Former CIA officer breaks down ‘duty to warn’ requirement that saw the US give rival Russia a heads up before the attack in Moscow

• Ex-CIA officer Laura Thomas explained the 'duty to warn' protocol, that sounds the alarm on threats.
• The protocol is a tool to save lives and also communicates the CIA's knowledge to adversaries.
• Before the March 22 Crocus City Hall attack, Russia dismissed the US warnings.

The US intelligence community notified Russia of a potential threat head of March 22 Crocus City Hall attack under the "duty to warn" protocol, a requirement that a former CIA case officer broke down in a series of posts this week.

The CIA uses the "duty to warn" protocol to alert a US or non-US entity of an impending threat. It's not only a tool to save lives, it also sends "a message to our adversaries about our knowledge and values," Laura Thomas explained on X on Thursday.

Beyond protecting innocent people, it "may make a foreign intelligence officer from an adversarial country think 'if they try to protect even those from enemy countries, maybe they really would take care of me and protect me if I were a clandestine source for them,'" Thomas said.

Delivering a "duty to warn" notification

The first step in delivering a "duty to warn" notification is vetting the source's information as "credible" and making sure it contains "enough details on timing, location and/or perpetrators of the attack that there is reason to believe that sharing the information would prevent innocent loss of life," she said.

"Duty to warn" provides domestic and international intelligence with as much information as possible to prevent an attack, but certain things are withheld to protect spy operations.

Sources could face serious risks like imprisonment or execution if adversaries find them out, so the language of a "duty to warn" notification is broad and sources are kept private when warnings are provided.

In general, "duty to warn" must communicate threats effectively to threatened individuals and governments without blowing the source's cover.

In her experiences with these warnings, Thomas said, she would notify CIA headquarters of the "duty to warn" need when it met the expectations of a typical "duty to warn" scenario and when she completed her outline of how the threatened entity would receive the "duty to warn" tip.

If CIA headquarters found intelligence that met the "duty to warn" threshold on its own, then it would appropriately craft and send the notification and plans to the appropriate office that would then deliver the warning to the threatened entity.

Once a "duty to warn" notification is delivered, the CIA officer who issued the warning documents marks it as a "fulfilled" duty.

It must be noted that a "duty to warn" tip is not the same as a State Department advisory warning.

"CIA's own duty to warn process does not always involve State Department, as it is not the same as a 'public' notification," Thomas said. "State would issue a public warning if they assessed that US citizens abroad would also be at significant risk (which would have been the case in Russia recently)."

The US embassy in Russia issued a warning weeks ahead of the Crocus Concert Hall. The US intelligence community also warned the Russians. Days before the attack, however, Putin said the warning was "blackmail" meant to destabilize and intimidate Russian society.

"The Embassy is monitoring reports that extremists have imminent plans to target large gatherings in Moscow, to include concerts, and U.S. citizens should be advised to avoid large gatherings over the next 48 hours," the US embassy in Russia stated in a public security alert on March 7.

On March 22, at least 137 people were killed and over 145 people were injured in an attack at a music venue near Moscow. ISIS-K, an Islamic State branch, took responsibility for the attack, but Russia is pushing blame in other directions, including at Ukraine.