The following brief has been prepared to complement Base Operation’s threat assessment for the 2025 Presidential Inauguration. The discussed events and global developments provide a number of lessons learned and considerations for both immediate and long-term security posturing. Investigations into many of these events are ongoing and it is advisable to also consult trusted news sources for updated information.
Major Domestic Incidents
On December 4th, 2024, Brian Thompson, CEO of UnitedHealthcare, was assassinated in Midtown Manhattan outside the New York Hilton Midtown. The suspect, Luigi Mangione, was arrested on December 9th in Altoona (Pennsylvania). He has received several federal and state charges in both New York and Pennsylvania, including First-degree murder in furtherance of terrorism (New York).
Mangione appears to have been motivated by enmity towards the US healthcare system and medical complications from receiving a back injury.
It is believed that Mangione used a ghost gun and a 3D-printed suppressor to carry out the attack, as well as a bag with Faraday cage properties to avoid electronic tracking.
Although Mangione acted alone and currently poses no physical threat, the ongoing publicity around the assassination and his court case perpetuates the risk of copycat activities by lionizing him. His actions were met with some degree of support on social media by those with grievances against the healthcare system, their insurance providers, and corporations, creating a distorted image of Mangione as a folk hero. some text
Officials have attempted to mitigate this by appealing to decency and reminding the public that political violence contradicts American values. Some social media platforms have also taken action to ban or moderate content that praises or glorifies the violence.
Security personnel are advised that there may be a prolonged period of elevated risk for copycat attacks against executive personnel, both within and outside the healthcare industry. In regards to the Inauguration, President Elect Trump has received donations for the festivities from a number of large tech companies (e.g., Meta, Amazon, OpenAI, and Uber), as well as hosted a number of tech leaders at Mar-A-Lago during the Post Election season (e.g., Tim Cook). Extremists wishing to carry out copycat attacks may be incited by relationships between the incoming administration and corporate leadership.
In addition to increasing executive protection measures, it is advisable to regularly conduct OSINT searches to identify potential threat actors with grievances against the organizations or individuals your team is responsible for. Publicly facing information that helps dispel misinformation, disinformation, and conspiracy theories may also be a useful mitigation measure.
On December 25th, 2024, the FBI disrupted an alleged plot against an AIPAC (American Israel Public Affairs Committee) office in Plantation, Florida. AIPAC advocates for Israeli causes among US politicians and is often the focal point of conspiracy theories and anti-semetic rhetoric.
The suspect, Forrest Pemberton of Gainesville (Florida), was arrested with three firearms (including an AR-15 style assault rifle). Before departing his home, he left a “goodbye” note with relatives and stated that he wanted to “stoke the flames.” It’s believed that he planned to commit a mass casualty event during Chaunnakuh at the AIPAC facility.
On January 1st, 2025, at least 14 people were killed and dozens injured when a terrorist drove a pickup truck through a crowd on Bourbon Street in New Orleans.
The suspect, Shamsud-Din Jabbar, was inspired by ISIS and flew an ISIS flag on the back of his truck when committing the attack. Jabbar was a US citizen and army veteran based in Houston (Texas). He was killed by police after opening fire on them, despite wearing a helmet and body armor.
Jabbar also planted improvised explosive devices (IEDs) in coolers within the vicinity of the Bourbon Street area, two of which have been recovered by the FBI.
It appears that the suspect wore Meta Ray Band smart glasses to film the area while conducting reconnaissance during a previous trip to the city, allowing him to blend in and obfuscate his activities.
The FBI, at the time of reporting, believes that Jabbar acted alone. Nevertheless, the Bureau is following up on potential leads as Jabbar had traveled to Egypt and Canada, as well as visited New Orleans before the attack.
Outside of trying to exploit the large crowds celebrating the New Year, Jabbar likely wanted to impact the Sugar Bowl game scheduled for later that day (which holds significant value to the local community).
In light of the attack, the city’s upcoming Mardi Gras celebration has been designated a SEAR 1 event by the Department of Homeland Security. It will receive enhanced federal support, including canine teams and air security.
On January 1st, there was also an attack at the Trump Hotel in Las Vegas. A driver drove a rented Tesla Cybertruck outside the lobby of the hotel before a cache of fireworks, gas canisters, and camping fuel detonated within the vehicle. The driver was killed, but there was limited damage and no further deaths (although some people experienced minor injuries).
The suspect is believed to be Matthew Livelsberger, an active-duty Green Beret.
FBI Deputy Assistant Director Christopher Raia stated: “At this point, there is no definitive link between the attack here in New Orleans and the one in Las Vegas.” Outside of being members of the military, both Livelsberger and Jabbar used the Turo app to rent the utilized vehicles.
There are no indications that there are further explosives in the Las Vegas area or that Livelsberger had an accomplice/a nexus to a terrorist organization. In a letter recovered by authorities, Livelsberger wrote that the act was not intended as a terrorist attack but as a “wake up call” for America. He wanted the country to rally around President-Elect Trump and Tesla CEO Elon Musk, arguing that the US was “terminally ill and headed toward collapse.”
The FBI’s Special Agent in Charge (SAC) for Las Vegas stated that Livelsberger was most likely suffering from PTSD and mental health issues, describing the situation as “a tragic case.”
Global Incidents and Developments
Magdeburg Christmas Market Attack
On December 20, 2024, a man drove an SUV into a crowded Christmas market in Magdeburg, Germany. Five people were killed and nearly 235 injured. The suspect is a 50 year old psychiatrist, Taleb Al Abdulmohsen, who came to Germany in 2006 from Saudi Arabia. Al Abdulmohsen eventually renounced his Islamic faith and began sympathizing with alt-right causes, fearing that Germany was becoming an Islamic country.
Before the attack, Al Abdulmohsen telegraphed his increasingly Islamaphobic views online and also exhibited signs of severe mental illness. A clear motivation for the December 20th attack has yet to be determined.
The suspect took advantage of a road and egress points left open for emergency service vehicles, allowing him to bypass anti-vehicle measures. This has led to criticism of the city’s security planning and highlighted the need to review current approaches to anti-ramming defenses.
The Resurgence of ISIS
ISIS, or the Islamic State of Iraq and Syria, is Foreign Terrorist Organization (FTO) defined by its Salafi jihadist ideology and adaptability. It gained attention after quickly and brutally seizing territories in eastern Syria and northwestern Iraq, forming a Caliphate between 2014 and 2019. It took over three years and over 25,000 airstrikes conducted by a broad coalition of nations to dislodge ISIS from Iraq alone.
In March 2019, ISIS lost its final stronghold during the Battle of Baghuz Fawqani, largely eliminating its conventional military power and claims to statehood. It now operates in a more clandestine nature, with at least 19 branches across Asia, Africa, and Europe (with additional cells and operatives worldwide). Where the organization's true threat now lies is its ability to effectively leverage online propaganda and radicalize disaffected people. This includes the use of popular platforms such as TikTok to influence youths.
ISIS also distributes digital manuals and guides on how to inflict casualties with low tech devices, such as edged weapons and vehicles. This empowers actors with limited skills and experience to become more lethal and evade detection. Altogether, ISIS doesn’t need to have any direct contact with a person to further their agenda; something which impedes detection and targeting measures by law enforcement.
Since the withdrawal of US soldiers from Afghanistan in 2021, Western intelligence and military agencies have lost significant intelligence gathering capabilities in the region. This has enabled the Khorasan branch of ISIS (aka ISIS-K) to establish a strong base in Afghanistan and launch a number of high profile attacks. This includes an attack on the Crocus City Hall in Moscow (Russia) in March 2024 that killed over 130 people. ISIS is also becoming a growing concern in Africa, particularly Somalia. In October of 2024, the chief of the US Africa Command commented that ISIS forces in northern Somali had doubled within a year. On December 31st, 2024, Somali forces repelled a large-scale and sophisticated attack against one of their military bases in the Puntland region. Within Afghanistan, ISIS-K continuously launches attacks against civilians (religious minorities), Taliban officials, and foreign tourists.
In December 2024, a rapid offensive by Syrian rebels forced the resignation of President Bashar Al Asad. Many Syrians have welcomed this development due the former President’s abuses of human rights and corrupt practices. However, this sudden change has also created uncertainties about Syria’s political future and a power vacuum in areas of the country; creating concerns about a potential ISIS resurgence. Both France and the US have stepped up strikes against the terrorist organization.
For further information, a Congressional Research Service (CRS) brief on the situation in Syria can be found here. As of 12/13/24, CRS puts ISIS’s limited territorial sphere east of Tadmur and west of Deir ez-Zor. This region is largely underpopulated and rural in nature, a testament to ISIS’s diminished conventional military strength.
Outside of street level intelligence, Base Operations Enterprise Dashboard provides granular population estimates across the world. Light blue hexagons reflect low-population estimates, whereas magenta hued ones are higher. Areas without hexagons reflect land without a permanent population presence. Historically, rugged terrain has allowed terrorist groups such ISIS and al-Qaeda to be resilient against air strikes and land forces.
One of the few population centers within this area, As-Sukhna (or Al-Sukhnah), has been heavily impacted by conflict. Between 12/9/23 and 12/10/24, the town (with a population just over 16,000 within its immediate core) experienced 94 unrest events, 84 of which involved political violence or military activity. These were partly defined by Russian airstrikes against ISIS, as well as Asad’s military forces attempting to clear the town of ISIS operatives. On 12/10/24, though, ISIS forces executed 54 members of Asad’s former military nearby the town (immediately after the regime collapsed).
Within a matter of weeks, As-Sukhna experienced a number of violent events and clashes, illustrating the dynamic nature of events unfolding in Syria.
Base Operations personnel have been tracking the returning threat of ISIS throughout 2024. Readers are strongly encouraged to read previous Base Operations threat assessments for additional information on ISIS activity earlier in 2024. These assessments are linked below:
Al-Qaeda (AQ), similarly to ISIS, has benefited from waning Western intelligence capabilities and influence in Afghanistan and Africa. According to the US National Counterterrorism Center (NCTC), the terrorism network has five affiliates that help it generate and project its power: “al-Qa‘ida in the Arabian Peninsula (AQAP); al-Qa‘ida in the Lands of the Islamic Maghreb (AQIM) and its Sahel branch, Jama‘at Nusrat al-Islam wal-Muslimin (JNIM); al-Shabaab; al-Qa‘ida in the Indian Subcontinent (AQIS); and Hurras al-Din (HaD)—operate across the Middle East, Africa, and South Asia.” The terrorist organization is viewed as a major resurgent threat. Ken McCallum, chief of MI5, the United Kingdom’s domestic security and counter-intelligence service, stated that AQ is targeting Europe once again and capitalizing on conflict in the Middle East to gain support and amplify calls for violence.
AQ affiliates also appear to be forming alliances with the Houthis in Yemen. Formerly enemies, the two terrorist groups are now collaborating against common enemies and further mutual business interests. This includes smuggling operations with al-Shabaab so that the Houthis can have a steady supply of necessary materials for its drones, which pose a threat to Israel and critical international shipping routes.
AQ and its affiliate branches have gained notoriety throughout 2024 for a number of high-profile attacks in Africa that reflect the persistent threat it presents.
In January of 2025, the 152nd Engineer Support Company of the US Army National Guard began its deployment to Djibouti as part of American efforts to monitor and deter both ISIS and AQ groups in Africa.
The US’s military presence in Africa has been disrupted by a number of factors:
President Trump pulled troops out of Somalia in 2020, a decision that President Biden reversed in 2022. There’s now uncertainty as to whether the 2nd Trump administration will withdraw troops once again. Doing so would severely limit counterterrorism operations in the area while eroding trust with local leaders that may no longer view the US as a reliable partner.
In September 2024, US forces withdrew from Niger after the country experienced a coup and the new government began to closely align itself with Russia. In response to this, the US has moved forces and assets to countries such as Chad, Côte d’Ivoire, and Benin. Nevertheless, the withdrawal in Niger has greatly impacted the US’s ability to counter terrorism in the continent. Niger’s alignment with Russia, also limits opportunities for intelligence sharing and joint operations. Subject matter experts have also raised concerns that Russian forces in Africa have limited counterterrorism experience and capabilities. Additionally, they have raised concerns that Moscow may have major difficulties sustaining its Africa Corps or lack the political will to do so.
In late September, AQ affiliate Jama’at Nusrat al-Islam wal-Muslimin launched an attack on an airport in Mali, setting fire to the President’s airplane and a number of UN Humanitarian Air Service planes. The terrorist group also attacked a paramilitary police training center in Faladié. Security experts expressed concern that the group has the capabilities to launch such large-scale attacks against military targets (pivoting away from random attacks on civilians).
On August 24th, AQ affiliate Jama’at Nusrat al-Islam wal-Muslimin massacred at least 600 civilians in Burkina Faso that had been ordered by their government to build fortifications around their village of Barsalogho. A French official stated to CNN that in Burkina Faso “armed-terrorist groups are enjoying increasing freedom of action because security forces are unable to cope.”
On August 3rd, an al-Shabaab operative committed a suicide bomb attack against a beach hotel in Mogadishu (Somalia), killing at least 32 and wounding 63.
Mogadishu (Somalia) has been frequently subjected to unrest. Between 1/1/24 and 12/10/24, Base Operations assesses that there were 259 acts of political violence within the city’s core. The government’s weakened hold on the country has allowed groups such as al-Shabaab to take root and grow in strength. Not all of al-Shabaab’s activity is defined by high-profile and mass casualty events. It also targets and intimidates civilians as well.
For further information, the Institute for the Study of War has this primer on Jihadist activity in the Sahel. The Congressional Research Service also has a brief related to the current status of AQ here.
Key Takeaways
Security teams are advised of the following:
Events in Magdeburg, New Orleans, and Las Vegas underscore the importance of anti-vehicle defensive measures.
These defenses must incorporate emergency egresses and pathways for first responders, but not at the expense of creating a major vulnerability.
The potential use of vehicles to transport explosives rapidly to a target before immediate detonation also highlights the need to keep vehicles reasonably away from pedestrian entranceways and other chokepoints.
Terrorism, foreign and domestic, remains a persistent concern that will almost certainly grow throughout 2025.
With limited US reach into Afghanistan, ISIS-K will likely remain largely unchecked. From its base in Afghanistan, it’s well situated to disseminate digital propaganda, train forces, and destabilize the region by challenging the Taliban in parts of the country.
Although US and European forces are proactively striking ISIS targets in Syria, the country’s rapid regime change may open up opportunities for the terrorist network to seize small areas of the country or cause devastation.
Security teams are strongly cautioned to limit any corporate travel to Syria until the political situation stabilizes. Travel to neighboring Turkey, despite its stability, should also be reconsidered within the immediate future while ISIS is being contained.
In Africa, both al-Qaeda and ISIS are growing threats that could also be left relatively unchecked if the Trump administration pursues a more isolationist foreign policy.
Security teams with assets and personnel in Africa are advised to closely monitor these developments. They are also cautioned that both AQ and ISIS have enormous enmity towards Westerners and Western influence, making them specific targets for violence.
Domestically, the initial months of President-Elect Trump’s second term will likely be categorized by dynamic political action and a number of divisive measures (e.g., massive deportation plans and anti-transgender policies). This may catalyse political violence and unrest, both in support of and against the incoming administration.
Teams with personnel and assets nearby Trump organization properties and sites of political significance may benefit from additional resources during the first quarter of 2025.
Security teams are also advised to implement permanent or long-term enhancements to executive protection measures in light of Brian Thompson’s assassination. Copycat assassins may be inspired by Mangione or wish to gain a similar level of notoriety. Political rhetoric regarding class warfare, as well as perceived ties between President-Elect Trump and business elites, may also serve to incite threat actors.
Based on your article selection above, we believe you would like these additional resources. Enjoy online or subscribe for our newsletter and get articles delivered straight to your inbox.
.jpeg)
.png)