When a citizen flags a direct threat against a sitting president, the question that matters is not whether someone “sent an email,” but whether the protective system did what it was built to do: receive, triage, and act—fast, traceably, and in proportion to risk.
At a Glance
- WeTheJ6ers co-founder Barry Ramey says he supplied threat material about President Trump to the U.S. Secret Service within 80 minutes of an agency request, then sent nine follow-up emails over the next 25 days without a reply.
- The allegation is narrow and concrete: a reported communication gap after a documented initial request for evidence.
- The Secret Service’s own doctrine explains why intake and triage matter; its model separates alarming messages from actionable threats and emphasizes case management.
- History shows the Service routinely monitors and acts on open-source threats to protectees, underscoring the stakes of timely, documented responses.
What Ramey and WeTheJ6ers reported—and why it matters
According to reporting, on September 12, the U.S. Secret Service asked Barry Ramey, a co-founder of WeTheJ6ers, to provide evidence of threats against President Trump. Ramey says he delivered the requested material within 80 minutes, then sent nine follow-up emails over the subsequent 25 days seeking acknowledgment or next steps; he contends none were answered. The claim is not a sweeping indictment of the agency’s protective posture; it is a specific assertion of an unclosed loop after an initial agency ask. In the world of protective intelligence, that loop—receipt, triage, and documented disposition—is not clerical trivia; it is the backbone of risk management.
The stakes are straightforward. Modern threat environments are saturated with social media posts, doxxing attempts, and propaganda, all of which require disciplined separation of noise from signal. The protective system cannot neutralize what it has not captured and categorized. At minimum, a traceable intake and disposition record answers two critical questions later: was the threat material received, and what was done with it?
How protective intelligence is supposed to work
The Secret Service’s approach—pioneered over decades and distilled through its National Threat Assessment Center—frames threat management as a three-part cycle: identify persons or behaviors of concern, assess intent and capability, then manage the risk through intervention, monitoring, or referral. Crucially, the doctrine distinguishes an alarming message from an actionable subject; the former can be disturbing yet non-credible, while the latter is a person whose behavior, capability, and pathway to violence merit active casework. That framework demands reliable intake and triage mechanisms: centralized capture of tips, structured review against credibility heuristics, and routinized escalation to investigators when thresholds are met.
The Service’s public materials outline those guardrails—protective intelligence is not a linear inbox but a managed pipeline where each item receives a disposition. Even when no investigative threshold is met, the process still values auditable acknowledgement and archiving; incidentally, that paperwork discipline is what allows the Service to reconstruct its posture in after-action reviews. The key performance indicator is not the volume of tips processed, but the alignment between risk indicators and the decisions recorded about them.
What history tells us about open-source threat monitoring
Whatever one thinks of any single allegation, the Service has long treated open-source threats as a primary feed for protective intelligence. In the days before January 6, 2021, for example, the agency’s Protective Intelligence Division identified 80 web-based behaviors of interest directed at multiple protectees, including then-President Trump and then–Vice President Mike Pence, underscoring that public posts and forums are routine inputs to protective posture. Congressional and independent reviews have since surfaced internal communications showing agents were tracking threat chatter and adapting to it in real time, reinforcing that the Service is institutionally wired to mine public sources for risk signals.
That history cuts both ways for the current controversy. On the one hand, it shows the system is built to ingest and act on open-source warning signs; on the other, it raises the bar for documentation, because high-volume intake without clear dispositioning can create blind spots in accountability. The point is not that every alarming message must trigger an arrest; it’s that the pipeline must leave a trail.
Aligning the allegation with the doctrine
The Ramey account describes a breakdown at the most basic level of the pipeline: acknowledgment. If an agency initiates a request for evidence, then silence ensues across multiple follow-ups, the problem is not a dispute over credibility thresholds; it is an intake-and-comms lapse. Within the Service’s own model, the minimum viable process would capture the submission, assign it for preliminary assessment, and communicate a holding response if operational sensitivity precludes detail. That can be as spare as “received and routed,” yet it preserves chain-of-custody for the information and confidence in the system’s function.
Why does that formality matter? Because source relationships are perishable. Citizen-reporters, campaigns, and advocacy groups are not substitutes for law enforcement, but they are often first movers in surfacing volatile posts or doxxing attempts before platforms remove them. If such reporters conclude the intake channel is unresponsive, two predictable outcomes follow: they stop sending, or they go public first. Both degrade the risk pipeline.
The volume problem—and how credible systems handle it
To be fair to any protective service in the social era, volume is not a nuisance; it is the threat surface. Agencies must contend with spam, hoaxes, performative extremism, and genuine criminal intent jumbled together. Mature systems address this with three tools: standardized submission portals that enforce required metadata; automated triage that flags capability, proximity, and specificity; and human review that can escalate within minutes when indicators cluster. None of that requires divulging investigative steps to external reporters; it does require that acknowledgments be fast, standardized, and logged.
The Service’s own publications emphasize operational discretion, but they do not prescribe silence to outside sources who supplied the initial material. “We can’t tell you more” is different from “we won’t tell you anything.” The former protects operations while assuring the pipeline works; the latter breeds avoidable friction with the very people who surface leads.
What accountability looks like in practice
The fix is procedural, not political. First, use a single, published intake channel for non-emergency digital threats, with automated confirmation numbers on receipt. Second, commit to an SLA-style acknowledgment—hours, not days—stating only that material has been received and routed. Third, where the agency itself solicits evidence, mirror law-enforcement chain-of-custody norms: issue a case or item number, log submissions, and timestamp follow-ups. Finally, retroactively reconcile ad hoc email exchanges into the case file so the after-action record reflects the full communication history. None of this compromises operational security; all of it strengthens institutional trust and post-incident review.
The Service’s performance on open-source threat detection around past high-risk periods shows the capability exists to run this playbook under stress. When a citizen says the acknowledgment piece failed after an agency-initiated ask, the right metric is not public disclosure of steps taken, but evidence that the intake loop closed—receipts, routing, and a disposition trail inside the case system.
Bottom line
Protective intelligence lives or dies on disciplined intake. The allegation here is precise: after the Secret Service requested threat material about President Trump, the citizen who provided it received no answer despite nine follow-ups over 25 days. The Service’s own doctrine leaves little ambiguity about what should have happened next: log, triage, route, and—at minimum—acknowledge. In an era when a single credible post can compress the timeline from warning sign to incident, that small administrative act is part of the security architecture. It is not optional.
Sources:
thegatewaypundit.com, 1stheadlines.com, cnn.com, wethej6ers.com, en.wikipedia.org, cbsnews.com
