Were the events of January 6 the result of an intelligence failure? Spoiler alert: It’s still too early to know. More hearings are needed. More information must be made available to understand whether our leaders failed to gather sufficient information, whether the information that was available was properly assessed, whether it was adequately disseminated, and finally, whether there was simply a failure to imagine the worst happening that day.

The focus to date has largely been on the nugget of reporting coming from the FBI office in Norfolk, Virginia, on January 5. According to newspaper accounts, the FBI office there noticed online chatter among those heading to Washington for the mass protest that talked about taking violent action to stop the Electoral College vote count in Congress. In particular, one message stated, “Be ready to fight. Congress needs to hear glass breaking, doors being kicked in. … Get violent. Stop calling this a march, or rally, or a protest. Go there ready for war. We get our President or we die. NOTHING else will achieve this goal.” The FBI in Norfolk flagged the message, sent it up the chain, and distributed it to the counterterrorism “fusion” center in D.C.—one of the 80 centers created in the wake of 9/11 that facilitate information sharing among local, state and federal law-enforcement and intelligence officials. It was then passed along to the Capitol Police intelligence unit. It appears that, while distributed, the message was not then sent up the chain to the most senior levels of the police, FBI, or DHS.  This has led some to speculate that, if it had been taken more seriously, greater efforts could have been made to protect the Capitol and possibly prevent its sacking.

Certainly, it was known among intelligence and police officials that at least some of those coming to D.C. were coordinating their activities and arming themselves. What we don’t know yet is how widespread those discussions were. It makes a difference whether tens of individuals or hundreds were involved. It also makes a difference whether the scale of the discussions and the individuals involved were on par (or not) with pro-Trump rallies in November and December. In short, was the Norfolk FBI note an outlier in the noise of all the other reporting, or an intelligence nugget that, when combined with more of the same, should have set off alarm bells? 

Note, as well, that coming only the day before the protest, the Norfolk message left little or no time for analysts to fit it into some larger picture that might drive a change in security plans that had already been laid down. Nor did the late-arriving message give police and intelligence time to do more digging to determine whether this was a lead that needed serious follow-up or, as some likely thought, a not atypical example of fringe online BS. Whatever the possible value of the intelligence, the Norfolk office let the air out of that balloon by adding the information was not “finally evaluated intelligence” and other agencies “are requested not to take action based on this raw reporting without prior consultation with the FBI.”

Even if the FBI, DHS, or the police had had the time or inclination to dig more, it’s not clear that the language being used was sufficient to cross the line where free speech tips over into insurrectionist, criminal behavior. Having been beaten over the head for years about not crossing that line in opening investigations, the police and the FBI will take two steps back before they now take that one step forward. As the Norfolk office also included in its message, “Individuals/Organizations named” in the report “have been identified as participating in activities that are protected by the First Amendment. … Their inclusion here is not intended to associate the protected activity with criminality or a threat to national security.” Bottom line: There is a lot more context to look at when it comes to the Norfolk intelligence message than immediately meets the eye.

It’s not the case that the Capitol Police ignored incoming intelligence, either. As the Capitol Police have admitted, they were aware of the potential for violence. On January 4, DHS hosted a call to talk about the rally and the possibility of an attempt to forcefully disrupt the congressional proceedings. The Capitol Police had an all-hands-on-deck approach, had its anti-riot units available, deployed an enlarged safety perimeter, enhanced security efforts for members, and coordinated with the D.C. police, which put its officers on 12-hour shifts and deployed extra personnel near the Capitol. Additional help—either by having the D.C. National Guard at the ready or more federal law-enforcement—was taken off the plate by the D.C. mayor and Capitol Hill security officials, probably to avoid any echoes of the city looking like an armed camp as it had during the summer during the Black Lives Matter protests.

What no one anticipated, obviously, was a worst-case, mass assault on the Capitol, with several thousand people converging on the building and nearly a thousand determined to breach its doors. Steven Sund, who resigned as chief of Capitol Police after the insurrection, testified that “none of the intelligence we received predicted what actually occurred.” That’s undoubtedly true. Rarely does intelligence “predict” with such certainty. Senior officials have to make judgments on what is known, and what isn’t. 

No doubt one reason for not seeing what was coming was that D.C. had already dealt with two large pro-Trump rallies in the previous two months. The city had seen thousands of MAGA supporters come and go without anywhere close to the violence of January 6. This one was to be a larger rally and likely more of a security problem, but whether the intelligence supported an order-of-magnitude leap in required defenses remains to be seen. Again, this depends on the number of red lights that were (or were not) flashing and how they were handled.

We do know that the day before, on January 5, DHS’s daily intelligence summary stated that there was nothing new to report. And we also know that the acting head of the department did not issue a “National Special Security Event” notice—a standard procedure whenever a large foreign delegation or a massive crowd is anticipated for the capital area and there is the possibility of criminal or terrorist activity. It doesn’t take much imagination to think that a Trump appointee would be pretty reluctant to declare a Trump rally to be a NSSE, since it would imply that some large number of Trump supporters were a security risk.

But ultimately, the failure to think about the worst case on January 6 has to be tied to no one knowing or even thinking about what the president would do that day.  Even for the most ardent anti-Trumpers, it was a shock to see the president go to the rally, feed the crowd’s frenzy with the hottest of rhetoric and then tell them, before sending them off to the Capitol, “If you don’t fight like hell, you’re not going to have a country anymore.” Not since the Civil War have we had to think about the possibility of Americans assaulting the Capitol. Intelligence will always have a problem imagining the seemingly unimaginable. So, while finding out whether there was an intelligence failure of some bureaucratic sort leading up to that day is important, those investigating will be doing Congress and the nation a disservice if they don’t understand just how unprecedented Trump’s behavior was and, absent his actions, whether the riot aimed at Congress and the vice president would have occurred at all.