A major Canada SMS blaster cybercrime case has come to light as Toronto Police charge three men with 44 offences in what authorities describe as a first-of-its-kind investigation in the country. The case, part of Project Lighthouse, highlights a growing threat where cybercriminals use mobile technology to target thousands of people at once. The investigation began in November 2025 after a security partner alerted police to a suspected SMS blaster operating in downtown Toronto. What followed was a months-long probe into a sophisticated operation that combined mobility, deception, and large-scale disruption.

What Is the Canada SMS Blaster Cybercrime Case?

At the center of the Canada SMS blaster cybercrime case is a device that mimics a legitimate cellular tower. When nearby mobile phones connect to it, users receive fraudulent messages that appear to come from trusted organizations. These messages often include links to fake websites designed to steal sensitive information such as banking credentials and passwords. This method is widely known as “smishing,” a form of phishing carried out through text messages. However, the scale and mobility of the device used in this case set it apart from typical cyber fraud schemes. Deputy Chief Rob Johnson said the operation posed serious risks beyond financial fraud. He noted that the technology had the capability to reach thousands of devices simultaneously, raising concerns about public safety.

Large-Scale Disruption Across the Greater Toronto Area

Investigators found that the SMS blaster was not stationary. It was operated from vehicles, allowing suspects to move across the Greater Toronto Area and deploy the device in multiple locations. According to Detective Sergeant Lindsay Riddell, tens of thousands of devices connected to the rogue network over several months. Police also recorded more than 13 million network disruptions, during which affected devices were unable to connect to legitimate cellular networks. These disruptions had serious implications. During those moments, access to emergency services such as 9-1-1 could have been impacted, making the Canada SMS blaster cybercrime case not just a financial threat but also a public safety concern.

Arrests and Seizure of Devices

Toronto Police executed search warrants on March 31 at residences in Markham and Hamilton, leading to the arrest of two suspects. Authorities seized multiple SMS blasters along with a significant amount of electronic evidence. A third individual later turned himself in on April 21. All three now face a combined total of 44 charges linked to the operation. The Canada SMS blaster cybercrime case involved extensive coordination between multiple agencies, including the Royal Canadian Mounted Police National Cybercrime Coordination Centre, regional police services, financial institutions, and telecom providers. Officials say this collaboration was key to identifying and disrupting the activity.

A New Type of Cyber Threat in Canada

Law enforcement officials emphasized that this is the first known case of SMS blaster technology being used in Canada. The case reflects how cyber-enabled crimes are becoming more advanced and harder to detect. Authorities noted that while the technology is new, the objective remains the same: to gain unauthorized access to personal and financial information. The Canada SMS blaster cybercrime case shows how attackers are combining traditional fraud tactics with newer tools to scale their operations.

Public Advisory and Safety Measures

Police are urging the public to remain cautious when receiving unexpected text messages. Users are advised not to click on suspicious links or share personal information through unsolicited messages. Officials recommend accessing banking services only through official applications or by directly entering website addresses into browsers. Victims of suspected fraud are encouraged to report incidents to law enforcement. Deputy Chief Johnson also acknowledged the role of the Toronto Police Coordinated Cyber Centre and partner agencies in handling the investigation. He stressed that staying informed and vigilant remains one of the most effective defenses against such threats.

The Nova Scotia Power data breach has forced the utility provider to commit to stronger cybersecurity and privacy safeguards after a cyberattack exposed sensitive data of more than 900,000 current and former customers. The scale of the Nova Scotia Power data breach and the nature of the compromised information have raised serious questions about how organizations manage and protect customer data. The breach, discovered on April 25, 2025, was not the result of a single failure. Instead, it unfolded over weeks—highlighting how attackers can quietly move through systems before being detected.

Nova Scotia Power Data Breach Linked to Malware Infection

According to details shared in a compliance letter, the Nova Scotia Power data breach began on or around March 19, 2025. An employee accessed a compromised website infected with “SocGholish” malware and clicked on a malicious pop-up link. This allowed the malware to install and create a foothold within the network. From there, attackers escalated their access. Between April 8 and April 22, they moved laterally across systems using domain administrator privileges, conducted internal reconnaissance, and harvested credentials. This phase is critical, and often underestimated in cyber incidents. By the time the Nova Scotia Power data breach was detected, the attackers had already spent days exploring the network.

Data Exfiltration and Ransomware Deployment

The final stage of the Nova Scotia Power data breach occurred between April 23 and April 25, when the threat actor exfiltrated data from both on-premises systems and cloud storage. Shortly after, ransomware was deployed, backups were destroyed, and multiple applications stopped functioning. The attack was only discovered when employees reported system disruptions—an indication that the breach had already reached its most damaging phase. The attackers later contacted the company via a Tor-based dark web page, providing proof that sensitive customer data had been accessed. However, there is no confirmed evidence so far that the data has been publicly released or sold. Nova Scotia Power chose not to pay the ransom, aligning with law enforcement guidance.

Scope of the Nova Scotia Power Data Breach

The Nova Scotia Power data breach impacted approximately 375,000 current customers and 540,000 former customers. The compromised data includes:

• Names, phone numbers, and email addresses
• Mailing addresses and dates of birth
• Account and billing history, including bank details
• Driver’s license numbers and Social Insurance Numbers (SINs)

This level of exposure significantly increases the risk of identity theft and financial fraud, making the Nova Scotia Power data breach particularly serious.

Delayed Notifications and Customer Concerns

The handling of the Nova Scotia Power data breach has also drawn scrutiny. The Office of the Privacy Commissioner of Canada received multiple complaints, particularly around delayed notifications and the use of mailed letters, which slowed communication with affected individuals. Some concerns were also raised about the collection and storage of SINs, which were part of the compromised dataset. While Nova Scotia Power informed the public on April 28 and notified regulators by May 1, direct notifications to customers began weeks later, with additional affected individuals identified months after the initial disclosure. This staggered communication reflects the complexity of breach investigations—but also highlights the importance of timely transparency.

Response and Security Commitments

Following the Nova Scotia Power data breach, the company took steps to contain the incident. This included isolating affected systems, resetting compromised credentials, and working with third-party cybersecurity experts to investigate and remediate the breach. Customers were offered credit monitoring and identity protection services, initially for 24 months and later extended to five years for all customers. More importantly, Nova Scotia Power has now committed to strengthening its security measures under a compliance agreement. The Office of the Privacy Commissioner will continue to monitor progress until all commitments are fulfilled. Privacy Commissioner Philippe Dufresne stated, “I welcome this commitment by Nova Scotia Power to ensure stronger protections for the personal information of its customers. This privacy breach highlights the significant risks of cyberattacks to individuals and companies. Strong, proactive data protection, including robust safeguards, must be prioritized by all organizations in this evolving landscape.”

This investigation is part of a collaboration between Bellingcat, Evident Media and CalMatters. You can watch Evident’s investigative video here, and read CalMatters’ report here.

In early January 2025, a gardener named Ernesto Campos was pulled over by Border Patrol agents in the city of Bakersfield, California. 

The agents were a long way from home: Bakersfield is over 240 miles (386km) from the US border with Mexico.

They were there as part of Operation Return to Sender, a Border Patrol surge in the city that acted as a portent of what was to come across the US in 2025.

Video footage shows one agent threatening to break Campos’ car window as they believed he was transporting an undocumented individual. 

Campos filmed the agents, who he said slashed his tyres before arresting him and a passenger. The agents’ faces later appeared on local news reports detailing the incident.

Ten months later, two of the agents visible in footage recorded by Campos were filmed in Chicago as Border Patrol agents descended on the city for what was dubbed “Operation Midway Blitz”.

One was seen grabbing a man by the throat before slamming him to the ground with help from other agents.

@govpritzker.illinois.gov 37 and Kedzie, East Garfield, Illinois. This is assault.

[image or embed]

— Daniel Connerton (@lordnad.bsky.social) 4 October 2025 at 20:56

The other was seen punching a man in the face before pulling his gun on protesters in a Chicago suburb.

These confrontations were not isolated incidents.

A federal judge in Illinois said in November that the use of force by federal agents in Chicago – including the use of tear gas and other less lethal munitions on multiple occasions –  “shocks the conscience”.    

A restraining order issued by that Illinois judge was vacated on appeal earlier this month. But what took place on the streets of Chicago also happened in other locations, with some of the same agents involved.

Bellingcat has worked with our partners at Evident Media and CalMatters to analyse over 85 hours of social media and bodycam footage, as well as court documents and incident reports, to try to unpack the actions of Border Patrol agents across the country. 

With agents often masked and badge or identification numbers not always visible, understanding exactly who has enforced the immigration surges of the past year has been difficult. This, in turn, has made public questioning and accountability around use-of-force incidents challenging. 

Nonetheless, we observed over 25 agents who appeared in more than one city, either by recognising their faces or matching badge numbers that were visible on their vests or arm patches. Many were seen alongside former Border Patrol Commander at Large, Gregory Bovino, on at least one occasion. 

But this is likely just a fraction of the agents who moved around the country to take part in Border Patrol surges in cities like Los Angeles, Chicago and Minneapolis. When speaking to reporters in January, Border Czar Tom Homan said he had spoken to some agents who had “been in theatre for eight months”. Many wore masks in the videos viewed by Bellingcat, and it was not always possible to identify number patches from social media or bodycam footage alone.

Although some of the agents we logged appeared on neighbourhood walkabouts or in footage where little happened, others could be seen using force on multiple occasions. For this story, we have focused on the actions of five agents whom we have been able to identify and who appear to have repeatedly used force in at least two, but often more, locations. We have decided to name those we have been able to identify just as we would name any officer involved in incidents like those detailed. But these were by no means the only agents whom we saw using force across one or multiple cities.

The footage we analysed also appears to show a steady escalation of violence and confrontational incidents as 2025 progressed, culminating in widespread use-of-force incidents in Chicago and Minneapolis, where two people, Renee Good and Alex Pretti, were killed by Immigration and Customs Enforcement (ICE) and Border Patrol agents, respectively, in early 2026.

Agents on the Move

While former Border Patrol Commander at Large Gregory Bovino is no longer in a national role, some of the agents observed and documented for this report appear to have travelled from his El Centro sector over the past year.

These included agent Timothy Donahue and Georgy Simeon, who were filmed by Ernesto Campos in Bakersfield. Donahue was the agent who was subsequently pictured pointing his gun at citizens just outside Chicago after a traffic incident (Donahue stated in his incident report that his car was rammed by an activist – something also described in Illinois federal judge Sara Ellis’ opinion – although Donahue’s report made no mention of punching a man in the face or unholstering his weapon). It was Simeon, meanwhile, who was filmed slamming a man to the ground after grabbing him by the throat.

Donahue was also spotted in social media footage in Los Angeles in June last year pushing a citizen who was blocking his vehicle, as well as grabbing a man on an immigration raid inside a car wash.

The Chicago publication, Unraveled Press, previously reported that Donahue was the owner of a social media account that made seemingly racist and sexist posts. Bellingcat and others have checked this account and found that an old profile picture showed an image of Donahue. Bodycam footage from outside a detention centre near Chicago also showed Donahue tackle a journalist from Unraveled without apparent warning.

Footage from Donahue’s own bodycam on Oct. 3 also appears to show him compiling an incident report with ChatGPT. The possibility of CBP agents using ChatGPT to compile incident reports was addressed by Judge Ellis in her ruling issuing a restraining order in November. She wrote that using ChatGPT to write reports “undermines their credibility and may explain the inaccuracy of some reports filed by CBP officers”.

The evidence doesn’t enable us to determine if Donahue used ChatGPT to compile the Oct. 31 incident report in which he did not mention he punched a man and unholstered his gun. 

Our reporting partners CalMatters emailed and called Donahue prior to publication. The email received no response. Donahue answered his cellphone but said, “never, ever call my cellphone again,” and hung up.

Simeon did not respond to emailed questions prior to publication, and calls to a number listed under his name went unanswered. 

The Department of Homeland Security (DHS) did not respond to questions posed about the actions of Donahue and Simeon detailed in this report or the agency’s use-of-force policies. They also did not respond to questions about whether it was permissible for agents to use generative AI platforms like ChatGPT to compile incident reports.

While the actions of Donahue and Simeon made news reports in various cities, the pair were far from alone in having their actions filmed and documented across the country. 

Kristopher Hewson, a supervisory agent based out of Bovino’s El Centro sector, was seen on bodycam footage in Chicago spraying an individual who was being held down by agents with what he detailed in his incident report as oleoresin capsicum (OC), also known as pepper spray, from what appears to be just a few inches away. The individual was on the ground and had one hand behind his back, but agents could be heard asking for his other hand during the incident. Hewson said in his incident report (see here and here) that the individual had been resisting arrest, but he also stated that he deployed the pepper spray from two feet away. Bodycam footage (see below) showed the canister beside the individual’s head right after a burst of spray can be heard.

Bodycam footage shows an individual being held down before pepper spray is released while he remains on the ground. Annotations after 15 seconds made by Bellingcat.

Hewson, who wore a mask but was identifiable in several videos by the C-29 ID number on his uniform, was later spotted in Minneapolis. He also said his name during one incident that allowed us to find other bodycam footage releases that belonged to him. In one video, his mask slipped, which allowed us to compare his face to images on his social media accounts.

Court testimony revealed that he was present in Los Angeles during a Border Patrol surge in the city in the summer of 2025. He was also seen alongside Bovino on numerous occasions, including in Chicago, where Bovino can be heard greeting him by saying, “Hey, Hewson”, in one video captured by the filmmaker Jeff Perlman.

In bodycam footage from Chicago a man can be heard saying that the person Hewson pepper-sprayed was his son, who was just 15 years old. This appears to be backed up by an incident report showing the individual’s date of birth. A short time later, Hewson can be heard shouting “get back or you will be gassed” at a group of protesters immediately before deploying tear gas towards them. As he throws the canister, a person can be heard shouting, “You’re not de-escalating shit, bro”. Hewson stated in his incident report (see here and here) that he gave a warning that CS gas was coming, but he did not detail how that warning was virtually instantaneous. 

All of these actions came two weeks after a judge issued a temporary restraining order on Oct. 9, preventing agents from using chemical agents on protesters and journalists unless there was an imminent threat of physical danger to federal forces. While that order was lifted in March 2026, it was still in force during the incidents detailed in this story.

Hewson was seen in Minneapolis in early 2026 alongside Bovino. He was captured on footage marching towards and tackling a Target employee, a teenage US citizen, who was directing insults at agents. A melee ensued at the front door of the Target store before two people were handcuffed and taken away by agents. Hewson’s C-29 number was visible as he led one of the men away. Both of those arrested were later released.

Hewson was questioned as part of a preliminary injunction hearing in Chicago, where, among other things, he stated (pages 183 and 184) that protesters have the right to shout and even swear at officers as long as they aren’t impeding their ability to carry out their work. He also said during questioning that tear gas “doesn’t harm people” (page 189). Multiple individuals who were impacted by the release of gas and chemical irritants in Chicago stated otherwise in incidents detailed in Judge Ellis’ ruling. 

When reached on the phone by CalMatters, Hewson said he could not comment. DHS did not respond to questions posed about the actions of Hewson detailed in this report or the agency’s use-of-force policies.  

El Paso Agents

Hewson was present and visible in footage when ex-Border Patrol Commander at Large Bovino appeared to push and manhandle a protester who crossed his path on Nicollet Avenue in Minneapolis. 

Also beside Bovino and Hewson that day were two officers based out of El Paso bearing the ID numbers EZ-2 and EZ-17. Both of these agents are seen wearing vests of the Border Patrol Tactical Division (BORTAC), a specialised unit that, according to the CBP, has a selection process “designed to mirror aspects of the US Special Operations Forces’ selection courses”. 

Bellingcat and Evident Media previously reported how EZ-17 fired less lethal munitions at protesters from close range a day after Renee Good was shot and killed by an Immigration and Customs Enforcement (ICE) officer in Minneapolis.

EZ-17 was accompanied during that incident by EZ-2, who could be seen spraying a chemical irritant in the face of a man who appeared to have thrown a snowball at him. EZ-2 was also seen throwing two female protesters to the ground outside Roosevelt High School in Minneapolis on Jan. 7. 

Both EZ-17 and EZ-2 were present in Chicago. EZ-17 was seen passing a tear gas canister to Bovino at an incident in the city’s Little Village neighbourhood on Oct. 23. 

The Chicago publication, Unraveled, previously identified EZ-17 as Edgar Vazquez and EZ-2 as Michael Sveum. Bellingcat was able to corroborate these identifications using similar techniques. Firstly, for Vazquez we compared images on his Facebook page with footage from EZ-2’s bodycam, which showed Vazquez inside a vehicle without a mask.

EZ-2 was identified in a similar manner. Bodycam footage from EZ-2 showed him looking at his phone. On the lockscreen was a picture of a man smiling and wearing a blue jacket. That same picture was posted on Sveum’s social media accounts and appeared to have been taken at an ultramarathon event whose organisers posted Sveum’s name alongside that same image.

When reached by phone by CalMatters reporters, Vazquez said that he could not comment. Sveum hung up immediately after CalMatters’ reporter introduced himself. DHS did not respond to questions posed about the actions of Vazquez or Sveum detailed in this report or the agency’s use-of-force policies.   

Dozens of other incidents where agents appeared to escalate rather than de-escalate situations, as well as use force or less lethal munitions, were logged as part of this investigation. This included agents pointing guns at protesters (see here and here) as well as using violent force and less lethal munitions on protesters, journalists and bystanders.

Bovino himself appeared to instigate confrontations with people, such as in Chicago, when he can be seen throwing a man to the ground before agents pounce on him, although he stated during his Illinois deposition that he did not think such actions represented a use-of-force incident. 

The former Border Patrol Commander at Large told CalMatters that he could not speak to the media without DHS approval prior to publication of this story. Requests sent to DHS to speak with Bovino went unanswered.

‘Unusual and Beyond the Pale’

According to John Roth, a former DHS Inspector General, and Steve Burnell, a former DHS General Counsel, the events of the past year, involving masked agents descending on select cities, have eroded trust and credibility in DHS and law enforcement.

While both agreed that there had to be professional immigration enforcement operations, they said that has to be done in a way that is responsible and ensures accountability when lines are crossed. 

“This is sort of a scary Orwellian thing”, Roth said. “I don’t think the public understands how unusual and beyond the pale it is to have these roving sort of groups of masked agents, out there handling the public.”

Burnell said that the inability to identify agents carrying out their work as enforcement officers was a particular concern: “At the end of the day, ICE and everybody at DHS are public servants. They’re supposed to be working for the public. And, you know, if somebody is working for you, you should have a right to know who they are, and you should have a right to hold them accountable and protest what they’re doing.”

Roth and Burnell both served under President Barack Obama and during President Donald Trump’s first term. The pair have testified to Congress in recent months, raising the alarm about what they see as a dismantling of accountability at DHS. Prominent members of the US government, including President Trump, have offered repeated support to Border Patrol agents, even after the death of protesters such as Renee Good.

Our partners at Evident and CalMatters showed Roth and Burnell some of the footage described in this report. While they refrained from commenting on individual incidents, Roth described the footage generally as “difficult to watch”.

“The question I’d ask. Have [agents] inserted themselves into something that requires them to use force,” said Roth. “In which case that would be a violation of DHS policy,” he added, referring to use-of-force policies that detail how law enforcement officers may use force when no “reasonably, safe and feasible alternative appears to exist”.

“It’s actually DHS policy that you [are required] to attempt to de-escalate when that’s possible. I mean, they don’t have a duty to retreat, but they do have a duty not to insert themselves into a place where use of force is necessary,” Roth said.

Burnell described a lot of what has happened over the past year as a type of “dominance display”.

“It’s there to send a message. And that is not de-escalatory. It’s the opposite,” he said.

Bellingcat, CalMatters and Evident Media jointly sought to contact DHS as well as all of the agents mentioned in this story prior to publication. 

We asked DHS whether any of the incidents detailed in this report violated DHS use-of-force policies or whether those policies had been updated under the current administration. 

We also asked if DHS was taking any action or providing further training to agents to ensure the public’s constitutional rights are respected during immigration enforcement operations carried out by Border Patrol.

DHS did not respond before publication.

---

Youri van der Weide, Kolina Koltai and Eoghan Macguire from Bellingcat, as well as Sergio Olmos from CalMatters and Kevin Clancy from Evident Media, contributed reporting to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Agents of Chaos: Unpacking the Actions of Border Patrol Agents Across the US appeared first on bellingcat.

ShinyHunters claims it stole up to 1 petabyte of data from Telus Digital, including support recordings, code, and employee records after a breach.

Canada has a choice to make about its artificial intelligence future. The Carney administration is investing $2-billion over five years in its Sovereign AI Compute Strategy. Will any value generated by “sovereign AI” be captured in Canada, making a difference in the lives of Canadians, or is this just a passthrough to investment in American Big Tech?

Forcing the question is OpenAI, the company behind ChatGPT, which has been pushing an “OpenAI for Countries” initiative. It is not the only one eyeing its share of the $2-billion, but it appears to be the most aggressive. OpenAI’s top lobbyist in the region has met with Ottawa officials, including Artificial Intelligence Minister Evan Solomon...

The post Canada Needs Nationalized, Public AI appeared first on Security Boulevard.

Canada has a choice to make about its artificial intelligence future. The Carney administration is investing $2-billion over five years in its Sovereign AI Compute Strategy. Will any value generated by “sovereign AI” be captured in Canada, making a difference in the lives of Canadians, or is this just a passthrough to investment in American Big Tech?

Forcing the question is OpenAI, the company behind ChatGPT, which has been pushing an “OpenAI for Countries” initiative. It is not the only one eyeing its share of the $2-billion, but it appears to be the most aggressive. OpenAI’s top lobbyist in the region has met with Ottawa officials, including Artificial Intelligence Minister Evan Solomon.

All the while, OpenAI was less than open. The company had flagged the Tumbler Ridge, B.C., shooter’s ChatGPT interactions, which included gun-violence chats. Employees wanted to alert law enforcement but were rebuffed. Maybe there is a discussion to be had about users’ privacy. But even after the shooting, the OpenAI representative who met with the B.C. government said nothing.

When tech billionaires and corporations steer AI development, the resultant AI reflects their interests rather than those of the general public or ordinary consumers. Only after the meeting with the B.C. government did OpenAI alert law enforcement. Had it not been for the Wall Street Journal’s reporting, the public would not have known about this at all.

Moreover, OpenAI for Countries is explicitly described by the company as an initiative “in co-ordination with the U.S. government.” And it’s not just OpenAI: all the AI giants are for-profit American companies, operating in their private interests, and subject to United States law and increasingly bowing to U.S. President Donald Trump. Moving data centres into Canada under a proposal like OpenAI’s doesn’t change that. The current geopolitical reality means Canada should not be dependent on U.S. tech firms for essential services such as cloud computing and AI.

While there are Canadian AI companies, they remain for-profit enterprises, their interests not necessarily aligned with our collective good. The only real alternative is to be bold and invest in a wholly Canadian public AI: an AI model built and funded by Canada for Canadians, as public infrastructure. This would give Canadians access to the myriad of benefits from AI without having to depend on the U.S. or other countries. It would mean Canadian universities and public agencies building and operating AI models optimized not for global scale and corporate profit, but for practical use by Canadians.

Imagine AI embedded into health care, triaging radiology scans, flagging early cancer risks and assisting doctors with paperwork. Imagine an AI tutor trained on provincial curriculums, giving personalized coaching. Imagine systems that analyze job vacancies and sectoral and wage trends, then automatically match job seekers to government programs. Imagine using AI to optimize transit schedules, energy grids and zoning analysis. Imagine court processes, corporate decisions and customer service all sped up by AI.

We are already on our way to having AI become an inextricable part of society. To ensure stability and prosperity for this country, Canadian users and developers must be able to turn to AI models built, controlled, and operated publicly in Canada instead of building on corporate platforms, American or otherwise.

Switzerland has shown this to be possible. With funding from the federal government, a consortium of academic institutions—ETH Zurich, EPFL, and the Swiss National Supercomputing Centre—released the world’s most powerful and fully realized public AI model, Apertus, last September. Apertus leveraged renewable hydropower and existing Swiss scientific computing infrastructure. It also used no illegally pirated copyrighted material or poorly paid labour extracted from the Global South during training. The model’s performance stands at roughly a year or two behind the major corporate offerings, but that is more than adequate for the vast majority of applications. And it’s free for anyone to use and build on.

The significance of Apertus is more than technical. It demonstrates an alternative ownership structure for AI technology, one that allocates both decision-making authority and value to national public institutions rather than foreign corporations. This vision represents precisely the paradigm shift Canada should embrace: AI as public infrastructure, like systems for transportation, water, or electricity, rather than private commodity.

Apertus also demonstrates a far more sustainable economic framework for AI. Switzerland spent a tiny fraction of the billions of dollars that corporate AI labs invest annually, demonstrating that the frequent training runs with astronomical price tags pursued by tech companies are not actually necessary for practical AI development. They focused on making something broadly useful rather than bleeding edge—trying dubiously to create “superintelligence,” as with Silicon Valley—so they created a smaller model at much lower cost. Apertus’s training was at a scale (70 billion parameters) perhaps two orders of magnitude lower than the largest Big Tech offerings.

An ecosystem is now being developed on top of Apertus, using the model as a public good to power chatbots for free consumer use and to provide a development platform for companies prioritizing responsible AI use, and rigorous compliance with laws like the EU AI Act. Instead of routing queries from those users to Big Tech infrastructure, Apertus is deployed to data centres across national AI and computing initiatives of Switzerland, Australia, Germany, and Singapore and other partners.

The case for public AI rests on both democratic principles and practical benefits. Public AI systems can incorporate mechanisms for genuine public input and democratic oversight on critical ethical questions: how to handle copyrighted works in training data, how to mitigate bias, how to distribute access when demand outstrips capacity, and how to license use for sensitive applications like policing or medicine. Or how to handle a situation such as that of the Tumbler Ridge shooter. These decisions will profoundly shape society as AI becomes more pervasive, yet corporate AI makes them in secret.

By contrast, public AI developed by transparent, accountable agencies would allow democratic processes and political oversight to govern how these powerful systems function.

Canada already has many of the building blocks for public AI. The country has world-class AI research institutions, including the Vector Institute, Mila, and CIFAR, which pioneered much of the deep learning revolution. Canada’s $2-billion Sovereign AI Compute Strategy provides substantial funding.

What’s needed now is a reorientation away from viewing this as an opportunity to attract private capital, and toward a fully open public AI model.

This essay was written with Nathan E. Sanders, and originally appeared in The Globe and Mail.

EDITED TO ADD (3/16): Slashdot thread.

US President Donald Trump said on January 2 that the US was “locked and loaded and ready to go”. Trump was talking aloud about intervening in Iran if it continued a violent crackdown on demonstrators who had taken to the streets over spiralling inflation and ongoing repression. 

Thousands of Iranian’s were reported to have been killed by state security forces in just under a month. According to Amnesty International, the Islamic Revolutionary Guard Corps (IRGC), the Basij plainclothes militia, police forces and other plain-clothed agents carried out the deadliest violence against protesters in decades.

On Saturday, February 28, the United States and Israel launched a large-scale attack against Iran, killing Supreme Leader Ayatollah Ali Khamenei and targeting military infrastructure throughout the country. President Trump initially told Iranians they should seize control of the government but on Tuesday this week said: “If you’re going to go out and protest, don’t do it yet. It’s very dangerous out there. A lot of bombs are being dropped.” Almost 800 Iranians have been killed in US and Israeli strikes so far, according to the Iranian Red Crescent. 

While the US has released a list of military targets, including IRGC headquarters and missile systems, Bellingcat has reviewed strikes against another type of target inside the Islamic Republic — police stations.

Experts told the New York Times that strikes against these facilities may be part of an effort to motivate Iranians to challenge the regime, although satellite analysis alone doesn’t allow us to tell if it is the US, Israel or both nations who have targeted police stations.

Mapping Targeted Police Stations

Using medium-resolution PlanetScope satellite imagery from Planet Labs, Bellingcat has been able to locate at least 15 local police stations or similar buildings that were struck between March 1 and March 3. Videos and photos shared on social media also show the aftermath of some of these strikes.

Comparing the March 1 PlanetScope satellite imagery with imagery taken on March 3, it’s possible to make out visible signs of building destruction throughout Tehran. Some of these sites have already been widely-reported on, including the strike on Supreme Leader Ali Khamenei’s compound and official residence.

But Bellingcat reviewed damage to a number of smaller buildings throughout Tehran and cross-referenced the locations with data on Google Maps, Open Street Maps and Wikimapia where we found that several were listed as police stations. The majority of sites we identified are in dense urban areas. 

Video shared by Iranian state broadcaster Tasnim News showed the aftermath of a strike on what it describes as a “diplomatic police station” near Ferdowsi Square — one of downtown Tehran’s main intersections. Another video taken at the same location shows at least two people on the ground with a large amount of damage to nearby buildings. Geolocation of the videos puts them at 35.7032, 51.4189, adjacent to a school and office buildings. 

Another video, geolocated by a volunteer with Geoconfirmed — a volunteer geolocation collective — shows a heavily damaged police station near Tehran’s Grand Bazaar. PlanetScope imagery from March 3 shows heavy damage to the area around the police station.

Photos and video from the Golestan Palace, a UNESCO World Heritage Site that sits adjacent to the police office, shows that it also sustained damage.

Iran’s Police and Law Enforcement

Iran’s security apparatus includes a network of police, plain clothes officers, civilian militia battalions known as Basij and the Islamic Revolutionary Guard Corps. During recent protests security forces were seen shooting protestors on the streets, and many of those killed showed signs of being shot in the head.

Iran has experienced several waves of anti-regime protests over the past 15 years, all of which have been put down by the authorities who have not shied away from using extreme violence to contain them.

Although the Financial Times reported speaking to a Tehran resident that said one of the police stations we identified, in the Gisha neighborhood, had hosted a branch of Iran’s morality police, it is thus far unclear from the satellite data whether any of the police stations had any particular role during the recent protests.

---

Trevor Ball, Logan Williams and Felix Matteo Lommerse contributed reporting to this piece for Bellingcat. Anisa Shabir and Stéphanie Ladel contributed from Bellingcat’s Volunteer Community.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Satellite Imagery Reveals Strikes on Iranian Police Stations appeared first on bellingcat.

The United States and Israel launched an attack on Iran on Saturday morning, killing Supreme Leader Ayatollah Ali Khamenei as well as several senior regime figures and striking multiple sites across the country. Iran retaliated by firing at targets across the region, including Israel, Bahrain, Qatar, the UAE and other Gulf states. The conflict is ongoing despite no declaration of war by the US Congress. US President Donald Trump initially called for regime change in Iran but has since delivered a mixed message about the aims of “Operation Epic Fury”.

Israel has said it dropped more than 2,000 bombs in the first 30 hours of the war. While the US claims to have struck over 1,000 targets in the first 24 hours, with President Trump stating that “bombs will fall everywhere”. In response, Iran is reported to have launched at least 390 missiles and 830 drones in the first two days.
Bellingcat has been monitoring strikes across the region, including those that caused civilian harm, and identified a wide variety of weapons have been used so far, including missiles and drones.

US-Made Weapons and Tomahawks Launched

The US reported that some of the first weapons they launched were Tomahawk missiles. Footage from the US McFaul also showed Tomahawks being launched.

There is also reporting that a new variant of the Tomahawk was used in these strikes.

Imagery of many other different munitions used by the US, Israel and Iran have appeared on social media. 

This article covers some of the munitions Bellingcat has seen imagery of as the war enters its fourth day.

Many of the weapons used so far have also been deployed in other recent US conflicts, including the 12-day Israel-Iran war, and US strikes in Yemen and Venezuela. 

The US is the major supplier of arms to allies in the region, including for Israel, Kuwait, Qatar, UAE, and Jordan.

On Sunday, the US Department Of Defence (DOD) published photos showing weapons being prepared for loading on aircrafts, including the MK-80 series of bombs like MK-82 500-pound bombs, and BLU-109 2,000-pound ‘bunker busters’ equipped with Joint Direct Attack Munition (JDAM) bomb guidance kits.

The DOD has also released several photos showing the C variants of the AGM-154 Joint Standoff Weapon (JSOW). As documented by the Open Source Munitions Portal, this weapon has been used recently by the US in Yemen and Venezuela.

The DOD also released a slideshow showing images from the first 24 hours of the war, including an image showing the first combat use of the Precision Strike Missile. The DOD further released a list of some equipment used, including the THAAD ballistic missile defense system.

Many of the weapons deployed by the US have also been used by Israel. This includes the MK-80 series of bombs, BLU-109 bombs and Joint Direct Attack Munition (JDAM) bomb guidance kits.

Israel also produces some of its own munitions, which they released video or photos of since the start of the conflict, including MK-83 1,000-pound bombs equipped with Israeli SPICE-1000 bomb guidance kits.

Israel also produces RAMPAGE missiles, visible in the image below. 

On Sunday, the DOD said they had used the Low-cost Unmanned Combat Attack System (LUCAS) one-way attack drones in strikes. The LUCAS drone is a US copy of the Iranian Shahed one-way attack drone.

A video of a crashed LUCAS drone has subsequently appeared online, reportedly in Iraq. 

While Bellingcat could not geolocate this video, then men seen in the footage can be heard speaking Arabic while US CENTCOM has said that this is the first time they have used this drone in combat.

Local Iraqi residents are taking the newly deployed, nearly intact American LUCAS drone for themselves. pic.twitter.com/fbx411iAYU

— Special Kherson Cat (@bayraktar_1love) March 2, 2026

A video shows a LUCAS drone that allegedly crashed in Iraq.

Iranian Attacks

Iran has retaliated by firing one-way attack drones, including Shahed variants, and missiles at Israel, and US-bases in various countries across the region, including UAE, Qatar, Kuwait, Jordan and Iraq. 

Iranian Shahed drones have hit civilian buildings in the Gulf, as well as US military bases.

Palm Jumeirah in Dubai was attacked by Shahed kamikaze drones.

[image or embed]

— Special Kherson Cat (@specialkhersoncat.bsky.social) 28 February 2026 at 15:37

A Shahed drone crashes into a hotel in Dubai on Feb. 28.

In Bahrain, a Shahed was seen crashing into a residential building on Feb. 28.

Virtually a first person view of the Iranian drone hitting the high-rise building in Manamah, Bahrain.

[image or embed]

— (((Tendar))) (@tendar.bsky.social) 28 February 2026 at 18:57

A Feb. 28. video shows a Shahed drone hitting a residential tower in Bahrain.

Many missiles have a booster, a rocket motor that detaches from the missile after it is expended. These boosters fall to the ground under the flight path of the missile. 

Bellingcat verified that Iranian missile boosters have fallen in nearby countries caught in the crossfire, including Qatar and Jordan (see below post geolocated to Al-Hashmi St. in Irbid, Jordan), while some Israeli boosters have reportedly fallen in Iraq.

اهلنا في اربد الله يحميكم pic.twitter.com/LvHWgicE4F

— فواز الذياب (@FawazElziyab) February 28, 2026

A Feb. 28. post shows an Iranian ballistic missile booster that fell on Al-Hashmi St. in Irbid, Jordan.

Iranian Missiles Intercepted

The US and Israel, as well as several Gulf countries, have fired missiles, intended to destroy Iranian missiles or drones in the air before they reach their targets. Many Iranian weapons have been intercepted, but others have successfully hit, including in a strike on a US command post in Kuwait, killing six US troops.  

Most ballistic missile interceptors are “hit-to-kill” where they are designed to destroy missiles by the impact. These interceptors have their own components that fall to the ground, as well as the debris from interceptions.

Remnants of Patriot Interceptor missiles, which are operated by the US and several Gulf countries, have been seen, and countries including the UAE have reported they have intercepted missiles. The UAE has claimed that 165 missiles and 541 drones were fired at the country, most were intercepted.  

A Sea of Unverified Images and Misidentification of Munitions

Many close-up images of munition debris have been posted on social media over recent days which are difficult to geolocate. While we have not been able to verify the location of these munitions, we used reverse image search tools to verify they had not been posted online prior to the current conflict. The munition remnants are also consistent with those used by the US, Israel and Iran. But as we cannot geolocate or chronolocate them yet, we cannot fully verify them. Many of these images have been posted with false claims about the object and who fired it.

Despite Bellingcat being unable to fully verify them, we are including a selection of them with accurate identifications, due to the likelihood that more images of these same objects will continue to appear online as the war continues.

One example of incorrectly identified munitions, is the below picture of an aircraft’s external fuel tank, or drop tank that was posted on Telegram on March 1 alongside the claim that it is an Israeli missile.

A Mar. 1. image shows a drop tank from an Israeli jet reportedly found in Anbar, Iraq. Source: NAYA.

Drop tanks are used on jets to extend the range and are jettisoned after use, resulting in these tanks falling to the ground. These tanks have been mistaken for missile parts in previous conflicts.

Despite Iran’s prevalent use of missiles, not all missile boosters are Iranian. On February 28 missile boosters from Israeli air-launched ballistic missiles were reportedly found just east of Tikrit, Iraq. The below image shows the booster from Israel’s Blue Sparrow series, and can be matched to images previously identified and posted on the likes of the Open Source Munitions Portal.

A short while ago, a missile landed near Duraji village in the Dauda area of the Khurmatu district.#Isreal #Iran pic.twitter.com/qzZLNUgekD

— Sarwan Wllatzheri (@SarwanBarzani_) February 28, 2026

A Feb. 28. post shows an Israeli Blue Sparrow series missile booster, reportedly found in Duraji, Iraq.

Additionally, unexploded WDU-36/B warheads from Tomahawk missiles were reportedly found –, one in Kirkuk, Iraq and one found near Jablah, Syria. Tomahawk warheads and other remnants are frequently misidentified, often as drones.

These titanium cased warheads comprise a small part of the much larger Tomahawk missile, and have been found intact in numerous countries when the warhead has failed to explode, as seen in images shared on the Open Source Munitions Portal. 

Unexploded Tomahawk warheads from strikes in other conflicts have also been identified by the Open Source Munitions Portal .

Remnants of an Israeli Arrow 2 interceptor missile were posted online, falsely identified as an Iranian missile, and were allegedly found in eastern Syria.  These images could again be matched to those found from previous conflicts on the Open Source Munitions Portal.

An Iranian missile fell in Al-Shoula area, south of DeirEzzor eastern Syria!. pic.twitter.com/TsWVuda2nf

— Omar Abu Layla (@OALD24) March 1, 2026

A Israeli Arrow 2 interceptor missile falsely identified as as an Iranian missile in a post on X.

An Ancient US Munition Used by Iran

One photo of a remnant reportedly found in Ahvaz, Iran, included a false claim that it was a US ATACMS missile. Bellingcat was able to confirm the image does not match ATACMS construction by comparing it to imagery of that munition. We have as yet been unable to confirm if it was indeed located in Ahvaz, Iran – although we were able to identify the munition.

U.S. ATACMS tactical ballistic missile remains found in Ahvaz, Iran.@Osinttechnical pic.twitter.com/plytSUI4w6

— Open Source Intel (@Osint613) March 1, 2026

An actuator section of a MIM-23 HAWK missile, falsely identified by the post above as an ATACMS missile.

The markings on the remnant include an  “FSN” or federal stock number, that can be looked up to identify the item. The FSN was replaced by the national stock number (NSN) in 1974, meaning this missile was produced prior to 1974.

Bellingcat looked up the  FSN/NSN (1410002343266) which corresponds with the US manufactured MIM-23B HAWK, an air defence missile. 

There are many other US, Israeli and Iranian munitions that may have been used in the current conflict, but images have not yet appeared on social media.

With fresh strikes carried out overnight/ early Tuesday and President Trump saying that “likely more” US troops will die, the conflict continues to escalate and shows no sign of ceasing in the days ahead. And despite the death of Ayatollah Ali Khamenei the Iranian regime has vowed revenge and continued strikes against Israel, the US and their Gulf allies.

---

Bellingcat’s Carlos Gonzales, Jake Godin and Felix Matteo Lommerse contributed research to this article. Anisa Shabir from Bellingcat’s Volunteer Community also contributed to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post “Bombs will fall Everywhere”: The American, Israeli and Iranian Weapons Being Deployed in Middle East appeared first on bellingcat.

ASEC Blog publishes Ransom & Dark Web Issues Week 3, Fabruary 2026           Anubis and The Gentlemen launch ransomware attacks targeting a South Korean plastics manufacturer and an IT consulting company [1], [2] Emergence of the new ransomware group Payload ShinyHunters claims data breach involving a well-known Canadian apparel manufacturer

In the days after the US Department of Justice (DOJ) published 3.5 million pages of documents related to the late sex offender Jeffrey Epstein, multiple users on X have asked Grok to “unblur” or remove the black boxes covering the faces of children and women in images that were meant to protect their privacy. 

While some survivors of Epstein’s abuse have chosen to identify themselves, many more have never come forward. In a joint statement, 18 of the survivors condemned the release of the files, which they said exposed the names and identifying information of survivors “while the men who abused us remain hidden and protected”. 

After the latest release of documents on Jan. 30 under the Epstein Files Transparency Act, thousands of documents had to be taken down because of flawed redactions that lawyers for the victims said compromised the names and faces of nearly 100 survivors. 

But X users are trying to undo the redactions on even the images of people whose faces were correctly redacted. By searching for terms such as “unblur” and “epstein” with the “@grok” handle, Bellingcat found more than 20 different photos and one video that multiple users were trying to unredact using Grok. These included photos showing the visible bodies of children or young women, with their faces covered by black boxes. There may be other such requests on the platform that were not picked up in our searches.

The images appeared to show several children and women with Jeffrey Epstein as well as other high-profile figures implicated in the files, including the UK’s Prince Andrew, former US President Bill Clinton, Microsoft co-founder Bill Gates and director Brett Ratner, in various locations such as inside a plane and at a swimming pool.

From Jan. 30 to Feb. 5, we reviewed 31 separate requests from users for Grok to “unblur” or identify the women and children from these images. Grok noted in responses to questions or requests by some users that the faces of minors in the files were blurred to protect their privacy “as per standard practices in sensitive images from the Epstein files”, and said it could not unblur or identify them. However, it still generated images in response to 27 of the requests that we reviewed. 

We are not linking to these posts to prevent amplification.

The generations created by Grok ranged in quality from believable to comically bad, such as a baby’s face on a young girl’s body. Some of these posts have garnered millions of views on X, where users are monetarily incentivised to create high-engagement content.

Of the four requests we found during this period that Grok did not generate images in response to, it did not respond to one request at all. In response to another request, Grok said deblurring or editing images was outside its abilities, and noted that photos from recent Epstein file releases were redacted for privacy. 

The other two requests appeared to have been made by non-premium users, with the chatbot responding: “Image generation and editing are currently limited to verified Premium subscribers”. X has limited some of Grok’s image generation capabilities to paid subscribers since January amid an ongoing controversy over users using the AI chatbot to digitally “undress” women and children. 

View this post on Instagram

A post shared by Bellingcat (@bellingcatofficial)

X did not respond to multiple requests for comment. 

However, shortly after we first reached out to X on Feb. 6, we noticed that more guardrails appeared to have been put in place. Out of 16 requests from users between Feb. 7 to Feb. 9, which we found using similar search terms as before, Grok did not attempt to unredact any of the images. 

In most cases, Grok did not respond at all (14), while in two cases, Grok generated AI images that were completely different from the images uploaded in the user’s original request. 

When a user commented on one of these requests that Grok was no longer working, Grok responded: “I’m still operational! Regarding the request to unblur the face in that Epstein photo: It’s from recently released DOJ files where identities of minors are redacted for privacy. I can’t unblur or identify them, as it’s ethically and legally protected. For more, check official sources like the DOJ releases.”

As of publication, X had not responded to Bellingcat’s subsequent query about whether new guardrails had been put in place over the weekend.

Fabricated Images

This is not the first time AI has been used to fabricate images related to Epstein file releases. Some images that were shared on X, which appeared to show Epstein alongside famous figures such as US President Donald Trump and New York City mayor Zohran Mamdani as a child with his mother, were reportedly AI-generated. Some of the individuals shown in the false images, such as Trump, do appear in authentic photos, which can be viewed on the DOJ website.

X users also previously used Grok to generate images in relation to recent killings in Minnesota by federal agents. 

For example, some users asked Grok to try to “unmask” the federal agent who killed Renee Good, resulting in a completely fabricated face of a man that did not look like the actual agent, Jonathan Ross, and a false accusation of a man who had nothing to do with the shooting.

Bellingcat’s Director of Research and Training @giancarlofiorella.bsky.social appeared on CTV yesterday to discuss the misleading AI-generated images that were used to falsely identify ICE agents and weapons at the centre of the two fatal shootings in Minneapolis youtu.be/mL7Fbp3UrSo?…

[image or embed]

— Bellingcat (@bellingcat.com) 5 February 2026 at 09:36

After Alex Pretti was shot and killed by federal agents in Minneapolis, people used AI to edit video stills, resulting in AI images that showed a completely different gun than the one actually owned by Pretti. In another instance, an AI-edited image of Pretti’s shooting falsely depicted the intensive care unit nurse holding a gun instead of his sunglasses. 

Grok has also been at the centre of a controversy for generating sexually explicit content.

On Twitter/X, users have figured out prompts to get Grok (their built in AI) to generate images of women in bikinis, lingerie, and the like. What an absolute oversight, yet totally expected from a platform like Twitter/X. I’ve tried to blur a few examples of it below.

[image or embed]

— Kolina Koltai (@koltai.bsky.social) 6 May 2025 at 03:20

Multiple countries including the UK and France have launched investigations into Elon Musk’s chatbot over reports of people using it to generate deepfake non-consensual sexual images, including child sexual abuse imagery. Malaysia and Indonesia have also blocked Grok over concerns about deepfake pornographic content. 

One analysis by the Center for Countering Digital Hate found that Grok had publicly generated around three million sexualised images, including 23,000 of children, in 11 days from Dec. 29, 2025 to Jan. 8 this year. X’s initial response, in January, was to limit some image generation and editing features to only paid subscribers. However, this has been widely criticised as inadequate, including by UK Prime Minister Keir Starmer, who said it “simply turns an AI feature that allows the creation of unlawful images into a premium service”. The social media platform has since announced new measures to block all users, including paid subscribers, from using Grok via X to edit images of real people in revealing clothing such as bikinis.

---

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Epstein Files: X Users Are Asking Grok to ‘Unblur’ Photos of Children appeared first on bellingcat.

To stay up to date on our latest investigations, join Bellingcat’s WhatsApp channel here

On January 24, Alex Pretti, a 37-year-old intensive care unit nurse at the Minneapolis Veterans Affairs Health Care System, was shot and killed by federal agents on Nicollet Avenue in Minneapolis, Minnesota. The shooting comes just over two weeks after Renee Good was shot and killed by a federal agent in the same city. 

The United States Department of Homeland Security claimed Pretti was killed after an “armed struggle” with DHS officers and that it seemed he had wanted to “do maximum damage”. Yet video footage shared online, showing shortly before and during the incident, appears to contradict that claim.

Some of the earliest available footage of the encounter was posted to Instagram and shows an agent crossing the street to talk to Pretti who appears to be filming with his phone, which he is holding in his right hand. According to DHS, agents were conducting an immigration arrest in the area. 

The agent can be seen placing his hand on Pretti’s torso to push him back and away from the middle of the road towards the sidewalk. 

Another video shared on Reddit shows what happened after this initial contact, as well as the lead-up to the shooting. Pretti appears to put himself between two women after they were both shoved by a DHS agent. He is holding a cellphone, held sideways in his right hand.

An agent can then be seen spraying Pretti with a substance from a canister, and continuing to spray him as he turns his back to him. At least five additional federal agents approach and attempt to force Pretti to the ground while one appears to strike him with a spray can. 

Twenty-five seconds after Pretti is first sprayed, a shot is heard followed by nine more shots in the span of about six seconds. Additional video from the scene shows Pretti lying motionless on the ground.

Video Analysis

Bellingcat further analysed the Reddit video, a separate video posted to Facebook and others taken at the scene to break down the key moments of the shooting, splicing them together (see Bluesky post below) to view in more granular detail.

We’ve placed the available videos of the shooting of Alex Pretti by federal agents in Minneapolis today into the same synchronised timeline and are continuing to analyse further.

[image or embed]

— Bellingcat (@bellingcat.com) 24 January 2026 at 20:39

Closer inspection of the videos shows that an agent appears to remove a weapon from the melee before the first shots are fired. 

In both the Reddit and Facebook video, a federal agent wearing a grey jacket can be seen approaching federal agents who are on top of and struggling with Pretti. Notably, the agent’s hands are empty as he approaches. He can be seen reaching into and rummaging amid the bodies. About twelve seconds later, he is seen carrying a handgun away from the scene. 

Another video, also posted to Reddit, shows the agent removing a gun from a holster in Pretti’s waistband before he is shot.

Several aspects of the gun the federal agent is seen moving away with appear to match the gun DHS claim belonged to Pretti (and which they posted to X), a Sig Sauer P320, chambered in 9mm. Some posts online mistakenly claimed the photo of the gun was old due to a misunderstanding of Google Reverse Image Search.

While some law enforcement agencies issue Sig Sauer P320 guns to their agents, the gun that DHS claims Pretti had is customized, and visually distinct from those that are standard issue. 

These distinct features include a white pistol grip, black pistol frame, brown slide, and a red dot sight mounted atop the slide. The red dot sight and these various colours are visible on the gun the federal agent is seen leaving with.

Before the agent who takes the gun leaves the scene, it appears someone shouts “gun”, as can be heard in this video that was posted to X, and another video posted to Reddit. 

This Reddit video also shows that almost immediately after the agent in the grey jacket leaves with the gun, a single gunshot can be heard, followed by nine other shots.

Slowing it down, the same video shows that as the federal agent in the grey jacket removes Pretti’s gun, an agent in a black beanie, who appears to have a line of sight on the gun being removed, begins to draw his own weapon. As soon as the agent in the grey jacket moves away with the gun and leaves, the agent in the black beanie steps to where the agent in the grey jacket had been with his finger on the trigger and fires the first shot. 

Two agents appear to fire their weapons from the footage available, one wearing a black beanie and another wearing a brown beanie, as can be seen in this video.

At the same time as the first shot is fired, the agent in the grey jacket is leaving with the gun taken from Pretti’s holster. An alternate angle appears shows that the slide of this firearm does not move to the rear. This would indicate that it was not fired. Multiple agents, including the agent in the grey jacket, look towards the man in the black beanie immediately after the first shot. Despite some online speculation, there is as yet no evidence that Pretti’s gun was fired.

Bellingcat synced and slowed three videos to show where the agent in the black beanie, and grey jacket, with both drawn guns are when the first shot occurs. What some commenters have suggested is impact marks appear to be snow, that is visible before any shots occur. 

Three-way video sync and slow+zoom showing the moment of the first shot before Alex Pretti was killed by DHS agents in Minneapolis yesterday. There’s some claims that Pretti’s gun was the source of the first shot after it was taken from him, though in these videos it doesn’t appear that’s the case.

[image or embed]

— Jake Godin (@godin.bsky.social) 25 January 2026 at 18:33

What’s more, the agent with the black beanie’s right arm that was seen holding the gun moves backwards as the first shot is heard, likely due to the recoil from firing.

After firing once, the agent in the black beanie repositions, and then quickly fires three more shots at Pretti’s back at close range while he appears to try to stand up.

In this video, multiple agents are piled on top of Pretti while his hands can be seen in front of him, on the ground. His hands remain in front of him as the agent in the grey jacket recovers the gun and moves away.

Pretti collapses onto the ground after the first shots and the agents back away. A second agent (the one wearing the brown beanie hat) then draws his gun and fires at least one shot. This is the fifth shot that is heard. The agent in the black beanie can be seen and heard firing more shots. Shots five through ten all fired at Pretti’s motionless body.

The agents can be seen from another angle, with the agent in the black beanie visibly firing into Pretti’s motionless body.

A video taken shortly after the shooting shows two agents searching Pretti’s body with one appearing to be heard asking: “Where’s the gun?”.

Bellingcat contacted the Department of Homeland Security to ask why Pretti was shot and killed and whether he was in possession of his gun when the first shots were fired.

DHS did not respond by time of publication.

DHS and CBP statements have so far only stated that one agent fired shots, identifying them as an eight year veteran of Customs and Border Patrol who fired “defensive shots”. It is not known which of the two agents who appeared to fire shots in the videos analysed by Bellingcat is an eight year veteran of CBP. 

Border Patrol Commander Greg Bovino, on CNN the day after the shooting, when shown video of the gun being removed before the shooting and asked why border patrol agents shot an unarmed man said, “You don’t know he was unarmed. I don’t know he was unarmed.” Deputy Attorney General Todd Blanche, when asked if Pretti was unarmed, said on Meet the Press, “I do not know and nobody else knows either, which is why we’re doing an investigation”. 

In the same CNN interview, Bovino also said that “The victims are the Border Patrol agents.” and that “The suspect [Pretti] put himself in that situation.”

Minneapolis Police Chief Brian O’Hara said that Pretti was a legal gun owner with a permit to carry and did not have a criminal record.

---

Jake Godin, Trevor Ball, Kolina Koltai and Carlos Gonzales contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Alex Pretti: Analysing Footage of Minneapolis CBP Shooting appeared first on bellingcat.

This investigation is part of a collaboration between Bellingcat and Evident Media. You can watch Evident’s video here.

The fatal shooting of Renee Nicole Good by Immigration and Customs Enforcement (ICE) agent Jonathan Ross in Minneapolis on Jan. 7 sparked nationwide protests, with often violent clashes breaking out between protesters and federal agents. Some of the most intense protests took place in Minneapolis itself, with an agent using a less-lethal launcher in ways that experts told Bellingcat were “punitive” and “questionable at best”.  

This agent, an elite Border Patrol officer who was masked but identifiable through the uniform number patch EZ-17, was captured on camera firing his B&T GL06 40mm less-lethal launcher at protesters five times in five minutes as he travelled down a street adjacent to where Good was killed.

While “less-lethal” weapons are not designed to kill, they can still result in serious injuries and even death when misused. In California, a protester said he was permanently blinded in one eye after he was shot with a less-lethal weapon at a protest on Jan. 13. Footage shows a DHS officer firing a PepperBall gun at his face at close range, causing him to bleed. 

Last year, a judge in Illinois ordered an injunction limiting federal agents’ use of force in the state due to what she described as aggressive use of force against peaceful protesters that “shocks the conscience”. However, Bellingcat found multiple examples of force and riot control weapons being used during immigration raids and in apparent violation of that order in the weeks immediately after.

Experts told Bellingcat that most of the less-lethal shots fired by EZ-17 after arriving at the site of Good’s shooting with Border Patrol Commander Gregory Bovino on Jan. 7, also appear to breach CBP’s use-of-force policy. 

Bellingcat analysed videos from news outlets and social media and mapped out all five shots the agent fired.

Four of these shots appeared to be aimed directly at protesters’ faces at close range, while a fifth was fired from a distance towards a crowd after tear gas had already been deployed. A sixth shot, captured at another location on the same day, also shows EZ-17 firing a shot from the same launcher at someone at head-level.

As of publication, DHS had not responded to Bellingcat’s requests for comment.

The Agent

In footage captured by independent news outlet Mercado Media, EZ-17 is seen inside the crime scene tape perimeter, standing near Bovino, with eight 40mm munitions on his belt. 

These included three sponge-nose impact rounds, which are designed for “pain compliance” through the direct force of impact, and five cylindrical munitions that can be filled with different payloads and chemical irritants. “BLAST” in blue text is visible on one munition, indicating a “Muzzle Blast” munition with a CS gas fill – commonly known as tear gas. At least three additional 40mm munitions are visible in his plate carrier. 

Another video by independent news network Status Coup News showed uninterrupted footage capturing five shots from the time the agent exited the crime scene perimeter (at 5:02) shortly before firing the first shot, to when he left in a truck with other agents (9:23) immediately after firing the fifth shot. 

The back of EZ-17’s vest shows that he belongs to CBP’s Border Patrol Tactical Unit (BORTAC). BORTAC is a specialised and highly trained unit that, according to the CBP, has a selection process “designed to mirror aspects of the US Special Operations Forces’ selection courses”. 

Members of BORTAC have regularly accompanied Bovino as he leads Trump’s immigration raids, including EZ-17 and EZ-2, another CBP agent that was frequently seen beside EZ-17 in the footage from Jan. 7. Both agents have continued to accompany Bovino on raids in Minnesota in subsequent days.

EZ-17 was also spotted alongside Bovino at an incident in Illinois, where a CBP agent in front of him appeared to shoot a protester at close range.

First Shot

In the Status Coup Media video, EZ-17, and three other CBP agents, including EZ-2, can be seen leaving the crime scene tape perimeter set up after Good’s death, pushing protesters who are physically blocking them. Snowballs are thrown at the CBP agents. 

EZ-17 and EZ-2 push a man to the ground who is blocking them. The video shows a clear view of his belt, and the eight munitions visible on his arrival at the scene are still loaded at this point.

EZ-17 initially aims at the man he had pushed to the ground, but then turns and aims at the face of another nearby protester who did not appear to be involved in any previous physical contact with the agents. As EZ-17 aims at the face of this protester, the man raises his arms to shield himself before EZ-17 fires. 

The large cloud of chemical irritant appears to disperse from the barrel immediately on firing for this shot as well as the next three shots EZ-17 fires.

This is consistent with the “Muzzle Blast” 40mm munitions produced by Defense Technology, which were seen in images of the agent’s belt.  Defense Technology says in its product specifications for 40mm “Muzzle Blast” munitions that these rounds provide “instantaneous emission” of a chemical agent in the immediate area (30 feet) of the person shooting them. 

Second Shot

Seconds later, after EZ-17 is hit by a snowball, he turns and fires towards the face of a man who is filming in the direction the snowball came from. It is unclear if this man is the intended target or someone else in the crowd behind him. 

Third Shot

The third shot is at a man who was seen on video throwing a snowball that hits EZ-2.

EZ-17 and EZ-2 chase this man, with EZ-2 spraying him in the face with Oleoresin Capsicum (OC) spray, also known as pepper spray or mace. EZ-2, when leaving the perimeter, can be seen carrying a Vexor Professional-branded canister.

Vexor exclusively produces various types of OC spray, and does not list any chemical irritant sprays that do not contain OC on its website. 

The man slowly walks closer to the agents, saying that he has been maced. EZ-17 pushes the man, then aims at the man’s face and fires. 

The seals that keep the chemical irritant inside the 40mm canister before it is fired can be seen hitting the man in this shot, with the smoke surrounding his face.

Fourth Shot

After the third shot, an unmarked white CBP truck turns off the street and tries to drive down an alley. Protestors begin physically blocking the vehicle, throwing snowballs and other objects at it. The windshield gets cracked, and the back window gets broken. EZ-17 and EZ-2 physically push the protesters blocking the truck out of the way, with EZ-2 also deploying what appears to be a canister of OC spray.

A person begins banging on the windows of the truck, and EZ-17 rushes around the truck to fire his launcher towards this person’s face.

University of St. Thomas School of Law professor Rachel Moran, who reviewed the videos at Bellingcat’s request, said that of the six shots we identified as being fired by EZ-17 this one appeared to be “the most reasonably related to carrying out the duty of helping the vehicle evacuate” as the person targeted was “still pounding aggressively” on the vehicle when EZ-17 fired the shot.

Fifth Shot

After EZ-17’s fourth shot, EZ-2 deploys a tear gas grenade, and the CBP truck moves down the alley, away from protesters. 

EZ-17 can be seen reloading next to EZ-2, who is holding a canister that appears to be OC spray, and another CBP agent holding a PepperBall gun.

The CBP agent with the PepperBall gun appears to cross over to the other side of the truck, and EZ-2 appears to begin to enter the vehicle. 

As soon as the back right door on the truck closes, gas from the muzzle can be seen from where EZ-17 was standing. 

This fifth shot appears to be “skip-fired” or aimed towards the ground before ricocheting upwards, at close range, resulting in three visible projectiles going towards the crowd of people, narrowly missing some. 

Although the footage is blurry with the tear gas from the grenade EZ-2 threw still clouding the air, EZ-17 appears to be the only agent who could have fired this: EZ-2 was not armed with a projectile launcher, and PepperBall guns like the one carried by the other CBP agent do not have munitions that release multiple projectiles with a single shot.

Chemical irritant smoke was seen being released by the projectiles from this last shot as it travelled through the air. 

The multiple projectiles are consistent with the 40mm “SKAT Shell” by Defense Technology, which ejects four separate submunitions upon firing, each dispensing chemical irritants. In one of the videos, a SKAT Shell is seen in EZ-17’s belt.

Roosevelt High School

In another video from the same day, EZ-17 was filmed again alongside Bovino when CBP showed up at Roosevelt High School in Minneapolis at dismissal time. 

This video showed EZ-17 again firing his B&T GL06, apparently towards someone’s head, this time someone who threw a snowball at a CBP agent. 

‘Punitive and Unlawful’

Patrick Wilcken, Amnesty International’s Researcher on Military, Security and Policing issues, said that while the overall situation shown in the videos was tense, with “verbal abuse, some shoving/throwing of snowballs and the attempted obstruction of a vehicle”, there did not seem to be any substantial physical threat to the agents that would have justified the use of less-lethal weapons. 

Wilcken, who reviewed the videos of all six shots fired by EZ-17 at Bellingcat’s request, said the actions of agents shown in these videos – pursuing fleeing protesters and in some instances firing at protesters who appeared to be trying to protect themselves – were “punitive and unlawful”. 

CBP’s use-of-force policy states that weapons such as 40mm launchers are only authorised for use against subjects offering “active” or “assaultive” resistance. Similarly, DHS’ use-of-force policy guidance says agents may use force “only when no reasonably effective, safe and feasible alternative appears to exist”, and may only use the level of force “objectively reasonable in light of the facts and circumstances” that they face at the time force is applied.

“Officers should only resort to less lethal weapons when faced by a serious physical violence posing a threat to themselves or others that is not possible to diffuse in any other way,” Wilcken said. “They must exercise force with restraint, to the minimum extent possible while respecting and enabling the right to peaceful assembly.”

University of St. Thomas School of Law professor Rachel Moran agreed that whether the use of less-lethal weapons is justified largely depends on the level of threat or aggression the agent faces from the person targeted. Although she said the fourth shot could be justified in helping the CBP vehicle evacuate, Moran said the justification for the other shots was “questionable at best” based on the footage. 

For example, Moran noted that although the man in the third shot had thrown a snowball at another officer, any threat had dissipated by the time EZ-17 shot him because the man had already run away and clearly had his hands up with nothing in them. “The shot appears to be more retaliatory than defensive”, she said. 

Similarly, for the incident at Roosevelt High School, Moran noted that EZ-17 did not appear to be in any danger from the snowball, as the person who threw it was already retreating before the agent fired.

Moran said that if EZ-17 was carrying a B&T GL06 40mm launcher, he did appear to violate CBP policy by directly aiming at people’s faces.

B&T GL-06 by 草泥马小逼崽子 on Sketchfab

CBP’s use-of-force policy states that agents using munitions launchers, including 40mm launchers “shall not intentionally target the head, neck, groin, spine, or female breast”. However, Bellingcat’s analysis of the six shots fired by EZ-17 showed that he appeared to be aiming at the head of targets in five of these cases. 

Travis Norton, a retired police lieutenant and use-of-force consultant, told Bellingcat that standard training and manufacturer guidance for 40mm launchers recommended aiming at “large muscle groups of the lower body” while avoiding “prohibited target areas” like the head, neck, chest, spine and groin. This helps to reduce the risk of significant injury, Norton said. 

Norton said that 40mm launchers are not intended for random or area fire: “Their use is limited to clearly identified individuals who are engaging in violent or dangerous behaviour and cannot be safely addressed by other means.”

Although he declined to comment on specific incidents based solely on video footage, Norton said that skip-firing – which was used in the fifth shot identified by Bellingcat, and the only shot where a person did not appear to be targeted at head-level – was generally not a standard or recommended practice in most law-enforcement training programs. 

“Because ground conditions, angles, and projectile behaviour are unpredictable, skip-firing reduces accuracy and control and increases the risk of unintended injury,” Norton said. 

---

Pooja Chaudhuri contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Five Shots in Five Minutes: Analysing One Federal Agent’s Use of Less-Lethal Launcher in Minneapolis appeared first on bellingcat.

To stay up to date on our latest investigations, join Bellingcat’s WhatsApp channel here

On Jan. 7 Renee Good, a 37-year-old mother of three, was shot and killed by a federal agent on Portland Avenue in Minneapolis, Minnesota. The incident was captured on several separate videos and spread rapidly on social media. The videos were soon accompanied by competing analysis and narratives as to what had happened.

Bellingcat looked at five videos filmed during the incident, including one apparently from the phone of Jonathan Ross, the ICE agent who shot and killed Good.

While each video alone provides valuable information, the five together provide a fuller picture of the situation as it unfolded.

Synced Overview

One of the ways to visualise the full incident was by tracking the movements of the key players on an overview map, which Bellingcat did shortly after the incident on Jan. 7. 

Using eyewitness video shared by Daniel Suitor on Bluesky we tracked the movements of federal agents at the scene – including Ross as he moved around the street. The video also captured the position and movements of Good’s vehicle before, during and after the shots were fired.

We’ve also updated our animated map of the positions of agents and vehicles during the incident here with new footage published by @cnn.com that shows the shooter closer to a white SUV prior to the shootingbsky.app/profile/bell…

[image or embed]

— Bellingcat (@bellingcat.com) Jan 8, 2026 at 18:38

Close-Up View

Another video, filmed by a bystander and later shared by the Minnesota Reformer, shows a closer view of Ross’ movements in the moments immediately before the shooting. 

In the video, Ross can be seen with his phone in his left hand filming Good before he pulls his gun out of its holster with his right hand. Roughly one second elapses before he fires the first round through Good’s front window. Two more shots follow.

A still from that same video captures Ross as he walks past in the seconds after the shooting. A camera app appears open on his phone.

Agent’s Phone

On Jan. 9, a video filmed by Ross was published on X by a conservative news outlet called Alpha News. 

By syncing this video up with the other four available videos, it was possible to observe more of what occurred, including from Ross’ rough perspective. However, it is important to note that Ross was holding the phone slightly away from his body, so what appears in the video would be marginally different to what would have been his line of sight. 

In the footage, Good can be seen backing up before veering to the right as Ross and the camera move to her left. It is not clear from this footage exactly how close the car came to Ross, as the cellphone points up and away as the vehicle moves forward. Someone can be heard saying “whoa” before gunshots are heard. 

An angle captured from down the street (middle lower right in the synchronised video below and in full view here) – which some have suggested shows Ross being hit by the vehicle – does appear to show the vehicle pass close to the agent as he fires. However, the close-up video shared by the Minnesota Reformer (middle top and in full view here) shows Ross moving out of the way and to the side of the vehicle as he fires.

Another video published by CNN (middle lower left) shows a head-on view of the incident from surveillance footage.

New footage from the ICE agent’s phone who shot at Renee Nicole Good in Minneapolis has emerged, posted by AlphaNews on X. We’ve placed that footage in a synced timeline with the other currently available footage.

[image or embed]

— Bellingcat (@bellingcat.com) Jan 9, 2026 at 21:23

Almost one week after the incident, protests have been held in Minneapolis and other cities in the US. 

US President, Donald Trump, and Department of Homeland Security, Kristi Noem, initially said that Good had tried to run over an ICE officer after blocking the road, labelling her a “domestic terrorist”. However, the Democratic mayor of Minneapolis, Jacob Frey, said that version of events was “garbage” and disproven by the video footage.

On Monday Jan. 12, Noem, told FOX News that more ICE agents would be sent to Minnesota.

Individual links to each of the five videos detailed above can be found here, here, here, here and here.

---

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Analysing Footage of Minneapolis ICE Shooting appeared first on bellingcat.

In the early hours of June 13, Israeli missiles slammed into apartment buildings across the Iranian capital, Tehran. 

By morning, it became apparent that nine men Israel said were closely associated with the country’s nuclear programme were dead. 

Videos posted to social media showed buildings in flames and rescue workers sifting through rubble as they looked for survivors.

Dozens of civilians who lived in the same apartment blocks as those targeted also died in the strikes. In one instance, a 14-storey residential tower completely collapsed.

But this was just the start, the opening shots of what Israel dubbed Operation Rising Lion – a 12-day operation targeting Iranian scientists, nuclear sites, security figures and military capabilities.

While Iran sought to fight back, launching missiles and drones at Israel, the damage and death toll inflicted by Israel was far greater.

On day 10 of the operation, the United States joined with Israel, carrying out strikes on nuclear sites at Fordow, Natanz and Isfahan.

Bellingcat worked with FRONTLINE (PBS), The Washington Post and Evident Media to piece together the events of the 12-day war to try and understand the true impact of the strikes on Iran’s nuclear programme. Iran maintains the programme is peaceful but Israel has long suspected that it is designed to develop nuclear weapons.

FRONTLINE filmmakers were given access to Iran, where they visited the sites of some of the strikes and spoke to neighbours and relatives of those who were killed as well as high-ranking Iranian officials.

The Washington Post also spoke to senior intelligence and military sources involved in Operation Rising Lion, and the filmmakers visited Vienna to speak with the International Atomic Energy Agency (IAEA), the organisation that has been responsible for monitoring Iran’s nuclear programme.

Bellingcat, alongside The Washington Post, analysed open source information such as satellite imagery, social media footage, local media coverage, death notices and cemetery records to understand how the attacks on Iranian scientists unfolded as well as analyse the civilian cost of the conflict.

US viewers can watch the full film below.

Full reporting reporting from The Washington Post on this topic can be found here and seen on FRONTLINE’s YouTube channel, at pbs.org/frontline, on PBS stations and in the PBS App.

---

Trevor Ball, Carlos Gonzales, Sebastian Vandermeersch and Eoghan Macguire reported for Bellingcat. Sebastian Walker and Adam Desiderio reported for PBS Frontline. Nilo Tabrizy and Jarrett Ley reported for The Washington Post.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here and Mastodon here.

The post Investigating the Impact of US-Israeli Strikes on Iran’s Nuclear Programme  appeared first on bellingcat.

To stay up to date on our latest investigations, join Bellingcat’s new WhatsApp channel here.

This investigation is part of a collaboration between Bellingcat and Evident. You can watch Evident’s video here.

Children in Chicago’s Old Irving Park neighbourhood were preparing for a Halloween parade on Oct. 25 when federal agents reportedly deployed tear gas on the street to disperse protesters opposing immigration-related arrests in the neighbourhood.

“Those kids were tear gassed on their way to celebrate Halloween in their local school parking lot,” US District Judge Sara Ellis said in court on Tuesday, according to a CBS News report. “I can only imagine how terrified they were.” 

Ellis was questioning US Customs and Border Patrol Commander Gregory Bovino over this and other incidents that protesters allege violate a temporary restraining order (TRO) she issued earlier this month. 

The Oct. 9 TRO was issued after a group of journalists, faith leaders and protesters filed a lawsuit against the Trump administration over what they described as a “pattern of extreme brutality” by federal agents against peaceful protesters since Operation Midway Blitz – a multi-agency operation against “criminal illegal aliens” in Illinois – began on Sept. 2. 

When Judge Ellis asked Bovino to produce all use-of-force reports since Sept. 2 from agents involved in Operation Midway Blitz by the end of Tuesday, Bovino said it would be impossible because of the “sheer amount”. Ellis then ordered Bovino to turn over these reports, along with the accompanying body camera footage, by the end of Friday, Oct. 31.

The court order places restrictions on federal agents’ crowd-control measures within the state, including their use of “riot control weapons” such as tear gas and pepper spray, the use of force against individuals and requiring people to leave public spaces that they lawfully have the right to be in. 

A subsequent court filing on Oct. 27 alleges that federal agents have violated the TRO “almost every day” since it was issued. “Immigration enforcement does not typically require the daily use of tear gas on civilians in residential areas,” the filing stated.

Bellingcat’s analysis of social media videos from 28 events in Illinois from Oct. 9 to Oct. 27 found multiple examples of force and riot control weapons being used.

In total, we found seven that appeared to show the use of riot control weapons when there was seemingly no apparent immediate threat by protesters and no audible warnings given. Nineteen showed use of force, such as tackling people to the ground when they were not visibly resisting. Another seven showed agents ordering or threatening people to leave public places. Some of the events identified showed incidents that appeared to fall into more than one of these categories. 

You can view the full dataset here. 

View this post on Instagram

A post shared by Evident Media (@evidentmediaorg)

It is important to note that the full context of an incident may be unclear from videos on social media alone. Bystanders often only begin filming when an arrest is already ongoing, for example, which can make it difficult to determine what happened in the moments before force was applied. Each of the events included in our dataset were verified to have taken place in Illinois in recent weeks with at least two sources – videos taken by different people, local reporting or statements from the Department of Homeland Security (DHS).

The DHS – which oversees Customs and Border Patrol (CBP) as well as the United States Immigration and Customs Enforcement (ICE) – has justified the use of force or riot control weapons by saying that protesters were threatening or attacking agents. 

Bellingcat asked DHS whether it had any response to the TRO or allegations that agents had violated the TRO.

In a response received after the publication of this piece, Assistant Secretary Tricia McLaughlin did not directly address the TRO but said DHS officers “only use crowd control methods as a last resort when repeated warnings have been given”. 

DHS also said, several times in its response, that its officers were “facing a 1,000 percent increase in assaults against them”. This is a claim that the department has previously made when commenting on clashes with protesters during immigration operations in other cities such as Los Angeles and Portland. However, an NPR analysis of court records earlier this month only showed about a 25 percent rise in charges for assault against federal officers through mid-September, compared with the same period a year ago.

The TRO does say that riot control weapons or force may be deployed in circumstances such as where there is an “immediate threat” of physical harm to the agents or others, multiple warnings have been given, or where “necessary and proportional” for an arrest. We did not include videos where it was obvious that such conditions had been met. 

Despite the limitations, videos taken by eyewitnesses are often the only evidence of such incidents, which may not be reported by media or may have concluded by the time journalists reach the scene.

Riot Control Weapons

In our analysis, we found videos showing the use of riot control weapons such as tear gas, pepper spray and other less-lethal weapons in seven events where protesters appeared to be posing no visible threat in the footage, and where no audible warnings appeared to be given. 

Among its provisions, the TRO prohibits the use of these types of weapons on people “who are not posing an immediate threat to the safety of a law enforcement officer or others” and also in cases where using them on intended targets would result in injury to those who aren’t posing any threat. 

One of these videos captured the moment Bovino threw what looked like a tear gas canister during the Oct. 23 clashes in the Little Village neighbourhood, during an operation where eight people were arrested, including a 16-year-old US citizen. Bovino and DHS have said that he was hit on the head by objects thrown by protesters before he threw the tear gas canister.  

DHS posted a video on Facebook, claiming that it was evidence that “the use of chemical munitions was conducted in full accordance with CBP policy and was necessary to ensure the safety of both law enforcement and the public”. 

The video showed a rock skidding on the ground behind Bovino, but did not show the moment that it allegedly hit the Border Patrol chief on the head. A protester who filmed the encounter has reportedly disputed that Bovino was hit. 

Tear gas was also deployed on Oct. 12 in Albany Park, Oct. 14 in the East Side of Chicago, Oct. 24 in Lakeview and Oct. 25 in Avondale. Bellingcat reviewed footage of each of these incidents and could not see threats to the agents’ safety in the videos before tear gas was deployed, or that audible warnings were issued within the footage.

Videos we reviewed also showed other types of riot-control weapons mentioned in the TRO. Another video from the Oct. 23 protests in Little Village, posted by a protester named Enrique Bahena, shows an agent shooting a less-lethal projectile directly at the person filming. An Oct. 26 court filing said Bahena was shot in the “neck from five feet away with a pepper ball”. 

Bellingcat’s analysis of the video, which appears to be the same one shown in screengrabs in the court filing, found that the video in fact shows the agent deploying a B&T GL-06 40mm launcher, which can be used to launch chemical irritant rounds such as the one visible in the video.  

Bahena said in an interview with local outlet Chicago Block Club that agents did not give warnings before they shot him “in the throat” and threw gas canisters at the group of protesters who were shouting at them to leave. He also said in the interview that protesters did throw objects at agents, but that this was after agents had already used force.

B&T technical specifications for their 40mm projectiles state that “shots to the head, neck, spine, or heart are to be avoided unless lethal force is justified”, and advise users to aim at the waistline. 

A DHS Office of Inspector General Report in 2021 states that “ICE’s use of force policy indicates that the 40MM launcher is deadly force when fired at someone, while the CBP use of force policy only directs officers not to target a person’s head or neck”.

During this same event in Little Village, videos show other officers appearing to fire less-lethal weapons towards protestors.

The TRO restricts the use of Compressed Air Launchers or Munitions Launchers such as 40mm launchers to strike a person, including on the neck, unless they pose an “immediate threat of causing serious bodily injury or death”.  

In another incident on Oct. 22, an agent appeared to quickly roll down a window and spray what appeared to be a chemical irritant at protesters who were confronting federal officers near a Sam’s Club store in the Cicero neighbourhood of Chicago. 

The incident was captured in two separate livestreams, which show a few protesters near an unmarked dark grey Chevrolet Tahoe with no front licence plate. One of the protesters taps on the window of the vehicle. Someone then rolls down the window and sprays what appears to be a liquid very quickly before rolling the window back up as the car leaves the scene. One of the people filming said in the post for the livestream that this was pepper spray, although Bellingcat was unable to verify this. 

DHS did not respond directly to Bellingcat’s questions about whether it believed that the use of riot-control weapons – including during the Oct. 23 Little Village protests – was justified based on the terms of the TRO. 

Use of Force

Bellingcat also reviewed multiple videos of agents using force in arrests that appeared to be related to Operation Midway Blitz, and identified those where the force shown being used looked potentially excessive and the person being arrested did not appear to pose an “immediate threat of physical harm to others” – a requirement in the TRO for using force such as tackling or shoving someone to the ground.

On Oct. 10, a day after the TRO was issued, an ICE agent was seen dragging a teenage girl out of a car in Hoffman Estates, a suburb of Chicago, and tackling her to the ground while she shouted “I’m not resisting”. The teenager, reportedly an 18-year-old US citizen, was handcuffed and an officer appeared to put a knee on her back. DHS Assistant Secretary McLaughlin said in a post that the incident was a “burglary” arrest from 2024 which did not involve ICE – although this has been debunked by multiple news outlets. 

Bellingcat asked DHS about this specific incident and why McLaughlin’s post remains up on X despite multiple news outlets verifying that the incident took place this month in Hoffman Estates, but did not receive a response. 

This was not the only case where DHS’ version of events appears to contradict video footage of the incident posted on social media. 

On Oct. 22, a woman identified by DHS as Isabel Mata was arrested by Border Patrol agents in Little Village. A video of the incident shows multiple agents tackling her while one of them has his knee on her back to hold her to the ground. DHS stated Mata “allegedly threatened a law enforcement officer after stating she would put a hit out on Chief Gregory Bovino”. Bellingcat reviewed a video that showed the minutes before Mata was tackled by agents but did not hear any threat being made, even though Mata appeared to have been standing near the person filming.

DHS initially did not respond to Bellingcat’s questions about this incident, but after publication it sent us the same statement it made on Oct. 24 with the allegation that Mata had threatened Bovino.

Another video from Oct. 10 appears to show agents colliding with a car on Hubbard Street and dragging the driver out by her legs. The woman, identified as Dayanne Figueroa, told Newsweek that she was on her way to get coffee before work and “instead of handling the situation as a routine traffic incident”, masked armed agents forcibly removed her without questions or informing that she was under arrest.

DHS reportedly told Newsweek that Border Patrol was making a targeted arrest when Figueroa’s vehicle blocked agents and struck an unmarked government vehicle. They also said she “violently resisted” and was arrested for assault on a federal agent.

The video shows agents arresting someone, before one of their vehicles swerves into another lane and appears to hit Figueroa’s car. Multiple bystanders can be heard shouting that the agents hit Figueroa’s car first and that they were making a U-turn in the middle of the street.

Bellingcat asked DHS about the conditions under which it would consider the use of force – such as tackling or shoving people to the ground – proportionate and necessary, but did not receive a direct response to this question. 

Dispersal Orders

The TRO prohibits federal agents from “issuing a crowd dispersal order requiring any person to leave a public place that they lawfully have a right to be, unless dispersal is justified by exigent circumstances as defined by Department of Homeland Security Use of Force Policy”. 

Bellingcat has asked DHS about when agents are justified in telling people to get off the streets, or people in cars to stop following them, and whether there are any laws preventing people from following or filming federal agents from a distance. DHS did not respond to these questions in their response after this story was published.

However, we found several examples of agents telling people to leave public places when they did not appear to be impeding arrests in video footage. 

In a video recorded in Chicago’s Arlington Heights on Oct. 24, a masked man with a rifle tells someone filming to “get the f*** across the street” and “get back to your car”. The person filming is shouting that agents have assaulted a woman and slapped her phone out of her hands, and the video appears to show a woman in a scuffle with a masked agent. A separate video from the same location and date shows agents arresting a man who is on the ground. 

In some of these cases, agents appear to be pointing non-lethal weapons at civilians while ordering them to leave public spaces. A video from Oct. 16 shows agents telling protesters to “get out of the street”, pointing pepper spray at them and threatening them with arrest in Chicago’s Evanston neighbourhood.

A similar incident took place in Rolling Meadows on Oct. 19 when an officer was pictured pointing a pepper ball gun from a moving vehicle at a person filming him in a parking lot. A federal judge reportedly said the incident was “troubling” and has called for answers. 

On Oct. 20, in Berwyn, an agent pointed a gun at a woman who said she was pregnant. By the woman’s account, the agents were chasing after two people and the video shows her honking to alert those nearby. A DHS agent told Newsweek that the agent “acted to protect his life and safety of others around him and showed great restraint”.

Judge Ellis’ TRO is set to expire on Nov. 6. There is a scheduled hearing the day prior, Nov. 5, to determine if the TRO should be converted into a preliminary injunction. 

---

Editor’s Note (Oct. 31): This story was updated to include a response by the Department of Homeland Security who responded to our request for comment after publication.

Pooja Chaudhuri, Kolina Koltai, Youri van der Weide, Sebastian Vandermeersch, Melissa Zhu and Trevor Ball contributed research to this piece, alongside Fraser Crichton, Olivia Gresham, Bonny Albo and Vladimir Zaha from Bellingcat’s Global Authentication Project.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here and Mastodon here.

The post ‘Pattern of Extreme Brutality’: Tear Gas, Pepper Balls Among Weapons Deployed Against Protesters in Illinois appeared first on bellingcat.

Financial regulators in Canada this week levied $176 million in fines against Cryptomus, a digital payments platform that supports dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services. The penalties for violating Canada’s anti money-laundering laws come ten months after KrebsOnSecurity noted that Cryptomus’s Vancouver street address was home to dozens of foreign currency dealers, money transfer businesses, and cryptocurrency exchanges — none of which were physically located there.

On October 16, the Financial Transactions and Reports Analysis Center of Canada (FINTRAC) imposed a $176,960,190 penalty on Xeltox Enterprises Ltd., more commonly known as the cryptocurrency payments platform Cryptomus.

FINTRAC found that Cryptomus failed to submit suspicious transaction reports in cases where there were reasonable grounds to suspect that they were related to the laundering of proceeds connected to trafficking in child sexual abuse material, fraud, ransomware payments and sanctions evasion.

“Given that numerous violations in this case were connected to trafficking in child sexual abuse material, fraud, ransomware payments and sanctions evasion, FINTRAC was compelled to take this unprecedented enforcement action,” said Sarah Paquet, director and CEO at the regulatory agency.

In December 2024, KrebsOnSecurity covered research by blockchain analyst and investigator Richard Sanders, who’d spent several months signing up for various cybercrime services, and then tracking where their customer funds go from there. The 122 services targeted in Sanders’s research all used Cryptomus, and included some of the more prominent businesses advertising on the cybercrime forums, such as:

-abuse-friendly or “bulletproof” hosting providers like anonvm[.]wtf, and PQHosting;
-sites selling aged email, financial, or social media accounts, such as verif[.]work and kopeechka[.]store;
-anonymity or “proxy” providers like crazyrdp[.]com and rdp[.]monster;
-anonymous SMS services, including anonsim[.]net and smsboss[.]pro.

Sanders found at least 56 cryptocurrency exchanges were using Cryptomus to process transactions, including financial entities with names like casher[.]su, grumbot[.]com, flymoney[.]biz, obama[.]ru and swop[.]is.

“These platforms were built for Russian speakers, and they each advertised the ability to anonymously swap one form of cryptocurrency for another,” the December 2024 story noted. “They also allowed the exchange of cryptocurrency for cash in accounts at some of Russia’s largest banks — nearly all of which are currently sanctioned by the United States and other western nations.”

Reached for comment on FINTRAC’s action, Sanders told KrebsOnSecurity he was surprised it took them so long.

“I have no idea why they don’t just sanction them or prosecute them,” Sanders said. “I’m not let down with the fine amount but it’s also just going to be the cost of doing business to them.”

The $173 million fine is a significant sum for FINTRAC, which imposed 23 such penalties last year totaling less than $26 million. But Sanders says FINTRAC still has much work to do in pursuing other shadowy money service businesses (MSBs) that are registered in Canada but are likely money laundering fronts for entities based in Russia and Iran.

In an investigation published in July 2024, CTV National News and the Investigative Journalism Foundation (IJF) documented dozens of cases across Canada where multiple MSBs are incorporated at the same address, often without the knowledge or consent of the location’s actual occupant.

Their inquiry found that the street address for Cryptomus parent Xeltox Enterprises was listed as the home of at least 76 foreign currency dealers, eight MSBs, and six cryptocurrency exchanges. At that address is a three-story building that used to be a bank and now houses a massage therapy clinic and a co-working space. But the news outlets found none of the MSBs or currency dealers were paying for services at that co-working space.

The reporters also found another collection of 97 MSBs clustered at an address for a commercial office suite in Ontario, even though there was no evidence any of these companies had ever arranged for any business services at that address.

To stay up to date on our latest investigations, join Bellingcat’s new WhatsApp channel here.

The organisers of an annual combat sports event allegedly told the venue owner that they were using the space to film an activewear commercial featuring a small “crowd” including women and children. 

In reality, the event hosted on Aug. 30 by SoCal Active Club was part of a movement that champions violent and racist ideas. It featured combat sports fights and performances from two neo-Nazi bands who each have had a member involved in lethal violence, including one for a 2012 mass murder described by the former US Attorney General as a “heinous act of hatred and terror”.

Bellingcat verified a tip-off from independent researcher Wiley D. Cope and researchers from SoCal Research Club (SCRC) that the event was held at a suburban San Diego professional wrestling venue based on images posted by SoCal Active Club as well as a teaser video posted by a far-right propaganda outlet, which Bellingcat is not naming to prevent amplification. The venue operates as a professional wrestling school on weekdays, and is available for rental for events on weekends. 

Charles Smith, co-founder and CEO of Rising Star Entertainment Group, which leases out the venue, confirmed the location after Bellingcat showed him images of the event. He told Bellingcat by email that he was not aware that the space was being used for an Active Club event, and had never heard of the group or “any sort of racial movement here in San Diego of that calibre” before he was contacted by journalists about it.

Smith said he was told by the event’s hosts via Peerspace, a third-party booking and rental website, that the booking was to shoot “an active fitness clothing brand prototype commercial”. 

“I was informed that there would be a small audience of people that would be being used as the ‘crowd’ for the filming and that it would include women and children,” Smith told Bellingcat, “so of course I thought nothing of it.” 

Upon verifying from the images that the event did indeed take place at his venue, Smith said that it was “disappointing that this is undeniable proof that this event occurred here with this audience”.

The international Active Club movement focuses on using fitness, fighting and fashion to recruit young men and boys into the far right, normalise fascist ideas and prepare them for physical violence. The Active Club movement was founded by American neo-Nazi Robert Rundo, who is currently on probation in the United States after having pleaded guilty in December 2024 to planning and engaging in riots at political rallies across California in 2017.

Since 2023, Bellingcat has been tracking and geolocating annual “fight nights” held in the US, where white nationalist groups that focus on training their members to fight against their purported enemies gather. 

“Collaborations with other Active Clubs and neo-fascist organisations, such as the Patriot Front, serve as important cultural events for the far-right to grow their sphere of influence,” Heidi Beirich from the US-based Global Project Against Hate and Extremism (GPAHE), told Bellingcat by email. 

“Exposing Active Club and neo-fascist activities associated with violence helps to inform the public, and authorities, about the beliefs that turn into violence,” Beirich added, “especially when these beliefs have become commonplace in mainstream politics.”

Smith, who told Bellingcat that he is of mixed African-American and Japanese ethnicity, said that he visited the venue late in the evening after the event, when the hosts were cleaning up.

“I was greeted with pats on the back, handshakes, and a couple [of] ‘thanks for letting us use the space, greatly appreciated,’” he told Bellingcat. “It’s hard to believe it’s the same group.” 

SoCal Active Club and the far-right propaganda outlet, which was founded by Rundo, did not respond to Bellingcat’s requests for comment.

Identifying Details: An Orange Wall

On Sept. 2, SoCal Active Club posted several photos on their Telegram channel from the event. Two of these photos show details of the venue, including an orange-coloured part of a wall in the background. 

The photos also show a banner for a support group of the Hammerskins, a violent international neo-Nazi gang that has links to the Active Club movement, particularly in the United States. Hammerskins members have been convicted of multiple crimes, including assault and murder.

A 12-second black-and-white teaser video released by the far-right propaganda outlet founded by Rundo gave a blurry idea of the shape of the building and the ceiling of the venue.

These images provided crucial clues for Cope and researchers from SCRC, a Southern California-based research collective that monitors and shares information on hate and extremist groups, including Active Clubs. Based on local knowledge of the area and their familiarity with the activities of members of the Active Club chapter in Southern California, they began searching for San Diego County gyms and warehouses with boxing rings for rent. They found the venue the same day the teaser video was released, Cope said.

Bellingcat was able to confirm that this was the location of the Active Club combat sports event, using videos and images from previous events held by the wrestling school (which we are choosing not to name as there is no evidence that they have any involvement in the event). 

In a video posted on the school’s YouTube channel on Aug. 17, 2025 – two weeks before the Active Club event – the same orange wall and black banners with orange trim that are only partially obscured at the Active Club event, are visible. Also visible in both the venue’s YouTube video and the photos posted from the Active Club event is a wooden ceiling beam, with wires on the left-hand side.

Another photo posted by the hosts further confirmed that the professional wrestling venue was the location of the Active Club combat sports event. In a photo taken of one of the neo-Nazi bands that performed at the event, brown beams and wires are visible on the ceiling; these same beams and wires, in the same positions, can be seen in photos posted by the venue on their Peerspace page advertising the venue for rent for events.

Bands ‘A Major Cause For Concern’

The Active Club event was more than just a “fight night”. In their post after the event, the SoCal Active Club hosts thanked two US-based neo-Nazi bands for their musical performances after the fights, praising the bands for “really topping the event off with incredible energy.” 

Bellingcat is not naming the bands to avoid amplification, who have been active for many years in US and international neo-Nazi music scenes.

Both bands have had members associated with violence, including mass murder. A former member of one of the bands, Wade Michael Page, murdered seven people at a Sikh temple in Wisconsin in 2012 before taking his own life in what US authorities called a hate crime and a terrorist act. Page was also a member of the Hammerskins. 

A current member of the other band that performed at the Active Club event pleaded guilty in 2012 to attempted involuntary manslaughter and served prison time for his crime. This band member punched a man outside a Michigan bar and ultimately caused the man’s death from a severe brain injury.

According to the GPAHE’s Beirich, the presence of these bands is “a major cause for concern, albeit unsurprising considering the purpose of the Active Club movement is based on beliefs in an impending, and unavoidable, race war”.

“The history of violence associated with Active Clubs is clear,” Beirich added.

Evening Vigil Turned Into Alleged Assault

Two weeks after the combat sports event on Sept. 13, members of one of the Active Clubs that organised it participated in an alleged assault in Huntington Beach, California. 

Members of Patriot Front, SoCal Active Club and other far-right and neo-Nazi groups took part in an evening vigil in Huntington Beach, in the Los Angeles metropolitan area, in honour of assassinated right-wing commentator Charlie Kirk.

According to reporting from the event by The LA Ten Four, a newsletter covering issues surrounding first responders in the Los Angeles area, the man who was attacked was a vigilgoer who confronted the far-right group along with several others, calling them “un-American” and “traitors” and following the group into a parking garage. 

Video footage of the assault taken by The LA Ten Four shows the man being punched, kicked and stomped on by several others. At least two of the attackers appear to be wearing SoCal Active Club t-shirts, identifiable as such by photos and videos posted from the vigil.

SoCal Active Club has not responded to Bellingcat’s request for comment on their apparent involvement in this assault as of publication.

---

Wiley D. Cope contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Instagram here, X here and Mastodon here. With the unpredictability of social media algorithms making it harder for news outlets to reach audiences consistently, we have also started a WhatsApp channel that you can join to stay updated on our stories.

The post Like Clockwork: An Orange Wall Exposes Yet Another Active Club ‘Fight Night’ appeared first on bellingcat.

Four masked men in police tactical vests surround a young scooter rider, cuffing his hands behind his back. One person, whose face is fully obscured with a cap, sunglasses and a balaclava, is heard on eyewitness video telling the scooter rider: “You came into this country as a J1, as an exchange student. You didn’t show up … You lied, ok?” 

“Yeah, he’s illegal, either way,” another person is heard saying, before they lead him to an unmarked car. 

Nearby, two Metropolitan Police Department (MPD) cars are seen blocking part of the lane. Uniformed MPD officers stand around the area, neither intervening nor appearing to participate directly in the arrest. 

The video was posted by Will Allen-DuPraw, whose profile says that he is a photographer and videographer based in DC, on Sept. 2. Allen-DuPraw wrote in the post that bystanders reported that authorities were stopping Latino men on scooters along Florida Avenue Northwest, a major road in Washington DC, and had arrested two. 

An urgent alert sent out on the morning of the same day by Stop ICE Alerts, a community-driven alert network for those affected by Immigration and Customs Enforcement (ICE) raids, reported similar information. The alert said that ICE, Homeland Security Investigations (HSI) – a branch of ICE focused on investigating transnational crime – and MPD were “stopping Latinos on scooters” and had arrested one or two people along Florida Avenue Northwest. 

With US President Donald Trump’s crackdown on immigration, scenes of federal agents detaining people while accusing them of immigration offences have been cropping up all over social media from around the country. An analysis of ICE arrest data by DC-based think tank Cato Institute found that in June and July alone, ICE conducted almost 9,000 street arrests nationwide of immigrants who had no criminal convictions, charges, or removal orders. About 90 percent of these were immigrants from Latin America.

The incident on Florida Avenue Northwest was one of 42 that Bellingcat and our partner Evident Media geolocated and verified using videos and photos from social media and news reports. These showed federal agent encounters in the capital, in the month or so since Trump’s federal takeover of DC on August 11. The full dataset can be downloaded here.

In the three weeks after DC was placed under federal control, Trump’s administration said more than 300 people without legal immigration status were arrested in the District. 

Like previous immigration raids that we documented in Los Angeles, the federal agents involved in the DC cases were often masked and in military wear. Some wore generic “Police” vests, while others had attire indicating specific government entities such as ICE and HSI. The vehicles they used were usually unmarked, with plates from a variety of US states.

There is one key difference, however. In LA, a state law prohibits local law enforcement from using its resources for immigration enforcement in most cases. But in DC, where no such law applies, MPD has frequently been seen working with federal officers since the federal takeover last month. 

In half of the incidents in our dataset, local DC law enforcement could be seen working alongside federal agents. Most of the DC local police were from MPD, though some were from the Metro Transit Police Department. Aside from ICE and HSI, agents from federal agencies including the US Park Police, Federal Bureau of Investigation (FBI), Drug Enforcement Administration (DEA) and Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) were also seen in the videos.

“We are definitely seeing MPD cooperate at a level we’ve never seen before, and it is resulting in people getting arrested and sent to detention,” Michael Lukens, who runs immigrant rights centre Amica, told Evident Media.

MPD has not replied to Evident Media’s queries about their cooperation with federal law enforcement agencies as of publication.

Of the cases we analysed, 22 involved the arrest of delivery drivers or tradespeople, such as workers in an air conditioning and heating truck.

In two widely shared videos, DC resident Tyler DeSue claimed agents pulled over his Uber Eats driver for having “incorrect tags” on his bike, then checked his registration and insurance and saw it was valid. DeSue said they then asked for his immigration status and detained him.

The videos DeSue posted did not show the initial encounter between the agents and the driver, but did show the arrest. DeSue can be heard in one video telling agents that the man they were questioning did not understand what they were saying, and they should use Google Translate. Another witness is heard calling the arrest “ridiculous” and questioning if the agents have “better things to do than to harass Uber Eats drivers”. 

In a second video, also posted by DeSue, agents are seen wrapping the man in chains before putting him in an unmarked car. 

Another video posted by NPR reporter Chiara Eisner on Aug. 21 shows an agent in a “Police” tactical vest handcuffing a man in front of a truck, with US Park Police nearby. When Eisner asks what is happening, a Park Police officer says this is a traffic enforcement because the man was driving a commercial vehicle on park roads. 

Evident Media asked the Department of Homeland Security (DHS) about videos of these two specific incidents, as well as whether federal agents were using race or language as factors in their stops and arrests. In response, a DHS spokesperson said: 

“What makes someone a target for immigration enforcement is if they are illegally in the US – NOT their skin colour, race or ethnicity. America’s brave men and women are removing murderers, MS-13 gang members, pedophiles, rapists – truly the worst of the worst from our communities.”

The spokesperson also claimed that the men detained in these two incidents were undocumented immigrants who entered the country illegally. They did not mention any other criminal record for the men or comment on why the men were stopped by local police in the first place. 

Lukens told Evident Media that ICE agents had been seen in areas with larger immigrant populations, such as Columbia Heights and Adams Morgan, which he described as “high-level racial profiling”.

Constitutionally, the Fourth Amendment protects anyone in the US, regardless of immigration status, from unreasonable searches and seizures by the government. 

“If you are an ICE officer and the only thing that you have to fall on or to fall back on in justifying arrest is a person’s racial makeup and what vehicle they are driving, then you have conducted an illegal stop and an illegal arrest,” Lukens said. 

---

Melissa Zhu, Eoghan Macguire, Pooja Chaudhuri and Kolina Koltai from Bellingcat, as well as Vladimir Zaha, Fraser Crichton and Bonny Albo from Bellingcat’s Global Authentication Project, contributed research to this piece.

From Evident Media, Jennifer Smart, Kevin Clancy and Zach Toombs contributed to research and production for the video report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Trump’s Takeover of DC: Traffic Stops Turn Into Immigration Arrests for Delivery Riders and Workers appeared first on bellingcat.

Arrest warrants issued for ringleaders after investigation by police in Europe and North America

European and North American cybercrime investigators say they have dismantled the heart of a malware operation directed by Russian criminals after a global operation involving British, Canadian, Danish, Dutch, French, German and US police.

International arrest warrants have been issued for 20 suspects, most of them living in Russia, by European investigators while indictments were unsealed in the US against 16 individuals.

Continue reading...

© Photograph: Andrew Brookes/Getty Images/Image Source

© Photograph: Andrew Brookes/Getty Images/Image Source