The House Select Committee to Investigate the January 6th Attack on the U.S. Capitol has produced a great deal of material and riveting testimony about what happened that day, and about the actions of former President Trump and his administration. But to date the committee hearings have said relatively little about the many intelligence reports and other warnings that were available before Jan. 6, and why they appear to have been ineffective in helping to prevent what committee member Adam Kinzinger has called “a stain on our history.”
That lack of focus on intelligence may be corrected when the January 6 committee holds a hearing on Sept. 28, as press reports indicate that the Committee may reveal some of what its so-called “blue team,” the group examining how intelligence was analyzed by the FBI, the Department of Homeland Security (DHS), and others, has uncovered. But we don’t have to wait for the next set of committee hearings to begin to understand the intelligence lessons from January 6. Sufficient information is already available — including a January 6th intelligence failure timeline that I published previously –to identify lessons learned for how to avoid such disasters in the future.
The January 6 attack on the Capitol revealed details about U.S. domestic intelligence that few in the public understood before, including how many agencies are involved in collecting and assessing threat information. But the key takeaway is that despite the work of all these organizations, U.S. intelligence was unable to provide an effective warning before the attack. The nation faces what might be called a domestic intelligence paradox, in which domestic intelligence agencies lack tools they need, while the agencies that do have the tools lack the authorities and domestic focus. Unless the Intelligence Community learns from the lessons of January 6 and resolves this paradox, the risk of another failure will persist.
Lessons about Intelligence
A Large Number of Intelligence Agencies
The first set of lessons concerns things we learned about the inside workings of the intelligence business. It often takes a major intelligence failure or scandal to open the black box of intelligence; this happened after the 9/11 attacks, after the failure to properly assess Iraqi weapons of mass destruction capabilities, and after other failures dating all the way back to the Japanese attack on Pearl Harbor. But while those disasters focused attention on major national-level intelligence organizations such as the CIA, the FBI, and military intelligence agencies, the events of January 6 shed light on lesser-known domestic intelligence organizations and offices.
For example, a remarkable number of agencies and organizations were involved in tracking and assessing threats to the Capitol. We would have expected to see the FBI and DHS involved, of course, and they were. It was equally unsurprising to see the Secret Service involved, although we don’t often see their intelligence assessments about specific incidents like this. But we also learned from the January 6 timeline and reporting by organizations such as CREW that a surprising number of other federal agencies produced intelligence assessments before January 6, including the Postal Inspection Service, the Federal Protective Service, the Park Police, and the U.S. Marshals Service Office of Protective Intelligence.
Even more agencies and organizations were involved below the federal level, including the Washington, D.C., intelligence fusion center, which tracked social media activity that threatened violence on January 6, and the Capitol Police’s own intelligence branch, which produced regular reports during the days leading up to the attack. Even the New York City Police Department was involved, providing information on threats relating to January 6 to the Capitol Police and other agencies.
Analysis from Unexpected Intelligence Sources
Another surprising finding was that often the most perceptive intelligence reports and analysis did not come from organizations and individuals closest to the problem, but from those who we might not have expected to be involved at all. For example, the Capitol Police intelligence section and DHS’s Intelligence and Analysis (I&A) organization did not appear as concerned about the threat on January 6 as were analysts at the FBI’s Norfolk office, which published a report on the evening of Jan. 5 that warned about calls for violence and about individuals who were traveling to Washington for a “war” on January 6. Even farther from Washington, an Israeli analyst issued a Dec. 21 Twitterwarning that it was “highly likely” armed militias would attempt to storm the Capitol on January 6.
By comparison, as a Senate staff report noted, DHS I&A “never produced an intelligence product, bulletin, or warning specific to the January 6 Joint Session of Congress.” Although the Capitol Police intelligence division reported regularly on planned demonstrations leading up to January 6, its assessments rated the threat of violence as low. A Capitol Police daily intelligence report published Jan. 4, for example, assessed the chance as low that the demonstrating groups would break laws or incite violence, while another report on Jan. 5 stated that the chance of a major disruption was “highly improbable.” Similarly, a Secret Service intelligence brief on January 4 stated “there is no indication of civil disobedience” concerning protests planned for January 6.
More findings from the January 6 Committee would help us understand why analysts closest to the scene appear to have been unable to recognize threats as readily as other analysts farther from the problem. This could be similar to the widely known finding that often experts are not the best analysts to anticipate or even accept indications of change. In the case of January 6, it could be that analysts at DHS, the Capitol Police, and the Secret Service were simply too close to the problem, and possibly too used to seeing threats that never materialized, to realize that the threat developing on January 6 was something truly new and dangerous.
New Methods of Information Gathering
A third lesson concerns the wide variety of intelligence sources authorities have used to track down the rioters who entered the Capitol on January 6. As the Washington Post reported, the FBI has used the full array of modern digital surveillance tools, including facial recognition, license plate readers (LPR), and cell phone location records. The FBI identified one man, for example, even though he wore a mask in the building and carried his mother’s cell phone rather than his own. But when the FBI got two tips about him, they found surveillance footage of him going through a broken window into the Capitol and taking a selfie with his mask down. They compared his face with a photo from a 2017 passport application, and they found a clip on YouTube of him in a brawl wearing the same jacket he wore into the Capitol. They then used LPR data to show his car had left New York City the night before and was spotted near the Capitol at 2 am on Jan.6.
Intelligence Failure or Success?
Perhaps the most significant intelligence question concerning January 6 was whether more could have been done to prevent or at least prepare for what happened. Was it a failure of intelligence and warning?
A number of intelligence experts, including Michael J. Ard, have argued that it wasn’t a failure. After all, numerous intelligence agencies, news organizations, and private groups warned about the threat of domestic extremism well before January 6, and they also produced more specific warnings, based often on social media, in the weeks and days before the assault. Others see Jan. 6 as a failure of law enforcement, or as a broader policy failure across government agencies at many levels.
But several senior members of Congress have called it a failure, including Carolyn Maloney, Chair of the House Oversight and Reform Committee, who said “This was a massive intelligence failure by the FBI, plain and simple.” Senate Majority Leader Chuck Schumer called January 6 “just a pure intelligence failure.” And intelligence experts have also described January 6 as an intelligence failure, such as former DHS intelligence chief and legendary intelligence community figure Charles Allen, who has written that “The FBI, with the exception of the Norfolk field office, along with DHS intelligence failed in their most fundamental responsibility to warn of the grave threat to orderly federal governance.” Another former head of DHS intelligence, Frank Taylor, has said “There’s no explanation that I can give for the failure to produce analytical products that would have predicted what was going to happen.”
Many critics have, in fact, offered an explanation for what they see as an intelligence failure. Mitchell Silber, former director of intelligence analysis for the New York City Police Department, argues that it was a failure of analysis, rather than of collection, because although there had been a lot of warning available, there was little analysis and assessment of what it all meant. Others have described the problem as a failure of imagination on the part of intelligence analysts. Retired Army Lt. Gen. Karen Gibson, appointed Senate Sergeant at Arms after January 6, has pointed to just such a failure of imagination. So too has Senator Angus King of Maine, who said “There should be people in the Capitol Police who think the unthinkable, who think about what could happen in the mind of a malefactor, and it might be a domestic terrorist or international terrorist or some combination.”
Where to Put the Goalposts?
Discussions about whether this or that incident was an intelligence failure often come down to questions about where to place the goalposts. Is it enough for intelligence agencies to have been working hard on the problem? This was essentially the argument that CIA Director George Tenet made after 9/11 in defending his agency against charges of failure; he said “Failure means no focus, no attention, no discipline,” and because they focused, paid attention, and acted with discipline, they had not failed. But although one can sympathize with Tenet’s point of view, his definition of intelligence failure hardly seems appropriate; it would be like a military commander saying after losing a battle, or a Navy ship captain after running aground – “but we tried really hard!”
Or, maybe it should be enough for the intelligence analysts to provide a warning? The was the argument of Capitol Police intelligence official Julie Farnam, who said, “I think we provided the information. I think we did an excellent job.” But the problem here is that after just about every terrorist attack or other disaster, we learn there were warnings in the pipeline. This is what James Wirtz calls the first law of intelligence failure –after the fact, we can always find a warning. And although intelligence agencies and analysts constantly warn about threats to come, attacks still happen, and disasters are not prevented. It can’t be enough for intelligence just to have warned.
Intelligence success and failure cannot be determined based on the level of effort put in by intelligence agencies and analysts, or by the number of warnings and reports they produce. Instead, the success of intelligence must be judged by whether or not agencies produce the intelligence needed by decision makers –what is commonly referred to as “actionable intelligence.” And when assessed by this yardstick, the key intelligence agencies involved in protecting the U.S. Capitol clearly failed. For example, as the DHS Inspector General reported, DHS did not issue any finished intelligence products or assessments before January 6, and despite the fact that there were many indicators of potential violence, “I&A was unable to provide its many state, local and Federal partners with timely, actionable, and predictive intelligence prior to the U.S. Capitol breach on January 6, 2021.”
Why Did These Warnings Fail to Prevent the Attack?
How could January 6 have happened, despite the presence of so many warnings beforehand? The answer can be found at two levels. First, the intelligence warnings that came in during the weeks and days before January 6 were subject to the same problems that are routinely seen whenever intelligence is used to try to prevent major attacks. Intelligence estimates are always uncertain; even when agencies break an enemy’s codes or have a spy in the adversary’s camp, leaders can never know for sure whether the reports they are getting are valid. Similarly, the intelligence picture before January 6 was very cloudy — for every warning that something bad was brewing, there was another report or assessment that said the situation looked no different from the many other rallies and protests that routinely took place in Washington and elsewhere around the country in previous months.
As a result, these reports appear to have cancelled each other out in the minds of decision makers, especially in the absence of any overall assessment. And leaders appear to have been expecting too much from intelligence. Acting Capitol Police Chief Pittman testified in February 2021 that no intelligence identified “a specific credible threat indicating that thousands of American citizens would descend upon the U.S. Capitol attacking police officers with the goal of breaking into the U.S. Capitol Building to harm Members and prevent certification of Electoral College votes.” And former Capitol Police Chief Steven Sund testified, “None of the intelligence we received predicted what actually occurred.” Few intelligence professionals would claim to ever be able to give such a specific prediction of what is going to happen, and when decision makers have such high expectations for intelligence, they are bound to be disappointed.
We Got the Intelligence We Wanted
But there is another major reason for the intelligence failure of January 6 that is not as often seen in American intelligence, where most of the effort is still today focused on external threats: our intelligence agencies were limited in what they could do by the restrictions we have put in place on domestic intelligence. These restrictions have created a paradox, in that the agencies that have a focus on domestic issues don’t have the tools or authorities they may need to do the most effective job possible, while the agencies that do have the tools don’t have the domestic focus and authorities.
The limitations on domestic intelligence were especially important in the runup to January 6, because much of the intelligence coming in was from social media, and in particular from U.S. citizens. DHS and other agencies were appropriately very wary of reporting on what could be considered citizens exercising their right to free speech. It is very difficult to distinguish between constitutionally protected free speech and actual threats; as then-DHS acting under secretary for intelligence Melissa Smislova testified, “A lesson learned from the events of January 6th is that distinguishing between those engaged in constitutionally-protected activities from those involved in destructive, violent, and threat-related behavior is a complex challenge.”
The DHS Inspector General found that analysts at I&A didn’t feel the information they were seeing on social media met reporting thresholds, even though they recognized there was a significant risk of violence. For example, an Open Source Collector sent a message to a colleague on Jan. 3 saying, “I mean people are talking about storming Congress, bringing guns, willing to die for the cause, hanging politicians with ropes.” But they did not write an intelligence report about it.
Another problem the DHS Inspector General identified was that some I&A analysts said they had been hesitant to report information from open sources following the criticisms of I&A reporting during protests in Portland, Oregon in the Summer of 2020. I&A had been criticized by members of Congress and others for surveilling peaceful protestors and producing intelligence reports on the actions of journalists. As Christian Beckner has noted, in the case of Portland I&A was faulted for going too far in reporting on civil unrest, while with January 6 they were accused of not doing enough.
It may be that if DHS and other intelligence agencies had been leaning farther forward in warning about what U.S. citizens might do on January 6, they would have been criticized for doing so. This suggests that the United States got the kind of intelligence it had thought it wanted, but certainly not the outcome it needed.
What Can We Do about This?
First, we need an official, classified level investigation to confirm these lessons learned. The January 6 Committee may be able to provide such an examination, but it is likely that a more in-depth study will need to be done within the U.S. Intelligence Community.
Second, as a nation, we need to get our arms around the challenges of collecting and analyzing social media intelligence. In particular, we must rethink how to distinguish between what intelligence and law enforcement agencies can collect on, and what is considered free speech and should not be used. DHS began in 2021 an attempt to create a warning system to find threats on social media, without identifying specific individuals. But it continues to be limited in what it can collect, such as not being able to collect on social media posts that are not made public.
As former senior DHS intelligence official John Cohen has argued, DHS may need to take a more forward-leaning approach toward using social media intelligence. There are serious civil liberties issues involved, and any changes will need to be done carefully, involving public discussion and ensuring rigorous oversight mechanisms are in place, especially for any expanded domestic intelligence authorities. But if nothing is changed, and the lessons from January 6 are not learned, the next time a major domestic crisis arises the country could again find that its domestic intelligence policies and organizations are not up to the challenge.
About the Author
Erik Dahl is associate professor of national security affairs at the Naval Postgraduate School in Monterey, California. He is the author of Intelligence and Surprise Attack: Failure and Success from Pearl Harbor to 9/11 and Beyond(Georgetown University Press, 2013), and The COVID-19 Intelligence Failure: Why Warning Was Not Enough(forthcoming with Georgetown University Press). He is a former chair of the Intelligence Studies Section of the International Studies Association, and prior to his academic career he served 21 years as an intelligence officer in the U.S. Navy.