Shortly after news broke that federal agents had executed a court-authorized search for documents at former President Donald Trump's Mar-a-Lago estate, Rita Katz said she and her team jumped online.
Katz, the founder and executive director of the SITE Intelligence Group, which monitors extremist communities online, said they were primarily interested in what discussions looked like in spaces frequented by the far right, such as Telegram, Gab and Truth Social.
"What we saw were calls for civil war," said Katz. "Calls such as, 'This is what the Second Amendment stands for,' and asking then, 'When does the shooting start?' "
In the days after, a man was killed in a standoff with the FBI after he attempted to attack the agency's field office in Cincinnati. The U.S. Department of Justice has also charged a man in Pennsylvania with threatening federal law enforcement officers after he allegedly posted violent statements online.
The FBI and the Department of Homeland Security issued a joint intelligence bulletin highlighting the escalation in violent rhetoric against their agencies and employees.
But even as law enforcement may be monitoring or alerted to threats made in these spaces, experts say that responding to them will be challenging.
The shift from foreign to domestic extremism
Two decades after the attacks of 9/11, the country has fashioned infrastructure to counter violent extremism coming from foreign terrorist organizations, or those influenced by them. Today, with the DHS shift in focus toward violent domestic extremists, that infrastructure is showing its limits.
"There's certainly a more permissive environment for law enforcement to investigate threatening individuals when the threat looked like it was coming from overseas," said Mitch Silber, executive director for the Community Security Initiative, a program created to protect the Jewish communities of greater New York.
"When you're dealing with American citizens who can't be connected to a foreign terrorist organization, that already limits the reach and the ability for law enforcement to go deeper on those individuals because they're protected by the Constitution," he said.
Silber, who once headed intelligence analysis at the New York Police Department, said law enforcement needs to have relatively detailed information about a plot to obtain the required authorization to open an investigation. And though individuals post quite openly about their violent ideations in public online spaces, it often doesn't meet the necessary threshold. For those who recall the last time far right echo chambers churned with this level of anger, this is concerning.
"Before January 6, we had no credible, no specific threat. We just had a ton of non-credible, non-specific threats," said Donell Harvin, a senior policy researcher at the RAND Corporation and the former chief of homeland security and intelligence for the government of the District of Columbia. "It was like this kind of mush they just couldn't do anything with."
Beyond the legal constraints, Harvin said that the nature of the threat has also changed in ways that make effective interdiction of violence more difficult.
First, the uptake of violent, anti-government views has become widespread in the United States, whereas in the past, this sentiment was largely relegated to fringe extremist groups. As a result, the possibility of an attempted attack can come from a much larger and more diffuse pool of radicalized individuals.
Additionally, experts said that law enforcement now has to act almost instantaneously when alerted to a threat.
"There is often a brief period of time between radicalization and mobilization to violence that law enforcement has an opportunity to interdict that individual. And that brief moment is such a small window," said Harvin. "We've seen where people go from radicalization to mobilization of violence very, very quickly."
The legal and practical constraints behind identifying and stopping domestic terrorist attacks have many in the counter-extremism space looking to actors other than law enforcement.
Katz, who has monitored terrorist threats since before 9/11, said she would like to see more focus on the technology companies that facilitate alt-social media platforms where the most violent rhetoric is commonplace. Specifically, she said companies that provide hosting, website security and domain registration should be pressured into dropping clients whose services incite violence.
"Otherwise, it's just going to continue to grow," she said.
