Albany: a bomb in a food delivery bag, and five walks round the building
A 35-year-old woman from Albany is charged with plotting to bomb the New York State Capitol, kill state senators and destroy the building's records. She lived less than two miles away and walked round it five times, photographing it and marking where she meant to place the device.
The plan was to carry the bomb in a food delivery bag and pass as a courier at a public entrance. She was arrested taking possession of what she believed was an explosive device; it was inert, and the people helping her were working for the FBI.
↓ Download one-page brief (PDF)An online pledge, then contact
Prosecutors say Bowie recorded and circulated a formal oath of allegiance to Daesh and posted hostile material online. From 16 July she is in contact with a confidential source working for the FBI and posing as a facilitator for the group.
From 21 July - reconnaissance on foot
She visits the Capitol grounds on five occasions, photographs the building, and sends the images to the source with the intended point of attack marked. All five visits are captured on security cameras. She lives less than two miles away.
The cover story
She tells the source she intends to place the bomb in a food delivery bag so as to look like a delivery driver, leave it at a public entrance and get away. The cover is chosen because it is the one thing nobody looks at twice.
5 August - buying the components
At a recorded meeting she reaffirms the plan and directs FBI personnel to a hardware store where she buys nails. By 13 August she is asking for a concealable handgun to shoot at police if they approach her during the attack.
19 August - the arrest
She pays for what she believes are a handgun, magazine and ammunition, and is shown an inert device said to have been built from the materials she bought. She is arrested on taking possession of it. Prosecutors say she had by then learned the building could hold as many as 200 people and hoped to kill at least half of them.
Why a delivery bag
Food delivery couriers are ubiquitous, anonymous, expected at all hours and carry insulated bags that are opaque and unremarkable. The role provides a reason to approach a building, to wait near an entrance and to leave.
Five visits, all on camera
She walked the site five times and photographed it. That activity was recorded and, in this case, was recovered as evidence after the fact rather than acted on at the time.
Online to action
Prosecutors describe an online pledge of allegiance, hostile posting, then contact with someone she believed could help, then concrete steps - reconnaissance, components, a weapon. The sequence is the familiar one and the interdiction came at the last of those stages.
An FBI sting
The device, the weapon and the facilitator were all supplied within the operation. That is a lawful and well-established technique, and it also means the capability demonstrated is intent and effort rather than any ability to build a working bomb.
The distance between this and a real attack is the presence of a confidential source. She conducted the reconnaissance herself, chose the cover herself, bought the nails herself and formed the intent herself. What she could not do alone was build the device, and the person she asked for help was working for the FBI.
The delivery courier cover is the transferable idea, and it is the part worth acting on
The plan was to walk to a public entrance dressed as a food delivery driver and leave a bag. Delivery couriers are the one category of visitor that almost every organisation has trained itself not to examine: expected, anonymous, carrying an opaque container, and gone in a minute. Perimeter hardening does nothing about a person who is meant to come to the door, and the control that matters is what happens at the entrance and whether staff are willing to question a delivery nobody ordered.
Reconnaissance was recorded and was not acted on at the time
Five visits to the grounds of a state capitol, photographs taken, all captured on camera. The footage became evidence after her arrest rather than an indicator before it. The material existed and nothing in the system turned it into a trigger, which is the recurring gap in hostile reconnaissance cases and is a question about how CCTV is reviewed rather than whether it exists.
A sting proves intent, not capability, and both matter separately
The device was inert, the handgun was inert and the facilitator was an informant. She could not build a bomb, which is why she sought help. It is likely that the same intent without a confidential source produces a less capable attempt rather than none at all, and an improvised device built from nails and hardware-store materials at a crowded entrance does not need to be sophisticated to kill people.
Legislatures are open by obligation and that will not change
A parliament or assembly must admit the public, publish its sitting times and stand in a known place. The exposure is structural. The realistic protective measure is layered - screening at public entrances, stand-off from the chamber, and staff awareness of everyday cover - because the building cannot be closed.
Further lone-actor plots against seats of government are likely
Self-radicalisation online followed by concrete steps against a symbolic public building is a well-established pathway, and interdictions of this kind are regularly reported. It is likely that further plots against legislatures and civic buildings are attempted, and likely that they continue to favour everyday cover over forced entry.
Set this beside the Kuwait drone plot, disrupted the same month by a state security service watching one man. Both were stopped by intelligence rather than by anything at the target, and in both cases the site itself contributed nothing to its own defence. The difference is the method: one intended to fly over the fence, the other to walk through the front door.
- Treat unexpected deliveries as an access-control problem, not a logistics one. A courier at a public entrance with a bag nobody ordered is the scenario here. Staff need explicit permission to question it and a procedure that does not depend on their confidence.
- Screen at the public entrance, and give yourself stand-off. The plan was to leave a device inside a main door. Where a building must admit the public, the distance between the screening point and the occupied space is the control that remains.
- Review CCTV for repeat visitors, not just for incidents. Five visits by the same person taking photographs were all recorded. Footage that is only examined after an event is evidence rather than security.
- Brief front-of-house staff on hostile reconnaissance. The people who would have seen her are receptionists, security officers and grounds staff. They need to know what repeated photography and pacing look like, and to have somewhere to report it.
- Plan for the insider-adjacent categories. Deliveries, contractors, cleaners and maintenance are all expected, all routine and all rarely challenged. Each is a viable cover and each should have a verification step.
- Do not read a sting interdiction as evidence the threat was hollow. The intent, the reconnaissance and the target selection were hers. Only the device was not.
- https://www.justice.gov/opa/pr/albany-new-york-woman-charged-isis-inspired-terror-plot-targeting-new-york-state-capitol
- https://www.justice.gov/usao-ndny/pr/albany-new-york-woman-charged-attempting-provide-material-support-or-resources
- https://www.nbcnews.com/news/us-news/fbi-thwarts-isis-plot-bomb-new-york-capitol-building-rcna593595
- https://www.cnn.com/2026/08/20/us/new-york-state-capitol-bomb-threat
- https://www.cbsnews.com/newyork/news/albany-ny-alleged-attack-plot/
Compiled from open-source reporting for professional security discussion. These are allegations contained in a criminal complaint. Jessica Bowie has been charged and has not been convicted; she is entitled to the presumption of innocence. The account set out here derives from the Department of Justice and from an FBI affidavit as reported. The explosive device, the firearm and the facilitator were all supplied within an FBI operation and no functional device existed. Details may be revised as proceedings continue. This is a protective-security lessons-learned assessment, not an operational account.