The flyer was heavy on drama and ellipses.

“3x as many cops chose to take their own lives last year as died from felonious gunfire… WHY? Evil is real … It has a plan to defeat you …” it said. Then, a quote: “‘The skillful fighter puts himself into a position which makes defeat impossible…’—Sun Tzu.”

This bulletin, uploaded to an Alabama law enforcement website in March 2020 and accessed by hackers this summer, advertised to officers a police training course, approved for seven credit hours by the state police standards and training commission. Titled (in “oriental” typeface), “Sun Tzu and the Officer Resiliency Mindset,” the course promised to use “the epic war tome, The Art of War, required reading for the CIA, U.S. Military Intelligence and the Marine Corps Reading Program,” to examine how ancient wartime tactics “are used to destroy law enforcement officer’s [sic] psychological well-being.”

“This course will share ‘rubber meet the road’ strategies that will armor up warriors psychologically, fortifying them against defeat!”

The flyer is part of 269 gigabytes of data stolen in June 2020 by the hacktivist movement known as Anonymous and published by Distributed Denial of Secrets, a transparency collective. The files, known as BlueLeaks, come from over 250 law enforcement sites, and mostly span from 2007 to mid-June 2020; since their release, journalists have used documents swept up in the hack to shine a light on such malfeasance as the militarized targeting of immigrant rights activists, police–social media company collaboration, and the use of junk science interrogation techniques.

Sun Tzu poster.

Some of the most recent BlueLeaks files—which cover the ongoing nationwide protest movement against racism and policing up to roughly its second week—also shed light on what countless videos and police statements this summer have exposed, and what the Sun Tzu flyer so unsubtly illustrated: that US law enforcement has a warrior complex.

In memos, intelligence reports, and other interdepartmental communications from the days following the police killing of George Floyd, domestic law enforcement agencies, especially those on the federal level, put on display their zeal for War on Terror–style counterinsurgency, their propensity to portray themselves as under constant threat by conniving aggressors, and their willingness—even eagerness—to signal-boost disprovable rumors of dissenters’ violent intentions. Taken together, these documents give credence to one of the central observations of the Black Lives Matter movement: that law enforcement in the United States functions as a military occupation.

At the heart of the Anonymous hack are “fusion centers”—initiatives created in the wake of September 11, 2001, to foster more and better sharing of counterterrorism-related information between federal, state, and local law enforcement. Like so much of the post-9/11 national security apparatus, however, fusion centers have largely failed to live up to their original stated purpose: A Senate investigation in 2012 “could identify no [recent fusion center] reporting which uncovered a terrorist threat.” The investigation found that, among other deficiencies, “fusion centers forwarded ‘intelligence’ of uneven quality—oftentimes shoddy, rarely timely, sometimes endangering civilians’ liberties and Privacy Act protections, occasionally taken from already-published sources, and more often than not unrelated to counterterrorism.”

Reading through the BlueLeaks files from the first days of the protests, this description rings true. They reveal that dozens of fusion centers and similar law enforcement initiatives disseminated documents from federal and state agencies that included transparently flimsy intelligence about the unrest. Many files read as though law enforcement officials were using the fusion centers to play up the dangerousness of the protests and the threats that cops faced as the movement quickly swept the country.

Several “intelligence notes” from the Department of Homeland Security distributed across the hacked websites, for instance, warned police that protesters were stashing “caches” of “rocks, bottles, and accelerants” or “flammable materials, rocks, and other projectiles,” making them ready for “breakaway groups to commit violence.” Rather than the DHS’s own reconnaissance or exclusive briefings from local law enforcement, however, the intelligence notes mostly cited local and national news reports to make these assertions (and one merely cited a “social media user”). Those news reports mostly parroted unsubstantiated claims made by local police—and many of these types of claims turned out to be false, as social media users and police officials across the country mistook construction materials and other common street items for protester weapon stashes.

The “cache” intelligence is an example of the abundant evidence in the BlueLeaks files that federal agencies, at least in the early days of the protests, were relying on public sources of information to fill the pages of their daily briefs—thus creating a messy feedback loop between federal law enforcement, local police, and the press that was ripe for amplifying misinformation.

In another instance, a DHS intelligence note claimed that cops in Minneapolis “were forced to switch to cell phones for tactical communications after learning that their [radios] were being monitored by individuals using publicly available police scanner apps to disrupt law enforcement operations.” The only source cited for the claim was a throwaway line in an article from Coffee or Die, an online magazine sponsored by the “conservative, pro-military, pro-law enforcement, and pro-2nd Amendment” Black Rifle Coffee Company. No other news source has reported that Minneapolis cops had to switch to cell phones during the protest mentioned in the Coffee or Die article; when asked about the claim, a spokesperson for the Minneapolis Police Department told The Nation, “I have not seen the article nor do I have any idea if it was attributed to any person in particular.”

And in yet another example of questionable intelligence work, the San Antonio division of the FBI warned in a “potential activity alert” that as of June 2, “unidentified individuals” had discussed paying people in Bitcoin to “agitate and commit violent acts.” The hiring plan was “rumored to be managed by members of Antifa,” said the memo, which pointed to two websites—crowdsondemand.com and protestjobs.com—as venues “used to facilitate payments to violent agitators.” Crowds on Demand is a Beverly Hills–based company that provides clients “with protests, rallies, flash-mobs, paparazzi events, and other inventive PR stunts,” according to its website—hardly the violent insurrection scene.

Meanwhile, Protest Jobs is a full-on gag—and an obvious one at that—meant to make fun of “paid protester” conspiracy theories. While the website posted a disclaimer that it represents a fake company only shortly before the release of the FBI memo, Internet archives show that other telltale signs that the site is satire were prominently displayed in the days prior. These include an offer for a “Mega-Protest” package that promises between 200,000 and 1 million professional protesters, as well as an “EZ-Riot” package, which the FBI memo summarized neatly: “protest packages…include, but are not limited to, providing spray paint artists, broken storefront windows, and car and dumpster fire upgrade options.” The website also includes sardonic “testimonials” from some of the company’s “professional protesters and protest organizers”:

• “I was a broke college student but now I protest professionally and bring in over $7,000 a week. I was even the President’s ‘Black Guy’ at one event! How cool is that?!”
• “Protest jobs was great work to supplement my trust fund income. I work only 3 protests a year and make over $9,000 for shopping with my girls!”
• “When I needed 3,000 protesters to show up at my America First rally Protest Jobs came through!… Thank you protest jobs!”

Not all of the most recent BlueLeaks documents are so comically satisfying. Many show the alarming sensitivity with which US law enforcement interprets any sort of interference in its operations, such as protesters’ taking steps to protect themselves from electronic surveillance; how police meticulously track protester activity, especially those they tag “antifa” or “extremist”; and how quick federal agencies are to label protesters as violent threats.

In a “field intelligence report” dated May 31, for example, the DHS outlined an incident in which protesters purportedly got their hands on a Minneapolis Police Department portable radio. A protester “pressed the radio’s emergency button twice, sending an emergency signal to dispatch,” according to the report. A protester then broadcast into the radio, “‘stand down…go home,’” soon after which officials deactivated the radio remotely. The report used these two brief actions to label the protester or protesters involved as “violent opportunists.” As such, it alerted law enforcement that “these actors may capitalize on violent extremist narratives often espoused by organized Domestic Violent Extremist (DVE) movements…and may attempt to incite others to violence to provide cover for their own illicit activities.”

Concerns over “extremism” run throughout other memos, some of which seem to designate protester actions as threatening based on their political content rather than any specific calls to violence. A June 5 bulletin from the Colorado Information Analysis Center, a fusion center, lists examples of “recent threats and attacks by anti-government extremists.” On the list is an incident in Denver in which “far-left anarchist individuals vandalized various buildings and structures…with a common anarchist symbol, an encircled ‘A’.” The list also included a “call for solidarity” from the Revolutionary Abolitionist Movement, which merely “referred to the police as ‘pigs’” and bloviated: “All power to the black insurgency! Storm their vulnerable bastions of power! Revolution now and always!”

While the Colorado report conflated violence and political speech, other documents conflated violence with run-of-the-mill protest organizing and safety and privacy precautions. In an intelligence note titled, “Some Violent Opportunists Probably Engaging in Organized Activities,” DHS called attention to the presence of scouts and medics at protests, as well as the use of encrypted communications (some of the most commonly used texting apps employ end-to-end encryption). Meanwhile, a “tactical intelligence report” from the Tampa division of the FBI alerted cops that protesters were monitoring police scanners and disabling fingerprint and face-scanning unlock features on their phones, labeling the practices “sophisticated tradecraft…to impede law enforcement.”

The Tampa FBI report also called attention to protesters’ use of umbrellas, which they’ve used to shield themselves from police’s wanton use of tear gas and other “less lethal” projectiles, and social media posts advising protesters to cover their faces, tattoos, and other identifying features. In New York City, police recently used facial recognition to hunt down an activist the department wanted to charge with assault for yelling into an officers’ ear.

In addition to protester tactics, federal agencies displayed an eagerness to document social media posts that could be construed as even mildly threatening. One “situational information report” from the Los Angeles division of the FBI called attention to a tweet that read, “See a blue lives matter flag, destroy a blue lives matter flag challenge,” to which another Twitter user commented, “Truck with ‘blue lives matter’ crap on it just got all the windows smashed out. Give em hell tonight. #AvengeGeorgeFloyd.” The original tweet had 26 likes and four retweets. The FBI memo referred to the pair of posts as evidence that “civil unrest in response to [the] death of George Floyd threatens law enforcement supporters’ safety.”

In no BlueLeaks documents did The Nation find any recognition among law enforcement agencies that police officers across the country were routinely brutalizing protesters. In fact, what is perhaps the most significant mention of police brutality during the protests came from a June 1 DHS memo, which portrayed claims of cop violence as a project of “foreign influence activity.”

“Russian, Chinese, and Iranian state media outlets over the weekend published articles concerning protest activities across the United States, selectively amplifying content surrounding riots and portraying the country as divided, hypocritical, and racist,” the memo said. “Russian state media outlets particularly emphasized themes alleging excessive police brutality, police attacks against journalists, and claims of systemic racism.”

The BlueLeaks show that when it comes to policing Black Lives Matter, cops will view anything beyond a docile protest march as a threat. (Even the dissemination of information is felonious behavior: The BlueLeaks dump prompted the Department of Homeland Security to internally label Distributed Denial of Secrets a “criminal hacker group,” despite the collective’s claims that it merely published the data after receiving it from an outside source.)

Fast forward to Tuesday night in Kenosha, Wis. Local cops patrolled the streets in armored vehicles, seeking to enforce the city’s 8 pm curfew set in the wake of the police shooting of Jacob Blake. When they rolled up to a group of white men with assault rifles—self-described militia members—they greeted them over one of the armored cars’ speaker systems: “We appreciate you guys, we really do.” An officer in one of the vehicles stuck his torso out of the hatch and tossed a bottle of water to a rifled teenager in a green T-shirt.

Soon after the encounter, the boy in the green shirt, Kyle Rittenhouse, allegedly shot three protesters, killing two of them.

Contrast that with how the demonstrators have been treated. Police see armed militia members as brethren; law enforcement is hungry to feed its warrior complex.