Assessment The risk picture for the year ahead is straightforward. Large, nationally organized militia networks have been degraded by prosecutions following January 6, but the underlying drivers that produced those networks remain active and decentralized. Expect localized, adaptive militia activity that hides in plain sight under the cover of “community preparedness” or disaster response, and that can be mobilized quickly around political flashpoints. What we are seeing in open sources and enforcement actions is not a mass resurgence of national hierarchies. It is reformatting — smaller, regionally networked cells, shifting communication channels, and recruitment pushed into encrypted and semi-public forums. These patterns make detection harder and give hostile actors plausible deniability while they build capacity. Why this matters now We are entering the year before the 2026 federal election cycle. That gives opportunistic militias a long lead time to rehearse, recruit, and test tactics. Political events, contested races, or high-profile protests create predictable windows where armed actors can try to impose control through intimidation rather than through mass, coordinated operations. Federal law enforcement has publicly warned that multiple threat vectors are elevated at once, increasing the chance of concurrent incidents that strain local response. Observed behaviors to track

  • Localized recruitment tied to disaster response and grievance narratives. Expect to see training events pitched as emergency preparation that double as paramilitary drills.
  • Targeting of election personnel and polling locations for harassment, doxxing, and armed presence designed to intimidate rather than to seize infrastructure. Election administrators in some jurisdictions have already upgraded physical safety measures.
  • Use of encrypted messaging and fringe platforms to coordinate short-notice mobilizations, which complicates advance warning. Practical threat scenarios (plan for all three) 1) Probable scenario — Low-level, distributed intimidation: Armed individuals or small cells show up at select polling sites or campaign events to harass and intimidate. These incidents are tactically disruptive, generate media attention, and provoke local confusion without requiring national coordination. 2) Contingency scenario — Targeted escalation: Coordinated presence at multiple sites in a single county or region timed to a high-attendance event, combined with harassment and attempts to block access. The objective is to suppress turnout or create a law-and-order crisis that draws outside actors. 3) Worst-case scenario — Coordinated violent attack: A small number of actors attempt violent action timed to maximize disruption (assault on polling infrastructure, planned kidnapping or attack on an election official). This is less likely than intimidation, but it remains a credible risk given past behavior and the availability of weapons and tactical tradecraft. Plan accordingly. Operational priorities for government and partners Detect early: Invest in indicator-driven monitoring that blends human reporting from community partners with open-source monitoring of forums and public incident feeds. Prioritize signals tied to call-to-arms narratives, logistics posts (weapons, rendezvous points), and rapid fundraising. Do not depend on a single platform for detection; actors migrate channels. Deter visibly: Visible, well-communicated security measures reduce the tactical benefits of intimidation. That means trained local law enforcement presence at high-risk polling sites, clear escalation protocols, and practical protective measures such as panic buttons and direct 911 links for poll workers. Jurisdictions that have already implemented these steps offer a model for rapid rollout. Disrupt legally: Continue aggressive investigation and prosecution of violent planning and material support. The post-Jan 6 prosecutions demonstrate that the justice system can deter and incapacitate leadership and key nodes. Use civil remedies, including injunctions and enforcement of state laws where applicable, to disrupt logistics and financing. Protect people first: Training and simple, durable tools for election workers and volunteers are low-cost, high-value investments. Establish rapid-reporting lines, give staff situational awareness guidance, and plan for continuity if a site is forced to close. Messaging to the public should emphasize safe reporting and non-engagement with armed provocateurs. Information sharing and governance Timely intel handoffs between federal partners and state/local authorities matter. Federal agencies can provide threat context and technical resources, but state and local entities hold primary responsibility for on-the-ground response. Public-private partnerships with platform companies are relevant for takedown and disruption of coordination channels, but they are inconsistent. Build redundancy into information sharing so that no single choke point can blind local responders. Resource allocation checklist (practical triage)
  • Fund rapid rollout of panic buttons/direct emergency lines for poll workers and election offices. Evidence from jurisdictions that piloted these measures shows they improve response.
  • Prioritize training for sheriff departments and municipal police in de-escalation and crowd management tailored to armed demonstrators.
  • Maintain investigative capacity for online-to-offline threat assessments; fund analytic support to track migrating channels.
  • Ensure prosecutor offices coordinate charging strategies with federal partners on interstate planning and material support. Public messaging Do not amplify threats. Officials should provide clear, calm guidance: polls are secure; report threats to law enforcement; do not engage with armed individuals; follow local official instructions. Transparency about protective steps reduces rumor-driven panic and deprives militia actors of propaganda value. Closing assessment and next steps Militias are not likely to mount a mass, nationwide operation in the coming year. They are more likely to keep testing the edges with intimidation, selective mobilization, and episodic violence. That creates a persistent drag on election stability that can be managed but only if the work is done now. The priorities are simple and familiar: detect early, deter visibly, disrupt decisively, and protect people. Failure to act is a policy choice that hands the initiative to actors whose only objective is to make elections unworkable for everyone but them.