Prepared for: blog.roninsgrips.com Date of Assessment: July 1, 2026 Subject: Intersection of the September 2026 Threat Environment and Local Law Enforcement Intelligence Degradation

1. Executive Summary

As the United States approaches the 25th anniversary of the September 11, 2001, terrorist attacks in September 2026, the domestic security apparatus faces an increasingly complex, decentralized, and multi-vector threat environment. The convergence of resurgent Foreign Terrorist Organizations (FTOs), highly active Domestic Violent Extremists (DVEs), and advanced nation-state cyber actors creates a risk landscape that is simultaneously global in origin and highly localized in execution. Simultaneously, the operational capacity of the domestic intelligence architecture—specifically the localized “early warning” networks established in the immediate post-9/11 era—has been compromised.

A protracted, multi-year staffing crisis within local law enforcement agencies has forced municipal and state executives to systematically reallocate personnel from specialized intelligence, counterterrorism, and investigative units back to primary reactive patrol functions. This ongoing workforce attrition, characterized by spikes in resignations among mid-career personnel and a wave of senior retirements, has precipitated a loss of institutional memory and tacit community knowledge. The degradation of local intelligence capabilities directly and negatively impacts the efficacy of federal joint operations, notably the Federal Bureau of Investigation’s (FBI) Joint Terrorism Task Forces (JTTFs) and the Department of Homeland Security’s (DHS) state-level fusion centers.

Consequently, as adversarial tactics shift toward localized, opportunistic attacks with compressed radicalization timelines, the national security apparatus is experiencing a widening visibility gap at the municipal level. The loss of human intelligence (HUMINT) and pre-incident behavioral monitoring at the street level severely elevates the probability of undetected extremist mobilization in the months leading up to the September 2026 milestone.

2. Strategic Threat Environment: The September 2026 Horizon

The current threat matrix is defined by a distinct shift away from singular, highly coordinated, mass-casualty aviation or infrastructure plots toward decentralized, rapid-mobilization violence. This tactical evolution is occurring against the backdrop of highly symbolic temporal milestones, large-scale public events, and heightened geopolitical friction.

2.1. The 25th Anniversary of 9/11 as an Operational Catalyst

Anniversaries of major historical events routinely serve as catalysts for extremist mobilization, acting as focal points for both adversarial propaganda and operational planning. The 25th anniversary of the 9/11 attacks in September 2026 represents a generational milestone of significant symbolic weight. For FTOs, it offers an opportunity to demonstrate enduring relevance, ideological resilience, and operational capability despite a quarter-century of Western counterterrorism pressure.¹ For DVEs, the anniversary serves as a highly visible, emotionally charged backdrop against which to project anti-government, accelerationist, or ethnically motivated violence.

The demographic reality of the United States has shifted significantly since the attacks; an estimated 100 million Americans alive today—representing roughly one-third of the U.S. population—have no lived memory of September 11, 2001.³ This demographic shift has necessitated extensive educational and commemorative campaigns by organizations such as the 9/11 Memorial & Museum, aiming to educate younger generations on the consequences of terrorism.³ The legislative branch has also elevated the profile of the anniversary, with the bipartisan House passage of H.R. 1993, the 25th Anniversary of 9/11 Commemorative Coin Act, championed by Rep. Mike Lawler, which directs proceeds to the National 9/11 Memorial & Museum.⁴

High-profile commemorative events will serve as natural focal points for security protocols. The George W. Bush Presidential Center is hosting a major retrospective featuring the 43rd President, former Secretary of State Condoleezza Rice, and Chairman of the Joint Chiefs of Staff General Dan Caine.⁵ Simultaneously, organizations like the Soufan Center are convening the Global Summit on Terrorism and Political Violence in New York City on the eve of the anniversary, gathering senior policymakers and security leaders.¹ While these events are highly secured, their media prominence elevates the baseline threat for all critical infrastructure, federal buildings, and mass gatherings nationwide during the late summer and early autumn of 2026, as adversaries seek to counter-program these memorials with acts of violence.

2.2. The FTO Resurgence and the “New Terrorist Playbook”

The strategic posture of traditional FTOs, including al-Qaeda and the Islamic State (ISIS), has evolved significantly. Intelligence assessments indicate that these networks are experiencing a global resurgence, adapting their operational models to bypass traditional border security and signals intelligence (SIGINT) nets.⁶ The Trump administration’s May 6, 2026, National Counterterrorism Strategy outlines a multi-faceted threat landscape, prioritizing the disruption of cartels and narco-terrorist networks, global jihadist organizations (including al-Qaeda and ISIS), and violent left-wing extremists. The strategy underscores a pivot to address threats within the Western Hemisphere while maintaining pressure on foreign terrorist organizations capable of executing external operations.

The tactical methodology of these groups has transitioned to what the National Counterterrorism Center (NCTC) Director Joe Kent has termed the “new terrorist playbook”.⁶ Rather than prioritizing spectacular, multi-year plots reminiscent of 2001, FTOs are increasingly inspiring followers to execute localized attacks on targets of opportunity.⁶ Director Kent noted that the decentralized and barbaric nature of the October 7, 2023, attacks in Israel has served as a tactical template.⁷ NCTC assessments confirm verified intelligence corroborating al-Qaeda’s presence and planning across U.S. cities, with a specific focus on smaller cells or individual operatives taking action against accessible targets.⁷

This decentralized approach is heavily reliant on exploiting digital platforms and artificial intelligence. FTOs are leveraging digital ecosystems to radicalize, train, and fundraise remotely, allowing them to inspire domestic violence without their core operatives ever stepping foot on U.S. soil.⁶ The case of Ammaad Akhtar, who was arrested for attempting to provide material support to ISIS after unknowingly expressing support for jihad to an online undercover officer, illustrates the speed and accessibility of modern digital radicalization.⁶ Furthermore, terrorists are increasingly utilizing generative artificial intelligence to streamline propaganda creation and operational planning, prompting legislative responses such as the Generative AI Terrorism Risk Assessment Act.⁶

The threat is compounded by documented vulnerabilities in the immigration and vetting apparatus. The House Committee on Homeland Security’s December 2025 “Terror Threat Snapshot” highlighted systemic vetting failures, noting that an estimated 2 to 2.7 million individuals entered the U.S. from countries lacking reliable documentation after undergoing minimal vetting.⁶ Department of Homeland Security Office of Inspector General (OIG) reports from 2022 and 2024 revealed that DHS faced significant obstacles in screening evacuees, resulting in a fragmented process for identifying derogatory information.⁶ These vulnerabilities have materialized into physical threats, as evidenced by the arrest of Afghan national Rahmanullah Lakanwal for ambushing and shooting two U.S. National Guardsmen near the White House, and the charging of two other Afghan nationals in connection with an ISIS-inspired plot targeting Election Day 2024.⁶

2.3. Domestic Violent Extremism (DVE) and Accelerated Radicalization

While FTOs present a resurgent external threat, domestic terrorism remains one of the most persistent, complex, and lethal threats to the homeland.⁶ The FBI’s National Security Branch Operations Director Michael Glasheen reported that the Bureau currently has over 1,700 active domestic terrorism investigations underway.⁶ The DVE landscape is highly fractured and ideologically diverse, encompassing racially or ethnically motivated violent extremists, anti-government and anti-authority extremists, and single-issue actors.

A defining characteristic of the modern DVE threat is the compression of the radicalization timeline. Radicalization occurs frequently in online environments, accelerated by social media algorithms and encrypted messaging applications that increase the speed and accessibility of violent extremist content.⁶ Individuals transition from passive consumption of extremist propaganda to operational mobilization in a fraction of the time observed in previous decades. The greatest terrorism threat to the homeland is posed by lone offenders and small groups of individuals who commit acts of violence motivated by a range of ideological beliefs and personal grievances, looking to attack soft targets with easily accessible weapons.⁹

There is a documented, alarming increase in attacks explicitly targeting federal law enforcement personnel and facilities. For example, a shooting at a U.S. Immigration and Customs Enforcement (ICE) facility in Dallas resulted in multiple casualties, with the shooter leaving behind ammunition marked with the phrase “ANTI-ICE”.⁶ This ambient hostility complicates federal investigations and heightens the physical risk to agents operating in the field. Arrests of specific extremist factions have also risen sharply; for instance, arrests of Antifa members increased by 171 percent in the past year.⁶

The geopolitical shockwaves of international conflicts have also severely impacted the domestic landscape. The post-October 7 environment has seen a sharp, sustained escalation in antisemitic and religiously motivated violence targeting communities worldwide.⁶ This includes incidents such as the ISIS-inspired attack on Hanukkah celebrations in Sydney, Australia, which resulted in 15 deaths, and the domestic arrest of Mahmoud Amin Ya’qub Al-Muhtadi in Louisiana for alleged involvement in the Hamas-led terrorist attacks.⁶ These overlapping ideological drivers ensure a constant, elevated threat to religious institutions, cultural centers, and public gatherings.

2.4. Nation-State Cyber Pre-Positioning: Volt Typhoon and Salt Typhoon

While FTOs and DVEs primarily pursue kinetic violence and psychological terror, nation-state actors present a systemic threat to the operational technology (OT) and information technology (IT) networks governing U.S. critical infrastructure. Advanced Persistent Threat (APT) groups linked to the People’s Republic of China (PRC)—specifically actors identified as Volt Typhoon and Salt Typhoon—have fundamentally altered their operational mandates, transitioning from traditional cyber espionage and intellectual property theft to strategic pre-positioning.¹¹

Assessments from the Office of the Director of National Intelligence (ODNI), CISA, the NSA, and the FBI indicate that these PRC-linked actors are deliberately embedding themselves within the hardware and software that control critical infrastructure.¹² The objective is not immediate financial gain or data exfiltration, but rather to establish deep, persistent access that would enable them to disrupt lifeline societal functions—such as water purification, telecommunications, transportation, and energy distribution—at a time of their choosing, likely corresponding with a geopolitical crisis or military conflict in the Indo-Pacific.¹²

The scope of this infiltration is extensive. Microsoft revealed that Volt Typhoon had achieved the kind of persistent access necessary to disrupt essential services.¹³ CISA detailed incidents where Volt Typhoon maintained unauthorized access to the OT network of the Littleton Electric Light & Water Departments, a small public utility in Massachusetts, for nearly a year.¹⁵ The attackers mapped the energy grid’s layout and OT operating procedures, gathering intelligence crucial for planning future attacks targeting physical infrastructure.¹⁵ This is not an isolated incident; Check Point Research documented a 75 percent year-over-year increase in cyberattacks on U.S. utilities, totaling 1,162 attacks, while the North American Electric Reliability Corporation warned of rapidly growing susceptibility points on the digital grid.¹⁵

Concurrently, the Salt Typhoon group has executed sophisticated espionage campaigns against U.S. telecommunications carriers, exploiting vulnerabilities in backbone infrastructure to establish long-term, covert access to sensitive communications systems.¹² The evolution of other state-aligned actors, such as Russia-aligned hacktivists transitioning into groups capable of targeting OT and IoT environments, further complicates the cyber threat model.¹⁶

The structural challenge of defending against these APTs is immense. Approximately 50 to 85 percent of U.S. critical infrastructure is privately owned or operated by municipal entities that often lack the resources to defend against nation-state cyber capabilities.¹⁵ While CISA is the primary federal agency specifically tasked with defending civilian systems from cyber threats, maintaining real-time visibility into these distributed domains ¹³, the localized nature of these utility networks requires a coordinated ground-level response. Should a coordinated cyber-physical attack occur, local law enforcement and emergency services would face the catastrophic dual burden of managing widespread civil unrest and panic while operating with degraded communications, power, and logistical infrastructure.¹⁴

2.5. Resource Saturation: The FIFA World Cup 2026

Compounding the baseline threat environment is the substantial operational strain imposed by the FIFA World Cup 2026, hosted jointly by the United States, Canada, and Mexico. Kicking off in the summer preceding the 9/11 anniversary, the tournament represents the largest and most complex sporting event in U.S. history, attracting millions of international and domestic fans.¹⁸

Securing an event of this magnitude requires extensive interagency coordination and the deployment of substantial security overlays to protect stadiums, fan zones, transit hubs, and commercial corridors across multiple major metropolitan host cities.¹⁹ The event presents a highly attractive target profile for both FTOs seeking international media attention and DVEs attempting to exploit mass gatherings. The DHS, FBI, TSA, and the State Department’s Diplomatic Security Service (DSS) have established expansive security protocols, deploying advanced threat response capabilities and international coordination mechanisms, with leadership from figures such as DHS Secretary Markwayne Mullin emphasizing a secure experience for the millions attending.¹⁸¹⁸

Specific security measures include the enforcement of Department of Transportation Temporary Flight Restrictions (TFRs) and the deployment of counter-unmanned aircraft systems (c-UAS) and robotic ground assets (“robodogs”) to mitigate the physical hazards posed by unauthorized drone activity near matches and fan fests.²⁰ FBI Special Agents in Charge from Seattle (Karen Valaas) and Dallas (Joe Rothrock) have publicly highlighted the authorization to use technical capabilities to detect, assess, and mitigate drone threats.²⁰ Furthermore, the DHS World Cup Commission, comprising private industry experts, is advising the White House Task Force on security coordination.²²

However, the reality of securing these venues requires significant deployments of local law enforcement personnel. Officers must be pulled from regular duties to staff traffic control, crowd management, and perimeter security. This operational saturation draws resources away from routine investigative and intelligence functions across the host regions for an extended period, creating temporal vulnerabilities that adversaries can exploit.

3. The Local Law Enforcement Workforce Crisis

The foundational layer of the United States’ domestic intelligence architecture is local law enforcement. State, local, tribal, and territorial (SLTT) police agencies act as the primary sensors in the homeland security network, providing the baseline situational awareness necessary to identify anomalous behavior indicative of terrorist mobilization. However, this foundational layer has experienced severe, sustained erosion since 2020, resulting in a systemic contraction of operational capacity.

3.1. Statistical Dimensions of Attrition and the Hiring Paradox

Data compiled through extensive national surveys by the Police Executive Research Forum (PERF) reveals a notable and structural contraction in the law enforcement workforce over the past six years.²³ While hiring rates have shown signs of a rebound in the most recent statistical cycles, the sheer volume and velocity of resignations and retirements have fundamentally altered the demographic composition and total capacity of police departments nationwide.

The data indicates a compound crisis. Initially, hirings dropped precipitously by 19.4 percent from 2019 to 2020.²³ Concurrently, retirements increased by 33.5 percent over the same period, extracting a large cohort of highly experienced senior personnel.²³ As the decade progressed, resignations among mid-career officers increased substantially, rising 55.9 percent from 2019 to 2022.²³ This indicates deep dissatisfaction, burnout, and institutional strain among the very professionals usually tasked with complex investigations.

The net result of these converging trends is a chronic staffing deficit. Total sworn staffing decreased by 5.4 percent from January 2020 to January 2023.²³ Despite responding agencies reporting a 17.6 percent increase in hirings in 2025 compared to 2024, and overall hirings increasing 39.5 percent from the 2020 low point, the recovery has been insufficient to close the gap.²³ As of January 1, 2025, overall sworn staffing numbers were still 5.2 percent lower than they were on January 1, 2020.²⁷ Law enforcement agencies are losing officers faster than the academies can recruit, vet, and train their replacements.²⁵

Data indicates a notable 55.9% spike in resignations and a 33.5% spike in retirements during the peak crisis years, leaving agencies bleeding experience faster than they can replace it, despite a subsequent 39.5% rebound in hiring efforts.

Table 1: Law Enforcement Workforce Fluctuation Metrics (Selected Metrics, Base Year 2019/2020)

3.2. Geographic, Jurisdictional, and Financial Disparities

The impact of this attrition is not uniform across the country. PERF data indicates that staffing at agencies in the Midwest and West decreased more than the overall national average, as did staffing at large agencies employing more than 500 officers.²⁴ In large agencies, sworn staffing slightly increased during 2023, but remained more than 5 percent below where it was in January 2020.²⁶ Conversely, retirements were extremely elevated in small agencies, showing a 136 percent increase over 2019 levels during peak attrition years.²⁶

The financial burden of attempting to stabilize the workforce is substantial. Local police agencies face a threefold challenge: attrition resulting from budget crises and retirements, greater skill requirements restricting the applicant pool, and an expanding scope of duties requiring officers with a greater breadth of skills.²⁹ This is evidenced by the high demand for federal assistance; a recent appropriation of $1 billion to the federal Office of Community Oriented Policing Services (COPS) to help stabilize law enforcement positions resulted in over 7,000 applications requesting more than $8 billion to support nearly 40,000 sworn-officer positions.²⁸ Frequent departures lead to significant expenses related to recruiting, hiring, and training new personnel, diverting municipal funds that could otherwise be spent on advanced intelligence technologies or specialized training.³⁰

4. The Reallocation Cascade and Specialized Unit Dissolution

The operational mandate of any municipal police department is the maintenance of public order and rapid response to emergency calls for service (911 response). Patrol divisions are the foundation of public safety operations. When total sworn staffing drops below critical minimum thresholds, agency executives are forced into a state of continuous operational triage. To maintain minimum staffing levels in the patrol division, commanders universally adopt a strategy of reallocating personnel from specialized, proactive units back to uniform patrol.³¹

4.1. The Dissolution of Proactive Intelligence Capacity

This phenomenon, termed the “reallocation cascade,” systematically dismantles a department’s investigative, intelligence-gathering, and community-policing capabilities. Across the country, major metropolitan agencies have disbanded or severely reduced specialized units to feed the continuous demand of the patrol schedule.

The scope of this reallocation is broad. In Phoenix, Arizona, the police department announced the reassignment of more than 100 officers from specialty assignments back to the patrol division to address critical shortages.³⁴ Similarly, in Seattle, Washington, the police chief reassigned 100 officers to patrol to improve response times, explicitly stating that the move was necessary to avoid relying on overtime-funded emphasis patrols to address emerging crime issues.³⁵ In Austin, Texas, facing a deficit of over 300 vacant sworn officer roles citywide, the department reassigned 72 officers from specialized units back to patrol to cover vacancies in the downtown sector.³⁶

The impact extends deeply into investigative functions. The Baltimore Police Department notably disbanded district detective units responsible for investigating burglaries, reassigning 35 detectives to address shortages in patrol divisions.³⁷ Baltimore police media relations Chief T.J. Smith noted the move was driven by “the necessity behind patrol staffing,” while City Council Public Safety Committee Chairman Brandon Scott acknowledged that patrol was “severely understaffed”.³⁷ While department leadership argued that patrol officers would now handle these investigations, the reality is that complex case follow-ups are rarely successfully completed between emergency radio calls.

In New Orleans, an Office of Inspector General report sharply criticized the police department’s staffing model, noting that sworn officers assigned to specialized units, task forces, and district investigative units reduced the district’s capacity to answer calls for service.³¹ The report concluded that NOPD lacked 82 officer/detective positions needed to fully support centralized investigative functions, highlighting the intractable tension between maintaining a proactive investigative posture and answering the 911 board.³¹

4.2. Shifting from Proactive Disruption to Reactive Patrol

The withdrawal of personnel from narcotics task forces, gang units, human trafficking operations, and dedicated intelligence squads has an immediate, detrimental effect on domestic counterterrorism. The Austintown Police in Ohio, facing budget cuts, pulled officers back from both the Mahoning County Drug Task Force and the Mahoning County Human Trafficking Task Force to maintain adequate patrol staffing.³⁸ The Missouri State Highway Patrol similarly suspended its participation in an ATF task force due to staffing constraints.³⁹

Terrorism financing and operational logistics frequently intersect with traditional criminal enterprises, including organized retail theft, narcotics trafficking, and document fraud. When the specialized units that monitor these criminal ecosystems are dissolved or depleted, the peripheral intelligence that might expose a terror cell is never collected. The reallocation cascade ensures that police departments transition from a proactive posture—capable of identifying pre-incident indicators and disrupting plots—to a strictly reactive posture, responding only after a crime or attack has been committed. The use of specialized units significantly impacts patrol, but pulling officers from those units leaves a void in the intelligence collection apparatus.³²

5. The Institutional Memory Deficit and the Experience Gap

The mathematical reduction in headcount is only one dimension of the policing crisis. A compounding and enduring vulnerability arises from the qualitative degradation of the workforce. The exodus of senior officers via retirement, combined with the mass resignation of mid-career personnel, has created an acute “experience gap” across the profession.³³

5.1. Erosion of Tacit Knowledge and Community Intelligence

In intelligence and investigative contexts, “institutional memory” is not merely the archiving of digital reports; it is the accumulation of tacit knowledge, contextual understanding, and human relationships built over decades of continuous engagement.⁴⁴ A veteran detective possesses a highly nuanced understanding of the local baseline—the normal rhythms of a specific neighborhood, the key community influencers, the historical rivalries between local factions, and the behavioral anomalies that warrant further scrutiny.

When an investigator with twenty years of experience retires and is replaced by a recent academy graduate, the agency loses years of localized intelligence.⁴⁹ Research indicates that police organizations do not just forget information; they lose the connections and shared understanding that make that information useful.⁴⁸ Newer officers, while perhaps more proficient in contemporary digital forensics, lack the cognitive maps necessary to contextualize disparate pieces of information.⁵⁰ They are less likely to recognize when a routine arrest for fraudulent documentation or a seemingly random act of vandalism is actually a precursor to organized extremist violence. As one intelligence analysis platform noted, without institutional memory, a detective might fail to recognize that current call data records resemble the communication patterns of a network dismantled five years prior.⁴⁶

Furthermore, community policing relies heavily on trust cultivated through long-term, consistent engagement.⁵¹ High turnover frequently severs these relationships.³⁰ Confidential informants, community leaders, and local business owners are significantly less likely to share sensitive information—such as suspicions about a local individual undergoing rapid radicalization—with unfamiliar, transient patrol officers. The loss of institutional memory directly equates to a loss of human intelligence (HUMINT) at the street level.

5.2. The Paradox of Professionalization and Bureaucratic Vulnerabilities

The experience gap is exacerbated by what researchers studying investigative units have termed the “paradox of professionalization”.⁴¹ As policing has evolved to incorporate more stringent oversight, complex digital evidence requirements (e.g., managing terabytes of body-worn camera footage, executing cellular data extractions), and rigorous case management standards, the administrative burden on investigators has grown substantially.

In departments attempting to maintain strict investigative standards with depleted and less-experienced staffs, procedural requirements absorb disproportionate amounts of time and cognitive bandwidth.⁴¹ This dynamic has been extensively documented in the UK, where the College of Policing’s Professionalising Investigation Programme (PIP) is experienced by detectives as an administrative weight that diverts time from active inquiry, accelerates burnout, and reduces the role’s appeal.⁴¹

The U.S. domestic intelligence architecture mirrors this strain. Junior detectives, lacking the efficiency born of experience and operating without the mentorship of departed veterans, are easily overwhelmed by the sheer volume of digital data and procedural checklists. Consequently, investigations are frequently conducted in a perfunctory manner to clear caseloads, rather than with the deep, analytical rigor required to uncover complex terror networks or sophisticated lone-wolf preparations.⁴¹ Crucial operational dots remain unconnected because investigators lack the time, experience, and supervisory support to look beyond the immediate, superficial parameters of a localized crime.⁴⁰

Furthermore, at the command level, fragmented workflows and a reliance on informal institutional memory for evidence management transform from a lab-level issue into a severe organizational liability, where doubt easily beats proof in court and compromised investigations drastically damage public trust.⁴⁴

5.3. Leadership Turnover and Institutional Betrayal

The crisis of memory extends to the command level. Studies indicate that a vast majority of law enforcement agencies (nearly 74%) anticipate experiencing a large turnover in management personnel over the next three to five years, yet less than half (45.8%) have incorporated succession planning into their strategic frameworks, and over 90% lack formal mentoring policies.⁵⁴ This leadership vacuum exacerbates what organizational psychologists term “institutional betrayal trauma,” where communication gaps and inconsistent leadership decisions accumulate until officers feel dismissed, leading to further attrition and a collapse of morale.⁴⁹ The failure to transfer knowledge via formal mentoring ensures that the experience gap will persist well into the 2030s, leaving the U.S. vulnerable during a highly volatile geopolitical era.⁵⁴

6. Degradation of the National Counterterrorism Architecture

The vulnerabilities created at the local level do not remain contained; they propagate upward, degrading the national counterterrorism architecture. Following the intelligence failures of 9/11, the federal government restructured its approach to domestic security around the philosophy of intelligence fusion—the systematic sharing of information between federal, state, and local entities. This system is entirely dependent on the continuous inflow of high-quality, granular data from local police.

6.1. The Attrition of Joint Terrorism Task Forces (JTTFs)

The FBI’s Joint Terrorism Task Forces (JTTFs) act as the primary operational mechanism for domestic counterterrorism investigations. Originating in 1980 in New York City with a small team of NYPD officers and FBI agents, the concept expanded rapidly post-9/11 to 104 regional task forces located at every FBI field office and many resident agencies, comprising roughly 280 locations.⁵⁶ The National Joint Terrorism Task Force (NJTTF), established in 2002 at the National Counterterrorism Center (NCTC), manages this burgeoning program, which includes over 4,000 task force members from over 600 state and local agencies and 50 federal agencies.⁵⁸

The strength of the JTTF model relies explicitly on local Task Force Officers (TFOs). Local police provide the JTTF with direct access to municipal records, local informant networks, and geographical expertise that federal agents typically lack.⁵⁹ An FBI Supervisory Special Agent in Kansas City noted that local officers bring vital experience in standard patrol, knowledge of the city layout, and established interrogation skills.⁵⁹ Federal agents are often transient, rotating through field offices, whereas local TFOs possess the deep institutional memory of their specific jurisdiction.

However, the local staffing crisis is systematically eroding the JTTF network. As municipal chiefs and sheriffs struggle to fill patrol shifts, they are increasingly forced to recall their highly trained officers from federal task forces.³⁸ A local detective assigned to a JTTF represents a significant investment of municipal resources; when that detective is pulled back to handle routine city homicides or patrol duties, the JTTF loses its localized human intelligence pipeline.

6.2. Political and Fiscal Withdrawals from Federal Task Forces

Furthermore, the withdrawal of local officers from JTTFs is not solely driven by staffing metrics; it is increasingly influenced by political friction and concerns over civil liberties. The city of Portland, Oregon, serves as a prime example of this vulnerability. Despite apologies and assurances from the U.S. Attorney for Oregon, Billy Williams, regarding past FBI surveillance practices, the Portland City Council voted to withdraw its police officers from the JTTF.⁶⁴

Commissioners Jo Ann Hardesty and Chloe Eudaly, heavily lobbied by civil liberties organizations such as the ACLU and the Brennan Center for Justice, argued that the JTTF operated under a veil of secrecy that precluded civilian oversight and potentially violated state laws requiring reasonable suspicion for surveillance.⁶⁴ Mayor Ted Wheeler argued that “values alone cannot protect the safety of the community,” yet the council ultimately severed the tie, removing two Portland Police officers whose positions were funded by federal grants.⁶⁶ Other cities, including Oakland, California, have taken similar steps to cut ties with JTTFs.⁶⁹

Regardless of the motivation—whether fiscal necessity, severe patrol shortages, or political mandate regarding oversight—the result is identical: the federal counterterrorism apparatus goes blind in that jurisdiction. Without local TFOs, the FBI’s ability to swiftly investigate localized threats, assess the validity of incoming tips, and monitor the pre-incident behaviors of decentralized lone offenders is severely compromised.

6.3. Fusion Center Vulnerabilities and Analytic Turnover

Complementing the operational role of JTTFs are the network of state and major urban area fusion centers. Established with federal backing and outlined in the 2006 Department of Justice and DHS “Fusion Center Guidelines,” these centers are designed to serve as the primary conduits for threat information sharing between the federal government and SLTT partners.⁷⁰ Fusion centers analyze Suspicious Activity Reports (SARs), monitor open-source intelligence, and distribute intelligence products downward to local patrol officers while feeding trend data upward to the DHS Office of Intelligence and Analysis (I&A) and the FBI.⁷¹

However, the efficacy of fusion centers is highly dependent on consistent staffing, secure funding streams, and established inter-personal relationships. Audits and assessments of the National Network of Fusion Centers by the Government Accountability Office (GAO) and congressional committees have repeatedly highlighted vulnerabilities related to high personnel turnover.⁷² In some instances, 42 percent of fusion center directors were new to their positions in a single year, with an average tenure of only 2.5 years.⁷⁷ This short tenure fails to account for the time required to obtain high-level security clearances or to acclimate to leadership duties, resulting in chronic leadership instability.⁷⁷

Furthermore, fusion centers rely heavily on state administrative agencies for grant funding distribution, as they do not receive direct, dedicated operational funding from DHS.⁷² When state budgets contract, or when federal DHS grant funding caps the number of Intelligence Officers (IOs) deployed to the field, fusion centers are forced to prioritize and reassign personnel, often losing their “real-time connection” to federal databases.⁷⁷

This rapid turnover among directors and analysts, mirroring the broader attrition in law enforcement, destroys the connective tissue of intelligence sharing. Trust is paramount in interagency environments; state regulators, local police chiefs, and private sector utility operators are highly hesitant to share sensitive, raw intelligence with a constantly rotating cast of fusion center personnel.⁷⁶ Furthermore, the loss of experienced analysts within these centers means that subtle patterns in SAR data—such as coordinated purchasing of dual-use materials across multiple jurisdictions or the mapping of vulnerabilities along the border—may go entirely unrecognized.⁷⁸

6.4. The Expanding Intelligence Blind Spot

The ultimate consequence of localized attrition, political withdrawal from task forces, and fusion center amnesia is the creation of unmonitored intelligence blind spots across the homeland. The modern adversary—whether an ISIS-inspired lone wolf, a domestic accelerationist cell, or a PRC-linked cyber actor preparing the battlespace—relies heavily on operating within the “gray zone” of pre-incident behavior.⁶ They purchase legal firearms, conduct surveillance on soft targets, probe utility firewalls, and engage in online radicalization that flirts with the edges of protected First Amendment speech.

Federal agencies operating under foreign intelligence mandates, such as the NSA or the CIA, are legally and practically constrained from monitoring this localized, domestic behavior. The post-9/11 domestic security system was designed under the assumption that an experienced local detective, a vigilant school resource officer, or a highly trained intelligence analyst at a fusion center would intercept these behavioral anomalies, document them via a SAR, and escalate them to the JTTF for federal investigation.⁶¹

With patrol forces hollowed out, detectives returning to uniform, and local agencies withdrawing from JTTFs, the mechanism for identifying pre-incident indicators is critically impaired.⁶¹ The overwhelming “noise” of routine violent crime, which understaffed departments struggle to manage, drowns out the subtle “signals” of terrorist mobilization. In a paradigm where attackers increasingly favor targets of opportunity and require little sophisticated planning or external funding, the failure to intercept them at the local, community level significantly increases the likelihood of an adversary’s operational success. The Brennan Center for Justice has noted that the lack of consistency and oversight in local counterterrorism programs causes critical information to fall through the cracks, a vulnerability clearly demonstrated by the Boston Marathon bombing where critical data was lost in a din of irrelevant information.⁷⁹

7. Strategic Outlook and Intelligence Gaps

The domestic threat landscape leading into the September 2026 timeframe is characterized by an exceptionally high degree of volatility. The combination of the 25th anniversary of 9/11 serving as a symbolic catalyst, the impending resource saturation of the FIFA World Cup, the resurgence of FTOs promoting a decentralized, target-of-opportunity playbook, the persistence of rapidly radicalizing DVE networks, and the strategic pre-positioning of PRC cyber actors creates a threat environment of notable complexity.

The operational defense against this threat matrix is structurally unsound. The continuous, unmitigated attrition within state and local law enforcement has resulted in a severe loss of institutional memory and community trust. Federal counterterrorism elements, increasingly severed from their local intelligence pipelines due to JTTF withdrawals, specialized unit dissolution, and fusion center turnover, lack the granular situational awareness necessary to disrupt lone offenders and localized cells prior to mobilization.

Several critical intelligence gaps remain unresolved:

1. Visibility into DVE Mobilization: With local intelligence units disbanded or understaffed, identifying the transition from online radicalization to physical mobilization among domestic extremists relies entirely on retroactive, post-incident investigations rather than proactive disruption. The loss of community informant networks means localized behavioral shifts go unreported.
2. Attribution in Cyber-Physical Incidents: In the event of a localized critical infrastructure failure (e.g., a municipal water facility malfunction or power grid disruption), the lack of experienced local investigators and trusted fusion center liaisons will delay the initial assessment of whether the event is an accident, a routine criminal act, or a nation-state (Volt Typhoon) disruption, thereby slowing the deployment of federal cyber response teams.
3. Soft Target Vulnerability: As municipal police resources are heavily diverted to secure high-profile events like the World Cup and official 9/11 commemorative sites in major urban centers, peripheral soft targets (suburban shopping centers, local religious institutions, regional transit hubs) are left acutely vulnerable. The “new terrorist playbook” specifically exploits these minimally secured targets of opportunity.

Unless systemic, well-funded interventions are implemented immediately to rebuild local intelligence capacities, retain veteran investigators through aggressive succession planning, and politically restabilize the JTTF network, the national security apparatus will continue to operate with a severe, localized blind spot during one of the highest-risk periods of the post-9/11 era.

Appendix: Methodology and Data Sources

Methodology: This intelligence estimate was developed using a structured analytic approach designed to synthesize disparate data streams regarding both the adversarial threat environment and domestic defensive capabilities. The analysis applied a vulnerability-threat-consequence matrix to evaluate how specific weaknesses in law enforcement human capital intersect with current adversary tactics.

The assessment deliberately focused on identifying second- and third-order effects of police attrition. Rather than viewing workforce reduction as purely an administrative, budgetary, or response-time issue, the methodology treated human capital as a critical intelligence sensor network. By applying historical case studies of intelligence fusion (JTTFs and Fusion Centers) and analyzing the tactical requirements of the “new terrorist playbook,” the analysis identified specific failure points in the pre-incident detection cycle.

Data Sources: Information synthesized in this report was derived from the following core sources and assessments:

• Threat Assessments & Congressional Testimony:
• Department of Homeland Security (DHS) Homeland Threat Assessments (HTA) regarding nation-state cyber positioning and domestic extremism.¹¹
• House Committee on Homeland Security “Terror Threat Snapshot” and Worldwide Threats hearing testimony from the NCTC, FBI, and DHS regarding FTO resurgence, DVE case volumes, and the “new terrorist playbook”.⁶
• Office of the Director of National Intelligence (ODNI) and CISA advisories on PRC-linked Advanced Persistent Threats (Volt Typhoon/Salt Typhoon) and infrastructure infiltration.¹²
• Law Enforcement Attrition Data:
• Quantitative survey data on police staffing, hirings, resignations, and retirements published by the Police Executive Research Forum (PERF) from 2019 through 2025.²³
• Departmental audits, press reporting, and public statements regarding the reallocation of specialized units to patrol functions in major U.S. municipalities, including Baltimore, Phoenix, Seattle, Austin, and New Orleans.³¹
• Intelligence Architecture & Operations:
• Federal Bureau of Investigation (FBI) historical overviews, podcasts, and operational data regarding Joint Terrorism Task Forces (JTTFs).⁹
• Government Accountability Office (GAO) and Congressional reports detailing Fusion Center operations, funding, border intelligence products, and personnel turnover.⁷⁰
• Academic, policy, and psychological research regarding the qualitative impacts of the “experience gap,” the paradox of professionalization, institutional betrayal, and the loss of institutional memory in policing.²⁸
• Documentation of municipal withdrawals from JTTFs and civil liberties concerns.⁶⁴
• Event Security Planning:
• Federal Emergency Management Agency (FEMA), TSA, and Diplomatic Security Service (DSS) preparations, legislative actions, and threat parameters for the 9/11 25th Anniversary and the FIFA World Cup 2026.¹

Please share the link on Facebook, Forums, with colleagues, etc. Your support is much appreciated and if you have any feedback, please email us in**@*********ps.com. If you’d like to request a report or order a reprint, please click here for the corresponding page to open in new tab.

Sources Used

1. Global Summit on Terrorism and Political Violence – The Soufan Center, accessed July 1, 2026, https://thesoufancenter.org/events/global-summit-on-terrorism-and-political-violence/
2. New U.S. Counterterrorism Strategy Continues Focus on Jihadist Groups | Alhurra, accessed July 1, 2026, https://alhurra.com/en/20102
3. News Release: 9/11 Memorial & Museum Launches New Campaign to Educate and Inspire, accessed July 1, 2026, https://www.911memorial.org/news-release-911-memorial-museum-launches-new-campaign-educate-and-inspire
4. Lawler Celebrates House Passage of 25th Anniversary of 9/11 Commemorative Coin Act, accessed July 1, 2026, https://lawler.house.gov/news/documentsingle.aspx?DocumentID=5943
5. A Legacy of Service: America at the 25th Anniversary of 9/11 | Bush Center, accessed July 1, 2026, https://www.bushcenter.org/events-and-exhibits/a-legacy-of-service-america-at-the-25th-anniversary-of-9-11
6. House Homeland Unveils Updated “Terror Threat Snapshot” Assessment After Annual Worldwide Threats Hearing, accessed July 1, 2026, https://homeland.house.gov/2025/12/19/threat-snapshot-house-homeland-unveils-updated-terror-threat-snapshot-assessment-after-annual-worldwide-threats-hearing/
7. Decreasing Counterterrorism Funding Amid Rising Terrorist Chatter: A Risk Not Worth Taking – HSToday, accessed July 1, 2026, https://www.hstoday.us/subject-matter-areas/counterterrorism/decreasing-counterterrorism-funding-amid-rising-terrorist-chatter-a-risk-not-worth-taking/
8. Rep. Pfluger Sounds the Alarm During Annual Worldwide Threats Hearing, accessed July 1, 2026, https://pfluger.house.gov/news/documentsingle.aspx?DocumentID=2700
9. Federal Bureau of Investigation Department of Homeland Security Strategic Intelligence Assessment and Data on Domestic Terrorism – FBI, accessed July 1, 2026, https://www.fbi.gov/file-repository/fbi-dhs-domestic-terrorism-strategic-report.pdf
10. Federal Bureau of Investigation Department of Homeland Security Strategic Intelligence Assessment and Data on Domestic Terrorism, accessed July 1, 2026, https://www.dhs.gov/sites/default/files/2022-10/22_1025_strategic-intelligence-assessment-data-domestic-terrorism.pdf
11. Homeland Threat Assessment 2025, accessed July 1, 2026, https://www.dhs.gov/sites/default/files/2024-10/24_0930_ia_24-320-ia-publication-2025-hta-final-30sep24-508.pdf
12. China Threat Overview and Advisories – CISA, accessed July 1, 2026, https://www.cisa.gov/topics/cyber-threats-and-advisories/nation-state-cyber-actors/china
13. FDD’s Ma warns weakening CISA could undermine US cyber resilience amid rising critical infrastructure threats, accessed July 1, 2026, https://industrialcyber.co/cisa/fdds-ma-warns-weakening-cisa-could-undermine-u-s-cyber-resilience-amid-rising-critical-infrastructure-threats/
14. Are attackers already embedded in U.S. critical infrastructure networks? – IBM, accessed July 1, 2026, https://www.ibm.com/think/insights/are-attackers-already-embedded-in-us-critical-infrastructure-networks
15. Securing U.S. Critical Infrastructure against Evolving Cyber Threats | Strategic Technologies Blog | CSIS, accessed July 1, 2026, https://www.csis.org/blogs/strategic-technologies-blog/securing-us-critical-infrastructure-against-evolving-cyber
16. The Escalating Cyber Risk Landscape in Regional Conflicts & Strategic Actions for 2026, accessed July 1, 2026, https://blog.eclecticiq.com/the-escalating-cyber-risk-landscape-in-regional-conflicts-strategic-actions-for-2026
17. Volt Typhoon’s long shadow – The International Institute for Strategic Studies, accessed July 1, 2026, https://www.iiss.org/online-analysis/cyber-power-matrix/2026/01/volt-typhoons-long-shadow/
18. TSA delivers unmatched security, efficiency for FIFA World Cup 2026, accessed July 1, 2026, https://www.tsa.gov/news/press/releases/2026/06/10/tsa-delivers-unmatched-security-efficiency-for-fifa-world-cup-2026
19. FIFA World Cup 2026™: Be Prepared and Stay Safe – Ready.gov, accessed July 1, 2026, https://www.ready.gov/fifa-world-cup-2026
20. FBI, DHS emphasize no-drone zones as World Cup kicks off | FedScoop, accessed July 1, 2026, https://fedscoop.com/dhs-fbi-fifa-world-cup-counter-uas-robodogs/
21. Diplomatic Security Service—A Critical Link for FIFA World Cup 2026™ Security – United States Department of State, accessed July 1, 2026, https://www.state.gov/diplomatic-security-service-a-critical-link-for-fifa-world-cup-2026-security
22. World Cup 2026 Commission | Homeland Security, accessed July 1, 2026, https://www.dhs.gov/world-cup-commission
23. PERF national survey shows police staffing rebounds to its 2022 …, accessed July 1, 2026, https://www.policeforum.org/trending23may26
24. PERF survey shows steady staffing decrease over the past two years, accessed July 1, 2026, https://www.policeforum.org/workforcemarch2022
25. New PERF survey shows police agencies are losing officers faster than they can hire new ones, accessed July 1, 2026, https://www.policeforum.org/staffing2023
26. New PERF survey shows police agencies have turned a corner with staffing challenges, accessed July 1, 2026, https://www.policeforum.org/staffing2024
27. PERF survey shows police staffing increased slightly in 2024 but still lower than 2019, accessed July 1, 2026, https://www.policeforum.org/trending5jul25
28. Law Enforcement Officers: Observations on Recruitment and Retention at the Federal, Tribal, State, and Local Levels | U.S. GAO, accessed July 1, 2026, https://www.gao.gov/products/gao-26-108495
29. Improving Police Recruitment and Retention – RAND, accessed July 1, 2026, https://www.rand.org/pubs/research_briefs/RB9546.html
30. Addressing Police Turnover: Challenges, Strategies, and Future Research Directions | Published in RTI Press, accessed July 1, 2026, https://rtipress.scholasticahq.com/article/132453-addressing-police-turnover-challenges-strategies-and-future-research-directions
31. New Orleans Police Department Staffing and Deployment: Meeting the Need of Citizen Calls for Service with Existing Resources, accessed July 1, 2026, https://nolaoig.gov/wp-content/uploads/2023/03/OIG-FINAL-report-NOPD-Staffing-and-Deployment-140528.pdf
32. Baltimore Police Department Staffing Plan – PowerDMS, accessed July 1, 2026, https://public.powerdms.com/BALTIMOREMD/documents/652754
33. The State of Modern American Policing – National Law Enforcement Administration, accessed July 1, 2026, https://nleausa.org/the-state-of-modern-american-policing/
34. Phoenix PD reassigning 108 officers to patrol amidst staffing shortage – 12News, accessed July 1, 2026, https://www.12news.com/article/news/local/valley/phoenix-police-reallocates-resources-to-address-staffing-shortage-feb-2022/75-8b6d6e60-4466-444a-bff1-7ee834aa7048
35. New Seattle police chief reassigning 100 cops to patrol to improve response times – Police1, accessed July 1, 2026, https://www.police1.com/chiefs-sheriffs/articles/new-seattle-police-chief-reassigning-100-cops-to-patrol-to-improve-response-times-KwNNs16wiDmGUukO/
36. APD Faces Downtown Staffing Crisis Amid Citywide Officer Shortage – YouTube, accessed July 1, 2026, https://www.youtube.com/watch?v=FWayos3CMSk
37. Baltimore Police Restructure Burglary Detectives To Patrol – WBAL Radio, accessed July 1, 2026, https://www.wbal.com/baltimore-police-restructure-burglary-detectives-to-patrol
38. Austintown police prioritize staffing with levy funds | News, Sports, Jobs – The Vindicator, accessed July 1, 2026, https://www.vindy.com/news/local-news/2025/11/austintown-police-prioritize-staffing-with-levy-funds/
39. Some Missouri police cut ties with ATF sue to new gun law | AP News, accessed July 1, 2026, https://apnews.com/article/mo-state-wire-michael-brown-laws-gun-politics-police-0b82a41e6fe4fb5b5382cba420f686fd
40. Policing Productivity Review (accessible) – GOV.UK, accessed July 1, 2026, https://www.gov.uk/government/publications/policing-productivity-review/policing-productivity-review-accessible
41. Full article: Caseloads, culture, and capacity: rethinking investigative policing, accessed July 1, 2026, https://www.tandfonline.com/doi/full/10.1080/10439463.2025.2573903
42. COUNCILMEMBER CHRIS CATE CITY OF SAN DIEGO SIXTH DISTRICT MEMORANDUM, accessed July 1, 2026, https://www.sandiego.gov/sites/default/files/2016safetypriority.pdf
43. Law Enforcement Solutions By the Field, For the Field: Collaborative Reform Fourth Annual Review – Agency Portal, accessed July 1, 2026, https://portal.cops.usdoj.gov/resourcecenter/content.ashx/cops-p458-pub.pdf
44. Evidence Management Blind Spots: What Law Enforcement Command Staff Can’t Afford to Risk – Cellebrite, accessed July 1, 2026, https://cellebrite.com/en/blog/law-enforcement-command-evidence-management-challenge/
45. The Evolution of Intelligence Fusion: From Silos to Unified Operations – BlackScore, accessed July 1, 2026, https://www.blackscore.ai/blog/evolution-of-intelligence-fusion.html
46. Why Institutional Memory Is the New Strategic Asset for Intelligence Agencies – Innefu Labs, accessed July 1, 2026, https://innefu.com/why-institutional-memory-is-the-new-strategic-asset-for-intelligence-agencies/
47. Why Institutional Memory Matters in Long-running Criminal Investigations – Innefu Labs, accessed July 1, 2026, https://innefu.com/why-institutional-memory-matters-in-long-running-criminal-investigations/
48. Full article: Operation Kairos: entropy and the temporality of organised policing, accessed July 1, 2026, https://www.tandfonline.com/doi/full/10.1080/30679125.2025.2607612
49. IACP 2025 Quick Take: Fixing institutional betrayal in policing – Police1, accessed July 1, 2026, https://www.police1.com/health-wellness/iacp-2025-quick-take-fixing-institutional-betrayal-in-policing
50. Futures Orientation in Police Decision-Making Practices: The Promise of a Modified Canadian Model | FBI: Law Enforcement Bulletin, accessed July 1, 2026, https://leb.fbi.gov/articles/featured-articles/futures-orientation-in-police-decision-making-practices-the-promise-of-a-modified-canadian-model
51. Relational continuity in community policing: Insights from a human-centred design perspective – Oxford Academic, accessed July 1, 2026, https://academic.oup.com/policing/article/doi/10.1093/police/paad038/7214006
52. Addressing police turnover: Challenges, strategies, and future research directions, accessed July 1, 2026, https://www.rti.org/rti-press-publication/addressing-police-turnover-challenges-strategies-future-research-directions
53. Closing the rookie experience gap: What every shift can do to boost officer safety – Police1, accessed July 1, 2026, https://www.police1.com/what-cops-want/closing-the-rookie-experience-gap-what-every-shift-can-do-to-boost-officer-safety
54. Succession Planning – FDLE, accessed July 1, 2026, https://www.fdle.state.fl.us/getContentAsset/44aac86e-5e00-43aa-bdd3-b4dd38ced358/73aabf56-e6e5-4330-95a3-5f2a270a1d2b/Kandalec-Donald-paper.pdf?language=en
55. The Importance of Knowledge Transfer | Texas Police Trainers, accessed July 1, 2026, https://helloskip.com/b/texas-police-trainers/blog/the-importance-of-knowledge-transfer
56. FBI New Orleans Recognizes 45th Anniversary of the Joint Terrorism Task Force, accessed July 1, 2026, https://www.fbi.gov/contact-us/field-offices/neworleans/news/fbi-new-orleans-recognizes-45th-anniversary-of-the-joint-terrorism-task-force
57. Protecting Your Community from Terrorism, Volume 1: Strategies for Local Law Enforcement – Agency Portal, accessed July 1, 2026, https://portal.cops.usdoj.gov/resourcecenter/content.ashx/cops-w0359-pub.pdf
58. National Joint Terrorism Task Force – FBI, accessed July 1, 2026, https://www.fbi.gov/news/stories/2008/august/njttf_081908
59. Inside the FBI Podcast: Joint Terrorism Task Forces | Federal Bureau of Investigation, accessed July 1, 2026, https://www.fbi.gov/video-repository/inside-the-fbi-podcast-joint-terrorism-task-forces.mp4/view
60. – POLICE AS FIRST PREVENTERS: LOCAL STRATEGIES IN THE WAR ON TERROR, accessed July 1, 2026, https://www.govinfo.gov/content/pkg/CHRG-109hhrg35627/html/CHRG-109hhrg35627.htm
61. Best Practices for Local Law Enforcement in Counterterrorism: Enhancing Interagency Communication & Developing Modern Information Sharing Systems, accessed July 1, 2026, https://digitalcommons.newhaven.edu/cgi/viewcontent.cgi?article=1269&context=masterstheses
62. The Department of Justice’s Terrorism Task Forces, accessed July 1, 2026, https://oig.justice.gov/sites/default/files/reports/I-2005-007.pdf
63. Strategic Change and the Joint Terrorism Task Force: Ideas and Recommendations – DTIC, accessed July 1, 2026, https://apps.dtic.mil/sti/tr/pdf/ADA477108.pdf
64. FAQ on withdrawing from the Joint Terrorism Task Force | Portland.gov, accessed July 1, 2026, https://www.portland.gov/hardesty/news/2019/2/1/faq-withdrawing-joint-terrorism-task-force
65. Portland Pulling Officers Out of Anti-Terror Task Force; Dispute Over Security Clearance, accessed July 1, 2026, https://www.police1.com/terrorism/articles/portland-pulling-officers-out-of-anti-terror-task-force-dispute-over-security-clearance-Lf43UCHdxNWwY87k/
66. Portland Leaves the Joint Terrorism Task Force Again, Becoming Second U.S. City to Cut Ties – Willamette Week, accessed July 1, 2026, https://www.wweek.com/news/city/2019/02/13/portland-leaves-the-joint-terrorism-task-force-again-becoming-second-city-to-cut-ties/
67. Portland Commissioners Grill FBI, DOJ Over Terrorism Task Force – OPB, accessed July 1, 2026, https://www.opb.org/news/article/portland-joint-terrorism-task-force-fbi-doj/
68. Keeping Portland out of the Joint Terrorism Task Force – ACLU of Oregon, accessed July 1, 2026, https://www.aclu-or.org/news/keeping-portland-out-joint-terrorism-task-force-0/
69. Trump Counterterrorism Strategy Expands Administration’s War on Progressives | Truthout, accessed July 1, 2026, https://truthout.org/articles/trump-counterterrorism-strategy-expands-administrations-war-on-progressives/
70. Considerations for Fusion Center and Emergency Operations Center Coordination – FEMA, accessed July 1, 2026, https://www.fema.gov/sites/default/files/2020-07/considerations-fusion-center-emergency-operations-center-coordination.pdf
71. FUSION CENTERS? – ACLU, accessed July 1, 2026, https://assets.aclu.org/live/uploads/publications/fusioncenter_20071212.pdf
72. GAO-15-155, INFORMATION SHARING: DHS Is Assessing Fusion Center Capabilities and Results, but Needs to More Accurately Account f, accessed July 1, 2026, https://www.gao.gov/assets/gao-15-155.pdf
73. FY21 Fusion Centers Assessment Summary of Findings – National Archives, accessed July 1, 2026, https://www.archives.gov/files/isoo/oversight-groups/sltps-pac/2021-fusion-centers-assessment-summary-of-findings.pdf
74. 2018 National Network of Fusion Centers Final Report – Homeland Security, accessed July 1, 2026, https://www.dhs.gov/sites/default/files/publications/2018_national_network_of_fusion_centers_final_report.pdf
75. 2012 National Network of Fusion Centers Final Report – Homeland Security, accessed July 1, 2026, https://www.dhs.gov/sites/default/files/publications/2012%20National%20Network%20of%20Fusion%20Centers%20Final%20Report.pdf
76. Fusion Centers and State Energy Stakeholders: Pathways to Robust Threat Information Sharing – NARUC, accessed July 1, 2026, https://pubs.naruc.org/pub/E65B4300-A1FC-132C-70A5-7D0BD2B2778C
77. ADVANCING THE HOMELAND SECURITY INFORMATION SHARING ENVIRONMENT: A REVIEW OF THE NATIONAL NETWORK OF FUSION CENTERS, accessed July 1, 2026, https://nsarchive.gwu.edu/sites/default/files/documents/4311642/House-Homeland-Security-Committee-Advancing-the.pdf
78. Federal Agencies Are Sharing Border and Terrorism Information with Local and Tribal Law Enforcement Agencies, but Additional Efforts Are Needed, accessed July 1, 2026, https://www.gao.gov/assets/a299804.html
79. New Report: Police Intelligence Gathering Lacks Standards, Threatens National Security and Civil Liberties | Brennan Center for Justice, accessed July 1, 2026, https://www.brennancenter.org/our-work/analysis-opinion/new-report-police-intelligence-gathering-lacks-standards-threatens
80. Homeland Threat Assessment, accessed July 1, 2026, https://www.dhs.gov/publication/homeland-threat-assessment
81. Police and National Security: American Local Law Enforcement and Counter-Terrorism after 9/11 – Scholarship Archive, accessed July 1, 2026, https://scholarship.law.columbia.edu/cgi/viewcontent.cgi?article=2563&context=faculty_scholarship
82. Overview: FBI’s Joint Terrorism Task Force – ACLU of Colorado, accessed July 1, 2026, https://www.aclu-co.org/overview-fbis-joint-terrorism-task-force/
83. ACLU asks Denver to withdraw from JTTF – ACLU of Colorado, accessed July 1, 2026, https://www.aclu-co.org/aclu-asks-denver-withdraw-jttf/
84. BRENNAN CENTER FOR JUSTICE – Stanford Law School, accessed July 1, 2026, https://law.stanford.edu/wp-content/uploads/2020/06/Report_NationalSecurity_LocalPolice.pdf
85. Marking the 25th Anniversary | National September 11 Memorial & Museum, accessed July 1, 2026, https://www.911memorial.org/marking-25th-anniversary
86. Honoring the 25th Anniversary of 9/11: Balancing National Security and Civil Liberties in Post-9/11 America – Macomb Community College, accessed July 1, 2026, https://events.macomb.edu/event/honoring-the-25th-anniversary-of-911-balancing-national-security-and-civil-liberties-in-post-911-america

1. Executive Summary

The 2026 FIFA World Cup constitutes a logistical and security operation of historical significance. Spanning 16 host cities across the United States, Canada, and Mexico, the expanded 48-team tournament necessitates a fundamental adaptation in major event security, public order policing, and emergency medical response protocols.¹ With 104 matches occurring over a 39-day period—often featuring up to four matches per day during the initial group stages—the operational tempo will severely test the structural limits of municipal, federal, and international law enforcement frameworks.³ Match schedules ranging from group stage fixtures like Algeria versus Austria in Kansas City to Round of 32 elimination games like Brazil versus Japan in Houston demonstrate the vast geographic footprint required to sustain continuous security operations.⁴

The security architecture required to protect millions of traveling spectators, dignitaries, and critical infrastructure networks relies entirely on a highly integrated, trilateral command structure. In the United States, the designation of all 78 domestically hosted matches as Special Event Assessment Rating (SEAR) Level 1 and 2 events—with some matches potentially elevated to National Special Security Events (NSSE)—initiates a formalized federal command hierarchy. This structure centralizes operational planning under the(https://www.secretservice.gov/protection/events/credentialing) for NSSEs while relying heavily on state and local agencies for tactical execution.⁵ Parallel frameworks established by Canadian and Mexican authorities mandate seamless cross-border intelligence sharing and synchronized threat mitigation to ensure uniform security standards across the continent.⁷

This strategic playbook, developed for professional security planners, outlines the foundational blueprint for the tournament’s public safety operations, focusing deeply on three critical domains. First, it analyzes the overlapping command structures and multinational intelligence hubs that dictate resource allocation, interagency communication, and transnational threat assessment. Second, it details the tactical pivot by North American law enforcement toward European-style mounted police operations. This section focuses on the advanced crowd-control formations and equine desensitization programs required to manage the dense, highly passionate supporter demographics inherent to international soccer.⁸ Third, the analysis examines dynamic threat response models in gridlocked urban environments. Recognizing that traffic congestion neutralizes traditional emergency response, the report emphasizes the critical transition toward Tactical Emergency Medical Support (TEMS), the Rescue Task Force (RTF) model, and two-wheeled rapid response units designed to circumvent systemic urban paralysis.⁹ The resulting synthesis provides a comprehensive operational framework for navigating the multi-domain threat landscape of the 2026 tournament.

2. Trilateral Command Architecture and Overlapping Jurisdictions

The decentralized geography of the 2026 tournament dictates a security apparatus that transcends traditional municipal and national boundaries. The resulting architecture is a complex composite of federal statutory authority, multinational intelligence cooperatives, and localized tactical execution, designed to function cohesively despite significant jurisdictional overlap.

2.1 The SEAR and NSSE Security Frameworks

In the United States, the overarching security posture is defined by the Department of Homeland Security’s designation of all 78 U.S. matches as Special Event Assessment Rating (SEAR) Level 1 and 2 events, alongside potential National Special Security Event (NSSE) designations for select high-profile gatherings. For events receiving the NSSE designation—originating partially as a legislative response to the security vulnerabilities exposed during the 1996 Atlanta Summer Olympics—a federally mandated command hierarchy is initiated.⁵ Under Homeland Security Presidential Directive 5 (HSPD-5), the Secretary of Homeland Security authorizes the NSSE designation following assessments by a working group co-chaired by the United States Secret Service (USSS), the Federal Bureau of Investigation (FBI), and the Federal Emergency Management Agency (FEMA).⁶

Under this statutory framework, routine day-to-day local policing is not usurped; rather, the security perimeters and critical operational zones surrounding stadiums and fan festivals are absorbed into a federal matrix.¹¹ Title 18 USC 3056(e) and Presidential Policy Directive 22 designate the USSS as the lead agency responsible for the design, coordination, and implementation of the operational security plan, including the highly restrictive credentialing processes for all venue participants.⁶ Simultaneously, the FBI assumes command of intelligence gathering, counter-terrorism operations, and crisis response, while FEMA serves as the federal lead for planning support, consequence management, and operational readiness for mass-casualty emergencies.¹¹

To operationalize this triad, a Multi-Agency Command Center (MACC) is established in each host city to fuse data streams from the FBI’s Joint Operations Center (JOC), the Department of Homeland Security’s National Operations Center (NOC), and local Emergency Operations Centers (EOC).¹² This overlapping command structure ensures that local police departments—which supply the vast majority of the tactical manpower—are directed by unified federal intelligence and logistical support. The MACC also integrates specialized cells, including the Joint Information Center (JIC) and the Airspace Security Operations Center (ASOC), creating a unified operational picture.¹³

2.2 Financial Mobilization and Procurement Timelines

The financial burden of mobilizing tens of thousands of local officers and securing specialized hardware is heavily subsidized by federal grants. U.S. security efforts are supported by a $625 million grant package administered by FEMA, officially designated as the FIFA World Cup Grant Program (FWCGP), distributed across the 11 domestic host cities relative to the number and significance of the matches hosted at each venue. For instance, Florida agencies received the largest single allocation, totaling $73.7 million, directly reflecting Miami’s responsibility for hosting high-profile elimination matches, including the Round of 32, quarterfinals, and the third-place clash.⁵

However, the procurement cycle for advanced security infrastructure is highly sensitive to political friction. Department of Homeland Security funding was delayed until March 11 due to a partial government shutdown, severely compressing the financial timelines required for host cities to acquire necessary equipment and finalize staffing contracts.⁵ The impact of these delays was most visible in Foxborough, Massachusetts, where local officials threatened to withdraw Gillette Stadium from the hosting roster due to a $7.8 million shortfall in vital security funding, illustrating that host municipalities cannot sustain the financial weight of an NSSE without uninterrupted federal subsidization.⁵

2.3 The International Police Cooperation Center (IPCC)

The nerve center for multinational threat assessment and rapid intelligence dissemination during the tournament is the International Police Cooperation Center (IPCC), located at the National Conference Center in Leesburg, Virginia.² Facilitated in 2025 by the FBI’s Critical Incident Response Group under a mandate from the White House Task Force (Executive Order 14234), the IPCC operates as a secure, 24-hour centralized coordination hub.²

The architectural layout of the IPCC is deliberately designed to reduce bureaucratic friction and foster immediate operational trust. Command desks are arranged to co-locate international liaison officers from participating countries directly with representatives from all 16 host cities.² This spatial design enables the near-instantaneous transmission of intelligence regarding high-risk individuals, extremist networks, or organized criminal elements entering North America.² Intelligence sourced from U.S. embassies abroad, state fusion centers, and FIFA’s proprietary risk networks is aggregated within the IPCC, allowing foreign policing intelligence to be rapidly translated into actionable, localized protective measures.²

During pre-tournament operations, officials including White House Task Force Executive Director Andrew Giuliani and FBI Special Agent in Charge Doug Olson highlighted the center’s capacity to actively process upwards of 300 threat assessments and tips in a single day.² The threats managed range from localized disturbances, such as supporters attempting to smuggle unauthorized pyrotechnics into venues, to highly severe national security concerns including human trafficking rings and coordinated terror plots.² Throughout the tournament, the IPCC monitors a shared situational awareness dashboard, maintaining a unified operating picture across all stadiums, fan fests, and critical transit nodes to support enterprise-wide decision-making.²

2.4 Cross-Border Synergies and Intelligence Operations

The trilateral nature of the 2026 event necessitates profound integration between United States, Canadian, and Mexican security apparatuses. Through initiatives coordinated by the Organization of American States (OAS) and the((https://unicri.org/News-Coordinating-Security-Across-Borders-Canada-Mexico-United-States-Prepare-for-the-FIFA-World-Cup-2026)) (UNICRI), the three nations are actively aligning their security frameworks, planning timelines, and technological interoperability.⁷ A key element of this collaboration was the Peer-to-Peer Trilateral Meeting held in Washington, D.C., which gathered delegates from all 16 hosting cities to establish formalized cross-border information sharing protocols and develop strategies to mitigate disinformation, cyber threats, and hooliganism.⁷

Canada has committed substantial resources to secure matches in Vancouver and Toronto. The federal government allocated an additional $145 million to support local public safety agencies, building upon a baseline $220 million commitment and a separate $100 million budget for federal partners.¹⁴ The Royal Canadian Mounted Police (RCMP) leads the federal law enforcement effort, collaborating closely with the Canada Border Services Agency (CBSA) to collect intelligence on high-priority criminal threats, particularly entities exploiting the Nexus trusted traveler program.¹⁵ To support these operations, Shared Services Canada (SSC) provides resilient, secure digital networks at FIFA sites, ensuring that the RCMP and local police maintain uninterrupted communications infrastructure.¹⁶

Mexico approaches tournament security through an extensive, highly visible militarized deployment, a strategy validated during previous domestic international events. Operations such as “Plan Kukulkan” mobilize nearly 100,000 personnel drawn from the military, the Air Force, the National Guard, and municipal police forces.¹⁷ The Mexican security model relies on establishing deep, multi-layered perimeters, extending up to a one-mile radius around venues like the Estadia Azteca.¹⁷ This physical perimeter is reinforced by advanced surveillance architecture, including the deployment of robotic dogs, 33 surveillance drones, 24 tactical aircraft, and 188 specialized explosive and narcotic canine detection teams.¹⁷ Together, these trilateral efforts form a continental security shield designed to detect and neutralize threats prior to border transit.

3. Threat Landscape and Multi-Domain Risk Analysis

The overarching security apparatus must manage a highly convergent threat environment where physical, digital, and geopolitical risks intersect continuously. The scale and global visibility of the event ensure that localized disruptions possess the inherent potential to cascade into significant international incidents, requiring constant analyst-led assessment to maintain real-time situational awareness.

3.1 Supporter-Related Violence and Hooliganism

Unlike typical North American professional sporting events, international soccer possesses a long, well-documented history of organized supporter violence, commonly referred to as hooliganism.³ Opposing fan bases frequently travel with embedded organizational structures capable of orchestrating pre-planned violence or inciting spontaneous riots. Trilateral intelligence planners have focused heavily on this risk, engaging experts such as Franco Berlin of the Argentine Ministry of National Security to model supporter behavior and crowd control dynamics.⁷

Threat assessments indicate that because stadium perimeters are highly fortified with rigid access controls, criminal activity and violent confrontation will naturally displace into softer, secondary environments.¹⁸ This includes transit hubs, official fan festivals, local hospitality sectors, and team base camps.¹⁹ Furthermore, risk intelligence analysts warn that this distributed threat surface increases the likelihood of crimes of opportunity targeting unfamiliar visitors, as well as an escalation in human trafficking and exploitation linked to the massive influx of international travelers and temporary workforces.¹⁹ The high concentration of rival factions in dense urban centers requires preemptive intelligence gathering and physical separation tactics to prevent mass-casualty crowd crush events, unmanaged gatherings, or wide-scale rioting in public squares.¹⁹

3.2 Geopolitical Activism and Lone-Actor Extremism

The 2026 World Cup provides an unparalleled global platform for geopolitical messaging and targeted activism. Security analysts forecast persistent protest activity driven by international conflicts, domestic political disputes across the host nations, and localized economic disparities.²⁰ While organized activist groups may seek to disrupt transit infrastructure or blockade main stadium access routes to maximize visibility, a more severe kinetic threat profile involves lone-actor extremists.¹⁹

Driven by ideological extremism—ranging from Islamist extremism to domestic left- or right-wing militant ideologies in the U.S. and Canada—these individuals typically target the periphery of the event.²⁰ Because host nations maintain highly sophisticated intelligence capabilities to detect and disrupt coordinated, high-casualty terror plots involving multiple operatives, the primary physical threat is derived from isolated actors exploiting the “path of least resistance” in areas with high population density but lower security screening thresholds.¹⁸

3.3 The Cyber-Physical Convergence

The modern World Cup relies heavily on deeply interconnected digital infrastructure, creating a massive, highly lucrative attack surface for sophisticated cybercriminals and state-aligned actors. Analysts forecast severe stress tests on global digital infrastructure throughout the tournament.¹⁹ The risks extend far beyond data theft; during the 2024 Paris Olympics alone, authorities confirmed over 140 cyber-attacks targeting critical systems.²¹

For the 2026 tournament, identified cyber risks include widespread ticketing fraud utilizing fake domains that impersonate official FIFA platforms, alongside targeted phishing and social engineering campaigns directed at vendors, event staff, and logistics personnel.¹⁹ Most critically, ransomware and Distributed Denial of Service (DDoS) attacks pose a direct physical risk if directed at municipal transit grids, emergency 911 dispatch systems, or stadium access controls.¹⁹ A localized digital failure affecting stadium turnstiles or rail schedules could instantly induce dangerous crowd bottlenecks and physical crush risks. To mitigate these logistical vulnerabilities, FIFA relies on enterprise-grade AI command centers, such as the Lenovo technology hub in Miami, to continuously monitor and coordinate team arrivals, stadium resources, and fan transportation networks in real-time.¹

4. Adaptation of European Mounted Unit Tactics for Crowd Management

To safely manage the specific behavioral dynamics of massive international soccer crowds, North American law enforcement agencies are undertaking a fundamental overhaul of their public order strategies. A cornerstone of this tactical evolution is the widespread adoption of European and British mounted police methodologies, shifting the role of police cavalry from passive patrol to dynamic crowd manipulation.⁸

4.1 The Strategic Utility of Police Cavalry in Public Order

The deployment of mounted police units offers an unparalleled mass advantage in civil disorder and crowd management scenarios. Due to the sheer physical dimensions, muscle mass, and weight of a horse, a single mounted officer can safely exert the crowd-displacement force of ten to twelve officers on foot.⁸ This biological force multiplier allows agencies to push back dense, agitated crowds and physically separate violently opposed fan bases while simultaneously conserving highly valuable ground personnel for targeted arrests or perimeter defense.

Furthermore, mounted units provide critical “vantage point policing” capabilities. Seated approximately ten feet above ground level, mounted officers possess significantly enhanced situational awareness over a packed crowd. This elevated perspective enables the early visual detection of localized fights, medical emergencies, or dangerous crowd surges that would remain entirely invisible to foot patrols submerged within the mass, allowing commanders to intervene and de-escalate situations before they compound.⁸

4.2 European Methodologies and the “Turnstile” Concept

Historically, U.S. mounted units have been utilized primarily for community engagement or general park patrols.²³ To prepare for the World Cup, agencies including the Atlanta Police Department and the Cobb County Sheriff’s Office have partnered with specialized public order consultancies—most notably Survival Edge Tactical Systems.⁸ Led by instructors with extensive experience in London’s Metropolitan Police and other European forces, these training programs import tactics proven effective against football hooliganism across the United Kingdom and Germany.⁸

These European doctrines treat the mounted unit as a highly dynamic tool for physical crowd manipulation. A primary tactical application involves utilizing horses as living “turnstiles.” In this capacity, mounted units are positioned strategically at chokepoints to manage and restrict the flow of thousands of supporters moving toward stadium entrances or transit stations, preventing dangerous crushes by regulating the entry velocity of the crowd.⁸ Additionally, mounted units are designated to secure and escort massive fan marches, flanking the perimeters of the procession to insulate the supporters from vehicular traffic and rival factions.⁸

Crucially, planners must carefully distinguish between authorized crowd control tactics like “encirclement” and the more controversial European tactic known as “kettling.” While kettling involves police cordons completely containing a large, potentially violent crowd for an extended period—a tactic frequently challenged in human rights contexts—encirclement is a targeted maneuver. Mounted units may use encirclement to isolate a very specific, small section of a crowd to extract a downed officer, separate antagonistic instigators, or execute targeted arrests (snatch squads) without trapping innocent bystanders.

4.3 Dynamic Formations and Tactical Execution

The effectiveness of a mounted unit during civil disorder relies entirely on precise, coordinated geometric formations designed to break the momentum of a mob. These movements must be executed flawlessly amidst extreme acoustic chaos, relying on visual hand signals and standardized auditory commands relayed by the platoon leader.²⁵ The tactical deployment of these formations allows commanders to maneuver the crowd into advantageous positions.

The application of the wedge formation is particularly critical for targeted interventions. As the wedge drives into the center of a hostile crowd, it parts the mass, allowing a closely following, dismounted arrest team—often referred to as a “snatch squad”—to safely infiltrate the mob, identify ringleaders, and extract them behind the police line without triggering a broader riot.²⁷

4.4 Equine Desensitization, Logistics, and Embedded Medical Support

The success of these close-quarters formations relies inherently on overriding the biological flight instinct of the horse. Extensive desensitization, or “bombproofing,” is currently the focus of daily operations across host city mounted units. Through continuous repetition, positive reinforcement, and specialized obstacle courses, horses are subjected to extreme sensory overload.⁸ Instructors expose the animals to industrial smoke machines, wailing sirens, exploding firecrackers, waving flags, and the discharge of blank ammunition directly from the saddle, continuing the training until the horses demonstrate absolute neutrality to riot conditions.⁸

Sustaining this capability during continuous tournament operations requires meticulous logistics and the procurement of advanced riot equipment matching the British Home Office Scientific Development Branch (HOSDB) standards.²⁴ Recognizing the severe physiological toll on the animals, agencies are implementing European logistical models, deploying mobile staging trailers directly to the operational theater. These forward operating bases are equipped with large volumes of water, forage, and electrolyte syringes, allowing units to rotate out of the hot zone frequently.⁸ Crucially, operations will feature specialized veterinarians embedded directly into the field alongside the officers on match days. This protocol ensures immediate trauma care is available for any mounts injured by projectiles or crowd violence, securing the operational continuity of the unit.⁸

5. Dynamic Threat Response in Gridlocked Urban Environments

The influx of millions of international visitors will severely degrade the baseline transportation infrastructure of the host cities. The resulting logistical gridlock poses an existential threat to traditional emergency medical and tactical response models, forcing public safety planners to rethink deployment strategies fundamentally.

5.1 The Friction of Traffic Congestion on Emergency Services

Traffic congestion drastically compromises the efficiency and life-saving capabilities of police, fire, and Emergency Medical Services (EMS). Current industry data indicates that nearly 50% of first responder agencies report worsening response times year-over-year, with 41.7% specifically citing traffic gridlock as the primary insurmountable variable.²⁹ During the high-density travel windows surrounding World Cup matches, the sheer volume of pedestrian and vehicular movement creates localized paralysis in the urban core.

If an incident requires mass evacuation—due to a natural disaster, structural fire, or targeted attack—standard traffic flows collapse entirely. Planners rely on advanced geographic information systems (GIS) and Intelligent Transportation Systems (ITS) to simulate traffic flow and establish viable, pre-planned egress corridors.³⁰ However, in these paralyzed environments, the traditional reliance on heavy, motorized ambulances and large armored tactical vehicles to reach the point of injury is fundamentally flawed.

5.2 Tactical Emergency Medical Support (TEMS) and the Rescue Task Force (RTF)

Historically, during active threat scenarios or mass casualty incidents, conventional fire and EMS personnel adhered to strict operational doctrine: stage in a secure “cold zone” safely outside the perimeter, and wait for law enforcement to entirely neutralize the threat before advancing to treat casualties. This paradigm resulted in significant, often fatal delays in point-of-wounding care, a reality starkly exposed during the 1999 Columbine High School incident.⁹

To adapt to the modern threat landscape, the public safety architecture has shifted heavily toward Tactical Emergency Medical Support (TEMS) and the Rescue Task Force (RTF) model.³³ Developed and refined following the Hartford Consensus protocols, the RTF model pairs conventionally trained fire and EMS personnel with a heavily armed law enforcement escort.³⁵ Outfitted in ballistic personal protective equipment, the RTF aggressively pushes into the “warm zone”—areas where a direct threat is not currently active, but the environment is not entirely secure. This integration allows for immediate hemorrhage control, tourniquet application, and airway management at the exact point of injury.⁹

Successful “warm zone integration” requires meticulous coordination; joint evaluations of LEO-EMS simulated responses demonstrate that failing to maintain a tight, protective LEO-EMS physical formation is one of the most critical operational errors during extraction. During the World Cup, Casualty Collection Points (CCP) will be pre-identified in warm zones within stadiums and fan fests, heavily reliant on the disciplined RTF framework to stabilize victims prior to extraction through the gridlock.³⁴

5.3 Two-Wheeled Rapid Response: Bicycles and Motorcycles

To successfully extract patients or deploy critical medical personnel through impenetrable traffic to reach these warm zones, host cities are drastically expanding their two-wheeled rapid response capabilities.

Bicycle Rapid Response Teams: Bike medics possess an unparalleled capacity to navigate dense pedestrian crowds, access narrow alleyways, traverse difficult terrain, and utilize sidewalks or transit corridors entirely inaccessible to motorized transport.¹⁰ Case studies from high-density environments demonstrate their efficacy; the Los Angeles Fire Department maintains a full-time bike medic team at the Los Angeles International Airport that routinely achieves response times of two minutes, drastically outperforming traditional ambulances that require up to fifteen minutes to navigate the notorious local gridlock.¹⁰ Across the country, approximately 300 specialized bike medic teams are deployed to provide immediate life-saving interventions in environments where heavy vehicles cannot operate.³⁹

Motorcycle Medic Units: For slightly longer transit distances requiring the bypass of vehicular bottlenecks, motorcycle units provide exceptional rapid response capabilities.⁴⁰ Agencies in cities like Pittsburgh frequently deploy specialized motorcycle medics during major civic events and fireworks displays to intercept heat casualties or trauma victims before heavy ambulances can penetrate the perimeter.⁴² The speed, narrow profile, and agility of the police motorcycle allow tactical medical assets to weave between stopped vehicles and penetrate the core of an incident rapidly, applying stabilizing care while extraction logistics are coordinated.⁴⁰

6. Counter-Unmanned Aircraft Systems (C-UAS) and Airspace Interdiction

The rapid proliferation of commercial drone technology presents a highly asymmetrical threat profile to massive open-air venues. Unauthorized Unmanned Aircraft Systems (UAS) pose severe risks, ranging from accidental crashes into packed grandstands causing panic, to the deliberate, malicious deployment of chemical agents or explosive payloads directly over densely populated areas. Securing the airspace requires a robust synthesis of federal regulation and advanced military-grade electronic warfare capabilities.

6.1 Temporary Flight Restrictions (TFR) and Federal Statutes

To establish a sanitized and easily monitored airspace, the Federal Aviation Administration (FAA) will implement strict Temporary Flight Restrictions (TFR) covering all stadiums, official fan festivals, and team encampments throughout the tournament.⁴³ These restrictions dictate precise geographical boundaries, altitude ceilings, and operational timeframes where all civilian drone operations are expressly prohibited. For example, comprehensive TFRs are slated for the airspace surrounding the seven matches hosted at Boston Stadium, as well as the Fan Fest located at Boston City Hall Plaza, establishing a rigid “no-drone zone”.⁴³

Enforcement of these TFRs transitions the airspace from a regulatory concern to an active, zero-tolerance security operation. Unauthorized intrusion into a World Cup TFR is classified as a federal crime, carrying severe penalties that include the permanent seizure of the equipment, up to one year in federal prison, and criminal fines reaching $100,000.⁴³ The FBI maintains explicit statutory authority to deploy counter-UAS mitigation capabilities to detect, track, intercept, and disable unauthorized drones operating within these restricted zones, while simultaneously preserving the hardware for subsequent forensic exploitation and federal prosecution.⁴³

6.2 Civil-Military Integration and the Transfer of Combat Doctrine

The technological requirements for effective C-UAS operations far exceed the baseline capabilities of traditional municipal police departments. Consequently, securing the World Cup airspace requires extensive civil-military integration and the direct transfer of combat-tested methodologies to domestic law enforcement.

To bridge this critical capability gap, the U.S. Army’s Joint Interagency Task Force 401 (JIATF-401), directed by Brig. Gen. Matt Ross, has partnered directly with the FBI.⁴⁵ Operating through the FBI’s National Counter-UAS Training Center (NCUTC), military instructors are actively transferring Department of Defense drone detection and mitigation practices to state, local, tribal, and territorial law enforcement personnel.⁴⁵ This exhaustive training curriculum, executed at facilities such as the Yakima Training Center in Washington, encompasses nighttime detection protocols, complex airspace awareness, and coordinated electronic mitigation techniques designed to neutralize drones without causing kinetic fallout or collateral damage over crowded urban areas.⁴⁵

6.3 Procurement and Implementation of Mitigation Hardware

State agencies are heavily invested in acquiring the necessary hardware to support these advanced operations. Supported by the FEMA FWCGP grant distributions, entities such as the Texas Department of Public Safety have executed multimillion-dollar acquisitions of advanced detection telemetry and mitigation technology, securing $3.2 million specifically for C-UAS hardware. As international stakeholders, including Representative Michael McCaul, raise concerns regarding the potential for state actors or terrorist organizations to utilize drone technology, the implementation of these systems is accelerating.⁴⁶

During the tournament, a record number of venues will be enveloped in C-UAS mitigation networks. In 2025, only five SEAR-level (Special Event Assessment Rating) events in the United States featured counter-drone coverage; for the 2026 World Cup alone, an unprecedented 326 individual events, matches, and fan gatherings will be protected by active C-UAS mitigation systems, representing a historic escalation in domestic airspace security operations.²

7. Strategic Conclusions

The public safety architecture designed for the 2026 FIFA World Cup represents a defining evolution in the execution of major event security. The massive scale of a trilateral, 16-city tournament precludes the viability of isolated, municipal-level security planning. Instead, the operational reality demands a deeply fused, overarching federal command structure, exemplified by the SEAR/NSSE framework and the real-time global intelligence synchronization achieved at the International Police Cooperation Center.

Furthermore, the operational environment dictates severe tactical pivots. The integration of robust European mounted police doctrines provides necessary physical leverage for complex crowd management scenarios, while the rapid adoption of the Rescue Task Force model and two-wheeled medical dispatch effectively circumvents the paralyzing reality of urban gridlock. Finally, the militarization of domestic airspace security through expansive C-UAS networks highlights the critical need to adapt continuously to asymmetric technological threats.

Ultimately, the intelligence-sharing frameworks, interagency funding mechanisms, and tactical cross-training protocols established for the 2026 World Cup will forge a permanent legacy. The standard operating procedures developed during this tournament will irrevocably alter the baseline parameters for public order policing, emergency mass casualty response, and multi-agency coordination for all future North American high-density events.

Appendix: Analytical Approach and Source Architecture

The analytical framework governing this report relies on the synthesis of multi-source intelligence, tactical doctrine, and documented federal security directives related to the 2026 FIFA World Cup. The integration of data across disparate operational domains—ranging from high-level command structures to granular tactical field maneuvers—was achieved by analyzing the intersections of specific law enforcement, emergency management, and military source materials.

Information regarding the overarching command architecture, including SEAR/NSSE designations, FEMA funding parameters, and the IPCC infrastructure, was synthesized from federal communications, State Department briefings, and Congressional oversight documents.

Cross-border security integration parameters and regional risk intelligence matrices were evaluated utilizing reports from international cooperatives (such as UNICRI and the OAS), host-nation government declarations, and private sector risk intelligence analysts mapping cyber and physical vulnerabilities.¹⁹

Tactical evaluations of European mounted police crowd-control formations and desensitization training were derived from public order training consultancies, active law enforcement periodicals, and historical tactical manuals detailing cavalry integration into modern policing.

Assessments of emergency response models within gridlocked environments, encompassing the transition to TEMS, the RTF model, and rapid-response bicycle/motorcycle integration, were formulated using emergency management planning guidelines, public safety logistics reports, and specific operational case studies from heavily congested municipalities.

Finally, parameters regarding airspace interdiction, FAA Temporary Flight Restrictions, and civil-military counter-UAS training programs were analyzed through joint DoD-FBI public releases, drone industry publications, and state-level public safety procurement documentation.²

Works cited

1. FIFA’s Best-Kept Secret: The AI Command Center Powering the 2026 World Cup, accessed July 1, 2026, https://www.pcmag.com/news/fifas-best-kept-secret-the-ai-command-center-powering-the-2026-world-cup
2. Inside the FIFA World Cup 2026™ International Police Cooperation Center, accessed July 1, 2026, https://www.state.gov/briefings-foreign-press-centers/inside-the-world-cup-ipcc
3. Full article: Conceptualizing FIFA World Cup security – Taylor & Francis, accessed July 1, 2026, https://www.tandfonline.com/doi/full/10.1080/14660970.2026.2640515
4. Google Sports Data, accessed July 1, 2026, https://support.google.com/knowledgepanel/answer/9787176
5. Protecting the Goal: Stadium Security Preparations for the 2026 …, accessed July 1, 2026, https://www.kroll.com/en/publications/world-cup-2026-a-security-focused-breakdown
6. National Special Security Events Credentialing – Secret Service, accessed July 1, 2026, https://www.secretservice.gov/protection/events/credentialing
7. Coordinating Security Across Borders: Canada, Mexico and the United States Prepare for the FIFA World Cup 2026 | UNICRI :: United Nations Interregional Crime and Justice Research Institute, accessed July 1, 2026, https://unicri.org/News-Coordinating-Security-Across-Borders-Canada-Mexico-United-States-Prepare-for-the-FIFA-World-Cup-2026
8. How police mounted units are preparing for the World Cup – Police1, accessed July 1, 2026, https://www.police1.com/securing-2026/how-police-mounted-units-are-preparing-for-the-world-cup
9. Rescue Task Force (RTF), accessed July 1, 2026, https://mi-bcfa.org/images/Trainings/2024-11-02_RTF.pdf
10. Bike Medics Do It Faster – CampfireCycling.com, accessed July 1, 2026, https://www.campfirecycling.com/blog/2016/06/16/bike-medics-do-it-faster
11. Pre-NSSE Coordination – FHWA Office of Operations – Department of Transportation, accessed July 1, 2026, https://ops.fhwa.dot.gov/publications/fhwahop11012/nsse5_2.htm
12. Planning And Managing Security For Major Special Events: – Agency Portal, accessed July 1, 2026, https://portal.cops.usdoj.gov/resourcecenter/content.ashx/cops-w0703-pub.pdf
13. Full Statement of Timothy J. Koerner – ACLU of Colorado, accessed July 1, 2026, https://www.aclu-co.org/app/uploads/2023/10/Testimony.USSS_.Koerner.pdf
14. Government of Canada announces up to $145 million to support public safety and security for the FIFA World Cup 2026, accessed July 1, 2026, https://www.canada.ca/en/public-safety-canada/news/2026/04/government-of-canada-announces-up-to-145-million-to-support-public-safety-and-security-for-the-fifa-world-cup-2026.html
15. Royal Canadian Mounted Police’s 2026–27 Departmental Plan, accessed July 1, 2026, https://rcmp.ca/en/corporate-information/publications-and-manuals/departmental-plans/2026-2027
16. Government of Canada partners prepare for FIFA World Cup 2026™ with SSC, accessed July 1, 2026, https://www.canada.ca/en/shared-services/campaigns/stories/government-canada-partners-prepare-fifa-world-cup-2026-ssc.html
17. Security tight in Mexico as World Cup opens – The Watch, accessed July 1, 2026, https://thewatch-journal.com/2026/06/24/security-tight-in-mexico-as-world-cup-opens/
18. Three security risks shaping the 2026 FIFA World Cup – Securitas, accessed July 1, 2026, https://www.securitas.com/en/newsroom/blog/three-security-risks-shaping-the-2026-fifa-world-cup/
19. Navigating the Threat Landscape of the 2026 FIFA World Cup – Flashpoint, accessed July 1, 2026, https://flashpoint.io/blog/2026-fifa-world-cup-threat-landscape/
20. Q&A: What Makes Securing This Year’s World Cup Different? – ASIS International, accessed July 1, 2026, https://www.asisonline.org/security-management-magazine/articles/2026/05/world-cup-security/QA-Geopolitical-hooligans/
21. The three security threats and risks shaping the 2026 FIFA World Cup – Securitas, accessed July 1, 2026, https://www.securitasinc.com/news-insights/blog/the-three-security-threats-and-risks-shaping-the-2026-fifa-world-cup/
22. America250 Fourth of July Threat Assessment – Security Boulevard, accessed July 1, 2026, https://securityboulevard.com/2026/06/america250-fourth-of-july-threat-assessment/
23. Crowd Control and More: Modern Police Mounted Units – The Blue Magazine, accessed July 1, 2026, https://www.thebluemagazine.com/columnist-upload-here/2025/11/10/crowd-control-and-more-modern-police-mounted-units
24. Public-Order-LEVEL-1 – Survival Edge Tactical Systems, accessed July 1, 2026, https://survivaledgetactical.com/public-order-level-1/
25. Education & Training Bulletin – ETB 11-02 – Crowd Control Operations – Chicago Cop, accessed July 1, 2026, https://chicagocop.com/wp-content/uploads/Education-Training-Bulletin-ETB-11-02-Crowd-Control-Operations.pdf
26. Signals for dynamic crowd control tactics – Police1, accessed July 1, 2026, https://www.police1.com/crowd-control/articles/signals-for-dynamic-crowd-control-tactics-hIL2vITDijIyXAq4/
27. 3 basic formations used for riot control – YouTube, accessed July 1, 2026, https://www.youtube.com/shorts/4_Mrxs9iDrc
28. Riot control – Wikipedia, accessed July 1, 2026, https://en.wikipedia.org/wiki/Riot_control
29. The growing challenge of traffic congestion on emergency response times, accessed July 1, 2026, https://www.smartcitiesdive.com/news/archive-acc-the-growing-challenge-of-traffic-congestion-on-emergency-response-times/754760/
30. Emergency Evacuation Planning: Minimizing Gridlock and Improving Public Safety, accessed July 1, 2026, https://www.anylogic.com/resources/case-studies/emergency-evacuation-planning-minimizing-gridlock-and-improving-public-safety/
31. Preparedness and Catastrophic Event Management for the Washington, D.C. Metropolitan Area, FTA Report No. 0007 – Federal Transit Administration, accessed July 1, 2026, https://www.transit.dot.gov/sites/fta.dot.gov/files/docs/FTA_Report_No._0007.pdf
32. USING HIGHWAYS FOR NO-NOTICE EVACUATIONS – ROSA P, accessed July 1, 2026, https://rosap.ntl.bts.gov/view/dot/20674/dot_20674_DS1.pdf
33. Webinar: (2022) Rescue Task Force: Public Safety’s Current Jedi Mind Trick – Online – National Tactical Officers Association – NTOA Publications, accessed July 1, 2026, https://public.ntoa.org/default.asp?action=viewonline&courseid=20222270
34. INCIDENT COMMAND SYSTEM PUBLICATION UNIFIED RESPONSE TO VIOLENCE INCIDENTS ICS 701 January 2023 – Firescope, accessed July 1, 2026, https://firescope.caloes.ca.gov/ICS%20Documents/ICS%20701.pdf
35. Fixing the Rescue Task Force – Police1, accessed July 1, 2026, https://www.police1.com/active-shooter/articles/fixing-the-rescue-task-force-EesmgZQFEk25kTn0/
36. Integrated ASHER/RTF Program – Gila River Indian Community Public Safety, accessed July 1, 2026, https://www.gricsafety.org/index.php/emergency-medical-services/asherrtf
37. The Rise, Fall and Rebirth of Bicycle Police by Ross D. Petty Babson College Babson Park, MA 02457 USA – IPMBA, accessed July 1, 2026, https://ipmba.org/images/uploads/Ross_Petty_History_of_Bike_Patrol.pdf
38. EMS Functions in ICS-Student Manual – National Fire Academy, accessed July 1, 2026, https://apps.usfa.fema.gov/ax/sm/sm_0166.pdf
39. ipmba news, accessed July 1, 2026, https://ipmba.org/images/uploads/IPMBA_News_Summer_2006_WebR.pdf
40. Police Motorcycles: The Ultimate Guide To These Iconic Bikes – The Wrasse Gazette, accessed July 1, 2026, https://wrasse.plymouth.ac.uk/ac-news/police-motorcycles-the-ultimate-guide-to-these-iconic-bikes-1764802618
41. Beyond Police Motorcycle Officer: On Two Wheels For Justice – The Wrasse Gazette, accessed July 1, 2026, https://wrasse.plymouth.ac.uk/ac-news/police-motorcycle-officer-on-two-wheels-for-justice-1764800440
42. Public Safety – Pittsburgh, PA, accessed July 1, 2026, https://www.pittsburghpa.gov/City-Government/City-Information/City-Press-Release-Archive/Public-Safety
43. FBI Boston Warns Drone Operators of Temporary Flight Restrictions During FIFA World Cup 2026, accessed July 1, 2026, https://www.fbi.gov/contact-us/field-offices/boston/news/fbi-boston-warns-drone-operators-of-temporary-flight-restrictions-during-fifa-world-cup-2026
44. FBI, DHS emphasize no-drone zones as World Cup kicks off, accessed July 1, 2026, https://fedscoop.com/dhs-fbi-fifa-world-cup-counter-uas-robodogs/
45. U.S. Army, FBI expand counter-drone training ahead of 2026 World Cup, accessed July 1, 2026, https://uasmagazine.com/articles/us-army-fbi-expand-counter-drone-training-ahead-of-2026-world-cup
46. DHS Secretary: U.S. Still Building Counter-Drone Defenses for World Cup, accessed July 1, 2026, https://dronelife.com/2026/06/05/world-cup-counter-drone-defenses-mullin/
47. Washington National Guard Builds Counter-UAS Partnerships Ahead of World Cup 2026, accessed July 1, 2026, https://www.war.gov/News/News-Stories/Article/Article/4509924/washington-national-guard-builds-counter-uas-partnerships-ahead-of-world-cup-20/
48. DPS Secures Drone Mitigation Technology Ahead of 2026 FIFA World Cup, accessed July 1, 2026, https://www.dps.texas.gov/news/dps-secures-drone-mitigation-technology-ahead-2026-fifa-world-cup