By the time law enforcement officers began evicting residents of the Oceti Sakowin Dakota Access Pipeline resistance camp near the Standing Rock Sioux reservation on February 22, the brutal North Dakota winter had already driven away most of the pipeline opponents. With protesters’ numbers dwindling, along with nationwide attention to their cause, it would have been a natural time for the private security company in charge of monitoring the pipeline to head home as well. But internal communications between TigerSwan and its client, pipeline parent company Energy Transfer Partners, show that the security firm instead reached for ways to stay in business. “The threat level has dropped significantly. This however does not rule out the chance of future attack,” states a document dated February 24, two days after the eviction began. “As with any dispersion of any insurgency, expect bifurcation into splinter groups, looking for new causes.” Indeed, TigerSwan appeared to be looking for new causes, too. As The Intercept has reported, the security firm’s sweeping surveillance of anti-Dakota Access protesters had already spanned five months and expanded into Iowa, South Dakota, and Illinois. More than 100 leaked situation reports provided to The Intercept by a contractor working for TigerSwan describe in detail the firm’s observations of the NoDAPL movement; information obtained via invasive surveillance tactics such as infiltration of protest groups, aerial surveillance, and radio eavesdropping; and efforts to track the movements of individual pipeline opponents. In January and February the NoDAPL movement suffered major blows. On January 24, days after his inauguration, President Donald Trump revived the stalled pipeline by reversing an Obama administration decision that had denied Energy Transfer Partners a key permit. The eviction of the resistance camps followed a month later. Situation reports filed to Energy Transfer Partners in January and February reveal that as the pipeline’s construction neared completion, potentially threatening TigerSwan’s continued relationship with its client, the security company stepped up its efforts to portray the situation as volatile and dangerous. In a document dated February 27, the report’s author made a comparison clearly derived from TigerSwan’s background as a private defense contractor in Afghanistan and Iraq: The archetype of a jihadist post-insurgency is the aftermath of the anti-Soviet Afghanistan jihad. While many insurgents went back to their pre-war lives, many, especially the external supporters (foreign fighters), went back out into the world looking to start or join new jihadist insurgencies. Most famously this “bleedout” resulted in Osama bin Laden and the rise of Al Qaeda, but the jihadist veterans of Afghanistan also ended up fighting in Bosnia, Chechnya, North Africa, and Indonesia, among other places. The “anti-DAPL diaspora,” the document argued, was spreading to Iowa, New York, Florida, and Arkansas. Finding less to report in North Dakota, the company focused in February on individual opponents’ movements to other states and described surveillance of causes as varied as climate change and resistance to incoming President Donald Trump.

Photo: Derek R. Henkle/AFP/Getty Images

TigerSwan became particularly interested in Chicago, and the February documents describe various efforts to infiltrate area activist groups. A February 4 report refers to a TigerSwan operative’s intention to conduct “observation and photographic documentation” of a local protest. Documents dated between February 19 and February 21 describe TigerSwan’s efforts to monitor an anti-Trump protest organized by the local chapter of the Answer Coalition, an anti-war, anti-racism group. “TigerSwan collections team will make contact with event organizers to embed within the structure of the demonstration to develop a trusted agent status to be cultivated for future collection efforts,” notes the February 19 report, which also speculates on the remote possibility of violence at the event. Answer Coalition’s coordinator in Chicago, John Beacham, who organized the protest TigerSwan described, said that while participants were supportive of the NoDAPL movement, it was not the event’s primary focus. “They’re trying to make connections where they aren’t. It’s almost like they’re trying to cast conspiracy theories across the entire progressive movement because they’re sympathetic to the NoDAPL movement,” he told The Intercept. A February 22 document describes an upcoming organizer training put on by the group Lifted Voices: “This would be a good opportunity for us to get someone inside, become known and gather the most current direct action [tactics, techniques, and procedures]. While Lifted Voices is not a #NoDAPL organization, Kelly Hayes has influenced organizing protest events and has spoken at the last two events in Chicago.” “We were pretty aware that, with that number of people in the mix, an agent of law enforcement might be in the room,” Hayes told The Intercept. “So hearing that it was a rent-a-spy that was in the room isn’t that shocking.” TigerSwan also focused on Iowa, and the documents describe in detail the growth there of the Little Creek Camp, built primarily as a space for education and healing. Documents dated between February 22 and February 27 provide updates on the movements of a group of water protectors as they traveled from North Dakota to the new Iowa camp, stopping at a hotel and at one point getting stuck in the mud.