Expert Q&A – The FBI is investigating why 20-year-old suspect Thomas Matthew Crooks target Since former President Donald Trump spoke at a campaign rally in Pennsylvania on Saturday night, largely uninformed social media speculation has fueled a dangerous narrative that seeks to exploit existing political divisions.
“The lethality of anti-government, anti-authoritarian movements has really increased on both sides, and I think we saw that in this attack,” said Jill Sanborn, a former FBI deputy director. Cypher Briefing Just hours after the attack. “Unfortunately, I was a little shocked, but this attack also reinforces what we were seeing.”
Cypher Briefing We spoke with Sanborn and her husband, retired FBI agent Mike Sanborn, who led the White House investigation into the 2011 assassination attempt on then-President Barack Obama. We asked them about Saturday’s attack, the FBI’s investigative responsibilities, and what to expect on the domestic terrorism front.
Cipher Brief: The FBI is going to dig deep into the suspect’s background to figure out what led him to do this. How do all the agencies come together to do this quickly?
Jill Sanborn: In today’s law enforcement community, the power of partnerships and the importance of a task force environment cannot be understated. When something like this happens, people often think of the Joint Terrorism Task Force (JTTF), but it really transcends all threats. I think what we see in this investigation is the power of the task force. Everyone brings a unique capability or a unique database to the game. And you also see a lot of state and local partners and a lot of federal agencies working together to support the investigation here.
And you hit the nail on the head when you said they’re focused on the background of the shooter. That’s a priority for the Secret Service. They’re asking, ‘How do we move forward and make sure that our candidates, our protectees, are protected in today’s environment?’ And the FBI, the organization that’s actually doing the investigation, is looking at who the shooter is. Does he have friends and associates? Is there a bigger threat? Is this a movement? Or is this a lone shooter?
So, those are going to be top of mind for the FBI and their partners right now. And it’s going to be all about search warrants, social media scrubs, interviews with family, friends, colleagues. It’s definitely going to be all hands on deck to get to the bottom of this.
Cypher Briefing: 24 Hour Operation?
Jill Sanborn: 100%. You’ll see it both in the field office and in the headquarters where we have a command center focused solely on this case.
Mike Sanborn: This is the biggest case in the FBI right now. I was the lead investigator on that case. Assassination attempt It was the trial of former President Barack Obama in 2011. So I know a lot about this issue. It’s under the FBI’s jurisdiction now.
Jill Sanborn: There is also a secondary investigation into law enforcement shootings, which is also initiated whenever law enforcement uses a weapon. So you actually have two agencies trying to do two similar things, which is to preserve the crime scene and interview witnesses.
Mike Sanborn: One of the first things we do in a situation like this is secure the scene and recover the bullets and other evidence ballistically. When the gunman fired 13 shots into the White House on November 11, 2011, on the Ellipse, just south of the White House, we had to secure the White House and do a crime scene investigation there. In fact, six months later, we found the bullets that jumped over the White House and landed on the roof of the church. It’s going to be a long, arduous process that won’t happen overnight. It’s going to take weeks.
It’s not just for the president anymore. Are you getting your daily national security briefing? Subscribers+Members have exclusive access to the open source collection Daily Briefing, providing the latest information on global events affecting national security. Becoming a Subscriber+Member benefits you.
Jill Sanborn: And the first tendency is to assume that others are there, because the cost of mispredicting a subsequent threat is so high that we try to prove that assumption wrong rather than immediately assume that they acted alone.
Cypher Briefing: What’s the security situation during the Republican National Convention, which begins on Monday?
Jill Sanborn: I’ve worked on a number of Republican and Democratic conventions, and those are usually pretty powerful events. So they’ve probably already prepared for a lot of people to come to work at those conventions. With the shooting this weekend, they may add to that. But it’s pretty much standard operating procedure when you have a convention, everybody has to show up. The FBI, state, local partners, everyone comes together to try to make it as safe as possible.
Mike Sanborn: There may be a congressional hearing on this issue later. There was a hearing on the White House shooting. How does someone with a high-powered rifle, assuming it is a high-powered rifle, get close to a rally of a major presidential candidate?
Cypher Briefing: Can you give us an idea of how the relationship between law enforcement and social media works in situations like this? The two are not always close.
Jill Sanborn: I have always felt that the relationship between law enforcement and all social media companies is not exactly what is portrayed in the news. When necessary, the relationship is good. I think they are good at preserving information. They know that we are going to investigate here. So if they see something in their system, they will preserve it so that they can follow up with subpoenas and search warrants. I have never had a negative experience with a social media company. They are trying to do the right thing based on their privacy role with their customers.
Mike Sanborn: Most investigators already have a network of contacts, and they’ve probably already reached out and said, “Look, there’s a document coming. It’s not going to happen today, but we need to get in there and do a deep dive right now.” And they understand that. The important thing is to follow up on that document.
Jill Sanborn: This is where the real problem lies. All information is valuable, but it needs to be obtained using the right processes and procedures, not mechanisms that make people feel uncomfortable about how the government obtained the information.
Cipher Brief: The FBI defines domestic terrorism as “violent and criminal acts committed by individuals and/or groups to achieve ideological goals that are of a domestic nature, such as political, religious, social, racial, or environmental.” How do these cases change the terrorism landscape?
Jill Sanborn: We are in an interesting time. The overall terrorist threat, both homegrown violent extremists and lone actors, whether domestic or international, has been our greatest concern over the last several years. I think the warnings that FBI Director Christopher Wray raised in recent hearings and others have said, the international terrorist threat is at its highest level in the last 15 years. The terrorist threat is increasing both domestically and internationally.
Mike Sanborn: The 2011 attempt on President Obama was handled as a criminal investigation, not terrorism, but he was charged with terrorism because he attempted to change political views by committing a violent act, which by definition is “terrorism.”
Jill Sanborn: There are two ways to potentially handle this issue. You could handle it the way they did in 2011, with the criminal investigators, but the DOJ still has all the tools in their toolbox. All the laws that apply to whoever is doing the actual investigative work are still there. Or you could have a terrorism investigator. And again, the same laws that apply are still there.
Cipher Brief: America’s adversaries are quick to jump in and try to incite and misinform what’s already happening. What would you say to help people stay calm and understand how this is going to play out and when to accept what’s real? How do we think about this in a time when our country is so divided? Certain adversaries, especially Russia, never miss an opportunity to mess with what’s already happening. What do you think?
Jill Sanborn: The world today is so accustomed to 24-hour news. We’re so accustomed to instant information that it’s really hard to say to people, “You should be skeptical until you hear actual information from the source that’s doing the investigating.” You should be skeptical until the FBI or law enforcement comes out with a press conference and says this is true. As frustrating as it is, you have to wait for the press conference where the authorities who did the investigating work come out with the news. Anything that’s released is interesting. And it’s always interesting to see how it plays out. But until law enforcement or prosecutors come out on camera and say what they actually know, what they can prove with evidence, unfortunately, you have to think, “This could be true, this could be false.”
Cipher Brief: Partial information fueled by misinformation raises concerns that people may start to feel angry and actually act on that anger before they have all the facts. How can the FBI control that anger and prevent more acts of violence, whether misguided or not, in the name of “retaliation”?
Jill Sanborn: It’s really hard to predict someone’s mobilization. And there’s a lot of debate about what the FBI should and shouldn’t do on social media, right? Half of the country thinks we’re going to be prepared for anyone who’s ‘sucking’ the internet and doing something. And half of the country thinks we shouldn’t be able to see any of the communications that are out there. So it’s really important to make sure that we have the right authorization and that we’re seeing because someone has already claimed us. Because either way, it can be bad. It can seem like we’re not doing enough or, unfortunately, we’re violating rights.
Who’s reading this? More than 500,000 of the world’s most influential national security experts. Want full access to what they’re reading?
Read more expert-led insights, perspectives and analysis on national security in The Cipher Brief. Because national security is everyone’s business.
