Join the most advanced security teams around the globe and see what Base Operations can do for you.
In the past 5 days I haven’t closed Base Operations.
I give It a 10 out of 10.
Join the most advanced security teams around the globe and see what Base Operations can do for you.
In the past 5 days I haven’t closed Base Operations.
I give It a 10 out of 10.
Updated August 12, 2024: Base Operations team brings you the most-current security assessment for the upcoming Democratic National convention. This report was originally published ahead of the Republican National Convention in July, and has now been updated to reflect the latest information heading into the Democratic National Convention next week in Chicago.
This year’s Republican National Convention (RNC) in Milwaukee and Democratic National Convention (DNC) in Chicago face a variety of challenges, including Domestic Extremists, Foreign Terrorist Organizations, and Cyber Threat actors. Driving cyber threats are nation-state actors that wish to influence US elections, such as Russia and China.
Both conventions occur during months with historically high rates of crime for both Milwaukee and Chicago.
The switch from President Biden to Vice President Harris as the Democratic presidential nominee has rapidly changed the nature of the election. The threat landscape is more fluid and uncertain.
The fallout from the assassination attempt on former President Trump in Butler, PA continues to influence the threat landscape.
Despite calls for unity from some top U.S. politicians, misinformation surrounding and politicization of the incident will likely increase political divisions.
The incident could also potentially inspire copycat or retaliatory attacks.
A number of other recent events, such as Supreme Court rulings and the felony convictions of former President Trump, are also poised to spark unrest and extremist activity.
The main venue for the RNC (the Fiserv Forum) is situated in Milwaukee’s downtown area, where high levels of pedestrian activity and tourism can contribute to hotspots of crime and unrest.
The main venue for the DNC (the United Center), has gang territory on its northern, western, and southern periphery. To its east is the Chicago Loop, which is frequented by tourists and has high pedestrian activity.
During national conventions, political parties formalize their presidential tickets, articulate their platform, and describe goals for the next executive administration. This politically charged atmosphere has a target rich environment of candidates, journalists, elected officials, law enforcement officers, and VIPs (e.g., celebrities, donors, activists, former presidents, etc.). The administrative staff of political parties can also be attractive targets for espionage and cyber attacks.
Due to these potential threats, the Department of Homeland Security (DHS) classifies national conventions as National Special Security Events (NSSE), and are the responsibility of the US Secret Service (USSS). It coordinates security measures at the conventions and protects candidates throughout the campaign.
At previous conventions, DHS dedicated nearly 3,000 personnel to protecting the events, with an additional ~1,100 federal personnel assisting alongside local law enforcement1. They began planning for the 2024 conventions over 18 months in advance.
Although there have been no major incidents at conventions in recent years, law enforcement faces a particularly complex threat landscape for the 2024 presidential campaign. One high level DHS administrator is reported to have described the environment around the 2024 Democratic National Committee as a “tinderbox.”2
Factors contributing to this landscape include:
1. On July 13th, a lone gunman opened fire on former President Trump in Butler (PA), wounding him on his right ear.
At least two people were critically injured and another person, Corey Comperatore, was killed while shielding his family.
The suspected gunman, Thomas Matthew Crooks, was killed by USSS counter-snipers.
Misinformation regarding the incident continues to spread across social media3. Some conspiracy theories include that the attack was a false flag operation to bolster Trump’s campaign and, conversely, that the USSS intentionally allowed the attack to happen to benefit the Biden administration.
On July 16th, it was reported that US intelligence was tracking a potential Iranian assassination threat against Trump. On August 6th, it was reported that a Pakistani man was arrested (on July 12th) with alleged ties to the Iranian government was arrested and charged in Brooklyn with a murder for hire plot. It is believed that he was attempting to gather allies and work with a hitman to carry out the attack4.
In 2022, a member of the Islamic Revolutionary Guard Corps was also charged by the Department of Justice with murder for hire plot after trying to hire a hitman to kill former National Security Adviser John Bolton5.
2. On August 5th, it was reported that a Virginia man was arrested for threatening to kill Vice President Harris6.
The suspect, Frank Lucio Carillo, made “over 4,300 posts and replies containing threats against Harris, President Biden, FBI Director Christopher Wray and other officials.”
The FBI seized two firearms and thousands of ammunition rounds from the suspect’s home when executing a search warrant.
Two days after the assassination attempt on former President Trump, a Florida man was also arrested for making threats against President Biden and federal officials7.
A woman of color running for president as a major party candidate may incite racially and ethnically motivated extremists (REMEs) and misogynistic extremists.
3. Domestic political tensions are particularly high over the recent felony convictions of former President Donald Trump in NYC, which are viewed by some Trump supporters as illegitimate and a form of political persecution.
Continued denials of President Biden’s 2020 election victory have fueled far-right grievances.
4. Recent controversial Supreme Court rulingregarding securities fraud, gratuities for elected officials, the January 6th riots, and presidential immunity for official acts have created perceptions of corruption, and fears of overreach by the executive branch. This has led to calls for judicial reformation by Democratic politicians, including President Biden.
5. Presidential elections bring social agendas into the limelight, which can catalyze unrest and cultural conflicts across the political spectrum.
The next election could see a major reshaping of civil rights and the role of the executive branch. Abortion, LGBTQIA+, Gun rights, and migrant rights are some of the issues that could be critically impacted.
The Heritage Foundation’s Project 2025 presidential transition plan has stoked fears that a second Trump administration could lead to the enactment of far right policies nationwide, despite his campaign distancing itself from it.
6. The US’s role in ongoing conflicts in both Ukraine and the Middle East continues to fuel domestic unrest (e.g., protests in support of Palestine) and agitate terrorist groups and nation states with strong cyber capabilities (e.g., Russian, North Korea, and China).
A report from the Office of the Director of National Intelligence (ODNI) found that Russia and China may conduct “Malign Influence Operations” to influence election events in a way that would support their goals9.
7. During the first week of July, French and British voters respectively secured leftist and center-left victories. The consequences of these elections are still nebulous, but it's important to note that key allied governments are entering a transition period and may be distracted.
8. Western intelligence agencies are currently distracted by the 2024 Paris Olympics, the Israel-Hamas war, Russian aggression in Ukraine and related cyberattacks, and ISIS-Khorasan exerting its influence outside of Afghanistan.
In addition to this, the investigation of Thomas Crooks and responding to the aftermath of the Butler incident will also likely be a drain on federal law enforcement’s resources.
Escalating tensions with the Houthis in the Red Sea region, Hezbollah in Lebanon, and Iran have created fears of new warfronts opening up in the Middle East. In particular, there are major concerns that Iran will retaliate against Israel for the assassination of Ismail Haniyeh on Iranian soil.
9. D'Vontaye Mitchell died on June 30th after an encounter with security guards at a Milwaukee hotel10. His death is being reviewed by the local District Attorney as a possible homicide. Due to his death’s similarities with the murder of George Floyd, the incident may cause unrest in the area.
Despite these factors and an evolving threat landscape, DHS, USSS, and their partners are well prepared and cognizant of the challenges they face. Law enforcement is also likely even more vigilant in the wake of the July 13th attack on former President Trump. Nevertheless, there are a number of straightforward steps that those traveling and working near the conventions can take to enhance their situational awareness.
Readers are advised that only those with credentials are permitted to participate in the main convention events. Demonstrations and protests are restricted to specific areas.
It is recommended to plan travel routes ahead of time due to road closures and increased traffic.
A small number of events will be open to the public outside of the main venues. Please consult the official convention websites linked throughout this section.
The US Secret Service’s website for the 2024 Presidential Campaign can be accessed here.
For those living or working near the national committees, it’s advisable to subscribe for updates to receive press releases with updated maps, guidance, and restriction information.
The 2024 Republican National Convention (RNC) will take place in Milwaukee (WI), between July 15th and July 18th. Official events for the RNC will be largely held around the Fiserv Forum.
The City of Milwaukee’s official page for the RNC, in addition to a USSS map of restricted areas, can be found here.
The official RNC site and calendar of events is located here. Additional information is also available at this website.
Recent USSS press conference regarding security measures at the RNC can be viewed on this page.
50,000 people are expected to attend the event.
The 2024 Democratic National Convention (DNC) will take place in Chicago between August 19th and August 22nd, primarily at the United Center and McCormick Place.
Official DNC websites can be found here and here.
The City of Chicago’s Office of Emergency Management and Communication (OEMC) also has a dedicated page for the DNC here. The agency has its own mobile app (accessible through the link provided above), which will feature DNC related information and maps.
USSS press conferences regarding DNC security plans can be accessed here and here.
The DNC is also expected to have 50,000 guests.
Readers are advised that protestors are actively seeking closer access to the DNC, as well as a longer marching route11. Be aware that designated protest areas and security perimeters may be subject to change.
President Biden is expected to address the DNC during its first night12.
A multi-agency threat assessment obtained by ABC-7 states that: "Threat actors seeking to target government officials or the DNC could seek to use a range of violent or disruptive tactics against related critical infrastructure sector targets, including, but not limited to, targeted attacks, violent threats, swatting and doxing, mailing or delivering suspicious items, arson, and property destruction13."
Base Operations analysis for both Milwaukee and Chicago indicates that crime peaks during July and August for both cities. This is a common trend during the summer months, likely due to factors such as school vacations, increased pedestrian traffic and opportunities for outdoor activities, and a greater presence of tourists. Readers are therefore advised of the increased risk of common threats such as theft, robbery, and assault.
Domestic extremism is one of the threats the USSS has been preparing for in a “constantly evolving” threat environment14. Domestic extremists can come in the form of organized groups or lone wolves that are harder to identify if they don’t actively share their beliefs (investigators are still trying to determine what Thomas Crooks’ motivations were). While not all extremist groups always intend to carry out lethal attacks or cause mass casualty events, their presence can quickly turn a peaceful protest into one requiring police intervention.
Some considerations regarding domestic extremists include:
In Wisconsin, the Southern Poverty Law Center (SPLC) tracked 28 hate and antigovernment groups during 202315.
4 groups were assessed as being based in the Milwaukee area: Gays Against Groomers, Moms for Liberty, New Order, and Operation Save America.
In Illinois, the SPLC tracked 39 hate and antigovernment groups during 202316.
10 groups were assessed as being based in the Chicago areas: Partners for Ethical Care, We Are Change, Nation of Islam, Euro Folk Radio, Connecting the Dots, Lion of Judah - Jeshurun Lions, NCFM Chicago, United States of America Republic Government, Active Club, and the America First Foundation.
The recent Supreme Court ruling that the Department of Justice (DOJ) improperly charged some of the January 6th rioters17 may be viewed as a victory by extremists and the groups that participated in the riots (e.g., Patriot Front, Proud Boys, and the Oathkeepers).
It’s important to note that extremists pose a risk to all, regardless of where they are on the political spectrum. A report from the Council on Foreign Relations (CFR) found that:
“Many of the same sources of instability and grievances that precipitated the January 6, 2021, assault on the U.S. Capitol (along with other challenges to the outcome of the last election) remain present today. And, while the risk of far-right election-related violence is greater, the possibility of far-left extremist violence cannot be dismissed.”18
Another report from the CFR assessed that far right extremists can be a threat to conservative politicians as well19. Those viewed as not having a hardline stance on certain issues or didn’t support former President Trump in a sufficient manner during the 2020 election have faced threats of violence. Examples include former Vice President Michael Pence and FBI Director Christopher Wray.
If your organization has faced threats from domestic extremist groups, it’s recommended to perform OSINT on Alt Tech sites such as Gab, Gettr, Parler, and Truth Social if you have operations near the RNC or DNC. These sites are less moderated than mainstream social media and often touted as platforms for free speech. Because of this, extremists can feel empowered to post threats, discuss plans and goals, network with other extremists, and advertise in-person events. Alt Tech sites are, therefore, often an ideal means of identifying specific threat actors and activities of concern.
The United States faces continued threats from FTOs. In particular, there has been an uptick in open-source reporting around ISIS and the growing threat posed by its Khorsan branch (aka ISIS-K)20.
Recent ISIS related events include:
1. A series of Taylor Swift concerts in Vienna were canceled after Austrian police foiled a plot targeting the shows21. One of the two arrestees allegedly pledged his allegiance to ISIS22.
Austrian police are searching for a third person that may be an accomplice or had knowledge of the two men’s plans.
A bomb squad detected chemical substances when arresting one of the two suspects; with confirmation pending as to whether the substances could’ve been used to build an explosive device.
The foiled plot is reminiscent of the 2017 Manchester bombing, during which a suicide bomber killed 22 people and injured 119 more during a Ariana Grande concert. The bomber had pledged allegiance to ISIS.
2. In July, a father and son were arrested for plotting a mass casualty event in Toronto on behalf of ISIS23.
Canadian police recovered an ax and machete during the arrest.
3. On July 3rd, NBC reported that White House officials are considering expanding cooperation with the Taliban to address ISIS-K24. The Taliban view the group as a threat to their regime while the US is limited by a lack of intelligence and influence in both Afghanistan and Africa.
A White House source in the article stated: “We have a very, very limited ability to see what they’re doing.”
This lack of intel severely limits early identification and targeting efforts of specific individuals. Security professionals are advised to strengthen on-site deterrence measures and devote extra resources and attention to harden soft targets throughout the duration of the conventions.
4. On June 23rd, a Caucus branch of ISIS is believed to have conducted an attack on churches and synagogues in Dagestan (Southern Russia), leaving 19 dead25.
This follows an attack on Moscow’s Crocus City Hall in March 2024 that left approximately 145 people dead (also attributed to ISIS).
5. Over 400 migrants were brought into the US by an ISIS affiliated human trafficking network26.
Although many of these individuals have been detained or arrested, there are still approximately 50 subjects of concern believed to be in the US.
6. For additional information regarding recent ISIS activity, Base Operations has analyzed the network as part of threat assessments for the 2024 Paris Olympics and Pride 2024.
Although ISIS is a prominent threat, it is not the only FTO that poses a risk to the DNC and RNC. Other Islamic extremist groups (e.g., Al-Qaeda) have been recently angered by the US’s material and political support of Israel against Hamas since 10/7. For more information on FTOs, please review the State Department’s list of active and delisted FTOs. Summary profiles for many of them, provided by ODNI, can be accessed here.
Readers are also cautioned that part of the threat ISIS poses is that it radicalizes people through online propaganda, including teenagers27. Inspired actors can commit attacks without any direct support from the terrorist network.
National conventions, or any large gatherings of political VIPs, are ideal targets for cyber attacks and espionage (both physical and digital). Although the IT networks of political parties may not have classified materials on them, they still have sensitive digital communications that could be used for blackmail, election influence, or to identify additional attack vectors (e.g., a senator’s personal email address and phone number).
Regarding the 2024 elections, Mandiant assessed in a threat intelligence report:
“When we look across the globe we find that the attack surface of an election involves a wide variety of entities beyond voting machines and voter registries. In fact, our observations of past cycles indicate that cyber operations target the major players involved in campaigning, political parties, news and social media more frequently than actual election infrastructure.”28
Cyber attacks played a pivotal role during the 2016 presidential election:
During 2015 and 2016, Russian hackers Cozy Bear and Fancy Bear infiltrated the Democratic National Committee’s network as a means to influence US elections and gather information on the party.
On July 22nd, 2016, a hacker or collective of hackers using the moniker Guccifer 2.0 leaked Democratic party emails on WikiLeaks. The timing of these leaks is believed to have been strategic and intended to harm the Democratic party’s presidential campaign since the 2016 DNC was scheduled for July 25th.
Although the Republican National Committee was infiltrated as well, the hackers chose not to release these emails.
For detailed and technical information about these events, readers can access CrowdStrike’s post-investigation blog post and the Senate Intelligence Committee’s report (which is only partly unclassified).
Those operating at or near the DNC and RNC are advised:
Return any found USB devices or phones directly to law enforcement. Do not plug them into any devices as a means of identifying the owner as the found object may contain malware.
Utilize a power bank and do not charge your device directly from any USB port.
USB ports, even those just for charging, can be infected with malware.
When possible, turn off your phone’s Bluetooth and WiFi capabilities. Also limit or disable capabilities such as Airdrop or digital wallets (e.g., require Face ID or a fingerprint for a transaction) when near the vicinity of the event.
The intent of these measures is to limit the digital signatures given off by your device and reduce the number of ways your phone can be interacted with.
Familiarize yourself with the look of hacking tools such as the Flipper Zero or pwnagotchi.
Although these devices are legal, their presence near the Conventions is suspicious.
Practice good cyber hygiene. The DNC has prepared a comprehensive list here that provides a number of recommendations and practical steps.
Be aware that uncharacteristic lag or poor battery performance may indicate that a device has been compromised.
Additional considerations include:
1. In response to Russia’s actions and disinformation spread by domestic internet “trolls,” the Democratic party has set up a team to actively identify and refute disinformation29.
Security personnel are advised that if your organization is subject to disinformation or conspiracy theories, it may be beneficial to proactively create publicly available resources and webpages to counter this discourse.
2. On July 19th, a faulty Crowdsrike update caused a global IT outage across a wide array of sectors reliant on Windows.
Although a fix was quickly identified, the outage caused billions of dollars in revenue loss.
In the resulting chaos, cyber criminals created a number of fake websites30 and also increased phishing activity31.
Organizations operating in the vicinity of major campaign events are advised to ensure that their IT infrastructure has fully recovered from the Crowdstrike outage and inform employees of the increased cyber threats in its. Additionally, it's advisable to bolster cybersecurity resources throughout the duration of the event.
CNN recently obtained a joint agency threat assessment for the RNC32. Some highlights from it include:
While there’s no credible threat, an unknown individual was seen taking photographs outside of the Fiserv Forum.
Law enforcement believes that threat actors could utilize swatting tactics; making false 911 calls to trigger a law enforcement response at a person's residence.
Swatting calls can have lethal consequences. They also draw resources and specialized teams away from security details.
Since December, there have been at least 4 election officials that have been swatted
Both the FBI and DHS are concerned that peaceful protests outside of the RNC could quickly become violent.
Readers are advised that in addition to terrorist threats, those operating in the area should be wary of general crime patterns. As aforementioned, July historically has an elevated crime rate within Milwaukee. Additionally, the influx of RNC attendees may attract petty crime such as pickpocketing.
The southern districts of Milwaukee have the lowest assessed threat level.
In the southern half of the city, the area with the highest threat level is the city’s downtown area. This area includes the Fiserv Forum, as well as points of interest such as the City Hall, Historic Pabst Brewery, and an array of museums.
Between 1/1/23 and 7/5/24, 61% of crimes reported within the city occurred in the evening and nighttime, whereas 39% occurred during the daytime.
During this same time period, Base Operations analysts also assessed that crime was relatively uniform across weekdays and the weekend, with a slight increase on Sundays (280 average events, 20 above the weekly average of 260 a day).
A Milwaukee Police Department (MPD) report published in April 2024 suggests that homicide rates in the city are declining significantly33.
Despite this, readers should be aware that the city has recently faced issues of clique based violence: small groups less organized than a criminal enterprise or gang that feud with one another20.
The Milwaukee Journal Sentinel maintains a tracker of homicides in the city and their location.
From 1/1/23 to 6/20/24, Base Operations analysts were able to query and examine 11 unrest events for Milwaukee. Although the volume of events is relatively low, it should be noted that they are largely concentrated in the city’s downtown area and in proximity to the Fiserv Forum.
On June 14th, the group March on the RNC 2024 held a protest near the Fiserv Forum and Baird Center. It was protesting for an amended security perimeter so that it can rally closer to the RNC. Regardless of whether this request is granted, those in the area on July 15th should be aware that the group is planning a large march that may cause additional travel delays and greatly increase foot traffic.
Readers are advised that Chicago has historically high rates of homicides and shootings.
During the 2024 July 4th holiday weekend, 109 people were shot in Chicago (19 fatally).35
During 2023, there were 617 homicide incidents in Chicago.36
The Chicago Sun Times has a tracker of victims tragically lost to homicide and map of recent incidents. It can be accessed here.
This violence is fueled, in part, by gang conflicts. Chicago Police Department (PD) publishes its gang maps and readers are encouraged to consult them before planning travel routes and selecting hotels.
Some considerations for navigating Chicago’s gang presence include:
Gang territory is pervasive throughout the city and concentrated in its western and southern neighborhoods. It may be advisable to travel or stay in the City’s northside or parts of its waterfront, where gang territory is more sparse.
The United Center has gang territory to its north, west, and south.
There is a small patch of Gangster Disciples territory directly west of McCormick Place, as well as larger patches of gang territory to its west and south.
Gang territories are subject to change. If you believe that your operations may be directly impacted by gang activity, please contact the Chicago PD directly for the most up-to-date maps.
It's important to note that violence may note necessarily occur within territorial boundaries but also directly between them when rival gangs are feuding or seeking to expand their influence.
Base Operations data on violent crime in Chicago for 1/1/2023 to 6/20/24 closely aligns with the city’s gang territories. Violent crime is largely centered in the south and west of the city, with neighborhoods in the north having a lower threat level. However, it’s important to note that gang presence isn’t the sole driver of violent crime. Threat levels were also high along the city’s central waterfront and the Chicago Loop area; most likely driven up by tourists and high-levels of pedestrian traffic.
There were 2,950 reported crimes and unrest events in the 1 mile radius around McCormick Place. Crime was relatively uniform between the day (42% of events) and the evening/nighttime hours (58%). 791 of these events (27% of the total) were Thefts. 23% of events were violent crimes, with Simple Assault being the most common category (331 incidents).
Public safety and security professionals are advised:
Refer back to the sources provided throughout this assessment. Official guidance and area restrictions regarding the conventions are subject to change.
Contact information for USSS Field Offices can be found here.
Although the USSS is the lead agency for the RNC and DNC, it is prudent to have the FBI’s contact information on hand as well for emergencies and to establish partnerships.
The Cybersecurity and Infrastructure Security provides free toolkits and guidance on physical security topics such as securing public gatherings and vehicle ramming mitigation.
All of DHS’s prevention resources can be searched here.
Readers are reminded that threat actors may resort to low-tech means such as knives and vehicles when firearms and explosives are not easily available.
For those operating within Milwaukee during the RNC, visit RideMCTS.com/Alerts for notifications about public transportation delays and restrictions.
A real-time map of the city’s bus locations can be accessed here.
Organizations with developers can track the city’s streetcar system live by using this API.
For those operating within Chicago during the DNC, Text DNC to 2-2-6-7-8-7 for alerts related to the event. You can also subscribe to emergency alerts for Chicago here. The city government also has a FAQ for the event here.
Are you a security innovator or change-maker interested in the future of corporate security?
Subscribe for Updates.
Based on your article selection above, we believe you would like these additional resources.
Enjoy online or subscribe for our newsletter and get articles delivered straight to your inbox.
Harness the Power of Street-Level Threat Intelligence.
