Secret Service Ghosts Explosive Trump Tip

Microphones held up to a speaker in a suit — Photo: Microgen / Shutterstock

When a citizen sends a threat tip about a sitting president, what happens next should be predictable, documented, and timely — because in protective security, ambiguity is risk. The recent account from WeTheJ6ers co-founder Barry Ramey, describing prompt delivery of alleged threats against President Trump to the U.S. Secret Service and nine subsequent follow-ups without a reply, spotlights the gap between public expectation and how protective intelligence systems actually process inbound warnings.

The Short Version

WeTheJ6ers says the Secret Service requested threat evidence on September 12 and received it within 80 minutes, followed by nine unanswered emails over 25 days.
The Secret Service’s protective intelligence model triages massive volumes of tips; not every message triggers a case or external feedback loop.
Open-source threats tied to high-profile figures are common; agencies distinguish alarming language from credible, actionable risk tied to an identifiable subject.
The friction here sits at the intersection of volume management, investigative thresholds, and the public’s desire for confirmation that their warning mattered.

What We Know About the Reported Exchange

According to published reporting, the Secret Service asked Ramey on September 12 for material supporting alleged threats against President Trump. Ramey reportedly sent the requested files within 80 minutes, then sent nine more emails across the next 25 days to seek acknowledgment or further action, but received no answer. The claim is specific on timing, the number of follow-ups, and the parties involved. It also aligns with a longstanding reality of protection work: citizens frequently deliver threat fragments — screenshots, usernames, rhetoric — whose evidentiary value depends on whether investigators can link them to a real person with intent and capability.

That is not a small caveat. Protective intelligence is built to filter noise at scale. A message that sounds menacing is not the same thing as a subject who poses a near-term risk. The Service’s own doctrine emphasizes structured triage and assessment, not immediate external feedback, as the first order of business.

How Protective Intelligence Actually Works

The U.S. Secret Service pioneered modern behavioral threat assessment in federal protection, an approach that treats threats as a process rather than a product. In practice, the system moves through three functions: identification (surfacing persons of concern), assessment (judging intent, capability, and triggering stressors), and management (applying interventions proportional to the risk). This is not a linear conveyor belt so much as a gatekeeping lattice; cases branch or close based on whether investigators can connect an alarming communication to a living, locatable subject and a plausible path to violence.

Tip intake is only the ignition. Analysts compare the content to known subjects, cross-check with other agencies, and interrogate indicators such as fixation, leakage (pre-attack disclosure), and pathway behaviors — acquiring weapons, reconnaissance, or approach attempts. Much of that activity is invisible to the outside tipster by design. Doctrinally, the Service does not validate investigations in real time with third parties because doing so risks operational compromise and can reward threat rhetoric with attention.

Why Tip Volume and “Open-Source Threats” Complicate Expectations

In the digital era, celebrities and political leaders attract a torrent of menacing language. Years before the current episode, the Secret Service documented dozens of online “behaviors of interest” directed at multiple protectees in the days leading to January 6, 2021 — a snapshot of the sheer volume analysts face. Most of those signals do not convert to viable plots; some are bravado, some are bots, some are copy-paste propaganda. The system’s job is to find the needle without stopping the mill.

This is why agencies emphasize a behavior-based model over threat-language triage alone. A post that names a date and location and references reconnaissance is qualitatively different from a slur-filled rant. The threshold to escalate from screening to field investigation is evidence that a specific person, not just a post, is moving along a pathway to harm. When that linkage is weak or absent, cases may be logged, correlated, and held — with no outward sign to the original reporter.

Where the Friction Comes From

Ramey’s account underscores a recurring pain point: to citizens, silence from a protective agency looks like indifference; to practitioners, silence is procedure. Both can be true at once. Protective intelligence units are not customer-service desks. They are built to safeguard operational security, shield innocent subjects misidentified by tips, and avoid contaminating potential criminal cases with public commentary. Yet the absence of any receipt confirmation — particularly after an initial request for materials — predictably corrodes confidence among those who took the time to report.

Institutionally, there are ways to narrow this trust deficit without compromising tradecraft. Non-committal acknowledgments (“materials received and routed for review”), standardized tracking numbers for civil tips, and a published service-level expectation (e.g., “you may not receive further updates”) preserve discretion while honoring the citizen’s contribution. Many state and local threat assessment units have adopted such protocols to good effect, as reflected in federal guidance to partner agencies.

What “No Response” Does and Does Not Mean

It is critical to separate outward communications from internal action. A lack of email replies does not indicate that analysts failed to ingest, correlate, or act on the content; it means the agency declined to engage further with the external correspondent. That is consistent with doctrine, though not satisfying to reporters. At the same time, the original exchange reportedly began with a Service request for evidence — a detail that naturally raises expectations of at least minimal follow-through with the person who supplied it. Balancing those expectations against operational security is part of the craft; doing it poorly invites public doubt at precisely the moment institutions can least afford it.

The broader record shows the Service’s dual reality. On one hand, it is capable of rapidly surfacing and sharing emerging open-source threats, as contemporaneous records around January 6 illustrate. On the other, outside oversight has critiqued aspects of documentation and coordination in that same period, a reminder that even mature systems require constant refinement. None of that adjudicates what did or did not happen in a single tip exchange; it does explain why episodes like this resonate beyond their immediate facts.

What Matters Going Forward

For citizens: continue reporting. Provide the elements that sharpen assessment — specific handles or accounts, timestamps, platform URLs, screenshots with metadata, stated intent, means, and proximity to a protectee’s movements. For institutions: close the courtesy gap. A standardized, non-substantive acknowledgment, paired with clear public guidance on what to submit and what to expect, would reduce the perceived abyss between “we heard you” and “we told you nothing.”