Exhibit-A iWatch Brief Tracking W911RX24Q0001.pdf

CUI

As of 26 Apr 2022

Tim Morgan & Michelle Leonard Installation AT & OPSEC Officers

USAG, Fort Riley iWatch Army

26 April 2022

2 of 15Tim Morgan / 785-239-6303 / timothy.j.morgan8.civ@army.mil

Training Objective

Inform FRKS community members of the types of suspicious activity or behavior to watch for and how to report it to military police, local law enforcement, or the installation Antiterrorism Office.

Presenter Notes Presentation Notes Review the training objective information on the slide.

Emphasize the training requirement and its connection to AR, DODDs, and DoDIs

Inform the audience that following completion of the training, documentation will be provided to the COR to substantiate the training was completed.

3 of 15Tim Morgan / 785-239-6303 / timothy.j.morgan8.civ@army.mil

• Origin of iWATCH Army Program

• iWATCH Army Public Service Announcement (PSA)

• Indicators of Suspicious Activity or Behavior

• “See Something, Say Something”

• What to Report

• How to Report

• Source for Other Important Information

• Local Points of Contact

Training Topics

Presenter Notes Presentation Notes These are the topics to discuss during the training.

The subsequent slides will cover each of these areas.

4 of 15Tim Morgan / 785-239-6303 / timothy.j.morgan8.civ@army.mil iWatch Origins

• iWATCH Army is a nation-wide modern version of neighborhood watch designed to encourage and enable members of the Army community to help protect their community by identifying and reporting suspicious activity or behavior that may be associated with terrorist activities.

• The passive element of iWATCH Army is individual’s situational awareness of the surroundings.

• The active element of iWATCH Army involves individuals taking action to report suspicious activity or behavior to military police, local law enforcement or the installation antiterrorism office. Law enforcement conducts investigations and integrated analysis with the installation antiterrorism office to ensure threat information is shared with the installation Threat Working Group (TWG).

Origin: Headquarters, Department of the Army, ALARACT Message 110/2010, Army Implementation of iWATCH (Terrorist Watch Program), 15 April 2010

Presenter Notes Presentation Notes This slides covers the origin and background for the iWATCH Army program.

iWATCH Army was launched world-wide on 1 August 2010 under the direction of Headquarters, Department of the Army.

iWATCH Army is similar to other terrorism and crime watch programs throughout the Department of Defense (such as the U.S. Air Force’s Eagle Eyes) and other Federal and State law enforcement programs.

In addition to hearing the term iWATCH, you may also hear people simply refer to the intent of the program as “See Something Say Something.” Meaning, if you see any activity or behavior that appear suspicious, report it to law enforcement or security.

The term “Passive” means to be aware of your surroundings at all time so you can observe or hear any suspicious activity or behavior.

The term “Active” means to take ACTION by reporting suspicious activity or behavior. Getting involved!

5 of 15Tim Morgan / 785-239-6303 / timothy.j.morgan8.civ@army.mil iWatch Army PSA

Place cursor inside black screen area. Control/play will appear at the bottom of the screen. Click (Play/Pause) to view the video.

Presenter Notes Presentation Notes Before we jump into the details of what to look for (indicators of suspicious activity or behavior) we’ll take a minute to watch the iWATCH Army Public Service Announcement (PSA) released by the Department of the Army in March 2011.

Instructor Note: Follow the instructions on the screen to run the 59 second video embedded in the slide.

6 of 15Tim Morgan / 785-239-6303 / timothy.j.morgan8.civ@army.mil

Indicators of Suspicious Activity

• Individuals drawing pictures or taking notes in an area not normally of interest to a tourist or showing unusual interest in or photographing security cameras, guard locations, or watching security reaction drills and procedures

• Multiple sightings of the same suspicious person, vehicle, or activity, separated by time, distance, or direction

• Individuals who enter malls or restaurants and do not eat or shop.

• Individuals sitting in a parked car for an extended period of time

The essential element of suspicious behavior is the activity observed DOES NOT fit with what would NORMALLY be observed.

Presenter Notes Presentation Notes The next three (3) slides provide “indicators” of potential terrorist activity or behavior (the list is not all inclusive).

Each of the bullets on this slide represent an example of possible pre-operational activities by terrorist groups (or their affiliates) These activities could represent threat personnel performing intelligence gathering activities to capture information on a potential terrorist target location (or multiple locations) Terrorist groups, as well as affiliates (or even individual actors radicalized by terrorist ideologies) may be conducting intelligence gathering activities on multiple potential targets (such as buildings, airports, transportation, key intersections, etc.).

After gathering “target” intelligence these groups typically evaluate their various target options to assess the viability or likelihood of them accomplishing a successful attack against each of the various options. After evaluating their target options, the group typically sends back out more skilled intelligence personnel to refine target information prior to committing to detailed planning and an actual attack.

The WSVA is in full swing and discussions with asset owners, utility experts and environmental health personnel have been ongoing and the threats to the water system similar to those in Florida and Ellsworth KS have been assessed.

Mitigation methods remain the effective implementation of FPCON measures, RAM along with the Water System Vulnerability Assessments and the Food Vulnerability Assessments.

Any other incidents that may cause concern with this threat?

7 of 15Tim Morgan / 785-239-6303 / timothy.j.morgan8.civ@army.mil

Seattle MEPS Planned Attack

Planned to attack Seattle Military Entrance Processing Station (MEPS) They initially planned an attack on

Joint Base Lewis-McChord, Presenter Notes Presentation Notes Gained employment with a cleaning company, which was providing cleaning services to the MEPS. Sketched the interior of the facility as well as noting where employees and enlistees gathered. Used the web to link up. One USPER located in CA the other in WA. The USPER in CA travelled to WA.

8 of 15Tim Morgan / 785-239-6303 / timothy.j.morgan8.civ@army.mil

Indicators of Suspicious Activity or Behavior

• Individuals who don't fit into the surrounding environment because they are wearing improper attire for the location or season

• Individuals who exhibit suspicious behavior, such as staring or quickly looking away from individuals or vehicles as they enter or leave facilities or parking area

• People asking questions about security forces, security measures, or sensitive information

Presenter Notes Presentation Notes Like the previous slide, each of these bullets represent examples of possible activities or behavior which may indicate early steps in the intelligence gathering stage of a terrorist group planning an attack.

Some of these behaviors could actually be activities that immediately proceed the actual execution of an attack (which could follow within minutes, hours, or days).

Example: Generally speaking there is very little logical reason for a person to openly ask questions about the security forces, security measures, or sensitive information unless they have some nefarious purpose in mind for asking the questions.

9 of 15Tim Morgan / 785-239-6303 / timothy.j.morgan8.civ@army.mil

2007 Fort Dix

Six men were arrested in a plot to attack Fort Dix.

Presenter Notes Presentation Notes Six men were arrested in a plot to attack Fort Dix, a U.S. Army post in New Jersey. The plan involved using assault rifles and grenades to attack and kill U.S. soldiers. Five of the alleged conspirators had conducted training missions in the nearby Pocono Mountains. The sixth helped to obtain weapons. The arrests were made after a 16-month FBI operation that included infiltrating the group. The investigation began after a store clerk alerted authorities upon discovering a video file of the group firing weapons and calling for jihad. The group has no known direct connections to any international terrorist organization. A member of the group conducted recon of Fort Dix as a pizza deliveryman

10 of 15Tim Morgan / 785-239-6303 / timothy.j.morgan8.civ@army.mil

Indicators of Suspicious Activity

• Briefcase, backpack, suitcase, or package left unattended

• Vehicle parked in NO PARKING ZONES in front of an important building

• People in restricted areas where they are not supposed to be

• Chemical smells or fumes that worry you

• People purchasing supplies or equipment that can be used to make bombs

• People purchasing weapons or uniforms without proper credentials

The essential element of suspicious behavior is the activity observed DOES NOT fit with what would NORMALLY be observed.

Presenter Notes Presentation Notes

• Each of these bullets present examples of potential indicators of suspicious activity or behavior.

• Bullets #1 and #2: These items and vehicles, if left unattended, could be bombs (examples: on April 15, 2013, Boston Marathon Bombers left two backpacks near the finish line which contained improvised explosive devices; on April 19, 1995 Timothy McVeigh parked a U-Haul rental vehicle next to the Alfred P. Murrah Federal Building which resulted in the bombing of the building in Oklahoma City).

• Bullet #3: People in restricted areas where they should not be should always be reported (whether indoors, outdoors, or even if inside an already cleared facility but the person is in any area they don’t belong).

• Bullets #4 and #5: These are possible precursors (or preparatory activities) to terrorists gathering the equipment, supplies, weapons, gear, and explosives they would need to execute an attack.

Summary of Indicators Slides: Three of the last five (5) slides provide you an idea of the types of indicators to look for. However, as mentioned they are not all inclusive. If you see, smell, or hear something that concerns you (“gut feel something is wrong”) then report it.

11 of 15Tim Morgan / 785-239-6303 / timothy.j.morgan8.civ@army.mil

See Something Say Something

What to tell Us:

• Date and time activity occurred

• Where activity occurred

• Physical descriptions of the people involved

• Description of the vehicle(s) involved

• What type of activity

• Describe what you saw or heard

• Provide pictures if you took any

Who to Tell:

• Military Police

• Local law enforcement

• Security forces

• Chain of Command

• 902ND MI Detachment

• Installation Antiterrorism Office

• Contracting Officer

Presenter Notes Presentation Notes Where to Report and What to Report is critically important.

Options of where you can and should report is listed on the left side.

Do not allow your belief that what you are seeing/hearing “may be nothing” and prevent you from reporting; when in doubt REPORT, let law enforcement or security investigate and determine whether there is a risk.

The information on the right side provides the type of information you should try to provide when reporting suspicious activity or behavior. Don’t worry if you don’t have all the pieces of information – report what you can.

Caution: Do not put yourself in harms way to gather more information to report; do not risk being seen by the person(s) who you are observing. Simply report what you can as soon as possible and provide as much information as possible.

12 of 15Tim Morgan / 785-239-6303 / timothy.j.morgan8.civ@army.mil

Source for Other Information

Examples of Information:

• Antiterrorism Awareness Training

• Individual Protective Measures

• Individual Awareness Tips

• Insider Threats

• Active Shooter

• Cyber Threats

• Risks Associated with Social Media

• OPSEC Training

• Physical Security Training

• Information Security Training

Army OneSource (AOS) Website (select iWATCH Army / Antiterrorism logo on website) http://www.myarmyonesource.com or http://www.onguardonline.com

Also

Contact your installation Antiterrorism Office for Local information

Presenter Notes Presentation Notes As we complete this training, this slide provides you with information for additional resources.

The website on the bottom of the slide (Army One Source) has a section titled “iWATCH Army/Antiterrorism” where you can find a wide range of unclassified awareness information on the subject of terrorism awareness and measures you can take to protect yourself. Examples of what you can find on the website are shown on the right side of the slide.

Instructor Note: In addition to this slide recommend handing out the following materials which are available thru the local Antiterrorism Office or Antiterrorism Officer and is also available on the Army One Source website.

Suspicious Activity Reporting Two-Panel Card iWATCH Army Business Card (with local number for reporting suspicious activity or behavior) iWATCH Army Brochure Indicators of potential insider threat http://www.myarmyonesource.com/ http://www.onguardonline.com/

13 of 15Tim Morgan / 785-239-6303 / timothy.j.morgan8.civ@army.mil

Reporting through Fort Riley Homepage Go to https://home.army.mil/riley/index.php/about/dir-staff/DPTMS/iwatch

Fort Riley Homepage iWatch banner

Scroll to the bottom of the page and select the iWatch Banner.

You can choose to call, email, or submit your form over the webpage.

You can remain anonymous.

Presenter Notes Presentation Notes Instructor Note: “Personalize” this slide with the most appropriate contact information in the event anyone attending training has questions following the completion of the training.

https://home.army.mil/riley/index.php/about/dir-staff/DPTMS/iwatch

14 of 15Tim Morgan / 785-239-6303 / timothy.j.morgan8.civ@army.mil

Local Contacts

Installation ATO Name: Tim Morgan Phone: 785-239-6303 Email: timothy.j.morgan8.civ@army.mil

Installation ATO Name: Michelle Leonard Phone: 785-240-1993 Email: michelle.l.leonard.civ@army.mil

In case of emergency contact 911 immediately

24 Hour Phone line:785-239-6767 (MPMP)

MP DESK

Or call 1-800-CALL-SPY (National Hotline)

E-mail: usarmy.riley.imcom-central.list.iwatch@army.mil

Suspicious Activity Reports go simultaneously to DES, CID, 902ND MI Det and the Installation Antiterrorism Officer (ATO). ATO closes the loop by confirming DES, CID and 902ND MI received the report. ATO contacts the person submitting the report, thank them, if contact information is provided.

Presenter Notes Presentation Notes Instructor Note: “Personalize” this slide with the most appropriate contact information in the event anyone attending training has questions following the completion of the training.

mailto:timothy.j.morgan8.civ@army.mil mailto:michelle.l.leonard.civ@mail.mil

15 of 15Tim Morgan / 785-239-6303 / timothy.j.morgan8.civ@army.mil

End of Brief / Questions?

iWatch Briefing Roster for W911RX24Q0001

Name: Role

Date Assigned Date Completed Verified