CCC hoodwinks Law Enforcement with fake intel

This is the hilarious story of how a rag tag group of activists, at Coalition of Concerned Citizens in Memphis, beat intelligence analysts at MPD, TBI, THP and the Fusion Centers at what should be their own game.   They did it not once but several times.   We have new information on the events of April 3rd 2018.

CCC has a history of confusing law enforcement,  from the “Die In” at Mayor Jim Strickland’s house in 2016 which forced several serious errors, to “Operation Oink” in 2017 when MPD massed at Memphis in May while CCC protested at Overton Square, to the first anniversary of the occupation of the Hernando de Soto Bridge, July 2017, when 50 Tennessee Highway Patrol (THP) massed at the Welcome Center for an occupation of the bridge which never came.

The real Rolling Block Party itinerary was a 10:00 AM street blockade at FedEx’s Tculahoma location, the County Jail at 201 Poplar at 2:01 PM and a third protest at the Top Stop convenience store on Springdale, where a black resident had been murdered by a store clerk the previous weekend.   CCC’s operational security was perfect.  The real itinerary was released to supporters on April 2^nd and the true route was never known to law enforcement.

The Bogus Rolling Block Party itinerary

The previous week, on the afternoon of Thursday 29^th March, a false itinerary was planted in a social media source.  The itinerary started at 201 Poplar at 2:01 PM, went on to a 4:44 PM event at Graceland, the site of two protests in 2016, and a 6:30 PM occupation of the Bridge.

CCC was given word by an informant that MPD had sent an email to their collaborators contact list, warning their friends not to be at 201 Poplar, Graceland or the Bridge at the times mentioned.  CCC had a copy of this email on the afternoon of Friday March 30^th.    By all accounts, CCC was tickled pink at the success of their stratagem.

Here’s a redacted copy of a later version of this email which is dated Sunday April 1^st, and was sent to clergy.

Greetings Clergy,

I appreciate your willingness to pray for the peace of our city.

Disturbingly, I received some information circling the internet that threatens that peace. It seems that individuals are planning some disruptions on April 3, 2018 in our city at various locations; 201 Poplar, Graceland, and the Hernando-Desoto Bridge.

These disruptions will cause mandatory response from police – officers must intervene when there are disturbances.

The reasons for these disruptions, in our knowledge, have no direct connection to Memphis. It is our goal and duty to keep Memphis safe and at peace for everyone.

I am urging you, all clergy, to strongly encourage your congregants and public alike, to stay away from these activities, to help maintain peace and order in our city.

I appreciate the continued partnership with our clergy leaders, and let’s please reach out to the public to encourage peace during our MLK50 Celebration. Thank you.

Blessings and Peace,

Officer Tadario A. Holmes
Memphis Police Department
Crime Prevention Unit

Gary Moore’s Open Records Request.

 

Gary Moore, the documentary film-maker behind “Who Will Watch the Watchers”, and an expert on police, submitted an open records request to the Tennessee Department of Homeland Security and received this PDF in response.    We also used Matt Winter’s ORR documents from 2016.  MemphisTruth.org had previously cited the Winter ORR in a post on the Fusion Centers.

We collaborated on the analysis and Gary’s post is here.

Origin of the 2018 Intel.

The earliest email in the April ORR response, from March 30^th 2018, is redacted, with the sender and recipients blanked out.  The email contains this redacted boilerplate disclaimer, on page 9 of the ORR document.

This matches the disclaimer on an email in the Matt Winter document, on pages 14 and 15.

We see that the originator of both sets of intelligence was MPD’s Real Time Crime Center (RTCC).    The 2016 email was sent by Jessica Grafenreed of the RTCC.

MPD’s Real Time Crime Center is a sinister organization, which operates MPD’s Blue Crush systems, including the video wall.  Its political intel gathering operation includes the “Traffic” surveillance van, they are thought to operate the Stingray cell phone eavesdropping system for MPD and they were observed operating a drone over a protest march on 4/4/2017.     In 2016, they also used Geofeedia, an intel gathering platform for social media, which has since been cut off by social media companies for its violations of user privacy.   Having identified the source of the intel, we’ll move on with the April 2018 analysis and come back to the RTCC role in social media spying in the conclusions.

The RTCC emails from 3/30/2018 contain a Powerpoint presentation with several slides from an unknown Facebook source, corresponding to the fake news planted by CCC on March 29^th, and matching the information in the MPD email to its civilian supporters which was intercepted on March 30^th.

 

 

The above images were attached to the RTCC email as part of a Powerpoint deck.

The subject line on these emails was “Rolling Block Party”.

Second source of Block Party intel.

The source redaction in some of the emails included two separate sources.   A second  series of emails included some from early on 3^rd April, when the Tchulahoma operation was still going on.   The subject lines on these 3^rd April emails morphed from “ <redacted> Information Bulletin: Rolling Block Party” in an 11:28 AM email with redacted to and from lines, to an email sent by Fusion Center director John Curatolo at 11:58, where the subject line had been changed to “PRIORITY Urgent: CIU Information Bulletin: Rolling Block Party”.  In this one email, someone forgot to redact the “CIU”, which is the Criminal Intelligence Unit of the TBI, which also houses the Fusion Center.  The CIU is now doing political intel collection, which is not one of their public missions.  The CIU email included a link to Facebook Live video of the FedEx protest and contained the false itinerary that the RTCC has disseminated

There may have been one additional source of intel in the high-level emails, we can’t tell from the information available.    We discount the possibility that the CIU got its information from an on-the-ground spy at Tculahoma.  They did not know of the protest in advance, and they got their information from social media.   There were no secret police at Tculahoma.

It appears that the CIU “Intelligence” operations had captured the same bogus social media information as the RTCC and that the State brass has used those two bogus sources to “confirm” each other.      This is a very basic lapse in tradecraft, as human intelligence is supposed to be distributed to analysts with enough information to gauge the reliability of the source.   They did not know that they were confirming information with the same data from a duplicate LE source.   While CCC has been professional with its operational security and tradecraft, the professionals had been slipshod and had takes CCC’s bait.

Propagation of the fake Block Party intel among Law Enforcement

Except for an initial send to Capt. Jimmie Johnson and Greg Obie, of the Memphis squad of THP, all upward transmission of the intel is omitted from the Moore ORR.  In contrast, the Winters ORR contains a lot of information on intel gathering, including real-time emails from Kevin Bebout, of the Memphis branch of Tennessee Homeland Security, to and from FBI analyst and hula hoop enthusiast Stephanie Juneau, who is attached to the Tennessee Fusion Center at Humphreys Blvd in Memphis, and is a member of the Joint Terrorism Task Force.  The Winters ORR documents the intel traveling up and down the State and Federal LE agencies.   Juneau appears in both the Winters and Moore ORRs.

The Moore ORR does not have any details of the propagation of the raw intel in the LE establishment.  There is a gap between the initial transmission of the data from RTCC on Friday March 30^th until top State police brass are discussing their response on April 3^rd, the day of the protests.    We’ll come back to what’s different between the Winters’ and Moore’s ORRs in the discussion section.

The Influence of the CCC fake intel.

The bogus itinerary reached the top levels of Tennessee Law Enforcement.  Among the consumers of the fake intel named in the Moore ORR:

• Captain Jimmie Johnson III is head of the THP in Memphis, at Jimmie.johnson@tn.gov, located at 6348 Summer.
• Lieut Greg Odie, also of Memphis THP. Gregory.Obie@tn.gov
• Dereck R. Stewart Dereck.Stewart@tn.gov Lieutenant Colonel at the Field Operations Bureau, 1150 Foster Ave, Nashville 37243, which is the address of TN Dept of Safety and Homeland Security and several THP departments.
  On 11 April he was promoted to Colonel and the new head of THP.
• Tracy Trott (Tracy.Trott@tn.gov) Colonel in charge of THP at the time, replaced a week later by Stewart.
• John Curatolo who sent information from TBI’s CIU (Criminal Intelligence Unit) corroborating the fake RTCC intel. He is one of two directors of the Tenn. Fusion Center. Josh Molton is the other co-director.
• Commissioner David W. Purkey is the head of the Department of Safety & Homeland Security, 312 Rosa L. Parks Avenue Nashville, TN 37243(615) 251-5166 David.Purkey@tn.gov Purkey is the highest ranking LE official in Tennessee
• Tennessee Emergency Management Admin. (TEMA) got involved in the to and fro, asking questions about the April 3-4 schedule. Jane.Waldrop@tn.gov, TEMA regional administrator based in Jackson, was in the meetings and emails.
• Michael.Welch@tn.gov, Director of Operations, Region 4, Administration, TDOT
• Kevin.Bebout@tn.gov is an agent of Tenn. Bureau of Homeland Security at the Memphis Fusion Center.
• Other officials: Tony Barham (Tony.Barham@tn.gov) was, at the time, a major in THP, since promoted to Lieut. Colonel.
• Rick Shipkowski (Rick.Shipkowski@tn.gov), assistant commissioner for Homeland Security.
• Jerry Stout    Jerry.Stout @tn.gov, “…in charge of statewide operations. His duties will include support for first responders, communications enhancements, improved terrorism liaison officer contact capabilities, and increased suspicious activity reporting to the Fusion Center.”
• Kathleen.Elberson@tn.gov, Intelligence Analyst at Fusion Center, TBI Headquarters Nashville
• Kevin.Scott@tn.gov, Lead Intelligence Analyst at State of Tennessee, former military.
• Matt.Perry@tn.gov, THP Major in charge of the Nashville THP division. He was liaison to the Tennessee Fusion Center, and coordinator of the License Plate Reader Program.
• Curtis.Mansfield@tn.gov, Captain in THP, based in Madison County.
• James.Hutcherson@tn.gov THP Major in charge of all THP districts of Nashville and parts westward.

There were numerous additional email addressees.  These are the ones we could identify.

In summary, the fake intel was passed from MPD’s RTCC and TBI’s CIU through all levels of THP, TBI, TEMA, TDOT, TN Dept of Homeland Security, the Fusion Centers, and FBI.    The fake intel is discussed at the highest levels, and is the subject of top level meetings in Nashville on April 3^rd.   The entire State security apparatus, and some Federal agencies, are focused on the Rolling Block Party and the Bridge.

What Happened on April 3^rd?

The FedEx, Tchulahoma Rolling Block Party stop.

The Tennesseean reports that Coalition of Concerned Citizens massed at Tculahoma St., near the FedEx hub, a little after 11:00 AM on Tuesday April 3^rd.   There was no police presence initially.  CCC had disseminated the true itinerary to their followers on April 2^nd, using a secure medium which is unknown to us, and there is no sign that law enforcement had intercepted this communication.  MPD uniformed officers arrived about twenty minutes into the event, called for a supervisor and waited for a supervisor to arrive.   The block partiers left after about 25 minutes without the police taking any action.   The 2018 ORR says that police units followed the Block Party to the next stop.

The 201 Poplar County Jail stop.

This Rolling Block Party stop appeared on both the real itinerary and also the bogus version propagated by LE.
Things unrolled very differently at this stop, and MPD decided on a radical departure from their usual protest tactics.   MPD officers have little or no training in riot control.  They have never displayed proficiency in interlocking riot shields in phalanx or turtle formations, or in the use of snatch squads.   Police interventions in previous protests have been ad-hoc, with officers arresting people at random.

At the 201 Poplar protest, MPD deployed a unit which had never before been seen at protests, the Organized Crime Unit (OCU) of the paramilitary Multi-Agency Gang Unit (MGU).    MGU officers are often used in protest details, and they have a characteristic MGU patch, ballistic vest, MPD badge affixed to the vest, and drive obvious police vehicles, with cages, bumpers, sirens and spotlights but no police livery.   OCU officers generally operate in plain clothes and, when they wear uniforms, they are similar to the MGU gear, but the MPD shields are often hung on chains or affixed in arbitrary ways, because the officers usually need to conceal their shields.   They also usually use confiscated civilian cars, although an OCU-emblazoned SUV was seen on April 3^rd. OCU police don’t wear an OCU patch.

 

 

We think that the OCU officers were deployed because MPD brass had decided to perform a snatch squad maneuver.  The regular OCU operations often include mass raids and arrests in drug operations, so the skillset was right.    The objective of a snatch squad is not to make arrests that will hold up in court, but to disrupt protests by taking the leaders out of the picture until the protest is over.

Keedran Franklin, Yuleiny Escobar, Bill Stegall, Ashley Cathey, Ambra Cathey, Spencer Kaaz, Zyanya Cruz and  Elizabeth Vega were all arrested.   Many of them had participated in a mock chain-gang shortly before their arrest, and the group includes prominent protest leaders Keedran Franklin and Spencer Kaaz who were probably targeted as leaders but not in the chain gang theater.   A notable arrest was that of Manuel Duran, a Latino journalist who was wearing press credentials and doing live video at the time.

The arrests, for disorderly conduct and blocking a highway or passageway, and most of the protesters were released on bond the same day and misdemeanor charges are working through the system    The arrest affidavits were all signed by a one of two OCU members.

The sad case of Manuel Duran may have resulted from pique “at the very top of the Federal administration” at the way that Federal and State intelligence services had been flatfooted by CCC.   Soon after the other protesters had been released, Duran was arrested by ICE at 201 Poplar, after his county charges were dropped.   Duran is awaiting deportation in a Louisiana jail.

 

The scheduled third protest of the day was aborted by the snatch squad action.  We don’t know if THP attended the bridge that evening.

Some Conclusions

• The MPD Real Time Crime Center has a new tool using social media for spying on individuals. LE is very sensitive about this and now redacts information about it, which it was not doing in 2016.   They were using Geofeedia in 2016 but this product was terminated in the spring of 2017 when Facebook and other social media cut off its feed.  ACLU and others had targeted Geofeedia as a privacy concern.   It is possible that whichever replacement RTCC is now using has a confidentiality clause in its contract (like Stingray manufacturer Harris and Co has in its LE contracts), or LE is maybe worried the the new product might be pulled, or maybe the replacement product uses NSA or other secret data.  This is the obscure world of governmental privacy infringement, so almost anything is possible.   We’d like to know more  about the Geofeedia replacement.
• The TBI’s Criminal Intelligence Unit is now playing an active role in political intel gathering, using electronic media. This fact also seems to be sensitive to LE.  It may well be the same social media tool MPD’s RTCC is using.
• From the different information path between Winters’ and Moore’s ORR documents, where email was widely used by RTCC and the Fusion Centers to disseminate and escalate the information through the LE establishment in 2016 but some other means was used in 2018, it looks like LE has improved their communications capabilities. This might be an enhancement to the NCIS (National Crime Information System) which has been continually improved since 2003, and whose function is to share LE-relevant information.   It is also possible that they are using a more secure product than email as a stand-alone.
• The rag-tag Coalition of Concerned Citizens has handed out another resounding defeat to the city, state and Federal law enforcement communities, exposing their poor tradecraft, extreme sensitivity over the Bridge and general gullibility and ineptitude. This was just the most recent example of CCC demonstrating the flat-footedness of our police.
• The current FOIA suggests that LE failed to place undercovers in Memphis’s burgeoning activist community. A large number of individuals and organizations had details of the true itinerary on April 2^nd, but there is no sign that this information was acquired by undercovers in any of the affiliated organizations until they monitored live video from the event.   CCC’s operational security looks good.

We thought long and hard before releasing this information, in case some damage might be done to CCC’s operational security as a result.   We concluded that these revelations do not matter, because, if CCC or anyone else talks about going to the Bridge again, the State must defend the bridge or risk a repeat of July 10^th 2016.   This is true whether the information is true or false.   So no harm can come to CCC as a result.   At some point the LE brass will tire of their subordinates crying wolf over the bridge.

We think it’s more important to share information on CIU’s activities, on the new social media tool and on MPD’s new protest tactics.   And on the impact of CCC’s ruse.

The resourceful folks at CCC can step forward and take a bow for a job well done.