UNCLASSIFIED//FOR OFFICIAL USE ONLY

OFFICE OF INTELLIGENCE & ANALYSIS

February 2022
(U//FOUO) COLLECTION SUPPORT PRIMER – Eastern European Conflict
(U//FOUO) The Department of Homeland Security (DHS) Office of Intelligence and Analysis Collection Management Division prepared this Collection Support Primer in collaboration with the Cyber Mission Center,
Counterintelligence Mission Center, Counterterrorism Mission Center, Economic Security Mission Center, and Transnational Organized Crime Mission Center to assist DHS and its federal and state, local, tribal, and
territorial (SLTT) partners in identifying and reporting threats to the United States stemming from the potential conflict in Eastern Europe. Please refer to the recently published classified Collection Primer on this topic for
additional information.

(U) Cyber Threats
(U//FOUO) The United States could face cyber threats tied
to an Eastern European conflict, including indirect effects
from cyber attacks and direct effects if an adversary uses
cyber to respond to US punitive measures.
(U) Counterterrorism Threats (U) Economic Concerns
(U//FOUO) In the event of conflict in Eastern Europe,
(U//FOUO) Americans could be targeted as recruits to
there could be economic ramifications that affect the
participate in the potential conflict arising in Eastern Europe.
United States.
(U) Migration and Travel
(U//FOUO) In the event of conflict in Eastern Europe, this
may cause a mass migration event to nearby European
nations with potentially indirect effects on the United States.

(U//FOUO) Federal and SLTT partners may be
well-positioned to identify any potential cyber threats to
the United States that are related to the conflict in
Eastern Europe.
(U//FOUO) Federal and SLTT partners may be
well-positioned to assist in identifying counterintelligence
threats resulting from the conflict in Eastern Europe.
(U//FOUO) Federal and SLTT partners may be
(U//FOUO) Federal and SLTT partners may be
well-positioned to assist in identifying concerns relating to
well-positioned to assist in identifying US economic
concerns arising due to the conflict in Eastern Europe. mass migration and travel due to the conflict in Eastern
Europe.

(U//FOUO) DHS requests reporting on malign cyber actors
who attempt to acquire information unlawfully, corrupt
data, damage information technology and communications
infrastructure, penetrate cyber defenses, and exfiltrate
data.
(U//FOUO) DHS is interested in information on malign
cyber actors who have attempted to conduct cyber attacks
against US critical infrastructure, SLTT partners, and
US-based private sector entities.
(U//FOUO) DHS is interested in the tactics, techniques, and
procedures that malicious cyber actors use to select targets,
including whether specific victims were targeted within
networks or systems, and whether the networks contain
sensitive government information or a critical infrastructure
component.
(U//FOUO) DHS seeks identifying information on malicious
cyber actors who have conducted or are planning to
conduct ransomware attacks against the United States.
(U//FOUO) DHS is interested in foreign malign actors who
attempt to recruit Americans to engage in overseas hostilities
in irregular or regular military units and militias.
(U//FOUO) DHS seeks reporting on patterns and trends
relating to Americans being recruited to fight abroad, or
those who are traveling to fight abroad. DHS is not requesting
reporting on unique individuals and the personally identifying
information (PII) of the individuals engaging in these
activities.
(U//FOUO) DHS seeks reporting on RMVEs or DVEs planning
or intending to travel to foreign conflicts to gain tactical
training or participate in conflicts in order to commit
ideologically motivated violence.
(U//FOUO) DHS is interested in how a cyber attack may
affect the financial sector. For example, if a cyber attack is
successful against a US bank, citizens could potentially lose
access to their accounts temporarily and have their PII
exposed from the culpable cyber actors.
(U//FOUO) DHS requests information on how the global
supply chain could be affected if the US levies economic
sanctions against another country.
(U//FOUO) DHS is interested in whether citizens affected by
this conflict would attempt to travel to the United States. For
now, there is not any intelligence to suggest a mass influx of
irregular migrants traveling to the United States.
(U//FOUO) DHS is interested in the potential for people
affected by this conflict to use a nearby nation’s Visa Waiver
Program for unlawful entry into the United States.
(U//FOUO) DHS seeks information if changes to VWP
member countries’ border security capabilities and
information on information sharing on foreign terrorist travel
during a potential armed conflict. This includes added
pressures to security from an influx of migrants.
(U//FOUO) DHS requests reporting on Transnational Criminal
Organizations that seek to take advantage of this situation by
smuggling people affected by the conflict across the
Southwest border.

(U//FOUO) DHS is interested in the relationships between

cybercriminal actors and state-sponsored actors.

DHS-IA-NDB-2022-03725
(U) Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO). It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to
be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not
have a valid need to know without prior approval of an authorized DHS official. State and local homeland security officials may not share this document with critical infrastructure and key resource personnel or
private sector security officials without further approval from DHS.

UNCLASSIFIED//FOR OFFICIAL USE ONLY