Threat Analysis Report: Imminent Kinetic Actions & Surveillance Operations (27-31 JAN 2026)
1.0 Introduction and Scope
This report synthesizes Signals Intelligence (SIGINT) and other sources to provide actionable intelligence on a series of coordinated activist events planned for January 27-31, 2026, in Oregon. The adversary's activities are timed to coincide with the critical January 30 Department of Homeland Security (DHS) funding deadline, creating a high-volatility environment characterized by escalating pressure on federal law enforcement and legislative bodies.The scope of this report is to detail the adversary's operational plans for a "Week of Action," analyze their sophisticated surveillance and communication architecture, and assess the direct threats to federal personnel and operations. These threats include, but are not limited to, doxxing and targeted harassment, physical interference with law enforcement duties, and the systematic compromise of federal operations through real-time counter-surveillance.To fully appreciate the threat landscape, it is essential to first understand the adversary's organizational structure and guiding operational doctrine.
2.0 Adversary Profile: Doctrine, Structure, and Key Personnel
Intelligence indicates the subject of this analysis is not a collection of rogue actors but a structured, multi-layered insurgency operating under a specific doctrine of "Strategic Defiance." Understanding their organizational hierarchy and guiding principles is critical to anticipating their tactical actions and strategic goals.
2.1 Doctrine of 'Strategic Defiance'
The adversary's core operational philosophy is detailed in their 2026 field manual, "Indivisible: A Practical Guide to Democracy on the Brink." This doctrine of "Strategic Defiance" explicitly instructs members to "operate under increasingly authoritarian conditions" by creating friction for federal operations at every level. A central tenet is the "sand in the gears" tactic, which directs members to actively "block, delay, or distract" federal agents through a combination of legal challenges, legislative pressure, and direct physical interference.
2.2 Organizational Structure
The adversary operates through a redundant, hierarchical system designed to provide financial stability and strategic direction at the national level while enabling tactical autonomy for local cells.
Top Level (National Command)
Indivisible Project (501c4): Provides primary funding, strategic planning, and operational toolkits. It has received substantial grants from entities like the Open Society Foundations, Reid Hoffman, and the Democracy Alliance, with its legal and financial structures incubated by the Tides Foundation. It reported approximately $10.4M in revenue for fiscal year 2024.
Indivisible Action (Hybrid PAC): Functions as the political action wing, raising millions ($4.1M+ in 2025) to fund a primary program aimed at replacing incumbents with candidates they describe as "pro-democracy Democrats with fire in their bellies" or "progressive fighters."
Mid Level (Regional Nodes)
ORD2 Indivisible: The regional command hub for Southern Oregon, coordinating local campaigns and functioning as a bridge to the national apparatus.
Outer East Portland Indivisible: A key command node for the Portland metropolitan area, responsible for leading the planning of high-risk, direct-action events.
Tactical Level (Specialized Cells)
Rogue Valley Migra Watch: Serves as the functional intelligence wing, using standardized protocols to track federal law enforcement movements.
Community Protection Teams: The direct-action wing responsible for deploying "legal observers" and other personnel to physically interfere with or document federal arrests.
2.3 Identified Leadership
The following individuals have been identified as key personnel managing tactical operations within the Oregon theater:| Name | Role | Tactical Focus || ------ | ------ | ------ || Eric Lindquist | ORD2 Co-Leader | Strategic architect of the "Federal Team" and primary liaison with national Indivisible command. || Miriam | South Medford Cell Lead | Primary handler for I-5 overpass actions, which serve as recruitment and staging nodes for Portland-bound surges. || Dasja Dolan | Visual Logistics Lead | Manages "Banner Brigades" for psychological operations and serves as a primary documentarian. || Grace Warner | Surveillance Specialist | A dedicated "Migra Watch" volunteer who monitors federal facilities and documents ICE arrests in real-time. |
This organizational structure enables the adversary to translate national strategy into the specific, scheduled kinetic actions planned for the upcoming week.
3.0 Imminent Kinetic Operations: January 27-31, 2026
The adversary has planned a "Week of Action" designed to escalate pressure on law enforcement and legislators, culminating in a high-risk direct action event targeting a corporate partner. Analysis indicates that each scheduled event serves a specific tactical purpose in a larger operational pipeline designed to move volunteers, deploy "surge teams" from regions like the Rogue Valley to Portland, and transition participants from emotional radicalization toward physical confrontation.The following table outlines the planned operational schedule:| Date | Time (PST) | Event/Operation | Location | Assessed Tactical Objective || ------ | ------ | ------ | ------ | ------ || Jan 27 (Tue) | 3:00 PM | Pretti Memorial/Vigil | SW Portland | Emotional radicalization and surveillance deployment. || Jan 27 (Tue) | 5:00 PM | Ground Truth Orientation | Virtual/Portland | Training new recruits on surveillance technology, including the "Indivisible App" for real-time tracking of federal agents and geo-targeted political pressure. || Jan 28 (Wed) | 8:30 AM | South Medford Banner Brigade | I-5 Overpass | Recruitment and staging for Portland surge. || Jan 29 (Thu) | 3:00 PM | Visibility Messaging | 53rd Ave I-84 Overpass | Psychological operations targeting commuters. || Jan 30 (Fri) | 2:30 PM | "All in This Together" Rally | District Offices | Final pressure campaign before DHS funding deadline. || Jan 31 (Sat) | 2:00 PM | "Screw ICE!" Surge | Home Depot, Portland | CRITICAL - Direct action targeting a corporate partner. |
The Alex Pretti "martyr narrative" is a key component of this week's radicalization effort. Alex Jeffrey Pretti, a nurse reportedly killed by federal agents in Minneapolis on January 24, is being used as a powerful emotional catalyst. This narrative is being weaponized at events like the January 27 memorial to transition volunteers from political advocacy to a mindset that justifies physical interference with law enforcement activities, framing it as "community protection."The following section will detail the technical capabilities the adversary will employ to execute and document these planned actions.
4.0 Adversary Surveillance and Communications Architecture
The strategic effectiveness of the adversary is enabled by a professional-grade digital intelligence network—their "circulatory system." This network is designed to balance public-facing recruitment with the operational security required for kinetic actions, effectively eliminating any operational 'dark space' for law enforcement while maintaining encrypted channels that are invisible to traditional SIGINT until the moment of kinetic contact.
4.1 Intelligence Collection: The S.A.L.U.T.E. Protocol
The adversary's primary human intelligence (HUMINT) gathering tool is a standardized military protocol: S.A.L.U.T.E. (Size, Activity, Location, Unit, Time, Equipment) . By distributing S.A.L.U.T.E. reporting cards and providing training, the organization transforms civilian observers into a functional, decentralized counter-intelligence network. This network feeds real-time data on federal agent movements to tactical teams like "Migra Watch," which then disseminates the intelligence through encrypted channels.
4.2 Communications Doctrine: A Three-Tiered Hierarchy
To manage information flow and maintain security, the adversary employs a structured, three-tiered communication hierarchy.
Tier 1: Public Mobilization
Platforms: Indivisible.org, Action Network, Mobilize.us. Currently executing a strategic withdrawal from X (formerly Twitter) to Bluesky and Threads .
Function: This tier serves as the public-facing "megaphone" for mass fundraising, general recruitment, scheduling public events, and distributing S.A.L.U.T.E. cards to new volunteers.
Tier 2: Regional Coordination
Platforms: Slack, Zoom.
Function: These platforms form the "nervous system" for statewide collaboration and network meetings. They enforce mandatory "digital hygiene" protocols for leaders, including the use of Two-Factor Authentication (2FA) and password managers .
Tier 3: Tactical/Direct Action
Platforms: Signal, Session.
Function: These end-to-end encrypted platforms are reserved for coordinating "sensitive actions." Volunteers are instructed to use usernames instead of phone numbers on Signal to maintain anonymity from law enforcement during real-time "ICE Watch" alerts and command-and-control of kinetic operations.
4.3 Live-Stream and Visual Intelligence Network
The adversary operates a sophisticated "multi-cam" surveillance network with the explicit goal of saturating the operational area with high-definition streams. This capability is designed to "capture and weaponize" any law enforcement response, providing content for propaganda and potential doxxing.
Primary Kinetic Streams: STREETS 4K (YouTube) has been identified as the designated live-stream node for the January 31st "Screw ICE!" action.
Automated 24/7 Surveillance: Stationary webcams, including the KATU News 24-Hour ICE Cam and multiple Gray's Landing residential cams , are monitored by "Migra Watch" volunteers to provide continuous surveillance of federal facilities.
Decentralized Dissemination: Reddit (r/Portland) is used as a central hub for sharing direct links to unplanned "flash" protests, allowing activists to mobilize rapidly while avoiding pre-emptive law enforcement interdiction.The analysis of these technical capabilities leads directly to an assessment of the threats they pose to federal personnel and operations.
5.0 Threat Assessment: Risks to Personnel and Operations
The adversary's doctrine, organizational structure, and technical capabilities create a multi-faceted threat environment for law enforcement. During the January 27-31 operational window, personnel face three critical risks: doxxing and targeted harassment, direct physical interference with official duties, and real-time compromise of tactical operations.
5.1 High Risk of Doxxing and Targeted Harassment
The threat of doxxing is severe and has documented consequences. DHS has reported increases in assaults on ICE officers ranging from 700% to 1,300% , with vehicular attacks rising by 3,200% , directly linking the violence to inflammatory rhetoric and doxxing campaigns propagated by adversary networks. Specific tactics observed and verified through SIGINT include:
Livestreaming pursuits of federal agents from their workplace to their private residences.
Posting agents' home addresses and photographs on social media platforms like Instagram .
Executing the "Neighbor is ICE" campaign, which involves marking officers' homes with slogans like "La Migra lives here" to intimidate them and their families.
5.2 High Risk of Physical Interference and Obstruction
The adversary's "block, delay, or distract" doctrine directly translates to a high risk of physical interference with law enforcement operations. This threat is substantiated by their training materials, which include "de-arrest primers" teaching civilians how to physically extract suspects from federal custody. For the January 31 action, the stated intent is to form a "human corridor" at the Home Depot entrances to obstruct both business operations and any law enforcement response. The 86 arrests already made by the Portland Police Bureau for Riot, Disorderly Conduct, and Interference with a Peace Officer indicate a clear willingness among activists to engage in physical confrontation.
5.3 Critical Risk of Operational Compromise
The combination of the S.A.L.U.T.E. protocol, encrypted Signal channels, and a pervasive public live-streaming network creates a total "panopticon effect" for federal agents. This system provides the adversary with real-time operational intelligence, allowing them to track law enforcement movements, anticipate tactical responses, and alert targets. This capability effectively eliminates the element of surprise for federal operations, critically degrading their effectiveness and increasing the risk to officer safety.This comprehensive threat profile points toward an adversary with clear strategic goals extending beyond simple protest.
6.0 Strategic Assessment and Conclusion
Synthesizing the available intelligence, it is clear the adversary is not merely engaging in protest. They are executing a professional-grade intelligence and influence operation designed to achieve specific, tangible strategic outcomes. Their actions are calculated, their infrastructure is robust, and their objectives are aimed at fundamentally altering the operational landscape for federal law enforcement in the region.The adversary's primary objectives are assessed as follows:
Immediate Objective (Jan 31, 2026): To leverage the high-visibility "Screw ICE!" direct action at Home Depot, amplified by the pressure of the January 30 DHS funding deadline, to force a political and corporate withdrawal of support for federal law enforcement operations in Oregon.
Long-Term Objective: To achieve "institutional replacement." The adversary's stated goal is the "democratization of tools"—turning the state's surveillance and administrative power against itself to create a "'Real Democracy'" that functions as a parallel power structure. Their ultimate end-state is to replace elected officials and law enforcement personnel with individuals aligned with their ideology, thereby gaining long-term institutional control.The threat level for the period of January 27-31, 2026, is assessed as CRITICAL . There is a high probability of direct physical confrontation at planned events, targeted harassment of federal officers at their homes and offices, and systematic attempts to compromise law enforcement operations through sophisticated, real-time surveillance.
