THERE ARE DOWNLOADS FOR PAID SUBSCRIBERS AT THE BOTTOM OF THIS BULLETIN.
Bottom Line Up Front (BLUF)
Online supporters of the Islamic State of Iraq and Syria (ISIS) are calling for attacks on Christmas markets and Christian communities this season, and one user recommended vehicle ramming for attackers who cannot get guns or explosives. No church, city or date is named in the reporting, so churches should hold their Christmas events and put vehicle barriers and approach-route control in place before the first one.
Key Judgments
Highly Likely: ISIS supporters will keep posting target lists and attack advice aimed at the holiday season through December.
Likely: Churches will stay on those lists, and outdoor events with crowds near open streets or parking lots are the easiest targets for a vehicle attack.
Possible: A lone offender will attempt a vehicle ramming or a shooting at a holiday gathering in the United States this season.
What the Reporting Says
A restricted government document circulated this week describes two online posts from 13 October. In the first, one pro-ISIS user posted a list of targets for mass-casualty attacks by lone offenders. The list emphasized US citizens and Jewish and Christian communities, and it named Canada, Germany, France, Italy, Belgium and the Netherlands as countries where such targets can be found. Target types included civilian and commercial infrastructure, religious landmarks, large crowds and government institutions. The user told readers to pick the targets they considered the highest priority in their own region or country.
In the second post, several pro-ISIS users in an online forum ranked targets from highest to lowest priority. One user listed schools, Christmas markets, gatherings of LGBTQIA+ people, sports stadiums and political events. One user advised that an attacker who cannot get weapons or explosives should drive a vehicle into a crowd, citing earlier truck attacks in Belgium, France and Spain during the winter holidays. The government analyst noted that the first post appeared a few hours after a similar one, and expects more of this incitement as the holidays approach, in Europe and in the United States. The same document says Salafi-jihadist messaging has broadly encouraged supporters to attack Jewish and Christian communities this winter with weapons, explosives or vehicles.
Neither post names a specific church, city or date in the United States. These are anonymous users on online forums, and the document describes their posts as incitement. Nobody has claimed a plan.
Vehicle Attacks on Holiday Events
On December 19, 2016, a truck was driven into a crowded Christmas market in Berlin and 13 people were killed. On December 20, 2024, a rental car was driven into a Christmas market in Magdeburg, Germany. At least five people were killed and more than 200 were injured. Police stopped the driver within three minutes, and in that time the car still injured more than 200 people. A barrier that goes up after the vehicle arrives does nothing, so everything that stops a vehicle has to be in place before the crowd gathers.
Recent Attacks in the United States
Three attacks since the start of 2025 show how vehicles and rifles get used. On January 1, 2025, a man in a rented pickup truck drove around a police barricade onto Bourbon Street in New Orleans and into a crowd, killing at least 14 people. The Federal Bureau of Investigation (FBI) found an Islamic State flag on the truck and called it a terrorist attack. The truck traveled three blocks before a heavy lift vehicle in its path stopped it.
On September 28, 2025, a suspect drove a pickup into the front of a Church of Jesus Christ of Latter-day Saints church in Grand Blanc Township, Michigan, during a service with hundreds of people inside. He then shot at worshipers and set the building on fire. Four church members were killed and eight were injured, and police shot the suspect in the parking lot within minutes. The FBI called it an act of targeted violence.
On March 12, 2026, an armed suspect drove a vehicle through the doors of Temple Israel, a synagogue in West Bloomfield Township, Michigan, and into a hallway, where the vehicle caught fire. Security officers at the synagogue shot him. One officer was struck and not seriously hurt, and no children or staff were injured. The building houses an early childhood center. Investigators were still working on a motive in the first reports.
Motives differ across these cases. In each one a vehicle was used to reach a crowd or break into a building. In New Orleans a barricade that left a route around it did not stop the truck, and at Temple Israel armed security stopped the suspect inside the doors.
Church Events at Risk
Churches hold outdoor events in December: live nativities, tree lightings, caroling, parking-lot markets, parades and any event that closes a street. Each one puts a crowd in the open, next to a road or a parking lot.
Shootings are the other concern. On 11 October, a 19-year-old was arrested in Illinois and charged with plotting a mass shooting at a Hindu temple near Aurora. Police recovered a rifle, loaded magazines, ammunition, a gas can and a tactical vest. A document on his devices referenced violence against South Asians and white supremacist ideology, which the government labels racially or ethnically motivated violent extremism (REMVE). Investigators have not confirmed the planned location. The government analyst’s comment on that case is that churches and other religious sites remain targets of opportunity around major holidays for violent extremists from across the ideological spectrum.
Barrier Placement for Outdoor Events
You are setting up for the Sunday tree lighting. The crowd will stand on the grass between the sanctuary and the street, and the parking lot entrance is twenty yards to the left. A driver who wants to reach that crowd needs a straight path and enough room to build speed. Your job is to take both away.
The Cybersecurity and Infrastructure Security Agency (CISA) recommends establishing clear standoff zones, which means distance between a crowd and any place a vehicle can travel, and evaluating vehicle barriers. CISA divides barriers into passive types such as fixed bollards, fences and jersey barriers, and active types such as retractable bollards. It also recommends looking at traffic patterns around the venue and reducing vehicle speed and access.
Walk every approach route. Two weeks before the event, walk every road, driveway, alley and parking lot entrance that a vehicle could use to reach the crowd. Mark each one on a sketch of the site, including curb cuts and gaps in fences or landscaping.
Move the crowd back. Set up the stage, seating and standing area as far from the nearest vehicle route as the site allows. Use the sketch to choose the spot before you set anything up.
Block each route. Put a barrier across each marked approach. Ask city public works or the police department whether the city lends barricades for events, and request them in writing as soon as the event date is set. Heavy fixed objects such as concrete jersey barriers stop vehicles better than cones, sawhorses or plastic barricades.
Leave one staffed gap. Fire and ambulance crews need a way in. Keep one opening, assign one team member to stand at it, and give that person a phone and the direct number for the police dispatcher. The team member’s job is to open the gap for emergency vehicles and call for help, not to stop a vehicle with their body.
Slow the traffic. Ask the police department to close the street in front of the event, or at least to post an officer or signs that cut vehicle speed during the event.
Get a second opinion. CISA has security advisors in every region who will review a site. Find yours through the CISA website, and ask the police department to look at the sketch.
Check again the day of the event. Walk the routes before the crowd arrives to make sure nothing moved, nobody parked in the path, and the gap is staffed.
CISA also offers a Vehicle Ramming Action Guide and a Vehicle Ramming Self-Assessment Tool for evaluating a site.
Warning Indicators and Reporting
CISA’s guidance on vehicle ramming includes warning signs aimed mainly at vehicle rental agencies, such as a customer who has difficulty explaining why they need the vehicle. For a church team, the observable behaviors are different: someone photographing barrier positions or approach routes, a vehicle that circles the event area more than once, and a person asking when the barricades come down or when the street reopens. Any of these should reach the police department the same day. Report anything that looks like a threat to a specific church or city to the Federal Bureau of Investigation (FBI) at tips.fbi.gov or 1-800-CALL-FBI.
Threat Assessment
The overall threat level for church Christmas events is ORANGE (high). The government reporting contains no named church, city or date, and the posters are anonymous users who may never act. Those facts keep the level at high, below critical. One lone offender who reads one of these posts and acts can cause mass casualties, so the level stays above elevated.
Vehicle ramming at outdoor events is the primary concern. It needs no firearm or explosive, a rental or borrowed vehicle will do, and a crowd standing near an open road is a target a driver can reach in seconds. A shooting at a church service or event is the secondary concern. In the Illinois case, a coworker reported the suspect’s messages and police made the arrest before any attack.
The posture is to hold the events. A church that cancels its tree lighting because of anonymous forum posts has given the posters what they wanted, and it has also left its own people without the Christmas gatherings they came to enjoy. The exception is specific targeting. If the police, the FBI or your own reporting names your church or your city, church leadership should meet the same day, talk to the police, and decide whether to change or cancel the event. Until then, the work is barriers, approach routes and a briefed team.
Biblical Lens
Christmas has always carried a threat. When the angel announced the birth of Christ to the shepherds, the message came with an instruction about fear:
And the angel said to them, “Fear not, for behold, I bring you good news of great joy that will be for all the people.” (Luke 2:10, ESV)
The shepherds heard the command not to fear and went to see the child. The wise men in Matthew 2:1-12 traveled to Bethlehem while Herod was looking for the child to kill him. They worshiped anyway, and when a dream warned them, they went home by another road. They did both: they worshiped and they listened to the warning. Joseph did the same when he took his family to Egypt in Matthew 2:13.
John 1:5 says the light shines in the darkness and the darkness has not overcome it. Psalm 27:1-3 asks whom the Lord’s people should fear when armies camp against them. Hebrews 10:24-25 tells believers not to neglect meeting together. A congregation that stays home out of fear gives the posters what they wanted.
Closing
Leave a comment if your church has already planned outdoor events this December, and share this brief with your pastor and your team leader. Paid subscribers get the Analyst’s Notes, a Leadership Memo for your pastor and elders, a Tabletop Scenario and an Outdoor Event Planning Packet below.
For Paid Subscribers
This brief includes the following for paid subscribers:
✅ Analyst’s Notes on how much weight to give the forum posts and what would change the assessment ✅ Leadership Memo for your pastor and elders (editable Word document) ✅ Tabletop Scenario for your team (PDF) ✅ Outdoor Event Planning Packet with letters to the city and the police and a pre-event briefing card (editable Word document)
Analyst’s Notes
The two posts are small pieces of evidence. They come from anonymous users in forums, and the government analyst records that one post followed another within hours. That pattern fits supporters repeating each other’s lists, and it does not by itself point to a plan. The Illinois case shows what a real plan looks like by comparison: a rifle, loaded magazines, a gas can, a vest and a written document, found because a coworker reported messages that worried them.
The important word in the vehicle post is “if.” The user told readers to use a vehicle when weapons and explosives are hard to get. In the United States, a pistol or rifle is easier to get than in Europe, and an attacker here might choose a gun first. I do not read the post as a prediction that vehicles will replace guns, and I would plan for both. A barrier plan covers the vehicle and a briefed team covers the gun.
Three things would change my read: a post or message that names a church, city or event in the United States, a report of someone photographing or probing a church’s outdoor setup, and a vehicle attack on a holiday event in the US or Canada before December. Any one of those moves the conversation from general planning to a decision about the specific event, and the pastor needs to hear it the same day from the team leader.
One point for team leaders on the legal side. Team members do not try to stop a vehicle. They report what they saw to the police, open the emergency gap, and move people away.
Leadership Memo (Download above)
An editable Word document for your pastor and elders is attached. It states the current threat in plain terms and recommends holding events unless a church or city is specifically named. It includes a table of recent attacks on churches, synagogues and holiday events in the United States and Europe, and a table of protective options with who does each one, what it costs and a box to approve it. It also covers city permits and fees for closing a street, and names who calls the police and who calls the team leader if specific targeting appears.
Tabletop Scenario (Download above)
A tabletop scenario for your team is attached as a PDF. It runs 20 to 30 minutes and starts with a vehicle approaching the crowd at an outdoor tree lighting. It has timed injects, discussion questions for the team leader, a facilitator key for each situation and a short debrief checklist.
Outdoor Event Planning Packet (Download above)
An editable Word document with four templates is attached: a request to the city for temporary barricades, a cover letter for a street-closure or special event permit, a notice to the police department with a request for an officer, and a one-page pre-event briefing card to print for each event. The packet explains when to send each one and what information to gather first.
Sources
Internal restricted government document, weekly open-source reporting digest, October 2026
CISA, Vehicle Ramming Action Guide and Vehicle Ramming Attack Mitigation resources, cisa.gov
ABC News, “5 killed, including 9-year-old, in German Christmas market attack; more than 200 injured,” December 2024
Associated Press, “At least 2 dead and 60 hurt after a car drives into a German Christmas market,” December 2024
ABC News and ABC7 Chicago reporting on the Illinois arrest, October 2026
