The bulletin states that homegrown violent extremists, either inspired or directed by Syria-based operatives, represent the most likely ISIL threat to the homeland. Sent to more than 18,000 law enforcement agencies around the country, the bulletin warns that such extremists, "could seek to replicate the effects of the Paris attacks using similar weapons and tactics, although on a smaller scale."
Authorities believe the Paris attackers practiced a "high degree of operational security" and may have planned their attack in Belgium "outside the purview of French security services," and that a cell phone found by French authorities likely associated with an attacker contained encrypted applications, "likely intended to make it difficult for security services to exploit the contents."
Soft targets in the U.S. continue to be a vulnerability ISIL may try to exploit, according to the joint assessment. "We judge ISIL will almost certainly consider a diverse selection of soft targets for attacks in the West - including in the United States - that extend beyond targeting government, military, and law enforcement officials and facilities, based on the target selection in the attacks and other recent plots in the West."
Officials remain concerned about people from the U.S. who connect with violent extremists overseas because they "could gain combat skills...and possibly become further radicalized or persuaded to conduct organized or lone offender violent extremist-style attacks, potentially targeting the United States and US interests abroad," according to the bulletin.
ISIL supporters "who may be located in the Homeland continue to have the ability to conduct relatively unsophisticated attacks with little to no warning," the document states.
The document also shares the assessment that ISIL plots involving multiple teams of operatives with members who have trained in Syria or Iraq are "more likely to occur in Europe and other overseas locations than in the United States," due to to geographic and societal factors.
ISIL, the document states, "may expand efforts to conduct attacks against soft targets based on the success of the Paris attacks," but authorities are "unaware of any intelligence indicating any active, credible ISIL plots of the type seen in Paris targeting the Homeland."
The social media messaging campaign praising the Paris attacks and encouraging new attacks like in videos released in the past week referencing targets such as Times Square and Washington, D.C., are expected to continue, though the bulletin states similar videos released previously were deemed "aspirational in nature."
The bulletin calls for increased vigilance by state, local and private sector partners and the difficulty of detecting pre-operational indicators or behaviors which might indicate planning for an attack. "We face an increased challenge in detecting in-progress terrorist plots by individuals or small groups acting quickly and independently or with only tenuous ties to foreign handlers."
The document makes reference to a foiled attack in which police in Germany disrupted a possible plot against a sporting event because of a tip by an alert hardware store clerk. The clerk called police after he noticed a couple had purchased an unusually large amount of hydrogen peroxide, a chemical used to make the powerful explosive TATP, according to the bulletin.
The document reminds authorities to be aware of suspicious activities such as people who appear to be conducting surveillance, expressing unusual interest in security or a sharing media glorifying violent extremist acts.