When the largest Dakota Access Pipeline resistance camp in North Dakota was forcibly shut down in February, the work of TigerSwan, the private security company hired by Energy Transfer Partners to guard its property, appeared to be nearly done. Then the pipeline was hit by several acts of vandalism targeting valve sites along the route. Starting in mid-March, saboteurs snaked down the line, piercing holes in exposed parts of the pipeline and setting equipment on fire. The vandalism, which disrupted completion of the pipeline, created new work for TigerSwan. But the company did more than deploy additional guards along the line — it also embarked on a multistate hunt for the culprits. By early May, TigerSwan had a pair of suspects. “The best assessment based on the known facts is that the attack was most likely conducted by Iowa activists; Jessica Reznicek and Ruby Montoya,” states an internal report dated May 4. On July 24, Reznicek and Montoya claimed responsibility for the sabotage. Standing in front of an Iowa Utilities Board sign, the two women read a joint statement: “After having explored and exhausted all avenues of process, including attending public commentary hearings, gathering signatures for valid requests for environmental impact statements, participating in civil disobedience, hunger strikes, marches and rallies, boycotts and encampments, we saw the clear deficiencies of our government to hear the people’s demands.” “We are speaking publicly to empower others to act boldly, with purity of heart, to dismantle the infrastructures which deny us our rights to water, land and liberty.” Reznicek and Montoya then turned to the utility board sign behind them, and using a crowbar and a hammer, they began to remove its letters, prompting Iowa State Patrol officers to arrest them. They were charged with fourth-degree criminal mischief for damaging the sign and released on bond two days later.

Explaining the timing of their confession, Reznicek and Montoya referred in their statement to a phone call from The Intercept that they viewed “as an opportunity to encourage public discourse surrounding nonviolent direct action.” The Intercept had contacted the two women to give them an opportunity to respond to allegations about their involvement in the valve sabotage included in daily situation reports that TigerSwan prepared for its client Energy Transfer Partners. For at least two weeks in May, Reznicek and Montoya had been a primary focus of TigerSwan’s work, as operatives attempted to track their movements, sharing their photos and other identifying information with employees at hardware stores, hotels, and gas stations, and passing intelligence they collected to local law enforcement and the FBI, according to the reports, among more than 100 provided to The Intercept by a contractor working for TigerSwan. At the time this story was published on August 26, Reznicek and Montoya had not been charged in connection with any of the vandalism for which they claimed responsibility. TigerSwan was founded amid a private security industry boom, its business driven by U.S. government contracts supporting the nation’s wars in Afghanistan and Iraq. With its Dakota Access Pipeline contracts, agents applied the tactics they had honed in wars abroad to an environmental and indigenous rights movement based in the rural American Midwest. “Our concentrated focus is the massing of intelligence (digital and ground) to find, fix and eliminate one person from the ‘detachment’ who will lead us to the arrest and conviction to the remainder of these terrorists,” TigerSwan wrote on May 4, echoing a phrase, “find, fix, finish,” used by U.S. special operations forces in so-called targeted killing campaigns in Yemen, Somalia, and Afghanistan. The firm used the term “detachment” to refer to a group of anti-DAPL activists they believed were operating outside of protest camps. But as with the U.S. targeted killing program, TigerSwan’s surveillance operation frequently reached far beyond its mark, sweeping up dozens of individuals in its hunt for a few and casting suspicion on pipeline opponents who say they were uninterested in property destruction. Previously unreleased documents from March, April, and May — which the company referred to as “fighting season” — reveal that while protest activity had substantially died down, TigerSwan only escalated its efforts to convince Energy Transfer Partners that threats remained. In its reports, TigerSwan indicated to its client that agents could keep the pipeline safe by deploying infiltrators to influence activists’ actions, monitoring private residences connected to pipeline resistance, and recruiting employees at local businesses to help keep watch. The Intercept spoke to dozens of individuals mentioned in the documents, many of whom were disturbed by TigerSwan’s language and tactics. Several denied the accuracy of the reports. According to people whose activities were described by TigerSwan, the company misidentified their places of work and positions within tribal communities, misinterpreted disputes, and erroneously claimed that a protest encampment was armed. In multiple cases, the documents placed individuals at locations they said they had never been. A former TigerSwan contractor, who declined to be named out of fear of legal consequences, told The Intercept that the threats described in the situation reports were often inflated. Reports were framed based on “whatever sounded better for the company to put forth to ETP,” the former contractor said. “They were using scare tactics.”

Robert Cross Crocked Eyes of the Lakota Nation addresses supporters of indigenous rights gathered at the Colorado state Capitol during the Native Nations March in Denver on March 10, 2017. Photo: Jason Connolly/AFP/Getty Images

“Dictate the Battlespace” In early March, the media spectacle created by protest encampments and police violence at Standing Rock faded as national attention shifted to the chaotic Trump administration. But the NoDAPL movement lived on. Some water protectors started smaller encampments along the route, including the Little Creek camp in Iowa and the Takini, or Native Roots, camp in South Dakota. A busload of young people began crisscrossing the nation and giving talks, calling themselves the “Rolling Resistance.” And individuals who had called the large Oceti Sakowin camp home for months left North Dakota searching for their next move. TigerSwan continued to monitor many of them, but the company didn’t just watch — the spring situation reports are more explicit than those obtained by The Intercept from earlier months in descriptions of activities that went beyond observation into intervention. A March 5 report, for example, describes TigerSwan agents engaging in a vehicle pursuit of Tawasi, a DAPL opponent with a large social media following who helped coordinate media for the anti-pipeline Sacred Stone camp in North Dakota. As the activist drove through an industrial area in Patoka, Illinois, near the pipeline’s endpoint, agents used what they described as vehicle posturing to “manipulate” his direction of travel and “persuade Tawasi to take an alternate route.” Indeed, a live video Tawasi posted on Facebook at the time aligns with the company’s description of the incident. “He’s following us now — the [mercenary is] following us,” Tawasi says in the video. “I think we need to go and go to a diner or something and just go somewhere where we can be in public.” Only when Tawasi entered the freeway did TigerSwan call off the pursuit “in order to ensure to avoid a possible high speed chase.”

TigerSwan agents on the ground also sought to disrupt Little Creek and Takini by undermining public perception of the camps, priming local residents to assist with surveillance, and sowing internal discord. As a report from March 1 puts it, referring to members of Little Creek, “Their operational weakness allows TS elements to further develop and dictate the battlespace.” As The Intercept previously reported, around the time that Little Creek opened in February, videos began appearing on Facebook pages called Defend Iowa and Netizens for Progress and Justice featuring an individual named Robert Rice, who failed to disclose his link to TigerSwan. A September 22 document noted that Rice had assisted TigerSwan in developing an information operations campaign. He didn’t just warn area residents that Little Creek members might be dangerous — at least one video also encouraged people to send tips to the administrators of the Facebook page on what they were seeing and hearing about the camp.

Camp members felt the impact of TigerSwan’s efforts. “Law enforcement was warning people in the vicinity that they should lock their doors,” recalled Christine Nobiss, one of the founders of Little Creek. “When the Netizens videos came out, there were locals that stopped talking to us because they were scared.” Neither TigerSwan nor Rice responded to requests for comment on the videos. Energy Transfer Partners spokesperson Vicki Granado told The Intercept, “We were not involved in any way with Robert Rice.” TigerSwan’s reports repeatedly claimed that agents, at times posing as protesters, held sway over camp members. “Reporting officer has convinced some activists to leave Little Creek Camp and settle in the more forward-looking Native roots camp,” TigerSwan wrote in April. At that camp, the document notes, “Reporting officer was able to increase existing divisions between the Native American groups and Hippie group, which is a thinly veiled Marxist commune led by ‘Travis.’” Not long afterward, another report suggested that “it would be relatively simple to disband the camp internally, by inserting divisive rumors, as well as information operations on social media.”

Hunting the Valve Saboteurs On March 13, TigerSwan described the first valve incident. “At approximately 430 PM/1630 today a hole, roughly 1/4 in diameter was produced by some type of torch or stick, was discovered on IA Valve 430.” Days later, five more damaged valves were discovered in Iowa and South Dakota, according to TigerSwan’s reports.

As far as the security firm was concerned, the valve incidents were more than property destruction: They were acts of terrorism with potentially dire environmental consequences.

Pipeline infrastructure expert Richard Kuprewicz, who serves on an advisory committee of the Pipeline and Hazardous Materials Safety Administration, told The Intercept that burning a hole in the valve could indeed cause serious problems if damage to the empty line went undiscovered and oil began to flow. But Kuprewicz, who reviewed the DAPL project on behalf of Earthjustice last year, also said TigerSwan’s claim that the resulting ecological damage “would be far worse than anything DAPL could have accidentally caused” was “not an accurate statement.” The company’s frequent references to eco-terrorism echo rhetoric that law enforcement agencies first widely adopted in the aftermath of 9/11. As the U.S. government’s definition of terrorism expanded, agencies like the FBI and Department of Homeland Security established new information-sharing partnerships with “critical infrastructure” industries, including the oil industry. A legal complaint filed on Tuesday suggests that ETP agrees that Dakota Access Pipeline opposition represents a terroristic movement. The 187-page complaint accuses Greenpeace and an array of other anti-pipeline entities of racketeering and defamation, characterizing NoDAPL as driven by “a network of putative not-for-profits and rogue eco-terrorist groups who employ patterns of criminal activity and campaigns of misinformation.” TigerSwan repeatedly sought to collaborate and share information with local, state, and federal law enforcement agencies investigating the sabotage, the documents show.

The FBI declined to comment on its investigation or any meetings that took place with TigerSwan. Mike England, a spokesperson for the federal Department of Homeland Security, said the only contact the agency had with TigerSwan was when the company reported valve vandalism on March 13 and March 17. A spokesperson from the Iowa Department of Natural Resources, Alex Murphy, said the agency met TigerSwan for an intelligence-sharing meeting regarding DAPL in March, but had no further contact. Mark Schouten, director of the Iowa Homeland Security and Emergency Management Division, said that such conversations are “generally classified at a ‘secret’ level” and noted that the existence of a pending criminal investigation into the valve incidents further prohibited him from commenting. “We spend a great deal of our time talking with the private sector, because 80 percent of the nation’s critical infrastructure is held in the hands of private sector entities,” he said. “Frankly, the nature of our discussions are dependent on us holding their information confidential.” TigerSwan’s March and April reports reveal wide speculation about the culprits behind the vandalism, blaming the sabotage at various points on Tawasi; residents of Little Creek; the Mississippi Stand group, of which both Reznicek and Montoya are members; and the Rolling Resistance.

In an interview with The Intercept, Tawasi denied involvement in the valve sabotage. “I want to be a law-abiding citizen, and I make a point of behaving that way, because I don’t want to go to jail,” he said, adding, “I’d lose my ability to be a mouthpiece.” He said he was unaware of any contact he had with the FBI, although, he noted, “I suspect that people who are in my daily life are either agents or operatives or mercenaries.” Christine Nobiss vehemently denied the accusations levied against her and the Little Creek camp. “I don’t do anything illegal at all,” she said. At the camp, she added, “All we did was argue a lot, buy goats, and try to build a sustainable community.” Stuart Perkins, who traveled with the Rolling Resistance, said the group was never involved in any valve sabotage. As TigerSwan hunted the valve culprits, the Takini camp in particular became a talking point used to paint the NoDAPL movement as growing increasingly radicalized even as it shrunk.

Takini was located on private property, yet the reports fixate on allegations that its members were armed. The landowners “wish to develop the land into an armed resistance sustained community,” an April 16 document notes. “The arming of the groups within the camp are not at 100 percent, but each native familial-group has individual weapons.” TigerSwan identified Frank Archambault and Aidoneus Bishop — “the ‘Viking’ nut job” — as running the operation. Archambault, who was at the camp, said he and others had discussed whether the local community should hire security for self-defense, to protect against a proposed temporary housing site for pipeline workers in the area, known as a “man camp.” In North Dakota’s Bakken region, man camps have been linked to sexual violence and drug trafficking. “The thing about the weapons is false,” he told The Intercept. “I am a felon, and I cannot possess weapons, especially firearms.” Archambault also said he had never heard of any plans to damage valve sites or other property. Bishop, meanwhile, who goes by Viking, told The Intercept he had never even visited the camp and has not left Washington state since January. “I wish I was there,” he said. Bishop is tall, red-haired, and known for wearing a neon orange jacket. “I’m pretty easy to spot.”

The reports also claimed that a nonprofit called Sustainable Settings had offered to purchase weapons for the Takini camp, and Angela Ohmer and Phyllis Bald Eagle had planned a trip to Colorado to make arrangements. “Wow,” Ohmer said in response to the allegation. “It’s not true.” She said she did travel to Colorado, but met with the organization to discuss camp design. A member of Sustainable Settings said the group had only provided consultation in designing a sustainable community. The camp was created as a “healing space,” explained Amos Cook and Phyllis Bald Eagle, the native couple who own the land where Takini was set up. They called TigerSwan’s repeated claims that the camp was armed “funny” and “not true.” “Me and my wife, we are praying people, as our ancestors were,” Cook added. “We have no reason to have any weapons.” Spring was “when things started to get more crazy,” said the former TigerSwan contractor of the sinister light in which the situation reports cast activists’ activities. “It’s kind of amateur. You thought it sounded good, but it just made us sound like idiots.” “Use as Many Locals as We Can” At the end of April, TigerSwan reported that a burned-up Bobcat front-end loader was discovered at a valve site in Iowa. Within a few days, “the valve was torched” at another Iowa site. “The times have changed, nothing can be taken for granted anymore,” says a TigerSwan report submitted April 28. After a surveillance camera reportedly captured individuals cutting through a fence surrounding a South Dakota valve, where no additional damage was done, TigerSwan became convinced that Montoya and Reznicek were behind many of the incidents. Reports from the beginning of May describe how Reznicek smashed a window at the office of defense contractor Northrop Grumman in 2016 — for which she was arrested and charged with criminal trespassing and criminal mischief. “This was her turning point in the escalation of force,” one document states. “Most recently, Reznicek and Montoya participated in a fasting ceremony in order to ‘gain wisdom in dismantling the DAPL pipeline.’” TigerSwan’s hunt only became more sprawling as it zeroed in on its suspects. The company began sending agents into area businesses, showing employees images of the two women. In one case, the spouse of a hotel employee claimed to remember Montoya, saying she recalled the activist’s “smell” and that she was taken from the hotel to an area hospital. Montoya denied ever visiting the hotel or any hospital during that time. A May 9 document describes using digital surveillance to monitor the women and locating residences of Reznicek’s family members in Iowa that were believed to be “potential hiding places.”

Operatives scoured hardware stores, searching for the location where the culprits bought their tools. But the images passed around weren’t just of Reznicek and Montoya. Members of Little Creek were also posed to store employees as suspicious characters. And, according to the reports, two employees at stores agreed that they’d seen Nobiss or her partner, Lakasha. “If members of Little Creek Camp purchased the supplies, they likely used Christine Nobiss’s Indigenous Iowa credit card. (TigerSwan is in possession of Nobiss’s credit card information and can potentially match it to receipts),” a May 5 report states. Two other reports from the period note that TigerSwan captured drone footage of the Little Creek camp. Nobiss was alarmed to hear that the company had obtained her credit card information, and said that she kept her distance from Reznicek and Montoya because of their participation in acts of civil disobedience. As for visiting the hardware store where she was allegedly spotted, she said, “I don’t even know where that store is — that’s a complete lie.” She added that she suspected racial profiling was at play in the employees’ identifications, since both she and Lakasha are native. Lakasha also denied the accuracy of the reports. “The feeling of being surveilled doesn’t bother me so much, because I have nothing to hide,” Nobiss said. “What does bother me is the inaccuracies in these reports.” “A lot of this stuff is not really happening; it’s just them guessing,” she added. As they had done since the beginning of the Standing Rock protests, TigerSwan operatives on the ground kept track of vehicles they deemed to be suspicious — sometimes simply for driving in the vicinity of the pipeline at slower speeds. They listed license plate numbers and other identifying details in a “Be On Look Out” list, known as “BOLO,” and used the mobile app WhatsApp to warn their network in real time when they sighted a suspicious car. They also shared that information with law enforcement, as well as local landowners, gas station attendants, construction crews, and store employees they had recruited into their surveillance effort. In South Dakota, TigerSwan personnel began meeting with residents near the pipeline, asking them to be on the lookout and recording their names and contact information in the reports. “Use as many locals as we can to further our oversight on the valves,” a TigerSwan operative noted on May 5.

TigerSwan itself admitted the zealous effort yielded little of relevance. “Security personnel have been diligently reporting any suspicious vehicles,” a May report notes. “All reports at this time have not been anything resulting in malicious activity. All reports have been linked with either curious people or ETP inspectors.” But in one case, the company’s information sharing led a sheriff’s department in South Dakota to arrest someone TigerSwan operatives falsely suspected to be Montoya. “Description of the driver fits Ruby Montoya’s physical features. The woman had a brief conversation with the guard, was very upset, told the guard to stop following her, and sped off,” TigerSwan reported in a May document. TigerSwan then shared the license plate information with the Minnehaha County Sheriff’s Office, despite the fact that the same document also reported spotting Reznicek and Montoya in Des Moines, Iowa, demonstrating at a drone base. “As of today, the vehicle has been found and the sheriff’s department has the driver in custody. The driver was arrested because the plates that were on the vehicle did not belong to that vehicle. We are currently waiting to hear back on the driver’s information to determine the driver’s identity,” TigerSwan wrote. Contacted for comment, the Minnehaha County Sheriff’s Office provided an update on the arrest described in TigerSwan’s report. “Quite frankly, she was in the wrong place (with substitute plates on her vehicle) at the wrong time,” Sheriff Mike Milstead noted in an email. He said people often use such plates when they can’t afford a renewal fee. Regarding the department’s contacts with DAPL security, he said, “We really had very limited contact and events. We had a couple of vandalisms to the wellheads or whatever, but other than that, it went off here relatively with little, if any, problems.” Meanwhile, in Illinois, TigerSwan surveilled the private residence of Susan and Bradley Stanton, a native couple who had gone to Standing Rock and occasionally welcomed water protectors on their property. A report dated May 7 includes two Google Earth images of the couple’s property in Nauvoo, Illinois, as well as grainy photos taken at much closer range that show their home from behind a fence. “On site, the frame for a sweat lodge was discovered behind a shop,” the report states.

Reached by phone, Susan Stanton was shocked to find her home and sweat lodge in a TigerSwan report. “Why would they even pick on that? That’s so bizarre,” Stanton told The Intercept. “I’m not hiding. They can take pictures of my home. I don’t have anything under wraps,” she added. “If they wanted to come here, I’d show them around. I’d put them in the sweat lodge if they wanted to go and pray.”

Photo: Scott Olson/Getty Images

Counterinformation Ops Outside of the valve hunt, TigerSwan’s surveillance spread beyond the boundaries of the NoDAPL movement, portraying a range of progressive efforts as threatening. “Illinois activists have switched their current focus from the environment to the POTUS and recent combat activity in Syria,” a TigerSwan operative reported in April. Yet the firm continued to closely monitor those groups. “Chicago is a key indicator of the ongoing rise of the progressive movement and the hub of the financial support for that movement,” another report noted. Describing a pipeline divestment proposal presented to the Chicago City Council, TigerSwan wrote: “It will also affect the platform of the Democratic party, pushing it further left.” TigerSwan also pushed to expand its efforts at shaping the public narrative around the pipeline, pitching its client regularly on the need for a counterinformation campaign. “Chicago continues to foster continuance of the Narrative of Standing Rock,” an operative wrote on May 4, pointing to an issue of Scholastic News, a magazine distributed to elementary school kids, that featured water protectors on the cover. “The schools in the suburbs are now providing students with indoctrination of the same Standing Rock Narrative that the Native Americans are all being systematically repressed and discriminated against.”

All the while, TigerSwan sought contracts for new pipelines, and messaging efforts similar to those faced by Iowa’s Little Creek camp have begun to surface in other states where Energy Transfer Partners has a presence. In August, pipeline opponents in Pennsylvania and Louisiana discovered videos posted on local Facebook pages dedicated to criticizing anti-pipeline activists, called PA Progress and Louisiana First. As The Intercept confirmed in earlier reporting, TigerSwan operatives have been working on the ETP-owned Mariner East 2 Pipeline, slated to run through Pennsylvania. In Louisiana, ETP is seeking to build the Bayou Bridge Pipeline, which would deliver crude from the Dakota Access Pipeline to the refineries and ports of the Gulf Coast. The first video, posted on August 8, features a young man named Josh Baker warning Pennsylvania residents of the dangers associated with an anti-Mariner East camp called White Pine. The second, posted August 11, accuses an anti-Bayou Bridge activist in Louisiana of organizing protests for profit. It features the same man, who this time introduces himself as Brent Williamson.

“We’re asking people in the area to please stay away from [members of the camp] if you see them. And if you see anything suspicious, call the number below,” says “Josh Baker,” listing the number of Pennsylvania’s Huntingdon County sheriff. TigerSwan did not respond to questions about the videos, nor did administrators of the PA Progress or Louisiana First pages. ETP spokesperson Vicki Granado told The Intercept that the company had no involvement with either Facebook page. Meanwhile, the chair of TigerSwan’s advisory board, retired Maj. Gen. James “Spider” Marks, has been criticized for failing to disclose his link to the security company in a number of op-eds denouncing protest activities related to ETP projects. After learning of Marks’s affiliation with TigerSwan, the Pennsylvania news outlet PennLive promised his work would not appear on its website again. Yet a new Marks op-ed appeared in the Washington Examiner on August 23, referring to the valve sabotage and stating, “If Islamist terrorists had sabotaged a U.S. oil pipeline, held a press conference to claim credit for their crime, then punctuated their declaration by defacing government property, it would be a national news story.” In recent months, TigerSwan’s efforts to obtain new business have been stymied by increasing scrutiny from regulators. In June, citing documents published by The Intercept, the North Dakota Private Investigation and Security Board sued TigerSwan for operating without a license for the duration of its work in that state. In July, the company was denied a license to operate in Louisiana. In Illinois, meanwhile, the Department of Financial and Professional Regulation had no record of TigerSwan even seeking a license, a Freedom of Information Act request revealed, despite the company having operated in the state for several months. TigerSwan is appealing the Louisiana decision and fighting the North Dakota suit, demanding the state pay the firm’s attorneys’ fees. In legal filings, the company denied providing private security services at all in North Dakota, instead describing its activities as “management consulting.” “Contrary to what has been alleged on the internet and elsewhere, the reports were not a summary of TigerSwan’s security and investigative activity,” a filing reads. “Except for information gathered by TigerSwan in North Carolina, the information was gathered by other companies hired directly by the client and the client’s contractors.” TigerSwan also denied that it “placed or attempted to place undercover private security agents within the protest group to carry out investigative and surveillance activities” in North Dakota. TigerSwan did not respond to The Intercept’s requests for comment for this story. “We do not speak for TigerSwan,” ETP’s Granado told The Intercept. “I can confirm that we do use TigerSwan as an adviser for some of our security programs, however, beyond that we don’t discuss details of our security initiatives, which are designed to ensure the safety of our employees and the communities in which we live and work.” In its suit accusing DAPL opponents of racketeering, ETP counts Reznicek and Montoya among members of a massive “enterprise” led by Greenpeace. The suit alleges that the two were “incited by the enterprise’s misinformation campaign” to vandalize the valves. The law firm representing the pipeline corporation is Kasowitz Benson Torres, which was started by Trump’s longtime private lawyer Marc Kasowitz. Kasowitz drew criticism this summer when he responded to an email from a stranger encouraging him to resign. “Watch your back, bitch,” he replied.

Jessica Reznicek sits in an Iowa State Patrol car after she was arrested for prying letters off an Iowa Utilities Board sign in Des Moines on July 24, 2017. Photo: Brian Powers/The Register