In light of the U.S. attacks on Iran over the weekend, Jack speaks with Elizabeth Sherwood-Randall, former White House Homeland Security Advisor, about how the U.S. government would normally prepare for domestic threats during periods of heightened risk. They discuss how the federal homeland security enterprise activates in response to elevated threat levels, including coordination across the Department of Homeland Security, the FBI, the intelligence community, and state and local law enforcement. They also explore concerns about federal capacity, including a DHS funding lapse, resource diversion away from counterterrorism and toward immigration enforcement, and leadership turnover across key agencies.
Thumbnail: FBI Joint Terrorism Task Force photo. (U.S. Government Work.)
This is an edited transcript of an episode of “Executive Functions Chat.” You can listen to the full conversation by following or subscribing to the show on Substack, Apple, Spotify, or wherever you get your podcasts.
Jack Goldsmith: In light of the U.S. attacks on Iran over the weekend, the Department of Homeland Security and the FBI announced a heightened alert for domestic attacks, including cyberattacks, and U.S. Northern Command, which covers the United States, basically sent out a signal of heightened security on U.S. military and related bases. I think it’s important to understand how the U.S. government infrastructure would normally operate to deal with such threats and what the main concerns and issues this government faces are. I’m very grateful that Elizabeth Sherwood-Randall has agreed to talk about these issues.
Liz has a long career in U.S. national security and most recently was the White House Homeland Security Advisor from January 2021 through January 2025, a position now held by Stephen Miller. Liz is a senior fellow at the Harvard Kennedy School’s Belfer Center. Liz, thank you for coming on to talk about this today.
Elizabeth Sherwood-Randall: Thanks for inviting me today, Jack.
I would like for you to walk us through how, if you were sitting in your old chair in the White House, you would be thinking about these issues. What would you be doing in the current situation if there were a military conflict abroad that implicated domestic threats? What would you be doing?
So, Jack, the Homeland Security Advisor role at the White House was born right after 9/11. I lived for four years in a basement SCIF — a secure compartmented information facility, a room with no windows in the West Wing — where I worked basically 24/7 to ensure that we kept Americans safe. The job responsibilities include keeping Americans safe at home and also Americans around the world.
So wherever our people are — our diplomats, our military service members, our intelligence community — we watch out for them from that post. If this had been anticipated, which it clearly was for some time internally as the military preparations got underway, I would have been working for weeks to get us ready for the homeland implications of the attack on Iran that began over the weekend.
And we would have worked across the federal enterprise with every relevant department and agency to ensure that we were prepared for the possibility that there could be homeland consequences of these attacks, as well as for the possibility that there could be retaliation against our personnel in the region of the attacks and around the world.
In addition, we would have worked to ensure that we were aligned with our state and local counterparts. For example, the Department of Justice and its Federal Bureau of Investigation would be working anticipatorily through the FBI’s field offices — more than 50 around the country — to ensure that local law enforcement was ready for what might happen and was monitoring carefully for the possibility that there could be an increase in threats to American citizens.
Finally, importantly, we would have been working with allies and partners to prepare them as well. We’ve already seen significant retaliation against our partners in the region. In that case, one of the things we look at is whether we need to prepare to remove American personnel and representatives in the region or elsewhere, and to develop plans for evacuating American citizens — which is a quite complex operation, especially in a situation of live conflict.
So all of that work would have been done in advance to ensure that we were ready, and that in the event of adverse incidents at home or around the world, we could respond quickly to help our citizens.
Okay, I want to unpack that, and I want to focus on the at-home part of it, just so we can — otherwise I think it’ll be too much. You talked about what you called working “across the federal enterprise.” Can you give us the high points of what that looks like? You mentioned FBI and DOJ dealing with state and local officials, and I want to get to state and local in more depth in a second. But what is FBI and DOJ doing in this context? And how did it look from the White House?
So, the federal enterprise is large and has many different capabilities. We certainly would have involved in the work I described the FBI and DOJ, the Department of Homeland Security, the Department of Defense, and the intelligence community. Those are the key departments and agencies you would want to have at the table to begin planning for what you need to do.
We would be meeting in the Situation Room — a classified setting, obviously — where you can have confidential discussions. The objective would be for the leader of each department and agency to come forward with: here are the things I think we need to worry about if this happens, and here’s what I propose to do about it. Then you develop a coordinated plan.
And basically there’s an operational tempo in a situation like this in which you’re probably meeting every day — whether in person or on screen — to ensure that everyone is working together like the many instruments of an orchestra playing well together to prepare for what may be coming our way.
The Department of Homeland Security, for example — what would they be worrying about, in the time in which I served? Certainly they’d be looking at whether there would be cyberattacks. That would be a very important element of this. Right off the bat, we had an entity that has now been basically stripped of much of its capability at DHS called the Cybersecurity and Infrastructure Security Agency.
It would have been the tip of the spear in doing that work, alongside the FBI, which would be doing the investigative work to identify what’s happening on networks and to ensure that every possible capability was activated in support of those on the front lines — our government networks, but also the whole nation’s networks: cyber effects, telecommunications, financial systems, and health systems, as you well know. So that would be an example of the kind of work we’d be doing in advance to make sure we were, as I would describe it, “shields up” — that you get ready in advance to prevent and to be ready to mitigate any consequences of anything that might happen.
Okay, let me follow up on that. Two related questions. One, how would what DHS is doing in a heightened alert situation differ from what it’s normally doing? What would that look like? And DHS isn’t the only entity focused on cybersecurity, I’m sure, I mean, the FBI has a role there. So how does the government get activated when there’s a heightened cybersecurity threat?
In a heightened environment, what you’re doing is you are previewing to your partners, whether they are the state and local partners I mentioned, whether it’s the homeland security representatives in each state, the governor’s teams, the local law enforcement across the nation — you’re working with counterparts across the nation. Oh, and I should have mentioned, I’m sorry, the private sector, importantly. So, for example, on cyber, all of the providers of capabilities in this country, you’re working collaboratively to say, these are the kinds of tactics, techniques, and procedures that we have seen this adversary use in the past. Here is what you should be watching for.
That’s a capability the federal government can provide. And we provide that based on our intelligence capabilities, and we provide it based on our experience in doing this work. And so what you say is: Here’s what we anticipate may happen. And here’s what you need to be doing. And here are the resources we can make available to you if you need help.
Now, it’s possible that that would be very difficult to do if you’re trying to keep operational security around a military attack. The thing is, the president had been previewing that there could well be military action for some time. So that would have given a pretext for doing this because it was already out in the public domain that there was some consideration of undertaking an operation. And you could therefore do this work and say, should anything happen, here are the things we want to be sure we’re ready for.
Okay, what else would the FBI be doing? I mean, I take it that it might — I don’t know — but I take it that there are confidential sources that it would be working in a more aggressive way. I take it that it had, again, I’m speculating, that there are probably a list of suspects or people that it might be worried about that it would give extra attention to. Is that right? And what else would it be doing?
Jack, that is right. And I think what we see in a system in which the government is working effectively to bring to bear all the tools in the toolkit is that we bring together foreign intelligence information that gives us insight into what bad actors may be trying to do. And we merge that with domestic information that is available through the investigative work that is done on an ongoing basis by the FBI, where they are tracking numerous people over time — criminal networks, drug traffickers, potential terrorist actors.
Of course, you have to have an actual legal basis for bringing somebody in if you decide that they are trending toward violence and you need to take action. Much of the time there’s wait and watch, to gather more information, to ascertain whether there are networks of people working together. In the effort to be as effective as possible, not to just blow an investigation early, but rather to gather as much as you can, to do the greatest work that you can to break up anything that may be threatening to Americans.
So we saw this in a variety of contexts in the homeland, and there’s press reporting on some of the work we did in the years in which I was in this Homeland Security Advisor role with some ISIS members who were in the homeland. And that work was painstaking law enforcement work, took a great deal of time and effort. And ultimately, when it became evident that there was a possibility that these individuals would cause harm to Americans, we worked with the Department of Homeland Security to use our immigration authorities to remove them from the country. And that was a very good example, again, of collaboration between two entities that work in the homeland security space.
You mentioned the integration of foreign and domestic intelligence, which, I guess, typically tends to be collected by different entities. Can you talk about the challenge of that, how the coordination is done and where?
Of course, we’re very, very careful about any collection on Americans. We have very strict laws around the civil liberties and privacy of American citizens. So what we’re working to do is gather information about foreign actors and, to the extent necessary, bring it together with information that is gathered by state and local law enforcement and the FBI about developments in the homeland.
It’s all done very rigorously and generally without any involvement of the White House whatsoever, because that work is privileged information and the White House does not get involved in it. But when there is an action that will be taken — for example, there might be a case brought against an individual — then that becomes potentially public knowledge and you may find out about it in the news. It is not necessarily the case that the White House will know about that in advance because of how carefully protected those processes are of investigation and prosecution under traditional norms of conduct of the Department of Justice and the FBI.
We haven’t mentioned, I don’t think, the Office of the Director of National Counterterrorism and the National Counterterrorism Center. Could you speak to the roles that they play?
So after 9/11, the National Counterterrorism Center was created because, as you’ll recall, there was a diagnosis that one of the reasons we experienced what we experienced on 9/11 was that the dots were not being connected across all the different points of information that had been gathered, and where we might have known that this was happening and been able to prevent it had we connected those dots. So NCTC was established as a clearinghouse for all the intelligence information that is related to terrorism.
And experts are based in NCTC, coming from all the different intelligence agencies, in order to do the painstaking analysis that leads to that connection of the dots and which shows that there is a risk here of this individual or this group in this location or these locations for which we need to be prepared. We want to try to disrupt what they’re doing, if at all possible. And so we want to get ahead of the action that they might take.
That function was one that I relied on very, very heavily. And indeed, the head of the National Counterterrorism Center was often in these meetings that I convened regularly to ensure that we were seeing all of the developments in the international sphere and aligning them with what we knew was happening in the homeland. And so we would have in meetings together the head of NCTC, the appropriate representative from the Department of Justice and the FBI, similarly from DHS, similarly from other departments and agencies, so that there was cross-referencing and people would know that this was happening, this may affect your personnel, you may be able to contribute something to doing something about this. Let’s all come together to ensure that we prepare in every way, we prevent wherever possible, and if we can’t prevent, then we’re ready to respond effectively.
Okay. Can you talk about the distinction between a foreign agent in the United States or a suspected foreign agent in the United States versus someone in the United States who’s not an agent of a foreign power but who might be a threat of some sort through inspiration?
Yeah, so when I think about possible terrorism in the homeland, I think about three categories, Jack. One is a terrorist who is directed by one of the terrorist groups overseas to conduct an attack in the homeland, like 9/11, for example, with Al-Qaeda. You could see Lebanese Hezbollah or Hamas. You could see the IRGC today try to conduct an attack in the homeland where it’s funded and organized by a foreign terrorist group or by a state sponsor of terrorism — in that case, Iran for the IRGC or Hamas.
Second is a terrorist who is seeded into the country, who would be potentially in what might be called a sleeper cell. That could be an individual who is more of a mercenary than an actual believer in the ideology of the group that is directing his or her action, and they could be here for a long period of time, and they may or may not ever take action. But that’s also a challenge for our law enforcement agencies to suss out and to track and to discern whether somebody is trending toward action or whether they are here potentially with some motivation that is supported by a foreign entity but not necessarily intending to do something immediately.
And the third, and quite importantly, especially at this moment, is a homegrown terrorist who is inspired by but not directed by one of the foreign terrorist groups. So a good example of that would be the individual who was a former military service member who conducted a terrorist attack on January 1st, 2025, in New Orleans. And in that case, this individual was inspired by ISIS but was not directed by ISIS, to the best of our knowledge. And he committed mass murder on New Year’s Day, of course, in New Orleans.
So those are three different kinds of actors who we have to be monitoring for and trying to disrupt. The lone wolf actors in the homeland are particularly difficult. And it’s possible — we don’t know the full story yet about what happened in Austin — but it is conceivable that that individual falls into that category.
And that’s something that right now law enforcement will be working very, very hard to ascertain: whether there’s any intelligence about that individual; indications of conversations of direction or support to that individual from a foreign actor; what his connections are in the homeland. Was he acting in any group? Are there others who might do similar things with whom he is in contact? And how quickly can that be disrupted if that is the case?
And so that would be work that would be happening in real time, with the FBI as the tip of the spear.
I don’t know if you can speak to this, but do you have a view on either the impact on all of these considerations of the funding lapse in the Department of Homeland Security or the firing of career officials by the Trump administration across the intelligence and law enforcement terrain, including in the FBI, which does both of those things? Do you have a view about how either one of those things might affect protecting the homeland at the moment?
I do. So I have relied very heavily on the deep expert competence of people across the federal enterprise who do very unglamorous work every day to keep Americans safe. And that includes the people in the Department of Justice and the FBI who do this work that we were discussing, the people in the Department of Homeland Security at the Cybersecurity and Infrastructure Security Agency, at the Transportation Safety Administration, at FEMA, at the Secret Service, in the intelligence community — the professionals who are connecting those dots.
The fact that so much of the federal homeland enterprise has been diverted to focusing on immigration enforcement concerns me greatly. And if coupled with the mass departures and firings, in some cases, of very senior experienced leadership in these departments and agencies, we have a real risk of not having the human capacity we need to do the investigative work to prevent and disrupt attacks in the homeland. It’s hard enough when you have everybody in place and working closely together, as I described it.
When you’ve had such dislocation, reorientation, and loss of human capacity, it really does raise the risk that we could suffer experiences that we do not need to suffer in the homeland. I hope very much that that is not the case. And I hope that we’re able to withstand what may be coming our way.
We also need to count on our foreign partners in this regard, Jack. And as I mentioned earlier, that would have been an early element of the equation for me in terms of preparation. I can think of a number of instances in which my foreign counterparts called me to warn me about something and said, this is what we’re seeing in our intelligence. We are worried this is coming your way. And without that tip, we would not have been shields up at the time.
And so the relationships we have, the trusting relationships we have with our foreign counterparts, and between the — again — the departments and agencies that work with their foreign counterparts, FBI counterparts, intelligence community counterparts, all of that really matters right now to ensure that we’re getting the cooperation we need to get early warning and to prevent bad things from happening.
You spoke about the diversion of FBI resources from counterterrorism to immigration-related matters. I believe I read that last year, during last year’s attack on Iran, that those resources came back to the FBI to work on counterterrorism. I haven’t yet read anything on that, but it might well have happened. Do you have any thoughts on the going back and forth, if that’s what’s happening?
It’s hard to know without more detail. I saw the same reporting. I would say that this work is so detailed. It’s so continuous. It’s not something you do episodically and then drop it to follow the leads that were given, to be in communities with your counterparts, staying on top of emerging potential threats, to track people who are potentially trending toward violence. You want to have continuity, not episodic engagement.
And so I would say my strong view would be it would be better to have people in place continuously. That said, if people have been brought back and if there’s capability that’s being put on this challenge, that’s better. And it is also, I’d say, an important moment for the administration to consider a rebalance, because what we know is that, in general, these attacks don’t happen immediately. It may take weeks to months, especially if you’re trying to position somebody to conduct something at scale. And so we have some time to prevent if we get organized to do so.
In addition, some of these things are years in the making, and the radicalization of human beings can be several years in the making, too. And so one of the things we’ve known, tragically, is that the Hamas attack on Israel in October of 2023 and the subsequent consequences of that in terms of the ongoing crisis in Gaza have led to radicalization of individuals who are more likely now, after 18 months or two years, to be trending toward violence. That is the trajectory, in general, we have seen of people who have been radicalized over time.
That does not mean that somebody wouldn’t be motivated today. And an interesting additional and worrisome point is that we’ve seen the confluence of groups come together who previously were divided by an ideological divide in the Islamic world between Sunni and Shia. And so though Hamas is a Sunni group, quite quickly many of the Shia groups became involved in a parallel activity in support of Hamas, whether it’s Lebanese Hezbollah, which just attacked Israel overnight (this morning, Israel time), or the Houthis, or we have seen other groups as well, ISIS and Al Qaeda, in the wake of the crisis in the Middle East, call for solidarity with Hamas against the United States, Israel, and their allies.
So we could see additional actions by groups that are not directly involved in the conflict but want to express solidarity with Iran in this moment. We don’t know that that will happen. We have seen Lebanese Hezbollah, which is an Iranian-supported terrorist group, act. We’ll need to see what others decide to do. But again, we should be shields up for all of this, to make no assumptions.
Can I ask you — I’ve got two more questions. The first one is to ask you to go back. You mentioned at the beginning the importance of state and local authorities. I think people might be surprised to learn how absolutely crucial they are in these types of threats. Could you say more about that and how the federal government intersects?
I can’t say enough about that, actually. This is the way our country is supposed to work. We have the capabilities residing in communities where our law enforcement is supposed to be out in the community, feeling the pulse of the community, understanding what is trending and identifying it for possible action if need be.
Now, that can also be abused in certain circumstances, and we have wrestled with that as well. But in cases related to terrorism, optimally what is happening is that our local law enforcement is working closely with the FBI team that is in the region of that community to receive information and provide information. So there’s a two-way street that is full of activity all the time, in exchanging information about what is happening so that we are not blind, so that we know we’re seeing something happen here, and the locals may ask for help — may ask for help in immediate response should something be emerging, or may ask for help in trying to investigate and prosecute and disrupt something.
And that has to be, as I said, ongoing, and there has to be a trusted relationship. One of the things that’s happened in the last 14 months is that we’ve seen many departures of individuals in the FBI offices around the country who were in leadership roles — the special agents in charge, their deputies, and others — who have left for various reasons in frustration over the rule of law not being implemented. And so that also degrades our capacity to work in communities because we don’t have those trusted relationships that we’re building on.
Last question: do you have a view about — you know, we’ve talked about certain resources going from national security/counterterrorism to maybe national security immigration enforcement. And it seems in the administration’s mind, anyway, that there’s been a trade-off and a perceived need to rebalance and then maybe readjust that balance. Do you have any views about how the heightened threat now and possible threats — and again, this is speculative, from the Iran conflict, which seems to be, seems as we’re speaking on Monday afternoon like it’s going to be going on for at least many weeks — how that is going to affect other items, domestic agenda items of the administration, especially immigration enforcement?
Yeah. I mean, Jack, there’s a scenario that I worry about, which is that if there are terror attacks in the homeland and the military is fully engaged overseas in an escalating conflict, as you’ve just suggested, it could well be — we hope that’s not the case, but we don’t know where this is going. That could lead to a presidential decision to activate more military service members from the National Guard in the homeland to support, in his view, the suppression of violence or of civic unrest, or to manage terrorism if he perceives that there’s a rise in terrorist threats or activities.
That would be a development that will cause us to question whether it is necessary. There seems to have been an interest in doing this, obviously, in a number of communities over the last year. And if there is a heightened terror threat in the homeland, I could foresee that there would be an inclination to use that as a justification for putting more service members — potentially National Guard members — in our communities to provide security when the military is occupied overseas.
So we don’t know whether that will happen, but it’s something to watch because of the trends that we’ve already seen.
Okay, Liz, thank you very much. I appreciate it.
Thank you so much for giving me this opportunity to talk with you.
