we judge that DVE attacks have increased in number and
lethality in recent years, including attacks by both lone offenders and small groups. We remain
concerned that DVE attacks will continue but have no specific information to suggest they will
occur at Super Bowl LV or related events. Recent attacks and disrupted plots demonstrate the
persistent and lethal threat posed by DVEs, who have carried out mass shootings against soft
targets such as restaurants and stores, as well as cultural and religious institutions.
(U//FOUO) Crimes committed by racially or ethnically motivated violent extremists (RMVEs)

are often opportunistic in nature, though some have involved intricate planning.e Lone offenders
and small groups commit most violence, which typically has involved threats of violence,
intimidation, physical assault, and murder using firearms, edged weapons, and IEDs. Some
RMVEs responding to racism or injustice in American society, or in furtherance of their desire
for black separatism, have attempted to expand their criminal networks and skillsets by recruiting
individuals from criminal street gangs and prisons who have a propensity for violence and
hostility toward law enforcement. These RMVEs sometimes travel to the locations of police-
involved shootings and use public protests or highly publicized incidents of racial oppression to
promote their social and political goals, incite violence, and recruit new offenders and small cells
unaffiliated with existing extremist groups.
(U//FOUO) On 24 March 2020, the FBI disrupted the plot of a Missouri-based DVE to
attack a medical center using a vehicle-borne IED. The suspect indicated he selected a
healthcare facility and accelerated the timing of his attack because he believed it would
result in increased media attention during the COVID-19 pandemic, according to DOJ
press release. The suspect named his plot “Operation Boogaloo,” and was killed in a
shootout with federal law enforcement agents.
e (U//FOUO) The FBI and DHS define racially or ethnically motivated violent extremism (RMVE) as a threat involving the
potentially unlawful use or threat of force or violence, in furtherance of political and/or social agendas, which are deemed to
derive from bias often related to race or ethnicity held by the actor against others, including a given population group.
5
(U//FOUO) In January 2020, four members of the Atomwaffen Division in Tampa

allegedly conspired to threaten journalists and activists, particularly those who were
Jewish or minorities, via targeted media posters distributed in person or mailed to the
victims homes. This resulted in four arrests, including the arrest of an FBI Tampa
subject in February 2020; federal authorities charged the suspects with conspiracy to
threaten and intimidate journalists and activists. One of the suspects was sentenced to 16
months in prison after pleading guilty to the charge, while another is awaiting sentencing
after also entering a guilty plea. The remaining two suspects remain in custody pending
trial, according to a DOJ press release.
(U//FOUO) In December 2019, an RMVE allegedly attacked the home of a Hasidic

rabbi in Monsey, New York, during a Hanukkah celebration, wounding five with an
edged weapon. One of the injured individuals later died from wounds sustained during
the attack. The suspect was charged with five counts of willfully causing bodily injury
because of the victims religion and five counts of obstructing the free exercise of
religion in an attempt intent to kill, and is in custody pending a psychiatric evaluation as
of September 2020.
(U) In December 2019, two RMVEs fatally shot a local law enforcement officer at a
cemetery in Jersey City, New Jersey, and then targeted a nearby kosher supermarket,
where the subjects killed three individuals and injured several others. The RMVEs were
fatally wounded during an encounter with responding law enforcement, according to
press reporting.
(U) In August 2019, an RMVE allegedly shot and killed 23 and injured several others at
a retail store in El Paso, Texas, reportedly targeting Hispanic patrons. The individual s
alleged manifesto, “The Inconvenient Truth,” stated, “This attack is a response to the
Hispanic invasion of Texas.” In his manifesto, the RMVE cited inspiration from Brenton
Tarrant, who conducted a like-minded ideological attack that killed 51 people in
Christchurch, New Zealand, in March 2019. The suspect is awaiting trial after he pleaded
not guilty to multiple state charges of capital murder and federal charges of hate crimes
resulting in death, use of a firearm to commit murder during and in relation to a crime of
violence, hate crimes involving an attempt to kill, and use of a firearm during and in
relation to a crime of violence, according to press reporting.
6
(U//FOUO) We also remain concerned about anti-government or anti-authority violent

extremists, such as anarchist extremists and militia extremists, inciting violence at mass
gatherings to promote their agendas.f,g,h Anarchist extremists have exploited lawful protests to
further their agendas by attempting to incite violence against law enforcement and protesters
across the country. Anarchist and militia extremists are often inspired to respond to local,
national, and global events, and could be inspired to conduct an attack against large gatherings or
soft targets.
(U) On 20 January 2021, suspected anarchist extremists allegedly conducted acts of

violence amidst otherwise lawful protest activity in Portland, Oregon, vandalizing a US
Immigration and Customs Enforcement (ICE) facility and a political party business
office. Eight individuals were arrested on suspicion of offenses including rioting and
reckless burning, according to law enforcement officials.
(U//FOUO) In May 2020, FBI Las Vegas arrested three DVEs who self-identified as
“Boogaloo Bois” members for attempting to incite violence at protests with the intent of
using homemade incendiary devices, such as Molotov cocktails and IEDs, against law
enforcement.i The suspects pleaded not guilty to federal charges of conspiracy to damage
and destroy by fire and explosive and possession of unregistered firearms.
(U//FOUO) On 13 July 2019, an anarchist extremist set fire to a vehicle and a private
detention facility linked to immigration control operations in Tacoma, Washington, using
incendiary devices, according to media reports citing law enforcement. The attacker was
killed when he engaged responding law enforcement with a semi-automatic rifle that
malfunctioned.
f (U//FOUO) The FBI and DHS define anti-government or anti-authority violent extremism as a threat that encompasses the
potentially unlawful use or threat of force or violence, in furtherance of political and/or social agendas, which are deemed to
derive from anti-government or anti-authority sentiment, including opposition to perceived economic, social, or racial
hierarchies; or perceived government overreach, negligence, or illegitimacy.
g (U//FOUO) The FBI and DHS define anarchist extremists as individuals who seek, wholly or in part, through unlawful acts of
force or violence, to further their opposition to all forms of capitalism, corporate globalization, and governing institutions, which
they perceive as harmful to society. The mere advocacy of political or social positions, political activism, use of strong rhetoric,
or generalized philosophic embrace of violent tactics may not constitute extremism, and may be constitutionally protected.
h
(U//FOUO) The FBI and DHS define militia extremists as individuals who seek, wholly or in part through unlawful acts of
force or violence, to further their belief that the US government is purposely exceeding its Constitutional authority and is
attempting to establish a totalitarian regime. Consequently, these individuals oppose many federal and state laws and regulations,
particularly those related to firearms ownership. Militia extremists take overt steps to violently resist or facilitate the overthrow of
the US government. The mere advocacy of political or social positions, political activism, use of strong rhetoric, or generalized
philosophic embrace of violent tactics may not constitute extremism, and may be constitutionally protected.
i (U) The boogaloo concept—in its current usage—began as an internet meme which militia extremists, RMVEs, and other
DVEs have exploited to denote a large-scale violent conflict. Over the past year, some militia extremists increasingly co-opted
the concept to reference a second Civil War or impending insurgency against the government due to perceived abuses of power
and overreach, especially those associated with the Second Amendment and law enforcement authority. RMVEs closely link the
concept with accelerationism and a desire for “race war.” While many individuals may use the boogaloo concept in different
forms within First Amendment–protected activity, its online use, often as a moniker, and offline applications make it a versatile
and attractive tool for some DVEs and others predisposed to violence.
7
(U) Unmanned Aircraft Systems Concerns
(U//FOUO) Although there is no relevant, specific threat reporting, the potential risk posed to
Super Bowl LV by an UAS also remains a concern. UAS are becoming increasingly popular and
readily available, and may be lawfully operated for commercial or personal purposes. Malicious
use of UASs, however, poses a potential risk to spectators, security personnel, and first
responders at sanctioned and non-sanctioned events around the Tampa area during the week
leading up to Super Bowl LV. This assessment is based on a review of open source and law
enforcement information detailing how individuals have used UAS to conduct surveillance of US
law enforcement, facilitate terrorist or criminal activity, and disrupt mass gatherings. ISIS has
also weaponized UAS with IEDs overseas, a tactic HVEs or DVEs could replicate in the United
States. Between 25 January and 2 February 2020, the FBI deployed counter UAS assets to
Miami, Florida, to support Super Bowl LIV and Super Bowl Live events, resulting in 56
successful intercepts, 11 UAS seizures, and 2 arrests; four UAS were intercepted and two were
seized on the day of Super Bowl LIV.j,k The FBI also deployed special agent bomb technicians
to render safe landing areas in the event a UAS system were electronically mitigated.l
(U//LES) On 19 December 2020, an unknown subject (UNSUB) flew a UAS over the
seating area of Raymond James Stadium, 4201 North Dale Mabry Highway, Tampa,
Florida. The stadium was not operating for a special event at the time of this UNSUB
UAS flight. A witness stated they observed a UAS flying in from the northeast side of the
stadium. The UAS flew over the seating area and left after approximately 20 – 25
minutes of flight time. The UAS departed the stadium to the northeast, according to FBI
reporting.
(U//LES) On 22 September 2020, a UAS was observed flying over an active professional
baseball game at Yankee Stadium in the Bronx, New York, causing a brief interruption in
the game. The UAS entered the stadium from center field traveling west southwest over
the field of play, and exited the stadium above the stands behind home plate, according to
FBI reporting.
(U//LES) On 22 May 2020, a commercial pilot reported seeing a UAS in proximity to

the Tampa International Airport runway. The operation control center verified the UAS
via detection radar, but was unable to locate the UAS. In response to this incident, the
FAA shut down airspace for approximately 20 minutes, according to local law
enforcement reporting.
j (U) Interception is the act of geolocating the pilot.

k (U) Seizure of UAS indicates the device was confiscated by authorities for violation of the temporary flight restriction (TFR).
l (U//LES) Electronic mitigation is the act of using technology to affect the UAS in flight, to include overtaking the aircraft to fly
to render safe location or holding the UAS in place.
8
(U) Other Notable UAS Incidents
(U//FOUO) January 2020, Miami, Florida: Federal authorities charged a Florida resident
with violating national defense airspace, specifically knowingly and willfully flying a
drone in an area with a temporary flight restriction imposed by the FAA, after the suspect
allegedly flew a UAS into the temporarily restricted airspace in Miami Beach during the
week leading up to Super Bowl LIV, according to local law enforcement reporting.
(U//FOUO) August 2019, Ann Arbor, Michigan: During the University of Michigan s
opening football game, a UAS carrying a large box was observed hovering near the
student section. The box reportedly contained leaflets advertising a website, according to
press reporting.
(U//FOUO) April 2019, Boston, Massachusetts: An unauthorized UAS flew over

Fenway Park for approximately an hour during a Red Sox-Blue Jays game, reportedly
flying close to attendees, according to press reporting.
(U//FOUO) November 2017, Santa Clara, California: A Sacramento County, California,

resident was arrested after allegedly using a UAS to drop anti-media leaflets over crowds
at Levi s Stadium during a San Francisco 49ers game. Federal authorities charged the
suspect with violations of national defense airspace, according to press reporting.
(U) Cyber Security Concerns

(U//FOUO) We assess that terrorists, hacking groups, and other cyber criminals likely consider
this special event an attractive target for short-term financial gain or symbolic disruptions,
including ransomware extortion, distributed denial-of-service (DDoS) attacks, network
intrusions by point-of-sale (POS), or malware targeting websites and mobile devices. This
assessment is based on past behavior of cyber criminals at similar events, the symbolic
importance of the event, and recent credit card and data breaches involving major retailers, hotel
chains, and consumer credit data companies.
(U) Since the early 2000s, POS malware attacks have consistently been employed
by financially motivated cyber criminals, affecting multiple US-based businesses,
according to open source reporting. Due to the COVID-19 pandemic, all transactions at
Raymond James Stadium will be cashless, creating the opportunity for financially
motivated cyber attackers to exploit the stadium s vendors POS systems, according to
open source reporting.
9
(U) In November 2019, a popular streaming service experienced its customers being
denied access to their accounts, possibly from spyware or re-use of login credentials.
Later that month account credentials were found for sale on the dark web, according to
open source reporting. Similar DDoS attacks via a botnet targeting the game broadcast
may occur due to the continued popularity of streaming services, according to the same
source.
(U) During the week of Super Bowl LIV in 2020, the criminal hacking group OurMine
compromised the Twitter accounts of 15 NFL teams as well as the NFL s official Twitter
account, according to a open source report. OurMine actors posted a tweet to the hacked
accounts stating, “Hi, we re Back (OurMine.) We are here to show people that
everything is hackable.” The NFL and all 15 NFL teams regained control of their
accounts and have since deleted the tweets.
(U) In December 2019, cyber criminals conducted a ransomware attack against the City
of Pensacola network in Pensacola, Florida, disrupting the city s emails, phones, and
customer service and online payments from two of its utilities, according to a press
release. In June 2019, the government systems for Orlando, Lake City, Key Biscayne,
and Riviera Beach, all in Florida, were the target of ransomware attacks. Two of the four
cities paid the ransom to regain control of their systems and data, according to a separate
press release.
(U) In June 2018, a US-based ticket sales company announced a data breach that
potentially compromised their clients information, conducted as part of a larger credit
card skimming operation that affected more than 800 e-commerce sites across the
internet. Malicious cyber actors reportedly gained access to client payment information
by targeting a third-party firm that works with the ticket sales site, according to a press
release.
(U//FOUO) The FBI and DHS remain concerned that the GOI may use this event to retaliate for
the death of IRGC-QF General Qassem Soleimani or Iranian nuclear scientist Mohsen
Fakhrizadeh, though we lack credible and specific intelligence indicating Iran or its proxies are
planning or preparing for specific retaliatory action. The Super Bowl and surrounding events
offer a target of opportunity for Iranian state cyber actors and Iran-based cyber-criminal actors.
Malicious cyber actors could employ social engineering tactics against organizations or
individuals associated with Super Bowl LV to spread credential theft malware, engage in
phishing, or compromise merchants providing services to the event in order to steal payment
credentials at a centralized point using POS malware or other tools. Recent policy and malicious
cyber activity linked to the GOI highlight potential adversary intent and capabilities relevant to
the security of events such as Super Bowl LV, though reconnaissance or pre-positioning activity
indicative of state-sponsored Iranian cyber activity targeting Super Bowl LV has not been
observed.
10
(U) In January 2020, according to open source reporting, a website operated by the US
government was hacked by a group claiming to represent the GOI. Security experts have
warned that cyber attacks could be part of Iran s retaliation for the US airstrike on 3
January 2020 that killed IRGC-QF Commander Soleimani. Separately, senior and high-
ranking Iranian officials accused Israel and the United States of being involved in the
November 2020 bombing and shooting attack that killed Iranian nuclear scientist Mohsen
Fakhrizadeh, according to US media outlets. The head of Iran s Strategic Council on
Foreign Relations stated that “Iran will give a calculated and decisive answer” to the
killing, according to the same sources.
(U) Since 2011, Iranian cyber actors have conducted offensive cyber operations,
sometimes preceded by public threats, in retaliation for US actions and perceived threats
to Iranian interests, according to US cybersecurity firms and media reporting. Most
recently, an Iranian criminal hacker group defaced at least six local government and
education websites in the United States following the Department of Justice s indictment
of a fellow Iranian hacker in September 2020.
(U) Critical Infrastructure Concerns
(U//FOUO) Multiple social media posts brought to the attention of the FBI and DHS share calls
to target interdependent critical infrastructure facilities, including cell towers, locations
associated with the electric power grid, and other sites associated with perceived impending
government action against citizens during the COVID-19 pandemic.m Since December 2019,
dozens of arsons of cell towers in Western Europe and at least six in the United States have been
reported. Online calls for targeting such sites have focused particularly on those facilities
believed to be equipped with 5G wireless technologies, probably in part because of the recent
proliferation of conspiracy theories that falsely link the COVID-19 pandemic with 5G
infrastructure development, including beliefs that 5G towers cause the spread of COVID-19 or
weaken the immune system so as to facilitate the transmission of COVID-19.
(U//FOUO) Social media posts, including some by RMVEs and possible anarchist extremists,
shared instructional videos for the destruction of radio and cell towers, as well as calls for
“international days of action” to potentially vandalize 5G towers, often citing the dozens of arson
incidents in Europe as inspiration or guidance as to how to impact society.n
m
(U) US persons linking, citing, quoting, or voicing the same arguments raised by these activities likely are engaging in First
Amendment-protected activity, unless they are acting at the direction or control of a foreign threat actor. Furthermore, variants of
the topics covered in this product, even those that include divisive terms, should not be assumed to reflect foreign influence or
malign activity absent information specifically attributing the content to malign foreign actors. This information should be
considered in the context of all applicable legal and policy authorities to use open source information while protecting privacy,
civil rights, and civil liberties.
n (U) US persons linking, citing, quoting, or voicing the same arguments raised by these activities likely are engaging in First
Amendment-protected activity, unless they are acting at the direction or control of a foreign threat actor. Furthermore, variants of
the topics covered in this product, even those that include divisive terms, should not be assumed to reflect foreign influence or
11
(U//FOUO) On 9 April 2020, suspected arsonists set fire to the ground of a secure cell
tower with smoldering wire insulation in Portland, Oregon, according to a local incident
report. Separately, from 4 December 2019 to 17 February 2020, five arson attacks
occurred against cell phone towers, in Memphis, Tennessee, according to press reporting.
(U//FOUO) On 22 March 2020, an instructional video was posted on Telegram on the

destruction of radio tower support wires, and encouraged followers to target electrical
stations in California, New York, or Washington State, in addition to locations overseas,
according to FBI reporting.
(U) On 22 April 2020, an identified social media group encouraged individuals adhering
to anarchist extremist ideology to commit acts of sabotage by attacking buildings and 5G
towers around the world on 30 April or 1 May, in furtherance of an “International Day of
Sabotage.” This call for sabotage coincided with the annual occurrence of May Day,
celebrated by some as International Workers Day, though no related activity was
observed on these dates, according to open source reporting.
(U) Weapons of Mass Destruction (WMDs) Concerns
(U//FOUO) At this time, there is no information to indicate a planned WMD attack—such as

one featuring a chemical, biological, radiological, or nuclear agent—against Super Bowl LV or
related events. Nonetheless, concerns remain about the easy accessibility of dual-use precursor
materials, specifically those associated with chemical and biological threats, readily available in
commercial products. Furthermore, information on how to obtain, produce, and deploy crude
WMD materials, particularly chemical and biological devices, is widely available online.
(U//FOUO) If FTO-inspired HVEs choose to pursue a chemical or biological attack against the
Super Bowl, they most likely would employ commercially available toxic industrial chemicals
(TICs), or disseminate crudely produced biological toxins using methods such as explosive
dispersal, surface contamination, food or water poisoning, release of gases from pressurized
tanks, or improvised chemical devices. TICs are available from commercial vendors, do not
require a license, and are available on the internet, including the dark web.
malign activity absent information specifically attributing the content to malign foreign actors. This information should be
considered in the context of all applicable legal and policy authorities to use open source information while protecting privacy,
civil rights, and civil liberties.
12
(U) Food Sector Threat Concerns
(U//FOUO) According to the USDA, Food Safety and Inspection Service, there is currently no
known, imminent threat to the food sector for Super Bowl LV, but an ongoing, low-level threat
persists. There is continued interest by terrorist organizations in using chemicals and biological
agents to poison food and water sources, Therefore, vigilance is still necessary by all
stakeholders (e.g., public health, law enforcement, private industry, emergency management) to
prevent, detect, mitigate, and respond to an incident of intentional food contamination. In
addition, attacks on the food supply can be conducted with little money and little technical
expertise. A successful attack would likely receive widespread publicity, a goal of many threat
actors.
(U//FOUO) Should an inspired individual choose to pursue a chemical or biological attack

against Super Bowl LV by poisoning foods, they could employ commercially available TICs or
disseminate crudely produced biological toxins. TICs are available from commercial vendors
with no license required, and on the internet, including the dark web. The DHS Science and
Technology Directorate (S&T) developed a suite of models at S&T s Chemical Security
Analysis Center (CSAC). These models help federal agencies analyze threats, vulnerabilities,
and consequences of potential attacks to prioritize resources for the most effective defense and
response. The tools developed at S&T show that plausible foodborne scenarios using chemical or
biological agents at large venues could result in dozens to hundreds of illnesses, according to
DHS testing data.
(U//FOUO) Insider threats can be employees who are disgruntled or might be coerced by others
who want to exploit the individual s position. The insider threat might also be an individual who
harbors sympathies for groups that want to conduct an attack. The insider threat is considered
particularly dangerous because of the ability to circumvent security procedures and to apply
knowledge of food processing systems in a way that maximizes damage from an attack.
(U) A disgruntled Lakeland, Florida, restaurant worker was sentenced to seven years in
prison for putting deadly plumber's lye into the Yum Yum sauce at a local hibachi eatery.
The owner of the franchise checked surveillance video after tasting the sauce during a
routine inspection and immediately feeling his mouth burn. Lakeland police say the video
showed the employee accessing a container of poisonous drain cleaner and then going to
where the Yum Yum sauce was kept. The employee was arrested in June 2018 and
eventually acknowledged tainting the sauce because he was unhappy about working
conditions, according to open source reporting.
(U//FOUO) In 2018, a North Carolina pizza restaurant worker was jailed on charges of
putting rat poison into the cheese. A manager at the restaurant in Fayetteville noticed an
unknown substance mixed into the shredded cheese. He immediately stopped preparing
pizza and reviewed surveillance footage to determine who prepared the shredded cheese.
13
It was determined which employee was the one handling the cheese and was believed to
have added rat poison. Police say that all of the contaminated cheese was identified and
collected prior to being served to any customers, according to open source reporting.
(U//FOUO) A Shawnee, Kansas, individual pleaded guilty to a charge of conspiracy to

tamper with a consumer product after hatching a scheme to put a Methomyl-based
pesticide in salsa served to patrons at a Mexican restaurant in Olathe, Kansas. More than
40 diners reported suffering symptoms of poisoning. In the plea, the suspect admitted he
was angry after losing his job in June 2009, as he believed the owner of the restaurant
was responsible for him losing his job and his car being stolen, according to open source
reporting.
(U//FOUO) Although none of these is an example of an ideologically motivated attack, terrorist

groups have expressed interest in attacking the food sector. ISIS makes efforts to influence
individuals in the United States and other Western countries, encouraging them to act where and
how they can. ISIS calls to poison westerners have continued since 2014. Pro-ISIS social media
channels mention, among many possible attack scenarios, targeting food. The messages typically
encourage small scale attacks and provide few specifics. For instance, in September 2017 the
Knights of Lone Jihad channel suggested using a hypodermic needle to inject cyanide into fruits,
vegetables, and ice cream in grocery stores in the West. The message was in English and clearly
aimed at western audiences, according to open source reporting.
(U) In March 2020, US-based violent extremists encouraged followers online to

contaminate US food supplies, including at retailers such as grocery stores, with
COVID-19 by coughing on food, according to open source reporting.
(U) In March 2020, ISIS supporters distributed an online magazine encouraging attacks,
including poisoning food and water, according to open source reporting.
(U) Criminal Concerns
(U//FOUO) The FBI and local partners assess that high-profile large events can draw interest
from malicious actors looking for targets of opportunity to perpetrate criminal schemes,
including human trafficking. We assess that there likely will be a surge in non-violent crimes,
such as property theft, public intoxication, human trafficking, sales of illicit drugs, prostitution,
and fraud schemes (such as hotel or rental frauds) due to the influx of visitors attending Super
Bowl-related festivities from 29 January through 7 February 2021.
(U//FOUO) Other criminal activities that could affect Super Bowl LV include violations of
intellectual property rights through the sale of counterfeit goods (e.g., tickets, clothing, bags, or
other Super Bowl LV merchandise).
14
(U) High-profile events with large crowds, including major sporting events, can be
attractive targets for sex traffickers. This could include transient organized prostitution
rings, independent prostitutes, and human traffickers who frequent large special events
and often work out of budget hotels using social media sites to attract clients, according
to a DOJ press release.
(U) According to an open source media report, on 11 January 2021, HCSO announced
the arrests of 71 people during a month-long operation entitled “Operation Interception,”
as part of an effort to “combat human trafficking leading up to the Super Bowl in Tampa
in February 2021.”
(U) According to an open source media report, around the time of Super Bowl LIV in
Miami Gardens, in February 2020, 183 people were arrested in connection to human
trafficking. There were 20 victims of human trafficking recovered, including 4 minors.
(U) Event Overview
(U//FOUO) Super Bowl LV will occur on 7 February 2021 at Raymond James Stadium in
Tampa, Florida. Due to current COVID-19 restrictions, the NFL announced it will allow for a 25
percent seating capacity, or approximately 16,000 spectators in seats, and an additional 500 to
15,000 vaccinated frontline workers at the stadium. Additional patrons likely will participate in
pre-game activities at tailgating sites, local bars, and restaurants near the stadium, according to
an open source media report.
(U//FOUO) There are few sanctioned events leading up to the day of the Super Bowl, compared
to prior Super Bowls. The Super Bowl Experience, NFL s interactive football theme park, will
be held along the Tampa Riverwalk from Friday, 29 January 2021 through Saturday, 6 February
2021. Super Bowl Experience will offer fans the opportunity virtually to meet and greet with
current NFL players and legends, participate in games, and shop merchandise from NFL Shop.
Super Bowl Experience will also feature photos with the Vince Lombardi Trophy, a 40-yard
dash and vertical jump against NFL players on LED screens, and a Super Bowl rings display,
showcasing all 54 Super Bowl rings, according to an open source media report.
(U//FOUO) The Weeknd will perform during the Pepsi Super Bowl LV Halftime Show.
15
(U) SEAR Level
(U//FOUO) Super Bowl LV is designated as a SEAR 1 event and the Super Bowl Experience is
designated as a SEAR 3 event.o,p
(U) Potential Threat Indicators
(U//FOUO) Absent a specific, actionable threat to Super Bowl LV, we are providing indicators
to aid law enforcement and first responders in identifying and mitigating threats. The totality of
behavioral indicators and other relevant circumstances should be evaluated when considering
any law enforcement response or action. (Note: behaviors associated with the below indicators
can include constitutionally protected activities. The FBI does not initiate any investigative
activity based solely on the exercise of First Amendment activities or on the race, ethnicity,
national origin, religion, gender, sexual orientation, or gender identity of the subject, or a
combination of only such factors.)
(U//FOUO) Possible indicators of pre-operational surveillance or attack planning include:
(U//FOUO) Unusual or prolonged interest in or attempts to gain sensitive information

about security measures of personnel, entry points, peak days and hours of operation, and
access controls, such as alarms or locks;
(U//FOUO) Observation of security reaction drills or procedures, or multiple false

alarms or fictitious emergency calls to the same locations or similar venues;
(U//FOUO) Discreet use of cameras or video recorders, sketching, or note-taking

consistent with pre-operational surveillance, and coupled with other factors reasonably
indicative of plans to commit violence;
(U//FOUO) Unusual or unexplained interest in speaking with building maintenance

personnel without a reasonable alternative explanation;
(U//FOUO) Observation of or questions about facility security measures, including

barriers, restricted areas, cameras, and intrusion detection systems;
(U//FOUO) Observations of or questions about facility air conditioning, heating, and

ventilation systems without a reasonable alternative explanation;
o
(U//FOUO) An event is considered a SEAR Level 1 when it is of such significant national and/or international importance
that it may require extensive federal interagency security and incident management preparedness.
p (U//FOUO) A SEAR Level 3 is assessed for significant domestic events with national and/or international importance that
require only limited, direct federal support to augment state, local, or tribal capabilities.
16
(U//FOUO) Suspicious purchases of dual-use items which could be used to construct an

explosive device, including hydrogen peroxide, acetone, gasoline, propane, or fertilizer
without a reasonable alternative explanation;
(U//FOUO) Suspicious activities in storage facilities or other areas which could be used
to construct an explosive device without a reasonable alternative explanation; and
(U//FOUO) Attempted or unauthorized access to rooftops or other potentially sensitive

areas.
(U//FOUO) Possible indicators of threats involving UASs include:
(U//FOUO) Beginner-level hobbyists attempting to purchase expensive, difficult-to-fly

UASs in a manner that would arouse suspicion of terrorism or other criminality in a
reasonable person;
(U//FOUO) Operation of a video equipped UAS near sensitive locations or ongoing law
enforcement operations in a manner that would arouse suspicion of terrorism or other
criminality in a reasonable person;
(U//FOUO) Attempts to modify a UAS with explosives or chemical agents or with

weapons- or chemical-delivery mechanisms, to include sprayers or foggers;
(U//FOUO) Suspicious attempts to interview, interface with, or interact with employees

or individuals knowledgeable about key personnel, critical infrastructure, or key resource
facilities, networks, or systems with no alternative reasonable explanation;
(U//FOUO) Individuals who are unable or unwilling to answer basic questions on the
use, application, safety, or handling of UAS or who are evasive or vague about their
intended use for such a system; and
(U//FOUO) Theft or unusual or unauthorized acquisition of containers capable of

holding lethal chemical agents or explosive materials.
17
(U//FOUO) Possible indicators of cyber or cybersecurity threat activity include:q
(U//FOUO) Online forum or social media discussions among malicious cyber actors
indicating disruptive or damaging cyber-attacks targeting Super Bowl related networks,
systems, or websites;
(U//FOUO) Criminal hacker groups publicly encouraging cyber attacks against the Super
Bowl or its sponsors prior to the event;
(U//FOUO) Other cyber-enabled threats, including swatting, romance scams, or e-

commerce fraud, that use social engineering or low-level malware such as key loggers, in
addition to the use of computers to sell drugs and other illegal items; and
(U//FOUO) Threats that use a combination of computer intrusion, social engineering, e-

mail spoofing, or malware.
(U//FOUO) Possible indicators of commercial sex trafficking threat activity include:
(U//FOUO) Individuals who, for no apparent reason, appear fearful, anxious, depressed,
submissive, or paranoid;
(U//FOUO) Individuals who are not in control of their own money or identification
documents; and
(U//FOUO) Higher than normal foot traffic in an unlikely location without a reasonable
alternative explanation.
(U//FOUO) Possible indicators of other criminal activity include:
(U//FOUO) Individuals or groups involved in trademark infringement; counterfeit goods,

such as tickets, clothing, or other game merchandise; or fraud schemes related to Super
Bowl LV, such as hotel or rental scams.
(U//FOUO) Attempts to produce, store, or distribute trademark-infringing Super Bowl

LV items or counterfeit goods.
q
(U) US persons linking, citing, quoting, or voicing arguments raised by potential violent extremists likely are
engaging in First Amendment-protected activity, unless they are acting at the direction or control of a foreign threat
actor. Furthermore, variants of the topics covered in this product, even those that include divisive terms, should not
be assumed to reflect foreign influence or malign activity absent information specifically attributing the content to
malign foreign actors. This information should be considered in the context of all applicable legal and policy
authorities to use open source information while protecting privacy, civil rights, and civil liberties.
18

Language

Super Bowl Threat Asessment

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Super Bowl Threat Asessment

Uploaded by

Copyright:

Available Formats

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U) Super Bowl LV

(U) Scope Note

(U) Key Findings

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U) International Terrorism Concerns

(U//FOUO) We remain concerned about sustained interest by foreign terrorist organizations

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U) Lone Offender and Homegrown Violent Extremist Concerns

(U) On 25 December 2020, a suicide bomber detonated a recreational vehicle (RV)

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U) Domestic Violent Extremist Concerns

(U//FOUO) Crimes committed by racially or ethnically motivated violent extremists (RMVEs)

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U//FOUO) In January 2020, four members of the Atomwaffen Division in Tampa

(U//FOUO) In December 2019, an RMVE allegedly attacked the home of a Hasidic

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U//FOUO) We also remain concerned about anti-government or anti-authority violent

(U) On 20 January 2021, suspected anarchist extremists allegedly conducted acts of

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U) Unmanned Aircraft Systems Concerns

(U//LES) On 22 May 2020, a commercial pilot reported seeing a UAS in proximity to

j (U) Interception is the act of geolocating the pilot.

to render safe location or holding the UAS in place.

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U) Other Notable UAS Incidents

(U//FOUO) April 2019, Boston, Massachusetts: An unauthorized UAS flew over

(U//FOUO) November 2017, Santa Clara, California: A Sacramento County, California,

(U) Cyber Security Concerns

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U) Critical Infrastructure Concerns

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U//FOUO) On 22 March 2020, an instructional video was posted on Telegram on the

(U) Weapons of Mass Destruction (WMDs) Concerns

(U//FOUO) At this time, there is no information to indicate a planned WMD attack—such as

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U) Food Sector Threat Concerns

(U//FOUO) Should an inspired individual choose to pursue a chemical or biological attack

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U//FOUO) A Shawnee, Kansas, individual pleaded guilty to a charge of conspiracy to

(U//FOUO) Although none of these is an example of an ideologically motivated attack, terrorist

(U) In March 2020, US-based violent extremists encouraged followers online to

(U) Criminal Concerns

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U) Event Overview

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U) SEAR Level

(U) Potential Threat Indicators

(U//FOUO) Possible indicators of pre-operational surveillance or attack planning include:

(U//FOUO) Unusual or prolonged interest in or attempts to gain sensitive information

(U//FOUO) Observation of security reaction drills or procedures, or multiple false

(U//FOUO) Discreet use of cameras or video recorders, sketching, or note-taking

(U//FOUO) Unusual or unexplained interest in speaking with building maintenance

(U//FOUO) Observation of or questions about facility security measures, including

(U//FOUO) Observations of or questions about facility air conditioning, heating, and

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

(U//FOUO) Suspicious purchases of dual-use items which could be used to construct an

(U//FOUO) Attempted or unauthorized access to rooftops or other potentially sensitive

(U//FOUO) Possible indicators of threats involving UASs include:

(U//FOUO) Beginner-level hobbyists attempting to purchase expensive, difficult-to-fly

(U//FOUO) Attempts to modify a UAS with explosives or chemical agents or with