Skip to content

Photo by iStock

Protest Preparedness: Analyzing Crowd Dynamics, Threat Actors, and Intelligence

Mass protests are naturally dynamic environments, and their size and frequency are only growing. At certain points, the pro-democracy protests in Hong Kong in 2019 and 2020 involved nearly 2 million participants; protests against a farming bill in India have grown since September 2020, attracting up to 1 million people; and summer 2020 protests in the United States against police brutality attracted more than 1 million participants nationwide.

But when several hundred or several thousand people gather together to voice their opinions, it presents a plethora of variables and possibilities for security professionals to consider. As sociopolitical tensions rise, however, those variables multiply.


According to the Carnegie Endowment for International Peace Global Protest Tracker, more than 110 countries experienced significant protests since 2017, and more than 25 significant protests have been linked directly to the COVID-19 pandemic.

While most protests are peaceful, some trigger violence, riots, looting, and clashes with law enforcement. And where one protest escalates, other movements are likely to watch, learn, and adopt similar tactics or countermeasures. Therefore, it behooves security professionals to pay close attention to protest trends worldwide and where the tipping points are into violence, says Diego Andreu, CPP, principal at Control Risks.

Trigger Warnings

Protests don’t happen in a vacuum, Andreu says. Civil unrest typically has a trigger—whether that’s a natural disaster, pandemic-related restrictions, a police brutality incident, or a divisive, charged political environment—but the response to any given trigger depends on the environment. If people already feel oppressed or stressed, even a small incident could push them to act. Security professionals need to be on the watch for an elevated emotional pulse within society, within their jurisdiction, and even online, he says.

“In this very socially charged environment where things go viral very quickly, it’s becoming increasingly difficult to pinpoint which incidents are going to potentially trigger a riot or civil unrest,” Andreu says. “What we need to acknowledge is that in an environment where things are already so supercharged and everybody’s already feeling anxious and on the edge of their seats, anything that could be controversial can be that spark—a group on the left, on the right, or in the middle can use it as their justification for civil unrest and rioting.

“It’s less about the trigger event and more about the context and the environment,” he continues. The challenge today is that the COVID-19 pandemic has put the world on edge, especially as economic conditions continue to spiral downward and the crisis stretches out. This increases the possibility for civil unrest to break out as people seek an outlet for their frustrations.

Know Your Protesters

When protesters in Hong Kong start building barricades and establishing layers of security around protest sites, Andreu says, security managers in other metropolitan areas facing the possibility of mass protests should consider the possibility that other groups will do the same—potentially cutting off access to organizations and affecting employee travel and safety. Mass peaceful protests across the United States in 2020 devolved into clashes with counterprotesters and law enforcement, especially after dark.

“Crowd behavior and civil unrest was a dominant risk throughout 2020, and it is likely to be part of the dominant risk profile for 2021,” says Steven Crimando, principal of Behavioral Science Applications, LLC. “What we see today is nothing like generations before. It’s actually even radically different than 10 years ago during the Occupy Wall Street movement. Security personnel need to continue to educate themselves about the new challenges of civil unrest because everything constantly evolves in this space.”

While the trends of civil unrest continue to evolve globally, knowing the protesters—their goals, political or activist leanings, and previous actions—enables security professionals to predict their tactics, Crimando says.

Protest groups that escalate into security threats are often divided by sociopolitical philosophies, he adds, and although each protest has its own unique footprint and motivations, some themes remain.

Left-leaning activists and mass protest groups that cause damage tend to be traditional anarchists, who might dress in all-black and protest at the World Trade Organization or the G8 Summit, Crimando says. “They were always known for street-level violence, but what they specialize in is material property damage. They very seldom hurt people.” While these groups may be antigovernment, they are largely anarcho-socialists, working against all societal hierarchies, he explains—ideally, they would tear down all societal structure, roles, and titles for a flat, egalitarian system.


“When they’re on the street, security personnel should expect broken windows, a lot of graffiti, and maybe Molotov cocktails—property damage,” Crimando says. They learn and train nationally and internationally, including through organizations like The Ruckus Society, based out of Berkeley, California, where participants learn everything from urban rappelling—so activists can hang banners off bridges or cranes—to nonviolent (sit-ins, obstruction) and not-nonviolent (usually referring to the use of slingshots, blunt instruments, noxious liquids, and theatrics like flinging fake blood) tactics.

This training is relatively organized, with DVDs, training manuals, and other materials that can be dispersed to interested groups that want to learn how to manage a protest similar to how organizations might manage a crisis—they appoint a spokesperson and they bring lawyers, photographers, medics, and a police liaison, Crimando says.

While traditional anarchists want to tear down all societal structures, libertarian anarchists—who have a generally right-leaning ideology—are pure constitutionalists and view themselves as patriots who seek to tear down the current government and replace it with a pure constitutional one. “They’re very pro-gun, they’re anti-mask,” Crimando says. “Sometimes they merge with groups like the Sovereign Citizens, who are anti-tax…. In that camp, you tend to have nationalists, white supremacists, neo-Nazis, and groups like Oath Keepers, the Three Percenters, the Proud Boys, or the Boogaloo Boys. Their tactics are completely different, and they tend to be more militarized. They see themselves very much in this warrior mind-set, and they train as militias and arm themselves as militias.”

In some U.S. states that allow open-carry of firearms, “you see them usually with their Hawaiian shirts and such, carrying AR-15s with their tactical vests on loaded with magazines, helmets, and tactical body armor,” he says. “They don’t come to create property damage in most instances. When they come into a protest environment, usually they are looking to just be really scary and make their point—or to really go at it with counterprotesters. In 2020, we saw seven times more counterprotests than we did in any other year. There’s a high likelihood of violence between the groups when the anarcho-socialists show up and these other libertarian anarchists meet them and butt heads.”

When preparing for civil unrest, Andreu says, it’s important to consider the nature of the group in question. “If I’m expecting left-leaning groups to come to town, for whatever reasons, I want to board up my windows—they are notorious for breaking glass and doing a lot of graffiti—and maybe put extra security personnel very visibly around my perimeter as a deterrent.”

On the other hand, if the protest is linked to right-leaning groups, “I may need to think about rapidly evacuating people from my store or my office, because they’re more likely to use explosives or other things that are more serious,” he adds. “I do want to adjust my posture.”

The politics of protesters are also regional, Crimando says. In Scandinavian countries—particularly Norway—and Germany, white supremacist movements and undercurrents are on the rise. Militia movements are increasing in the United States in Michigan and New England, as well as in some midwestern states.

Past protests will also provide a good indication of future risk, Andreu says. “The reality is that you just have to have a good pulse on those locations that are going to be the most at risk for violence and understand what is the level of law enforcement support that you might expect,” he adds.


Regionality also affects law enforcement resources and response to protests, Andreu explains. “Not all police forces are created equal, and certainly, law enforcement can be politicized.” If a protest turns violent or widespread, organizations cannot rely on speedy law enforcement support at private property—their attention will be focused on securing critical infrastructure and protecting lives—so private security professionals will need to fill in the gaps.

Understanding past police responses to local protests will give organizations a good idea about which resources to invest in and what risk posture to take, he says.


But despite the geography of the protesters themselves, the training, expansion, and even funding of movements is global, Crimando says. For security professionals—especially those with a multinational footprint—the speed that protests can spread, assisted by the velocity of information online, is an ever-growing concern.

“A protest that gets raised in one of the states is likely to be happening concurrently abroad,” Crimando says. For example, Black Lives Matter protests in the United States over the summer of 2020 sparked racial justice and police brutality protests in countries worldwide. “Things that start overseas at different facilities can easily migrate here when protesters are able to reach out to likeminded people. They represent that level of a coordinated threat, but they also just generally raise the tide of protest sophistication. As one group gets more advanced in their tactics, in communication, in their funding sources… that tide raises all the boats. The frequency, intensity, and sophistication of collective violence or civil unrest continue to mature.”

Risk Escalation and Mitigation

“Most demonstrations have the potential to become violent, but yet not all of them do,” says Andreu. “It only takes a few individuals to decide that at the end of the march they’re going to start becoming violent. They’re going to start physically voicing their concerns, if you will, and then the herd mentality takes over. A lot of people go into these marches who are lawful and they go with the best of intentions. But when somebody starts spray-painting, breaking windows, yelling at the police, throwing rocks—the crowd can take on a life of its own.”

Often, an internal or external threat actor (including those hired by outside forces to fabricate violence—a common tactic in Latin America that is growing worldwide, Andreu says) goes to the protest with the intent to shift the tone of the protest. Once the crowd buys into the idea of violence, he adds, it’s very difficult to stop.

“From a risk planning standpoint, most of the destruction and violence tends to happen in the dark,” Crimando says. “That’s universal to all different types of groups and agendas, and that’s simply because of anonymity. We know that’s a very powerful psychological component of crowd behaviors.”

Protest organizers usually select a place of significance—whether it’s a city center, a business’s headquarters, a government building, the site of a previous incident, or law enforcement station—to end a march, Andreu says, and if a demonstration ends near dusk, it is more likely that emotions will run high and the added element of anonymity in the dark can push protesters to act.

“Evenings are when most people are going to go home,” he adds. “Most people that have day jobs or are responsible, concerned citizens, will head home because they have to go back to work the next day or they have to look after their kids. Those individuals who have an additional motive or that are just perhaps readily available to participate in violence are the ones who stay behind and participate.”

This nightfall element is why curfews start around 6:00 or 7:00 p.m.—to clear most protesters from the street before crowd dynamics can shift in the dark, he says.

Crimando cautions, however, to be wary of bias—just because destructive protests are the loudest and receive the most media coverage does not mean all protests will become destructive. Most fizzle out, especially near the end of the march when people begin to break off from the group to beat the traffic home.

Another key psychological element is the contagion effect, Crimando says. While this can have positive effects—like collective excitement at a sports match or a concert—it can also be dangerous, especially when it amplifies negative feelings, such as anger or frustration.

“The longer the group is together, there’s a greater standpoint for the contagion to spread. When we think from a security standpoint about these different tactics of separating groups, we use barriers, stanchions, and things like that. Part of that is to reduce the likelihood of contagion so the event doesn’t get more out of hand, because we know people do feed off each other,” he explains. “The dangerousness of crowds arises from the interaction of psychology and physics, which is why you need to address both the behavioral and physical challenges of the crowd.”

Local fusion centers or public–private partnerships around information-sharing can provide advanced warning and intelligence about the nature of protesters, Crimando says. But organizations could benefit from assigning an analyst to monitor civil unrest threats and tactics globally through open-source intelligence such as social media or message boards, as well as to review weekly briefings and documents provided by third-party partners like fusion centers.

“The things happening in Europe have a direct impact on what potentially could be happening here,” he says. “If there are new tactics being used, you want to know. If there are new targets being selected that have a relevance to your industry, you want to know. The information is out there, but it means connecting with those networks through the fusion centers, through programs in major city police departments and state governments, to be connected, to participate in their activities, to consume their products, and to use their products wisely.”

When preparing for a protest, Andreu says, it starts with understanding the immediate environment and having a good grasp on intelligence. “If there’s going to be a demonstration that’s coming near your door, where does it start? Where does it end? What time is it scheduled? What have we seen in terms of violence or non-violence in the past from similar demonstrations, both in this jurisdiction and somewhere else?” he asks. “Demonstrations tend to be very similar in nature when they’re about the same grievance.”

Unless the organization’s operations are business-critical, Andreu recommends closing early and bolting the doors if a protest is scheduled. Even if the protest is not expected to escalate, it could still cause logistical and safety problems for employees trying to come to or leave work. If the facility cannot be closed down, organizations could change shift schedules to have employees come in early or late and increase security as a deterrent.

In addition, organizations can bolster their communications with employees about crisis response plans, particularly during periods of high anxiety and mental stress like mass protests or civil unrest, he says.

“Organizations need to be transparent, and they have to be communicative with their employees,” he says. Through open communication, security leaders can acknowledge that “they understand that people might be anxious, and they might feel scared perhaps to go to work.… Let them know how you’re going to help them. That might be stopping work or delaying work, or that might be just providing additional security measures. The acknowledgment piece can go a long way to develop that level of trust.”

Claire Meyer is managing editor for Security Management. Connect with her on LinkedIn or email her at [email protected].