Source PacketCollectionsSource PacketsOfficial Source
U.S. Law Enforcement Threat Source Capture Packet
The law-enforcement lane should not be treated as a single "crime" bucket. Public FBI, DHS, DOJ, DEA, ATF, CBP, Coast Guard, Treasury, and State sources support separate evidence families: terrorism and targeted violence, counterintelligence and espionage, cybercrime and cyber-enabled fraud, WMD and proliferation prevention, transnational organized crime, illicit finance, border and port-of-entry statistics, maritime security, sanctions/legal status, and national-security prosecutions.
UNCLASSIFIED//OPEN SOURCE
Source Packet ID: WI-SOURCE-PACKET-US-LE-2026-0001
Prepared UTC: 2026-06-18T00:28:13Z
Information cutoff UTC: 2026-06-18T00:28:13Z
Source base: FBI terrorism, counterintelligence, cyber, WMD, and IC3 public sources; DHS homeland-threat and intelligence source families; DOJ National Security Division source family; DEA, ATF, CBP, Coast Guard, Treasury, State, and official U.S. intelligence/law-enforcement register source lanes.
Analytic confidence: High for FBI and IC3 source-family identity and safe corpus routing. Moderate for DHS, DEA, ATF, CBP, Coast Guard, and DOJ page-level currency because those lanes require later dated document-level refresh before stronger trend judgments.
Purpose: Create a dated law-enforcement source-capture packet for terrorism, counterintelligence, cybercrime, WMD, transnational crime, border, maritime, sanctions, and national-security legal-source lanes.
Boundary: Strategic source organization only. This packet does not provide investigative direction, collection tasking, surveillance guidance, enforcement guidance, targeting support, operational planning, tactical instructions, route selection, evasion guidance, trafficking methods, procurement advice, cyber exploitation steps, malware indicators for misuse, explosives or WMD methods, facility mapping, domestic political profiling, or protected-speech analysis.
Bottom Line
The law-enforcement lane should not be treated as a single "crime" bucket. Public FBI, DHS, DOJ, DEA, ATF, CBP, Coast Guard, Treasury, and State sources support separate evidence families: terrorism and targeted violence, counterintelligence and espionage, cybercrime and cyber-enabled fraud, WMD and proliferation prevention, transnational organized crime, illicit finance, border and port-of-entry statistics, maritime security, sanctions/legal status, and national-security prosecutions.
This packet turns those families into a dated collection frame. It is not a threat list and not an investigative guide. Domestic coverage is usable only when tied to official public definitions, violence or criminal conduct, and explicit civil-liberties boundaries. Foreign threat, sanctions, cyber, and counterintelligence material must remain tied to official issuer statements, public legal records, or source registers.
Source Ledger
| Source | Class | Access status | Corpus use | Reliability note |
|---|---|---|---|---|
| FBI Terrorism public page | A | Verified 2026-06-18 | Terrorism definitions, current threat framing, JTTF/partnership routing, and protected-speech boundary language | Authoritative for FBI public law-enforcement framing. It distinguishes violent criminal conduct from ideology and is not a substitute for designation, case, or intelligence-source evidence. |
| FBI Counterintelligence and Espionage public page | A | Verified 2026-06-18 | Foreign intelligence, espionage, economic espionage, advanced-technology, insider-threat, and counterintelligence source-family routing | Authoritative for FBI public mission framing. Do not identify private persons, companies, communities, or protected activity as threats without official public evidence. |
| FBI Cyber public page | A | Verified 2026-06-18 | Cybercrime, ransomware, cyber-enabled fraud, victim-reporting, and FBI cyber mission routing | Authoritative for FBI public framing. Use for strategic categories only; do not reproduce exploit chains, malware steps, scanning, evasion, or victim-specific detail. |
| FBI IC3 2024 Internet Crime Report | A | Verified 2026-06-18 | Reported complaint/loss baseline for internet crime, cyber-enabled fraud, ransomware, elder fraud, cryptocurrency fraud, and IC3 data caveats | Authoritative for reported IC3 complaint data. It is not a complete measurement of all cybercrime and should be labeled as complaint-based and underreported. |
| FBI Weapons of Mass Destruction public page | A | Verified 2026-06-18 | Public law-enforcement WMD prevention source family and CBRNE terrorism-risk routing | Authoritative for FBI public framing. Do not extract materials, methods, device design, facility vulnerability, or response tactics. |
| DHS Homeland Threat Assessment source family | A | Source family registered; later dated document refresh required | Homeland threat framing across terrorism, targeted violence, border security, illicit drugs, cyber, critical infrastructure, election security, foreign influence, and hazards | Authoritative when a specific DHS report is verified. Dynamic URL and PDF paths require dated page-level capture before exact claims are carried. |
| DHS Office of Intelligence and Analysis | A | Source family registered; later dated page refresh required | DHS intelligence mission, homeland threat environment, and federal/state/local/tribal/territorial/private coordination source routing | Authoritative for organizational framing. Do not extract collection, fusion-center, or partner operational detail. |
| DOJ National Security Division | A | Source family registered; later dated case/page refresh required | Counterintelligence, counterterrorism, sanctions/export-control, cyber, foreign-agent, and national-security legal-action source routing | Authoritative for public legal record and DOJ statements. Case allegations, pleas, convictions, and charges must be labeled by procedural status. |
| DEA National Drug Threat Assessment source family | A | Source family registered; later dated report refresh required | Transnational criminal organization, fentanyl, synthetic drug, trafficking-finance, and cartel-source routing at strategic level | Authoritative for DEA public threat framing when a dated report is captured. Do not reproduce trafficking, concealment, production, or distribution methods. |
| ATF firearms commerce and trafficking source families | A | Source family registered; later dated report refresh required | Firearms commerce, tracing, trafficking, explosives-statistics, and criminal-gun intelligence routing at public statistical level | Authoritative for ATF public statistics and program framing. Do not provide procurement, conversion, trafficking, or explosives guidance. |
| CBP statistics source family | A | Source family registered; later dated page refresh required | Border, port-of-entry, encounter, seizure, migration, and trade-enforcement source routing | Authoritative for CBP public statistics. Definitions must be preserved; statistics do not by themselves prove criminality, motive, or threat status. |
| U.S. Coast Guard maritime security sources | A | Source family registered; later dated page refresh required | Maritime homeland security, port security, illegal fishing, Arctic maritime, drug interdiction, and maritime law-enforcement source routing | Authoritative for Coast Guard public framing. Do not extract patrol patterns, interdiction methods, route analysis, or live movement detail. |
| Treasury OFAC and illicit-finance source families | A | Registered and active in official U.S. source lanes | Sanctions, terrorist financing, money laundering, cyber sanctions, narcotics finance, and illicit finance source routing | Authoritative for Treasury public legal/status and risk-framing evidence. Do not provide sanctions-evasion or compliance-circumvention guidance. |
| State terrorism designation and reports source families | A | Registered and active in official U.S. source lanes | FTO, state-sponsor, country-report, and counterterrorism cooperation source routing | Authoritative for State public designation/status framing. Designation evidence is not targeting evidence. |
Collection Matrix
| Law-enforcement lane | Primary source families | Corpus use | Confidence | Exclusions |
|---|---|---|---|---|
| Terrorism and targeted violence | FBI terrorism; DHS HTA; State terrorism reports/designations; NCTC historical guide; Treasury sanctions; DOJ cases | Separate international terrorism, domestic terrorism, material-support, designation, financing, and case-status evidence | High for FBI definitions and source family; moderate for current DHS/State annual refresh | No tactics, recruitment, attack-method detail, political profiling, or protected-speech labeling |
| Counterintelligence and espionage | FBI CI; ODNI/NCSC; DOJ NSD; Treasury sanctions; State/Commerce export-control lanes where public | Route foreign intelligence, economic espionage, export-control, sanctions, and transnational repression evidence | High for FBI source-family framing; moderate for case-specific current state | No private-person identification, collection guidance, insider-targeting guidance, or investigative methods |
| Cybercrime and cyber-enabled fraud | FBI cyber; IC3; CISA/NSA/FBI advisories; DOJ disruption actions; Treasury cyber sanctions; State RFJ | Distinguish cybercrime complaints, ransomware, fraud, state-linked cyber activity, critical infrastructure, and legal-source events | High for IC3 2024 complaint data; moderate for advisory page-level refresh | No exploit steps, malware detail, IOCs for misuse, scanning, evasion, victim-specific routing, or telecom network diagrams |
| WMD and proliferation law-enforcement | FBI WMD; FSAP; DTRA; State BWC; ODNI disclosure; DOJ/Treasury proliferation cases | Link terrorism-risk, biosecurity, proliferation, sanctions/legal records, and WMD public-source lanes | Moderate to high by source family | No materials, methods, controlled lists, facility tables, site mapping, device design, or vulnerability analysis |
| Transnational organized crime and narcotics | DEA; Treasury; FBI TOC; DHS/HSI; CBP; Coast Guard; ATF | Route cartel/TCO, narcotics, firearms, maritime, finance, and border-source evidence | Moderate pending dated DEA/CBP/ATF/Coast Guard refresh | No trafficking, concealment, manufacturing, procurement, logistics, or enforcement tactics |
| Border and port-of-entry statistics | CBP; DHS; DEA; Coast Guard; Treasury; GAO/CRS where relevant | Preserve official definitions for encounters, seizures, admissibility, trade, and port lanes | Moderate pending page-level refresh | No route selection, evasion guidance, or migration-path analysis |
| Maritime law enforcement | Coast Guard; CBP; DEA; Treasury; State; NOAA/NGA map references | Route maritime security, ports, illegal fishing, Arctic maritime, and maritime trafficking evidence | Moderate pending dated Coast Guard refresh | No patrol patterns, interdiction points, vessel tracking, route guidance, or tactical analysis |
| National-security legal actions | DOJ NSD; FBI; Treasury; State; Federal Register; court records where public | Separate allegations, indictments, pleas, convictions, forfeiture, sanctions, and civil actions | Moderate pending case-level refresh | No doxxing, investigative direction, witness/informant detail, or private-person profiling beyond public legal records |
Source Treatment Rules
- Keep issuer layers separate: FBI mission pages, DHS assessments, DOJ legal actions, Treasury sanctions, State designations, DEA threat reports, ATF statistics, CBP statistics, and Coast Guard maritime sources do not establish the same kind of evidence.
- Label data type before making a claim: complaint data, designation status, legal allegation, conviction, sanctions listing, annual threat assessment, statistical seizure data, source-family routing, or issuer perspective.
- Treat IC3 statistics as reported complaint data. Do not present complaint counts or losses as complete measurement of all cybercrime.
- Preserve civil-liberties boundaries in domestic terrorism or targeted violence lanes. Lawful dissent, protected speech, religion, ethnicity, nationality, journalism, protest, association, and political identity are not WARLOCK-INDEX threat categories.
- Do not carry operationally useful details from cyber, WMD, narcotics, firearms, border, maritime, or investigative sources.
- Use DOJ case material only with procedural status labels. An indictment is an allegation; a conviction, plea, forfeiture, or sentencing carries a different evidentiary status.
- Refresh dynamic agency pages before direct quotation or exact trend extraction. This packet establishes routing, not final page-level extraction for every agency source.
Integration Notes
- The official threat source tracker should treat this packet as the law enforcement umbrella packet for FBI, DHS, DOJ, DEA, ATF, CBP, Coast Guard, State, and Treasury lanes.
- The U.S. intelligence and law-enforcement register remains the canonical source-family ledger; this packet is the dated collection product.
- Cyber material should cross-link to the cyber baseline, PRC cyber packet, Salt Typhoon source note, CISA/NSA/FBI advisory lanes, IC3 data, and DOJ disruption-source events.
- WMD material should cross-link to the WMD/biosecurity packet, ODNI biolab disclosure source-treatment note, Ukraine biolab reconciliation note, FSAP, FBI WMD, DTRA, and State/BWC lanes.
- TCO, narcotics, border, maritime, and firearms material needs later dedicated packets before the corpus makes stronger trend judgments.
Follow-On Queue
- FBI/DHS terrorism and targeted-violence source packet with current DHS HTA and State designation refresh.
- FBI/DOJ counterintelligence and national-security legal-action source packet with procedural-status rules.
- IC3/cybercrime complaint-data source packet with CISA/NSA/FBI advisory crosswalk.
- DEA/Treasury/CBP TCO and narcotics source packet.
- ATF firearms commerce, tracing, trafficking, and explosives statistics source packet.
- CBP border and port-of-entry statistics source packet.
- Coast Guard maritime homeland security and law-enforcement source packet.
Cross References
- Official U.S. Intelligence And Law Enforcement Source Register
- Official Threat Source Collection Tracker
- Official U.S. Threat Source Baseline Packet
- WMD/Biosecurity Public Source Baseline Packet
- ODNI Global Biolab Disclosure Source-Treatment Note
- Ukraine Biolab Claim-Reconciliation Source Note
- Salt Typhoon And Telecommunications Defensive Source Note
- U.S. Official Threat Source Operating Picture