US | High terrorism threat around November elections

• Any attacks would probably be crude and target sites or individuals involved in the electoral process

We assess that isolated terrorist attacks around general elections on 5 November are likely. The US authorities have already said they expect a ‘heightened threat environment’ during the election period. Right-wing extremists (RWE) have discussed violence around the polls, based on our monitoring of extremist activity online. Already-severe polarisation and the intensification of this by foreign disinformation campaigns will probably sustain an urgency among extremists to mount attacks at least until the inauguration in January 2025. Our terrorism threat level for the US is high.

Around the 2020 election, extremists mounted various acts of violence, including trying to disrupt the electoral process in Washington DC. But members of groups such as Oath Keepers and Proud Boys are concentrating on operating in their local or state communities, according to several US-based extremist monitoring groups. Election sites and individuals involved in the electoral process in swing states are the most likely to be targeted, based on the Department of Homeland Security’s (DHS) 2024 Homeland Threat Assessment.

Nevertheless, we do not anticipate raising our countrywide terrorism risk rating from low; this means that exposure to an attack is unlikely. This is because state and federal law enforcement agencies are very likely to be at a very-high state of alert ahead of and around the polls, following the storming of the Capitol by supporters of former president Donald Trump in January 2021. They have been adept at identifying and disrupting major attack plots in recent years, and this is likely to remain the case over the coming months.

Deepening polarisation to sustain high terrorism threat

Charged campaign rhetoric by politicians and activists will almost certainly amplify the already-febrile political and social climate in the US. This is evident in the RWE online channels and forums that we monitor; in several instances, users have characterised the upcoming election (and specifically its outcome) as a pivotal moment in the country’s history. For instance, one user wrote last week that ‘November 5 is the beginning of the end’. Biden and Trump have characterised each other as a threat to the future of the country.

Disinformation campaigns carried out by foreign state actors will probably augment political and social tension in the country as well. In their 2024 threat assessment reports, DHS and the Office of the Director of National Intelligence (ODNI) identified China, Iran, and Russia as the most likely states that would engage in this type of activity. These agencies have warned that they will attempt to influence the US election this year to support their interests and goals by mounting disinformation campaigns around contentious social issues. Based on our monitoring of open sources, these will probably include immigration, access to abortion, and LGBTQ+ rights.

RWE most likely to mount terrorist attacks around the election

Among extremist groups, RWE are the most likely to carry out attacks around the election. Our monitoring of extremist channels and forums online suggest that members of these groups are particularly active. We have not seen any public evidence of this leading to real-world activity so far, nor have federal officials warned of any active plots or threats around the election. In our analysis, this is probably because the polls are still seven months away. And based on our monitoring of online extremist activity over the past week, the calls for violence around the election we have seen have been largely vague and generic.

Unlike the 2020 presidential election cycle, RWEs appear to be primarily focused on local-level activity, rather than coordinated national campaigns. Non-profit reports on domestic extremist activity in recent years suggest that these groups transitioned to local activity because of extensive federal investigations into individuals who took part in the storming of the Capitol building in 2021. These same sources suggest that groups such as the Proud Boys and Oath Keepers have determined that they are more likely to successfully disrupt local election proceedings, than national ones.

Antifa, short for anti-fascists, is likely to be the main left-wing extremist group active around the election. The group consists of a network of activists whose stated goals are to oppose fascism, capitalism, law enforcement, and government overreach. We have seen little evidence of these users issuing explicit calls for attacks around the election; this is consistent with their activity during the 2020 election. We do not anticipate this appreciably changing before November.

Terrorism threat to remain high in swing states

An act of terrorism around the election would probably involve a RWE actor mounting an isolated attack, rather than a high-impact coordinated incident. This is consistent with FBI and DHS intelligence assessments cited in the press over the past year. Our data also suggest that of the 42 RWE attacks we have recorded since 2021, all of them were carried out by a lone actor or very small group.

RWE actors would probably seek to target local election-linked sites and individuals to disrupt the democratic process. Based on the DHS 2024 Homeland Threat Assessment, voting locations, government facilities, ballot box locations, campaign events, and political party offices are among the most probable targets, given their role in the electoral process. In our analysis, these local sites are ideal targets because they usually have limited security measures in place.

A terrorist attack around the election would most likely consist of an isolated shooting carried out by a lone gunman, based on incidents of political violence that have occurred in recent years. In addition to the use of firearms in low-impact attacks, our data suggest that other tactics perpetrators would potentially use include:

• Doxxing (to publicly identify or publish private information about someone as a form of punishment or revenge) candidates, workers, officials, and officials’ family members
• Issuing fake bomb or shooting threats against federal and local election-related sites
• Perpetrating acts of arson against election sites and infrastructure (such as ballot drop boxes)
• Physically attacking or abducting candidates, workers, officials, and officials’ family members (four men were convicted in 2022 of plotting to kidnap the governor of Michigan in 2020, though they do not seem to have been motivated to act by the election that year)

We anticipate that Arizona, Georgia, Michigan, Nevada, North Carolina, Pennsylvania, and Wisconsin are where these would likely occur, given that the results in these swing states have been decisive in determining the outcome of recent presidential elections. In the event that these tactics are used, they would very likely lead to brief (several hours to a few days) disruption to local election operations or proceedings.

Looking beyond election day

We assess that a major incident of violence intended to disrupt the electoral process, such as occurred on 6 January 2021, is unlikely. The arrest and prosecution of more than 1,200 individuals involved seems to have caused extremist groups and actors to reevaluate the costs of participating in actions of that type. The arrests also seem to have led to distrust and paranoia within online extremist communities, based on our monitoring of extremist online channels and forums in recent years.

Inauguration day on 20 January 2025 is also likely to be a flashpoint for extremist activity. This is particularly likely if the election results are challenged. In this scenario, the uncertainty around the legitimacy of the results would probably deepen conspiracy theories about the fairness of the election. And given that the authorities would almost certainly try to resolve any challenges immediately, some extremists would probably act urgently to alter the outcome according to their view.

Local, state and federal authorities will probably be at a very-high state of alert to prevent any major incidents of violence. After 6 January 2021, there have been official hearings into the security failures that occurred during that day. These have prompted law enforcement agencies to update and expand their planning procedures, intelligence gathering capabilities and intelligence sharing practices, based on press reports. We assess that these efforts will probably succeed in thwarting any major incidents of political violence.