The post The Global Takedown: FBI and International Allies Dismantle Billion-Dollar Pig-Butchering Empires appeared first on Daily CyberSecurity.

In a major international enforcement action, Operation Tri-Force Sentinel, led by Dubai Police, in coordination with the FBI and Chinese Police, has dismantled a large transnational fraud network involved in global financial scams. The Operation Tri-Force Sentinel crackdown resulted in the arrest of 276 individuals linked to organised cyber-enabled fraud activities spanning multiple countries, primarily involving suspects from Southeast Asia. The Operation Tri-Force Sentinel was carried out under the UAE Ministry of Interior and focused on disrupting criminal syndicates running high-yield investment scams, commonly known as HYIS, “pig butchering” schemes, and virtual currency fraud. Authorities confirmed that nine major fraud centres were dismantled during the coordinated action.

276 Arrests and Nine Fraud Centres Dismantled in Operation Tri-Force Sentinel

As part of the operation, law enforcement agencies executed synchronized raids that dismantled three major criminal syndicates operating fraud centres. These centres were responsible for large-scale financial deception campaigns targeting victims across several regions. The operation led to the arrest of 276 suspects, with authorities confirming that the network used advanced social engineering techniques. Victims were reportedly engaged through digital platforms, where trust was gradually built before financial exploitation took place. Dubai Police also confirmed the arrest of a key leader of one of the syndicates in Thailand, carried out in coordination with the Royal Thai Police. The enforcement action marked one of the most significant coordinated strikes against cyber-financial crime groups in recent times under Operation Tri-Force Sentinel. [caption id="attachment_111753" align="aligncenter" width="553"] Image Source: Dubai Police[/caption]

Dubai Police, FBI, and Chinese Police Coordination 

Dubai Police played a central role in directing and executing Operation Tri-Force Sentinel, enabling real-time intelligence sharing between international partners. The collaboration with the FBI and Chinese Police was described as critical to the success of the operation. Dubai Police stated that the operation reflects a proactive strategy to combat evolving transnational financial crime threats. The agency emphasized that coordinated international efforts were essential to dismantling complex criminal networks operating across borders. The FBI highlighted the significance of joint enforcement efforts, stating that the operation demonstrates the effectiveness of coordinated global action in disrupting large-scale fraud schemes. It further noted that the partnership with the UAE authorities, particularly the Dubai Police, played a key role in achieving operational success. Chinese Police also reaffirmed their commitment to combating telecom and financial fraud crimes. They emphasized continued cooperation with global law enforcement agencies to address emerging cross-border criminal activities targeted in Operation Tri-Force Sentinel.

Transnational Fraud Networks and Financial Crime Disruption

The dismantled network operated multiple fraud centres using structured and organised digital fraud models. These included investment scams and cryptocurrency-related fraud schemes that have increasingly affected victims across several countries. Authorities noted that the criminal groups involved in Operation relied heavily on psychological manipulation and digital engagement strategies to execute financial scams at scale. The coordinated enforcement action disrupted key operational infrastructure of these networks in a single phase.

International Cooperation Strengthened 

This operation highlights the growing importance of international cooperation in tackling financial crime networks that operate beyond national borders. The joint action between Dubai Police, the FBI, and the Chinese Police demonstrates strengthened coordination in intelligence sharing and enforcement execution. Officials involved in the operation emphasized that continued collaboration is essential to countering sophisticated fraud networks. The success of Operation reflects the ability of global law enforcement agencies to respond jointly to complex cyber-enabled financial threats. The operation marks a significant step in global efforts to combat organised fraud networks and reinforces the role of coordinated international enforcement in addressing cross-border financial crime.

A major Canada SMS blaster cybercrime case has come to light as Toronto Police charge three men with 44 offences in what authorities describe as a first-of-its-kind investigation in the country. The case, part of Project Lighthouse, highlights a growing threat where cybercriminals use mobile technology to target thousands of people at once. The investigation began in November 2025 after a security partner alerted police to a suspected SMS blaster operating in downtown Toronto. What followed was a months-long probe into a sophisticated operation that combined mobility, deception, and large-scale disruption.

What Is the Canada SMS Blaster Cybercrime Case?

At the center of the Canada SMS blaster cybercrime case is a device that mimics a legitimate cellular tower. When nearby mobile phones connect to it, users receive fraudulent messages that appear to come from trusted organizations. These messages often include links to fake websites designed to steal sensitive information such as banking credentials and passwords. This method is widely known as “smishing,” a form of phishing carried out through text messages. However, the scale and mobility of the device used in this case set it apart from typical cyber fraud schemes. Deputy Chief Rob Johnson said the operation posed serious risks beyond financial fraud. He noted that the technology had the capability to reach thousands of devices simultaneously, raising concerns about public safety.

Large-Scale Disruption Across the Greater Toronto Area

Investigators found that the SMS blaster was not stationary. It was operated from vehicles, allowing suspects to move across the Greater Toronto Area and deploy the device in multiple locations. According to Detective Sergeant Lindsay Riddell, tens of thousands of devices connected to the rogue network over several months. Police also recorded more than 13 million network disruptions, during which affected devices were unable to connect to legitimate cellular networks. These disruptions had serious implications. During those moments, access to emergency services such as 9-1-1 could have been impacted, making the Canada SMS blaster cybercrime case not just a financial threat but also a public safety concern.

Arrests and Seizure of Devices

Toronto Police executed search warrants on March 31 at residences in Markham and Hamilton, leading to the arrest of two suspects. Authorities seized multiple SMS blasters along with a significant amount of electronic evidence. A third individual later turned himself in on April 21. All three now face a combined total of 44 charges linked to the operation. The Canada SMS blaster cybercrime case involved extensive coordination between multiple agencies, including the Royal Canadian Mounted Police National Cybercrime Coordination Centre, regional police services, financial institutions, and telecom providers. Officials say this collaboration was key to identifying and disrupting the activity.

A New Type of Cyber Threat in Canada

Law enforcement officials emphasized that this is the first known case of SMS blaster technology being used in Canada. The case reflects how cyber-enabled crimes are becoming more advanced and harder to detect. Authorities noted that while the technology is new, the objective remains the same: to gain unauthorized access to personal and financial information. The Canada SMS blaster cybercrime case shows how attackers are combining traditional fraud tactics with newer tools to scale their operations.

Public Advisory and Safety Measures

Police are urging the public to remain cautious when receiving unexpected text messages. Users are advised not to click on suspicious links or share personal information through unsolicited messages. Officials recommend accessing banking services only through official applications or by directly entering website addresses into browsers. Victims of suspected fraud are encouraged to report incidents to law enforcement. Deputy Chief Johnson also acknowledged the role of the Toronto Police Coordinated Cyber Centre and partner agencies in handling the investigation. He stressed that staying informed and vigilant remains one of the most effective defenses against such threats.

Bellingcat has identified at least 80 police stations or infrastructure related to law enforcement agencies and the Basij paramilitary group that has been damaged or destroyed in the first three weeks of the United States and Israel’s war against Iran. Experts told Bellingcat that both countries aim to degrade the Iranian regime’s “repressive capacity”.

Combined, the US and Israel have conducted thousands of strikes during the course of the 2026 war in Iran. Targets range from Islamic Revolutionary Guard Corps (IRGC) sites, Navy vessels to Iranian weapons manufacturers.

In early March, a Bellingcat analysis using satellite imagery and available photos and videos identified police stations as another apparent target, with at least 15 damaged or destroyed in the capital, Tehran.

We also identified multiple strikes against police infrastructure in the country’s north and west; these areas were targeted by the Israel Defence Forces according to a map released by the IDF on March 31.

“We are providing the brave people of Iran with the conditions to take their destiny into their own hands,” declared the Israeli Ministry of Foreign Affairs official X account, along with a photo of a destroyed police station.

اینجا کلانتری ۱۲۱ سلیمانیه در خیابان نبرد تهران بود.

ما شرایطی را برای مردم شجاع ایران فراهم می‌کنیم تا سرنوشت خود را در دست بگیرند. pic.twitter.com/VSm6YVvIwZ

— اسرائیل به فارسی (@IsraelPersian) March 5, 2026

In all, the majority of strikes Bellingcat analysed focused on police stations (30 incidents) and command centers or headquarters (29 incidents). Locations also include sites related to Basij, a plainclothes paramilitary organisation (9) affiliated with the IRGC that were “involved in the deadly crackdown” of protests in January 2026, others are associated with special forces (3) and traffic (2) or diplomatic (2) police compounds.

Due to commercial satellite companies limiting access to imagery over Iran and neighbouring countries we relied on Sentinel-2 imagery data to help verify the incidents, as well as videos and photos, some of which were also verified by independent geolocators and contributors to the Geoconfirmed volunteer community and confirmed by Bellingcat researchers. 

Location data was partly determined using open source mapping data either from Wikimapia, OpenStreetMap or Google Maps. When video footage or photos were available for incidents reportedly targeting police stations, the location was verified with geolocation and satellite imagery analysis using either Planet Labs medium resolution PlanetScope data (restricted to imagery collected by March 9) or low resolution Sentinel-2 data.

Some locations were discovered utilising location data taken from OpenStreetMap using Overpass Turbo and comparing that with available Sentinel-2 data throughout Iran.

Map showing geolocated incidents in Iran. Click the markers to view the coordinates, sources, and verification notes. Map: Bellingcat/Miguel Ramalho

A Problem of Scale

Israel has released multiple videos showing the targeting of bases and checkpoints belonging to the Basij. In mid-March, the IDF announced the killing of the paramilitary group’s commander, Gholamreza Soleimani. 

Targeting the Basij is part of Israel’s and the US’ agenda “to degrade the regime’s repressive capacity,” Ali Vaez, the director of International Crisis Group Iran Project, told Bellingcat. Police stations are “not involved in repression in the way that crowd control police or Basij centers are”, so targeting them “appears more aimed at preventing the Islamic Republic from being able to maintain control internally,” he said.

Vaez told Bellingcat that, when considered alongside the broader range of targets, including industrial factories, the widespread targeting of police stations is part of a strategy “to make Iran ungovernable for the existing regime or whatever comes after”. 

Vaez was skeptical about the short term effects: “It’s a problem of scale. Iran is such a large country, even if you are able to completely destroy, not just degrade, the capacity of the regime in policing, oppressing, etc – it really requires not just maybe weeks but maybe months if not years.”

The Risk of Civilian Casualties

As of April 7, the Iranian Human Rights Activists News Agency estimates there’ve been more than 1,700 civilian fatalities during the war. 

Several police stations are situated in densely populated urban areas such as Tehran. Stations are used by civilians for various reasons including renewing driving licences, so if these buildings are targeted “during working hours and not in the middle of the night then risk is higher for these people,” Vaez said.

Map showing geolocated incidents in Tehran. Click the markers to view the coordinates, sources, and verification notes. Map: Bellingcat/Miguel Ramalho

A recent joint Airwars, Center for Civilians in Conflict and Human Rights Activists in Iran report detailing the first month of civilian casualties included a section on the worsening situation for detainees in Iranian prisons — including police stations that have been targeted. 

“I was detained in the holding cell of [Police Station 148] for ten days, along with four other activists. Now it looks like nothing is left of that station but ruins. I can’t even recognize where the detention area was. I keep wondering what happened to the people who were being held there during the attack. – Activist, told HRA upon seeing photos of the police station after recent US/Israeli airstrikes.”

Footage shared and geolocated by the BBC’s Shayan Sardarizadeh showed Police Station 148 damaged after an apparent strike in mid-March.

The main building of Tehran’s 148 police station and its courtyard, located on Enghelab Street, has been severely damaged in air strikes conducted on Friday.

The adjacent Hamoon Theatre also sustained some damage.

Video: @Vahid

Location: 35.700812, 51.402163@GeoConfirmed pic.twitter.com/9sdOtHd2XN

— Shayan Sardarizadeh (@Shayan86) March 14, 2026

One destroyed police station identified by Bellingcat in the city of Mahabad in northwestern Iran led to apparent damage to an Iranian Red Crescent Society building located next door. According to Iran’s Tasnim News agency (an IRGC-affiliated media outlet sanctioned by the EU, the US and Canada), one Red Crescent employee was injured in the attack.

The police station adjacent to the Red Crescent building isn’t identified on any mapping services, though there are reports “Police Station 11” was targeted the same day.

Israel has also targeted checkpoints operated by Basij members.

Bellingcat examined two cases showing Israeli strikes on checkpoints while civilians were passing. In one video, a strike hits a checkpoint as five motorbikes and a vehicle go by.

In another IDF video, a yellow bus is immediately adjacent to the checkpoint when it is hit. It is unclear how many people were on the bus at the time of the strike or if anyone was injured.

According to the Open Source Munitions Portal (OSMP), Israeli drones commonly employ the Mikholit bomb. A variant of this bomb has 890 grams of explosives, an amount that creates hazardous fragmentation up to 104 meters away. 

“I have been watching the reporting on these Basij strikes and the use of the Mikholit in particular in open urban areas. It is IDF standard—using precision munitions and even sometimes “low collateral” munitions but in a reckless manner that still puts the civilian population at risk,” Wes J. Bryant, a defence and national security analyst formerly with the Pentagon’s Civilian Protection Center of Excellence told Bellingcat.

Questions Over Legality

International Humanitarian Law defines civilians as “persons who are not members of the armed forces”. Police officers fall under that definition, according to Adil Haque, Professor of Law at Rutgers University and Executive Editor at Just Security.  “As a rule, police are civilians and may not be attacked unless they take a direct part in hostilities,” Haque told Bellingcat. National security analyst Bryant agreed, adding that targeting police “does not stand up to legal scrutiny”.

In an email to Bellingcat, the IDF noted “that the police form part of Iran’s internal security apparatus, which also forms part of Iran’s armed forces, under Iran’s own domestic legislation. In every strike, the IDF takes feasible precautions in order to mitigate incidental harm to civilians and civilian objects to the extent possible under the circumstances.”

Police are indeed “part of the country’s armed forces. By that logic, anything with a flag on it is a legitimate target,” Ali Vaez, the director of International Crisis Group Iran Project, said.

Although Basij is a paramilitary group, any strikes against it would require precautions to minimise harm to civilians, Haque told Bellingcat. “Since the hostilities almost entirely involve aerial bombardment, the concrete and direct military advantage anticipated from strikes on Basij members who qualify as combatants is extremely low, so significant harm to nearby civilians would be disproportionate and illegal,” he said.

When asked about potential civilian casualties in the checkpoint strikes, the IDF told Bellingcat that since the Basij are subordinate to the IRGC and are therefore part of the armed forces, they are regarded as lawful military targets. Regarding the checkpoint strikes specifically, they stated “precision munitions and surveillance means were used in the strikes, as part of the precautions taken under the circumstances to mitigate expected incidental harm”.

Bellingcat reached out to US Central Command (CENTCOM) to ask if the US had any role in the police station strikes identified but received no official comment at the time of publication. 

The data collected so far for these sites can be found here.

---

Miguel Ramalho and Felix Matteo Lommerse contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post “Make Iran Ungovernable” – Tracking Efforts To Destroy Iran’s Police Infrastructure appeared first on bellingcat.

A company that ran anonymous tip lines for 35,000 American schools - handling reports of bullying, weapons, and self-harm - boasted on its website that it had suffered zero security breaches in over 20 years. A hacker called Internet Yiff Machine thought that sounded like a challenge, with predictable results... Meanwhile, Rockstar Games gets hacked again - and the stolen data turns out to be less embarrassing than the financial secrets it accidentally revealed. GTA Online is still making half a billion dollars a year. Red Dead Redemption is not. All this and more in episode 464 of the "Smashing Security" podcast with cybersecurity keynote speaker and industry veteran Graham Cluley, joined this week by special guest BBC cybersecurity correspondent Joe Tidy. Plus! Don't miss our featured interview with Ryan Benson of Meter.

The post FBI and Indonesian Authorities Dismantle Prolific “W3LL” Phishing Empire appeared first on Daily CyberSecurity.

FBI Atlanta and Indonesian National Police dismantle W3LLSTORE phishing market linked to $20M fraud, seizing domains and detaining developer.

According to a new law, the Hong Kong police can demand that you reveal the encryption keys protecting your computer, phone, hard drives, etc.—even if you are just transiting the airport.

In a security alert dated March 26, the U.S. Consulate General said that, on March 23, 2026, Hong Kong authorities changed the rules governing enforcement of the National Security Law. Under the revised framework, police can require individuals to provide passwords or other assistance to access personal electronic devices, including cellphones and laptops.

The consulate warned that refusal to comply is now a criminal offense. It also said authorities have expanded powers to take and keep personal electronic devices as evidence if they claim the devices are linked to national security offenses.

An elusive hacker who went by the handle “UNKN” and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion against victims across the country between 2019 and 2021.

Shchukin was named as UNKN (a.k.a. UNKNOWN) in an advisory published by the German Federal Criminal Police (the “Bundeskriminalamt” or BKA for short). The BKA said Shchukin and another Russian — 43-year-old Anatoly Sergeevitsch Kravchuk — extorted nearly $2 million euros across two dozen cyberattacks that caused more than 35 million euros in total economic damage.

Germany’s BKA said Shchukin acted as the head of one of the largest worldwide operating ransomware groups GandCrab and REvil, which pioneered the practice of double extortion — charging victims once for a key needed to unlock hacked systems, and a separate payment in exchange for a promise not to publish stolen data.

Shchukin’s name appeared in a Feb. 2023 filing (PDF) from the U.S. Justice Department seeking the seizure of various cryptocurrency accounts associated with proceeds from the REvil ransomware gang’s activities. The government said the digital wallet tied to Shchukin contained more than $317,000 in ill-gotten cryptocurrency.

The GandCrab ransomware affiliate program first surfaced in January 2018, and paid enterprising hackers huge shares of the profits just for hacking into user accounts at major corporations. The GandCrab team would then try to expand that access, often siphoning vast amounts of sensitive and internal documents in the process. The malware’s curators shipped five major revisions to the GandCrab code, each corresponding with sneaky new features and bug fixes aimed at thwarting the efforts of computer security firms to stymie the spread of the malware.

On May 31, 2019, the GandCrab team announced the group was shutting down after extorting more than $2 billion from victims. “We are a living proof that you can do evil and get off scot-free,” GandCrab’s farewell address famously quipped. “We have proved that one can make a lifetime of money in one year. We have proved that you can become number one by general admission, not in your own conceit.”

The REvil ransomware affiliate program materialized around the same as GandCrab’s demise, fronted by a user named UNKNOWN who announced on a Russian cybercrime forum that he’d deposited $1 million in the forum’s escrow to show he meant business. By this time, many cybersecurity experts had concluded REvil was little more than a reorganization of GandCrab.

UNKNOWN also gave an interview to Dmitry Smilyanets, a former malicious hacker hired by Recorded Future, wherein UNKNOWN described a rags-to-riches tale unencumbered by ethics and morals.

“As a child, I scrounged through the trash heaps and smoked cigarette butts,” UNKNOWN told Recorded Future. “I walked 10 km one way to the school. I wore the same clothes for six months. In my youth, in a communal apartment, I didn’t eat for two or even three days. Now I am a millionaire.”

As described in The Ransomware Hunting Team by Renee Dudley and Daniel Golden, UNKNOWN and REvil reinvested significant earnings into improving their success and mirroring practices of legitimate businesses. The authors wrote:

“Just as a real-world manufacturer might hire other companies to handle logistics or web design, ransomware developers increasingly outsourced tasks beyond their purview, focusing instead on improving the quality of their ransomware. The higher quality ransomware—which, in many cases, the Hunting Team could not break—resulted in more and higher pay-outs from victims. The monumental payments enabled gangs to reinvest in their enterprises. They hired more specialists, and their success accelerated.”

“Criminals raced to join the booming ransomware economy. Underworld ancillary service providers sprouted or pivoted from other criminal work to meet developers’ demand for customized support. Partnering with gangs like GandCrab, ‘cryptor’ providers ensured ransomware could not be detected by standard anti-malware scanners. ‘Initial access brokerages’ specialized in stealing credentials and finding vulnerabilities in target networks, selling that access to ransomware operators and affiliates. Bitcoin “tumblers” offered discounts to gangs that used them as a preferred vendor for laundering ransom payments. Some contractors were open to working with any gang, while others entered exclusive partnerships.”

REvil would evolve into a feared “big-game-hunting” machine capable of extracting hefty extortion payments from victims, largely going after organizations with more than $100 million in annual revenues and fat new cyber insurance policies that were known to pay out.

Over the July 4, 2021 weekend in the United States, REvil hacked into and extorted Kaseya, a company that handled IT operations for more than 1,500 businesses, nonprofits and government agencies. The FBI would later announce they’d infiltrated the ransomware group’s servers prior to the Kaseya hack but couldn’t tip their hand at the time. REvil never recovered from that core compromise, or from the FBI’s release of a free decryption key for REvil victims who couldn’t or didn’t pay.

Shchukin is from Krasnodar, Russia and is thought to reside there, the BKA said.

“Based on the investigations so far, it is assumed that the wanted person is abroad, presumably in Russia,” the BKA advised. “Travel behaviour cannot be ruled out.”

There is little that connects Shchukin to UNKNOWN’s various accounts on the Russian crime forums. But a review of the Russian crime forums indexed by the cyber intelligence firm Intel 471 shows there is plenty connecting Shchukin to a hacker identity called “Ger0in” who operated large botnets and sold “installs” — allowing other cybercriminals to rapidly deploy malware of their choice to thousands of PCs in one go. However, Ger0in was only active between 2010 and 2011, well before UNKNOWN’s appearance as the REvil front man.

A review of the mugshots released by the BKA at the image comparison site Pimeyes found a match on this birthday celebration from 2023, which features a young man named Daniel wearing the same fancy watch as in the BKA photos.

Update, April 6, 12:06 p.m. ET: A reader forwarded this English-dubbed audio recording from a ccc.de (37C3) conference talk in Germany from 2023 that previously outed Shchukin as the REvil leader (Shchuckin is mentioned at around 24:25).

404 Media has a story about Proton Mail giving subscriber data to the Swiss government, who passed the information to the FBI.

It’s metadata—payment information related to a particular account—but still important knowledge. This sort of thing happens, even to privacy-centric companies like Proton Mail.

This investigation is part of a collaboration between Bellingcat, Evident Media and CalMatters. You can watch Evident’s investigative video here, and read CalMatters’ report here.

In early January 2025, a gardener named Ernesto Campos was pulled over by Border Patrol agents in the city of Bakersfield, California. 

The agents were a long way from home: Bakersfield is over 240 miles (386km) from the US border with Mexico.

They were there as part of Operation Return to Sender, a Border Patrol surge in the city that acted as a portent of what was to come across the US in 2025.

Video footage shows one agent threatening to break Campos’ car window as they believed he was transporting an undocumented individual. 

Campos filmed the agents, who he said slashed his tyres before arresting him and a passenger. The agents’ faces later appeared on local news reports detailing the incident.

Ten months later, two of the agents visible in footage recorded by Campos were filmed in Chicago as Border Patrol agents descended on the city for what was dubbed “Operation Midway Blitz”.

One was seen grabbing a man by the throat before slamming him to the ground with help from other agents.

@govpritzker.illinois.gov 37 and Kedzie, East Garfield, Illinois. This is assault.

[image or embed]

— Daniel Connerton (@lordnad.bsky.social) 4 October 2025 at 20:56

The other was seen punching a man in the face before pulling his gun on protesters in a Chicago suburb.

These confrontations were not isolated incidents.

A federal judge in Illinois said in November that the use of force by federal agents in Chicago – including the use of tear gas and other less lethal munitions on multiple occasions –  “shocks the conscience”.    

A restraining order issued by that Illinois judge was vacated on appeal earlier this month. But what took place on the streets of Chicago also happened in other locations, with some of the same agents involved.

Bellingcat has worked with our partners at Evident Media and CalMatters to analyse over 85 hours of social media and bodycam footage, as well as court documents and incident reports, to try to unpack the actions of Border Patrol agents across the country. 

With agents often masked and badge or identification numbers not always visible, understanding exactly who has enforced the immigration surges of the past year has been difficult. This, in turn, has made public questioning and accountability around use-of-force incidents challenging. 

Nonetheless, we observed over 25 agents who appeared in more than one city, either by recognising their faces or matching badge numbers that were visible on their vests or arm patches. Many were seen alongside former Border Patrol Commander at Large, Gregory Bovino, on at least one occasion. 

But this is likely just a fraction of the agents who moved around the country to take part in Border Patrol surges in cities like Los Angeles, Chicago and Minneapolis. When speaking to reporters in January, Border Czar Tom Homan said he had spoken to some agents who had “been in theatre for eight months”. Many wore masks in the videos viewed by Bellingcat, and it was not always possible to identify number patches from social media or bodycam footage alone.

Although some of the agents we logged appeared on neighbourhood walkabouts or in footage where little happened, others could be seen using force on multiple occasions. For this story, we have focused on the actions of five agents whom we have been able to identify and who appear to have repeatedly used force in at least two, but often more, locations. We have decided to name those we have been able to identify just as we would name any officer involved in incidents like those detailed. But these were by no means the only agents whom we saw using force across one or multiple cities.

The footage we analysed also appears to show a steady escalation of violence and confrontational incidents as 2025 progressed, culminating in widespread use-of-force incidents in Chicago and Minneapolis, where two people, Renee Good and Alex Pretti, were killed by Immigration and Customs Enforcement (ICE) and Border Patrol agents, respectively, in early 2026.

Agents on the Move

While former Border Patrol Commander at Large Gregory Bovino is no longer in a national role, some of the agents observed and documented for this report appear to have travelled from his El Centro sector over the past year.

These included agent Timothy Donahue and Georgy Simeon, who were filmed by Ernesto Campos in Bakersfield. Donahue was the agent who was subsequently pictured pointing his gun at citizens just outside Chicago after a traffic incident (Donahue stated in his incident report that his car was rammed by an activist – something also described in Illinois federal judge Sara Ellis’ opinion – although Donahue’s report made no mention of punching a man in the face or unholstering his weapon). It was Simeon, meanwhile, who was filmed slamming a man to the ground after grabbing him by the throat.

Donahue was also spotted in social media footage in Los Angeles in June last year pushing a citizen who was blocking his vehicle, as well as grabbing a man on an immigration raid inside a car wash.

The Chicago publication, Unraveled Press, previously reported that Donahue was the owner of a social media account that made seemingly racist and sexist posts. Bellingcat and others have checked this account and found that an old profile picture showed an image of Donahue. Bodycam footage from outside a detention centre near Chicago also showed Donahue tackle a journalist from Unraveled without apparent warning.

Footage from Donahue’s own bodycam on Oct. 3 also appears to show him compiling an incident report with ChatGPT. The possibility of CBP agents using ChatGPT to compile incident reports was addressed by Judge Ellis in her ruling issuing a restraining order in November. She wrote that using ChatGPT to write reports “undermines their credibility and may explain the inaccuracy of some reports filed by CBP officers”.

The evidence doesn’t enable us to determine if Donahue used ChatGPT to compile the Oct. 31 incident report in which he did not mention he punched a man and unholstered his gun. 

Our reporting partners CalMatters emailed and called Donahue prior to publication. The email received no response. Donahue answered his cellphone but said, “never, ever call my cellphone again,” and hung up.

Simeon did not respond to emailed questions prior to publication, and calls to a number listed under his name went unanswered. 

The Department of Homeland Security (DHS) did not respond to questions posed about the actions of Donahue and Simeon detailed in this report or the agency’s use-of-force policies. They also did not respond to questions about whether it was permissible for agents to use generative AI platforms like ChatGPT to compile incident reports.

While the actions of Donahue and Simeon made news reports in various cities, the pair were far from alone in having their actions filmed and documented across the country. 

Kristopher Hewson, a supervisory agent based out of Bovino’s El Centro sector, was seen on bodycam footage in Chicago spraying an individual who was being held down by agents with what he detailed in his incident report as oleoresin capsicum (OC), also known as pepper spray, from what appears to be just a few inches away. The individual was on the ground and had one hand behind his back, but agents could be heard asking for his other hand during the incident. Hewson said in his incident report (see here and here) that the individual had been resisting arrest, but he also stated that he deployed the pepper spray from two feet away. Bodycam footage (see below) showed the canister beside the individual’s head right after a burst of spray can be heard.

Bodycam footage shows an individual being held down before pepper spray is released while he remains on the ground. Annotations after 15 seconds made by Bellingcat.

Hewson, who wore a mask but was identifiable in several videos by the C-29 ID number on his uniform, was later spotted in Minneapolis. He also said his name during one incident that allowed us to find other bodycam footage releases that belonged to him. In one video, his mask slipped, which allowed us to compare his face to images on his social media accounts.

Court testimony revealed that he was present in Los Angeles during a Border Patrol surge in the city in the summer of 2025. He was also seen alongside Bovino on numerous occasions, including in Chicago, where Bovino can be heard greeting him by saying, “Hey, Hewson”, in one video captured by the filmmaker Jeff Perlman.

In bodycam footage from Chicago a man can be heard saying that the person Hewson pepper-sprayed was his son, who was just 15 years old. This appears to be backed up by an incident report showing the individual’s date of birth. A short time later, Hewson can be heard shouting “get back or you will be gassed” at a group of protesters immediately before deploying tear gas towards them. As he throws the canister, a person can be heard shouting, “You’re not de-escalating shit, bro”. Hewson stated in his incident report (see here and here) that he gave a warning that CS gas was coming, but he did not detail how that warning was virtually instantaneous. 

All of these actions came two weeks after a judge issued a temporary restraining order on Oct. 9, preventing agents from using chemical agents on protesters and journalists unless there was an imminent threat of physical danger to federal forces. While that order was lifted in March 2026, it was still in force during the incidents detailed in this story.

Hewson was seen in Minneapolis in early 2026 alongside Bovino. He was captured on footage marching towards and tackling a Target employee, a teenage US citizen, who was directing insults at agents. A melee ensued at the front door of the Target store before two people were handcuffed and taken away by agents. Hewson’s C-29 number was visible as he led one of the men away. Both of those arrested were later released.

Hewson was questioned as part of a preliminary injunction hearing in Chicago, where, among other things, he stated (pages 183 and 184) that protesters have the right to shout and even swear at officers as long as they aren’t impeding their ability to carry out their work. He also said during questioning that tear gas “doesn’t harm people” (page 189). Multiple individuals who were impacted by the release of gas and chemical irritants in Chicago stated otherwise in incidents detailed in Judge Ellis’ ruling. 

When reached on the phone by CalMatters, Hewson said he could not comment. DHS did not respond to questions posed about the actions of Hewson detailed in this report or the agency’s use-of-force policies.  

El Paso Agents

Hewson was present and visible in footage when ex-Border Patrol Commander at Large Bovino appeared to push and manhandle a protester who crossed his path on Nicollet Avenue in Minneapolis. 

Also beside Bovino and Hewson that day were two officers based out of El Paso bearing the ID numbers EZ-2 and EZ-17. Both of these agents are seen wearing vests of the Border Patrol Tactical Division (BORTAC), a specialised unit that, according to the CBP, has a selection process “designed to mirror aspects of the US Special Operations Forces’ selection courses”. 

Bellingcat and Evident Media previously reported how EZ-17 fired less lethal munitions at protesters from close range a day after Renee Good was shot and killed by an Immigration and Customs Enforcement (ICE) officer in Minneapolis.

EZ-17 was accompanied during that incident by EZ-2, who could be seen spraying a chemical irritant in the face of a man who appeared to have thrown a snowball at him. EZ-2 was also seen throwing two female protesters to the ground outside Roosevelt High School in Minneapolis on Jan. 7. 

Both EZ-17 and EZ-2 were present in Chicago. EZ-17 was seen passing a tear gas canister to Bovino at an incident in the city’s Little Village neighbourhood on Oct. 23. 

The Chicago publication, Unraveled, previously identified EZ-17 as Edgar Vazquez and EZ-2 as Michael Sveum. Bellingcat was able to corroborate these identifications using similar techniques. Firstly, for Vazquez we compared images on his Facebook page with footage from EZ-2’s bodycam, which showed Vazquez inside a vehicle without a mask.

EZ-2 was identified in a similar manner. Bodycam footage from EZ-2 showed him looking at his phone. On the lockscreen was a picture of a man smiling and wearing a blue jacket. That same picture was posted on Sveum’s social media accounts and appeared to have been taken at an ultramarathon event whose organisers posted Sveum’s name alongside that same image.

When reached by phone by CalMatters reporters, Vazquez said that he could not comment. Sveum hung up immediately after CalMatters’ reporter introduced himself. DHS did not respond to questions posed about the actions of Vazquez or Sveum detailed in this report or the agency’s use-of-force policies.   

Dozens of other incidents where agents appeared to escalate rather than de-escalate situations, as well as use force or less lethal munitions, were logged as part of this investigation. This included agents pointing guns at protesters (see here and here) as well as using violent force and less lethal munitions on protesters, journalists and bystanders.

Bovino himself appeared to instigate confrontations with people, such as in Chicago, when he can be seen throwing a man to the ground before agents pounce on him, although he stated during his Illinois deposition that he did not think such actions represented a use-of-force incident. 

The former Border Patrol Commander at Large told CalMatters that he could not speak to the media without DHS approval prior to publication of this story. Requests sent to DHS to speak with Bovino went unanswered.

‘Unusual and Beyond the Pale’

According to John Roth, a former DHS Inspector General, and Steve Burnell, a former DHS General Counsel, the events of the past year, involving masked agents descending on select cities, have eroded trust and credibility in DHS and law enforcement.

While both agreed that there had to be professional immigration enforcement operations, they said that has to be done in a way that is responsible and ensures accountability when lines are crossed. 

“This is sort of a scary Orwellian thing”, Roth said. “I don’t think the public understands how unusual and beyond the pale it is to have these roving sort of groups of masked agents, out there handling the public.”

Burnell said that the inability to identify agents carrying out their work as enforcement officers was a particular concern: “At the end of the day, ICE and everybody at DHS are public servants. They’re supposed to be working for the public. And, you know, if somebody is working for you, you should have a right to know who they are, and you should have a right to hold them accountable and protest what they’re doing.”

Roth and Burnell both served under President Barack Obama and during President Donald Trump’s first term. The pair have testified to Congress in recent months, raising the alarm about what they see as a dismantling of accountability at DHS. Prominent members of the US government, including President Trump, have offered repeated support to Border Patrol agents, even after the death of protesters such as Renee Good.

Our partners at Evident and CalMatters showed Roth and Burnell some of the footage described in this report. While they refrained from commenting on individual incidents, Roth described the footage generally as “difficult to watch”.

“The question I’d ask. Have [agents] inserted themselves into something that requires them to use force,” said Roth. “In which case that would be a violation of DHS policy,” he added, referring to use-of-force policies that detail how law enforcement officers may use force when no “reasonably, safe and feasible alternative appears to exist”.

“It’s actually DHS policy that you [are required] to attempt to de-escalate when that’s possible. I mean, they don’t have a duty to retreat, but they do have a duty not to insert themselves into a place where use of force is necessary,” Roth said.

Burnell described a lot of what has happened over the past year as a type of “dominance display”.

“It’s there to send a message. And that is not de-escalatory. It’s the opposite,” he said.

Bellingcat, CalMatters and Evident Media jointly sought to contact DHS as well as all of the agents mentioned in this story prior to publication. 

We asked DHS whether any of the incidents detailed in this report violated DHS use-of-force policies or whether those policies had been updated under the current administration. 

We also asked if DHS was taking any action or providing further training to agents to ensure the public’s constitutional rights are respected during immigration enforcement operations carried out by Border Patrol.

DHS did not respond before publication.

---

Youri van der Weide, Kolina Koltai and Eoghan Macguire from Bellingcat, as well as Sergio Olmos from CalMatters and Kevin Clancy from Evident Media, contributed reporting to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Agents of Chaos: Unpacking the Actions of Border Patrol Agents Across the US appeared first on bellingcat.

Police in The Netherlands say they have arrested a 40-year-old man on suspicion of hacking... after police officers accidentally sent him a link granting him access to their own confidential documents Read more in my article on the Hot for Security blog.

To stay up to date on our latest investigations, join Bellingcat’s WhatsApp channel here.

Federal agents have frequently used so-called “less-lethal” weapons against protesters, including impact projectiles, tear gas and pepper spray, since the Trump administration’s nationwide immigration raids began last year. 

The use of less-lethal weapons (LLWs) has been controversial. While designed to incapacitate or control a person without causing death or permanent injury, they can cause serious or fatal injuries, especially when used improperly. 

Earlier this month, two protesters in California were reportedly blinded after US federal agents fired less-lethal rounds at their faces from close range. These incidents were part of a wave of violent clashes between agents from the Department of Homeland Security (DHS) and protesters across the country after the deadly shooting of US citizen Renee Good by an Immigration and Customs Enforcement (ICE) agent in Minneapolis. 

In protests in Minneapolis immediately following Good’s death, one Customs and Border Patrol (CBP) officer was captured on camera firing a 40mm less-lethal launcher five times in less than five minutes, with several of these shots appearing to target protesters’ faces, which is against CBP’s own use-of-force policy. 

A Bellingcat investigation of DHS incidents in October 2025 also found about 30 incidents that appeared to violate a temporary restraining order (TRO) issued by an Illinois judge restricting how DHS agents could use LLWs.

It is not always obvious whether the use of a LLW is authorised or not, as DHS component agencies such as ICE and CBP have varying guidance on factors such as the level of resistance an individual needs to show before a certain type of force can be used, as well as how specific types of less-lethal weapons and munitions can be used. 

While CBP’s use-of-force policy as of January 2021 is available on its website, ICE does not include specific guidance on less-lethal weapons in its 2023 “Firearms and Use of Force” Directive, and does not appear to have any publicly available policy that outlines this guidance.

DHS did not respond by publication time to Bellingcat’s request for the most recent DHS, CBP and ICE use-of-force policies, or to questions about what less-lethal weapons were authorised for use by the department and its component agencies. 

The DHS use-of-force policy, updated in February 2023, states that the department’s law enforcement officers and agents may use force, including LLWs, “only when no reasonably effective, safe and feasible alternative appears to exist”. It also says agents may only use a level of force that is “objectively reasonable in light of the facts and circumstances” that they face at the time.

DHS has repeatedly defended its use of riot-control weapons in protests across the country, stating that it was “taking reasonable and constitutional measures to uphold the rule of law and protect [its] officers”. 

Here’s how to identify some of the less-lethal weapons that DHS agents, including those from ICE and CBP, have been seen using during recent immigration operations. 

Compressed Air Launchers or ‘PepperBall Guns’

Compressed air, or pneumatic launchers, are essentially paintball guns that fire 0.68mm balls which break on impact. Often, this releases a powdered chemical irritant such as oleoresin capsicum (OC) or PavaPowder – the same compounds typically found in pepper spray. 

Compressed air launchers can also be used with other projectiles, such as “marking” projectiles that use paint to mark an individual for later arrest, and projectiles intended to break glass.

These weapons are often referred to as “PepperBall” guns, named after the leading brand PepperBall. However, DHS agents have also been seen carrying compressed air launchers from different brands, such as the FN303, produced by FN America.

Many compressed air launchers resemble standard paintball guns, with a distinct hopper or loader, which holds the ball projectiles, mounted to the top. They also have a compressed air tank that might be mounted to the side, bottom, or inside the buttstock (or back) of the weapon.

Many compressed air launchers, and less-lethal weapons in general, have very bright colours such as orange to distinguish them from lethal weapons. 

However, some compressed air launchers require closer scrutiny to distinguish them from firearms. 

For example, federal agents have been seen carrying FN303 compressed air launchers in videos of immigration enforcement activities. This weapon may resemble a rifle or other firearm, as it is usually all-black and, unlike the TAC-SF series PepperBall guns, lacks a visible hopper. 

If closer examination is possible, this weapon can be identified by its distinct features, including a circular magazine, side-mounted compressed air tank and a hose connecting the firearm to the air tank.

The January 2021 CBP Use of Force Policy places several restrictions on the use of compressed air launchers, including that they should not be used against small children, the elderly, visibly pregnant women, or people operating a vehicle. It also states that PepperBall guns should not be used within 3 feet “unless the use of deadly force is reasonable and necessary”. When using the FN303, the minimum distance is increased to 10 feet. 

The CBP Use of Force Policy says that the intentional targeting of areas where there is a “substantial risk of serious bodily injury or death is considered a use of deadly force.” Agents are instructed not to target “the head, neck, spine, or groin of the intended subject, unless the use of deadly force is reasonable”. PepperBall and FN America provide similar warnings about avoiding vital areas to prevent serious injury or death.

According to a 2021 report by the US Office of Inspector General, CBP requires its agents to recertify their training to use PepperBall guns and FN303s every year, but ICE does not.   

40mm Launchers

DHS agents also use 40mm launchers to fire “Less-Lethal Specialist Impact and Chemical Munitions (LLSI-CM)”. These launchers resemble military grenade launchers, but are used to fire less-lethal ammunition, including “sponge” rounds that can disperse chemical irritants on impact. 

Federal agents have been seen using or carrying the B&T GL06 launcher in footage of multiple incidents reviewed by Bellingcat. They have also been spotted with other 40mm launchers, including Penn Arms 40mm multi-shot launchers, which have a six-round cylinder magazine. 

There are various less-lethal munitions available for 40mm launchers, including those whose primary function is “pain compliance” through the force of impact, chemical irritants or a combination of both. 

Videos of clashes between Border Patrol agents and protesters show these launchers being used with combination rounds designed to hit the target for pain compliance while also delivering a chemical irritant such as OC or CS. 

Other munitions dispense chemical irritants or smoke after being launched. For example, in the protests immediately following Good’s death, a Border Patrol agent was seen firing a 40mm munition that released multiple projectiles emitting chemical irritants in a single shot, consistent with the “SKAT Shell” by Defense Technology.

Defense Technology’s technical specifications for its 40mm Direct Impact Rounds, which agents have been seen armed with, state that the munitions are considered less-lethal when fired at a minimum safe range of 5 feet and at the large muscle groups of the buttocks, thigh and knees, which “provide sufficient pain stimulus, while greatly reducing serious or life-threatening injuries”.

A DHS Office of Inspector General Report in 2021 noted varying guidance on the use of 40mm launchers among the department’s component agencies: “ICE’s use of force policy indicates that the 40MM launcher is deadly force when fired at someone, while the CBP use of force policy only directs officers not to target a person’s head or neck.”

CBP’s 2021 use-of-force policy states that agents should “not intentionally target the head, neck, groin, spine, or female breast”, and that anyone in custody who has been subject to such munitions should be seen by a medical professional “as soon as practicable”.

As of publication, DHS had not replied to Bellingcat’s questions about whether the department had an internal policy or provided training to staff on the minimum safe distance for 40mm less-lethal launchers as recommended by the manufacturers.

Hand-Thrown Munitions

DHS agents have also been seen throwing some less-lethal munitions, such as flash-bangs, smoke and “tear gas” grenades or canisters by hand. 

These munitions activate a short delay after the grenade is employed. When they activate, flash-bangs or “stun” grenades emit a bright flash of light and a loud sound that is designed to disorient targets. Both smoke grenades and tear gas (also known as “CS gas” or “OC gas”) emit thick smoke, but the former just impedes visibility, whereas the latter also contains chemical irritants that sting the eyes. 

Defense Technology offers smoke grenades with hexachloroethane smoke composition, but most of their smoke grenades use “SAF-Smoke”, a less toxic terephthalic acid smoke composition. 

Hexachloroethane, while toxic, is not a nerve agent, despite misinformation surrounding the deployment of green colored smoke grenades in Minnesota by DHS personnel. 

The shape and general construction, colour, and any text can help identify these munitions.

Less-lethal munitions typically feature the manufacturer’s logo, the model name of the munition, and the model or part number. The text and manufacturer logo are typically colour-coded to indicate the type of payload the munition has, with blue indicating CS, orange indicating OC, yellow indicating smoke, green indicating a marking composition and black indicating munitions with no chemical payload. 

A 2021 analysis by Bellingcat and Newsy found that Defense Technology and Combined Tactical Systems, the two manufacturers which produce most of the less-lethal munitions used by federal agents, both list the model numbers of their products online. Publicly available price lists for Defense Technology and Combined Tactical Systems can also be used to identify specific munitions by their model numbers. 

CBP’s 2021 use-of-force policy states that hand-thrown munitions are subject to the same restrictions for use as munition launcher-fired impact and chemical munitions. 

Chemical Irritant Sprays

DHS agents have also been using handheld chemical irritant sprays, often colloquially referred to as “pepper spray” or “mace”.

These sprays come in a variety of sizes and concentrations containing CS, OC, or both. Sprays used by law enforcement usually have a canister size designated “MK-” followed by a number, with higher numbers indicating larger canister sizes. The concentration of chemical irritants contained in the spray is also indicated on the canister.

The effectiveness of OC sprays is determined by the concentration of major capsaicinoids, which are the active compounds in OC that cause irritation. These sprays are also affected by the type of aerosol dispersion, or stream, used. Different types of streams increase or decrease the range of the spray as well as the coverage area. 

Civilian and law enforcement sprays range from 0.18 percent to 1.33 percent major capsaicinoids, according to SABRE, a producer of law enforcement and civilian sprays. Civilian sprays in the US can have the same major capsaicinoid content as law enforcement sprays, but are restricted to smaller-sized canisters. 

Defense Technology sprays have different colour bands to indicate the percentage of major capsaicinoids in the spray for OC. If the spray is CS, the CS concentration is standardised at 2 percent. The company uses a white band for .2 percent, yellow band for .4 percent, orange band for .7 percent, red band for 1.3 percent and a grey band for sprays containing either CS or a combination of OC and CS.

SABRE sells a variety of concentrations and sprays as law enforcement products, including 0.33 percent, 0.67 percent, and 1.33 percent major capsaicinoid concentrations of OC, as well as CS, and combination CS and OC sprays. The specific concentrations of SABRE sprays and the type of stream can also be identified by the text on the canister. 

One Air Force Research Laboratory study found that some sprays may pose a significant risk of severe eye damage due to pressure injuries resulting from large aerosol droplets hitting the eye. 

Defense Technology’s technical specifications recommend a minimum distance of between 3 and 6 feet, depending on the specific spray. SABRE does not publicly provide their minimum safe deployment distances, but a Mesa Police Department document lists a minimum distance of six feet for the SABRE Red MK-9. CBP’s 2021 use-of-force policy does not provide any minimum use distances. 

CBP’s 2021 use-of-force policy states that OC Spray may only be used on individuals offering “active resistance”, and that it should not be used on “small children; visibly pregnant; and operators of motor vehicles”. 

Electronic Control Weapons

DHS agents have also been seen using electronic control weapons (ECWs), which are colloquially called TASERs after the original weapon invented for law enforcement use, in immigration-related raids. 

ECWs can deliver a shock upon direct contact or launch probes that embed in the targeted person, incapacitating them. 

A shock on contact, or a “drive-stun” feature, delivers localised pain while in direct contact. When properly deployed, the probes send signals to the body that cause muscles to contract. A person’s body “locking up” from muscle contractions is an indicator that an ECW has been deployed. ECWs may be capable of using either or both methods.

ECWs are typically painted a combination of black and bright yellow, but this varies between models. The bright colour of parts of tasers is a common feature to help distinguish an ECW from handguns used by federal agents. When viewed from the front, a circular gun barrel is visible on handguns, while ECWs feature multiple circular probes or rectangular covers on the cartridge. ECWs also usually have flashlights and lasers, although handguns may also be equipped with these features. Some ECWs may make audible sounds when armed or deployed.

Axon, the predominant manufacturer of ECWs, produces several models including the TASER 10 and TASER 7. Axon provides a policy guide on recommended use of its TASER models to law enforcement agencies, which recommends targeting below the neck from behind, or the lower torso from the front. It recommends avoiding sensitive areas including the head, face, throat, chest and groin. 

Axon also recommends against using ECWs against small children, the elderly, pregnant people, very thin people and individuals in positions of increased risks such as running, operating a motor vehicle, or in an elevated position “unless the situation justifies an increased risk”.

CBP’s 2021 use-of-force policy, in addition to restricting the use of ECWs against small children, the elderly, visibly pregnant women, and people operating a vehicle, states that they should not be used against someone who is running or handcuffed. However, the policy does state that there may be an exception to the rule against using ECWs on a running person if an agent has a “reasonable belief that the subject presents an imminent threat of injury” to an agent or another person. This threat, according to the policy, must “outweigh the risk of injury to the subject that might occur as a result of an uncontrolled fall while the subject is running”.

---

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Identifying ‘Less-Lethal’ Weapons Used By DHS Agents in US Immigration Raids and Protests appeared first on bellingcat.

This is coming:

The Irish government is planning to bolster its police’s ability to intercept communications, including encrypted messages, and provide a legal basis for spyware use.

This investigation is part of a collaboration between Bellingcat and Evident Media. You can watch Evident’s video here.

The fatal shooting of Renee Nicole Good by Immigration and Customs Enforcement (ICE) agent Jonathan Ross in Minneapolis on Jan. 7 sparked nationwide protests, with often violent clashes breaking out between protesters and federal agents. Some of the most intense protests took place in Minneapolis itself, with an agent using a less-lethal launcher in ways that experts told Bellingcat were “punitive” and “questionable at best”.  

This agent, an elite Border Patrol officer who was masked but identifiable through the uniform number patch EZ-17, was captured on camera firing his B&T GL06 40mm less-lethal launcher at protesters five times in five minutes as he travelled down a street adjacent to where Good was killed.

While “less-lethal” weapons are not designed to kill, they can still result in serious injuries and even death when misused. In California, a protester said he was permanently blinded in one eye after he was shot with a less-lethal weapon at a protest on Jan. 13. Footage shows a DHS officer firing a PepperBall gun at his face at close range, causing him to bleed. 

Last year, a judge in Illinois ordered an injunction limiting federal agents’ use of force in the state due to what she described as aggressive use of force against peaceful protesters that “shocks the conscience”. However, Bellingcat found multiple examples of force and riot control weapons being used during immigration raids and in apparent violation of that order in the weeks immediately after.

Experts told Bellingcat that most of the less-lethal shots fired by EZ-17 after arriving at the site of Good’s shooting with Border Patrol Commander Gregory Bovino on Jan. 7, also appear to breach CBP’s use-of-force policy. 

Bellingcat analysed videos from news outlets and social media and mapped out all five shots the agent fired.

Four of these shots appeared to be aimed directly at protesters’ faces at close range, while a fifth was fired from a distance towards a crowd after tear gas had already been deployed. A sixth shot, captured at another location on the same day, also shows EZ-17 firing a shot from the same launcher at someone at head-level.

As of publication, DHS had not responded to Bellingcat’s requests for comment.

The Agent

In footage captured by independent news outlet Mercado Media, EZ-17 is seen inside the crime scene tape perimeter, standing near Bovino, with eight 40mm munitions on his belt. 

These included three sponge-nose impact rounds, which are designed for “pain compliance” through the direct force of impact, and five cylindrical munitions that can be filled with different payloads and chemical irritants. “BLAST” in blue text is visible on one munition, indicating a “Muzzle Blast” munition with a CS gas fill – commonly known as tear gas. At least three additional 40mm munitions are visible in his plate carrier. 

Another video by independent news network Status Coup News showed uninterrupted footage capturing five shots from the time the agent exited the crime scene perimeter (at 5:02) shortly before firing the first shot, to when he left in a truck with other agents (9:23) immediately after firing the fifth shot. 

The back of EZ-17’s vest shows that he belongs to CBP’s Border Patrol Tactical Unit (BORTAC). BORTAC is a specialised and highly trained unit that, according to the CBP, has a selection process “designed to mirror aspects of the US Special Operations Forces’ selection courses”. 

Members of BORTAC have regularly accompanied Bovino as he leads Trump’s immigration raids, including EZ-17 and EZ-2, another CBP agent that was frequently seen beside EZ-17 in the footage from Jan. 7. Both agents have continued to accompany Bovino on raids in Minnesota in subsequent days.

EZ-17 was also spotted alongside Bovino at an incident in Illinois, where a CBP agent in front of him appeared to shoot a protester at close range.

First Shot

In the Status Coup Media video, EZ-17, and three other CBP agents, including EZ-2, can be seen leaving the crime scene tape perimeter set up after Good’s death, pushing protesters who are physically blocking them. Snowballs are thrown at the CBP agents. 

EZ-17 and EZ-2 push a man to the ground who is blocking them. The video shows a clear view of his belt, and the eight munitions visible on his arrival at the scene are still loaded at this point.

EZ-17 initially aims at the man he had pushed to the ground, but then turns and aims at the face of another nearby protester who did not appear to be involved in any previous physical contact with the agents. As EZ-17 aims at the face of this protester, the man raises his arms to shield himself before EZ-17 fires. 

The large cloud of chemical irritant appears to disperse from the barrel immediately on firing for this shot as well as the next three shots EZ-17 fires.

This is consistent with the “Muzzle Blast” 40mm munitions produced by Defense Technology, which were seen in images of the agent’s belt.  Defense Technology says in its product specifications for 40mm “Muzzle Blast” munitions that these rounds provide “instantaneous emission” of a chemical agent in the immediate area (30 feet) of the person shooting them. 

Second Shot

Seconds later, after EZ-17 is hit by a snowball, he turns and fires towards the face of a man who is filming in the direction the snowball came from. It is unclear if this man is the intended target or someone else in the crowd behind him. 

Third Shot

The third shot is at a man who was seen on video throwing a snowball that hits EZ-2.

EZ-17 and EZ-2 chase this man, with EZ-2 spraying him in the face with Oleoresin Capsicum (OC) spray, also known as pepper spray or mace. EZ-2, when leaving the perimeter, can be seen carrying a Vexor Professional-branded canister.

Vexor exclusively produces various types of OC spray, and does not list any chemical irritant sprays that do not contain OC on its website. 

The man slowly walks closer to the agents, saying that he has been maced. EZ-17 pushes the man, then aims at the man’s face and fires. 

The seals that keep the chemical irritant inside the 40mm canister before it is fired can be seen hitting the man in this shot, with the smoke surrounding his face.

Fourth Shot

After the third shot, an unmarked white CBP truck turns off the street and tries to drive down an alley. Protestors begin physically blocking the vehicle, throwing snowballs and other objects at it. The windshield gets cracked, and the back window gets broken. EZ-17 and EZ-2 physically push the protesters blocking the truck out of the way, with EZ-2 also deploying what appears to be a canister of OC spray.

A person begins banging on the windows of the truck, and EZ-17 rushes around the truck to fire his launcher towards this person’s face.

University of St. Thomas School of Law professor Rachel Moran, who reviewed the videos at Bellingcat’s request, said that of the six shots we identified as being fired by EZ-17 this one appeared to be “the most reasonably related to carrying out the duty of helping the vehicle evacuate” as the person targeted was “still pounding aggressively” on the vehicle when EZ-17 fired the shot.

Fifth Shot

After EZ-17’s fourth shot, EZ-2 deploys a tear gas grenade, and the CBP truck moves down the alley, away from protesters. 

EZ-17 can be seen reloading next to EZ-2, who is holding a canister that appears to be OC spray, and another CBP agent holding a PepperBall gun.

The CBP agent with the PepperBall gun appears to cross over to the other side of the truck, and EZ-2 appears to begin to enter the vehicle. 

As soon as the back right door on the truck closes, gas from the muzzle can be seen from where EZ-17 was standing. 

This fifth shot appears to be “skip-fired” or aimed towards the ground before ricocheting upwards, at close range, resulting in three visible projectiles going towards the crowd of people, narrowly missing some. 

Although the footage is blurry with the tear gas from the grenade EZ-2 threw still clouding the air, EZ-17 appears to be the only agent who could have fired this: EZ-2 was not armed with a projectile launcher, and PepperBall guns like the one carried by the other CBP agent do not have munitions that release multiple projectiles with a single shot.

Chemical irritant smoke was seen being released by the projectiles from this last shot as it travelled through the air. 

The multiple projectiles are consistent with the 40mm “SKAT Shell” by Defense Technology, which ejects four separate submunitions upon firing, each dispensing chemical irritants. In one of the videos, a SKAT Shell is seen in EZ-17’s belt.

Roosevelt High School

In another video from the same day, EZ-17 was filmed again alongside Bovino when CBP showed up at Roosevelt High School in Minneapolis at dismissal time. 

This video showed EZ-17 again firing his B&T GL06, apparently towards someone’s head, this time someone who threw a snowball at a CBP agent. 

‘Punitive and Unlawful’

Patrick Wilcken, Amnesty International’s Researcher on Military, Security and Policing issues, said that while the overall situation shown in the videos was tense, with “verbal abuse, some shoving/throwing of snowballs and the attempted obstruction of a vehicle”, there did not seem to be any substantial physical threat to the agents that would have justified the use of less-lethal weapons. 

Wilcken, who reviewed the videos of all six shots fired by EZ-17 at Bellingcat’s request, said the actions of agents shown in these videos – pursuing fleeing protesters and in some instances firing at protesters who appeared to be trying to protect themselves – were “punitive and unlawful”. 

CBP’s use-of-force policy states that weapons such as 40mm launchers are only authorised for use against subjects offering “active” or “assaultive” resistance. Similarly, DHS’ use-of-force policy guidance says agents may use force “only when no reasonably effective, safe and feasible alternative appears to exist”, and may only use the level of force “objectively reasonable in light of the facts and circumstances” that they face at the time force is applied.

“Officers should only resort to less lethal weapons when faced by a serious physical violence posing a threat to themselves or others that is not possible to diffuse in any other way,” Wilcken said. “They must exercise force with restraint, to the minimum extent possible while respecting and enabling the right to peaceful assembly.”

University of St. Thomas School of Law professor Rachel Moran agreed that whether the use of less-lethal weapons is justified largely depends on the level of threat or aggression the agent faces from the person targeted. Although she said the fourth shot could be justified in helping the CBP vehicle evacuate, Moran said the justification for the other shots was “questionable at best” based on the footage. 

For example, Moran noted that although the man in the third shot had thrown a snowball at another officer, any threat had dissipated by the time EZ-17 shot him because the man had already run away and clearly had his hands up with nothing in them. “The shot appears to be more retaliatory than defensive”, she said. 

Similarly, for the incident at Roosevelt High School, Moran noted that EZ-17 did not appear to be in any danger from the snowball, as the person who threw it was already retreating before the agent fired.

Moran said that if EZ-17 was carrying a B&T GL06 40mm launcher, he did appear to violate CBP policy by directly aiming at people’s faces.

B&T GL-06 by 草泥马小逼崽子 on Sketchfab

CBP’s use-of-force policy states that agents using munitions launchers, including 40mm launchers “shall not intentionally target the head, neck, groin, spine, or female breast”. However, Bellingcat’s analysis of the six shots fired by EZ-17 showed that he appeared to be aiming at the head of targets in five of these cases. 

Travis Norton, a retired police lieutenant and use-of-force consultant, told Bellingcat that standard training and manufacturer guidance for 40mm launchers recommended aiming at “large muscle groups of the lower body” while avoiding “prohibited target areas” like the head, neck, chest, spine and groin. This helps to reduce the risk of significant injury, Norton said. 

Norton said that 40mm launchers are not intended for random or area fire: “Their use is limited to clearly identified individuals who are engaging in violent or dangerous behaviour and cannot be safely addressed by other means.”

Although he declined to comment on specific incidents based solely on video footage, Norton said that skip-firing – which was used in the fifth shot identified by Bellingcat, and the only shot where a person did not appear to be targeted at head-level – was generally not a standard or recommended practice in most law-enforcement training programs. 

“Because ground conditions, angles, and projectile behaviour are unpredictable, skip-firing reduces accuracy and control and increases the risk of unintended injury,” Norton said. 

---

Pooja Chaudhuri contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Five Shots in Five Minutes: Analysing One Federal Agent’s Use of Less-Lethal Launcher in Minneapolis appeared first on bellingcat.

To stay up to date on our latest investigations, join Bellingcat’s WhatsApp channel here

On Jan. 7 Renee Good, a 37-year-old mother of three, was shot and killed by a federal agent on Portland Avenue in Minneapolis, Minnesota. The incident was captured on several separate videos and spread rapidly on social media. The videos were soon accompanied by competing analysis and narratives as to what had happened.

Bellingcat looked at five videos filmed during the incident, including one apparently from the phone of Jonathan Ross, the ICE agent who shot and killed Good.

While each video alone provides valuable information, the five together provide a fuller picture of the situation as it unfolded.

Synced Overview

One of the ways to visualise the full incident was by tracking the movements of the key players on an overview map, which Bellingcat did shortly after the incident on Jan. 7. 

Using eyewitness video shared by Daniel Suitor on Bluesky we tracked the movements of federal agents at the scene – including Ross as he moved around the street. The video also captured the position and movements of Good’s vehicle before, during and after the shots were fired.

We’ve also updated our animated map of the positions of agents and vehicles during the incident here with new footage published by @cnn.com that shows the shooter closer to a white SUV prior to the shootingbsky.app/profile/bell…

[image or embed]

— Bellingcat (@bellingcat.com) Jan 8, 2026 at 18:38

Close-Up View

Another video, filmed by a bystander and later shared by the Minnesota Reformer, shows a closer view of Ross’ movements in the moments immediately before the shooting. 

In the video, Ross can be seen with his phone in his left hand filming Good before he pulls his gun out of its holster with his right hand. Roughly one second elapses before he fires the first round through Good’s front window. Two more shots follow.

A still from that same video captures Ross as he walks past in the seconds after the shooting. A camera app appears open on his phone.

Agent’s Phone

On Jan. 9, a video filmed by Ross was published on X by a conservative news outlet called Alpha News. 

By syncing this video up with the other four available videos, it was possible to observe more of what occurred, including from Ross’ rough perspective. However, it is important to note that Ross was holding the phone slightly away from his body, so what appears in the video would be marginally different to what would have been his line of sight. 

In the footage, Good can be seen backing up before veering to the right as Ross and the camera move to her left. It is not clear from this footage exactly how close the car came to Ross, as the cellphone points up and away as the vehicle moves forward. Someone can be heard saying “whoa” before gunshots are heard. 

An angle captured from down the street (middle lower right in the synchronised video below and in full view here) – which some have suggested shows Ross being hit by the vehicle – does appear to show the vehicle pass close to the agent as he fires. However, the close-up video shared by the Minnesota Reformer (middle top and in full view here) shows Ross moving out of the way and to the side of the vehicle as he fires.

Another video published by CNN (middle lower left) shows a head-on view of the incident from surveillance footage.

New footage from the ICE agent’s phone who shot at Renee Nicole Good in Minneapolis has emerged, posted by AlphaNews on X. We’ve placed that footage in a synced timeline with the other currently available footage.

[image or embed]

— Bellingcat (@bellingcat.com) Jan 9, 2026 at 21:23

Almost one week after the incident, protests have been held in Minneapolis and other cities in the US. 

US President, Donald Trump, and Department of Homeland Security, Kristi Noem, initially said that Good had tried to run over an ICE officer after blocking the road, labelling her a “domestic terrorist”. However, the Democratic mayor of Minneapolis, Jacob Frey, said that version of events was “garbage” and disproven by the video footage.

On Monday Jan. 12, Noem, told FOX News that more ICE agents would be sent to Minnesota.

Individual links to each of the five videos detailed above can be found here, here, here, here and here.

---

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Analysing Footage of Minneapolis ICE Shooting appeared first on bellingcat.

To stay up to date on our latest investigations, join Bellingcat’s new WhatsApp channel here.

This investigation is part of a collaboration between Bellingcat and Evident. You can watch Evident’s video here.

Children in Chicago’s Old Irving Park neighbourhood were preparing for a Halloween parade on Oct. 25 when federal agents reportedly deployed tear gas on the street to disperse protesters opposing immigration-related arrests in the neighbourhood.

“Those kids were tear gassed on their way to celebrate Halloween in their local school parking lot,” US District Judge Sara Ellis said in court on Tuesday, according to a CBS News report. “I can only imagine how terrified they were.” 

Ellis was questioning US Customs and Border Patrol Commander Gregory Bovino over this and other incidents that protesters allege violate a temporary restraining order (TRO) she issued earlier this month. 

The Oct. 9 TRO was issued after a group of journalists, faith leaders and protesters filed a lawsuit against the Trump administration over what they described as a “pattern of extreme brutality” by federal agents against peaceful protesters since Operation Midway Blitz – a multi-agency operation against “criminal illegal aliens” in Illinois – began on Sept. 2. 

When Judge Ellis asked Bovino to produce all use-of-force reports since Sept. 2 from agents involved in Operation Midway Blitz by the end of Tuesday, Bovino said it would be impossible because of the “sheer amount”. Ellis then ordered Bovino to turn over these reports, along with the accompanying body camera footage, by the end of Friday, Oct. 31.

The court order places restrictions on federal agents’ crowd-control measures within the state, including their use of “riot control weapons” such as tear gas and pepper spray, the use of force against individuals and requiring people to leave public spaces that they lawfully have the right to be in. 

A subsequent court filing on Oct. 27 alleges that federal agents have violated the TRO “almost every day” since it was issued. “Immigration enforcement does not typically require the daily use of tear gas on civilians in residential areas,” the filing stated.

Bellingcat’s analysis of social media videos from 28 events in Illinois from Oct. 9 to Oct. 27 found multiple examples of force and riot control weapons being used.

In total, we found seven that appeared to show the use of riot control weapons when there was seemingly no apparent immediate threat by protesters and no audible warnings given. Nineteen showed use of force, such as tackling people to the ground when they were not visibly resisting. Another seven showed agents ordering or threatening people to leave public places. Some of the events identified showed incidents that appeared to fall into more than one of these categories. 

You can view the full dataset here. 

View this post on Instagram

A post shared by Evident Media (@evidentmediaorg)

It is important to note that the full context of an incident may be unclear from videos on social media alone. Bystanders often only begin filming when an arrest is already ongoing, for example, which can make it difficult to determine what happened in the moments before force was applied. Each of the events included in our dataset were verified to have taken place in Illinois in recent weeks with at least two sources – videos taken by different people, local reporting or statements from the Department of Homeland Security (DHS).

The DHS – which oversees Customs and Border Patrol (CBP) as well as the United States Immigration and Customs Enforcement (ICE) – has justified the use of force or riot control weapons by saying that protesters were threatening or attacking agents. 

Bellingcat asked DHS whether it had any response to the TRO or allegations that agents had violated the TRO.

In a response received after the publication of this piece, Assistant Secretary Tricia McLaughlin did not directly address the TRO but said DHS officers “only use crowd control methods as a last resort when repeated warnings have been given”. 

DHS also said, several times in its response, that its officers were “facing a 1,000 percent increase in assaults against them”. This is a claim that the department has previously made when commenting on clashes with protesters during immigration operations in other cities such as Los Angeles and Portland. However, an NPR analysis of court records earlier this month only showed about a 25 percent rise in charges for assault against federal officers through mid-September, compared with the same period a year ago.

The TRO does say that riot control weapons or force may be deployed in circumstances such as where there is an “immediate threat” of physical harm to the agents or others, multiple warnings have been given, or where “necessary and proportional” for an arrest. We did not include videos where it was obvious that such conditions had been met. 

Despite the limitations, videos taken by eyewitnesses are often the only evidence of such incidents, which may not be reported by media or may have concluded by the time journalists reach the scene.

Riot Control Weapons

In our analysis, we found videos showing the use of riot control weapons such as tear gas, pepper spray and other less-lethal weapons in seven events where protesters appeared to be posing no visible threat in the footage, and where no audible warnings appeared to be given. 

Among its provisions, the TRO prohibits the use of these types of weapons on people “who are not posing an immediate threat to the safety of a law enforcement officer or others” and also in cases where using them on intended targets would result in injury to those who aren’t posing any threat. 

One of these videos captured the moment Bovino threw what looked like a tear gas canister during the Oct. 23 clashes in the Little Village neighbourhood, during an operation where eight people were arrested, including a 16-year-old US citizen. Bovino and DHS have said that he was hit on the head by objects thrown by protesters before he threw the tear gas canister.  

DHS posted a video on Facebook, claiming that it was evidence that “the use of chemical munitions was conducted in full accordance with CBP policy and was necessary to ensure the safety of both law enforcement and the public”. 

The video showed a rock skidding on the ground behind Bovino, but did not show the moment that it allegedly hit the Border Patrol chief on the head. A protester who filmed the encounter has reportedly disputed that Bovino was hit. 

Tear gas was also deployed on Oct. 12 in Albany Park, Oct. 14 in the East Side of Chicago, Oct. 24 in Lakeview and Oct. 25 in Avondale. Bellingcat reviewed footage of each of these incidents and could not see threats to the agents’ safety in the videos before tear gas was deployed, or that audible warnings were issued within the footage.

Videos we reviewed also showed other types of riot-control weapons mentioned in the TRO. Another video from the Oct. 23 protests in Little Village, posted by a protester named Enrique Bahena, shows an agent shooting a less-lethal projectile directly at the person filming. An Oct. 26 court filing said Bahena was shot in the “neck from five feet away with a pepper ball”. 

Bellingcat’s analysis of the video, which appears to be the same one shown in screengrabs in the court filing, found that the video in fact shows the agent deploying a B&T GL-06 40mm launcher, which can be used to launch chemical irritant rounds such as the one visible in the video.  

Bahena said in an interview with local outlet Chicago Block Club that agents did not give warnings before they shot him “in the throat” and threw gas canisters at the group of protesters who were shouting at them to leave. He also said in the interview that protesters did throw objects at agents, but that this was after agents had already used force.

B&T technical specifications for their 40mm projectiles state that “shots to the head, neck, spine, or heart are to be avoided unless lethal force is justified”, and advise users to aim at the waistline. 

A DHS Office of Inspector General Report in 2021 states that “ICE’s use of force policy indicates that the 40MM launcher is deadly force when fired at someone, while the CBP use of force policy only directs officers not to target a person’s head or neck”.

During this same event in Little Village, videos show other officers appearing to fire less-lethal weapons towards protestors.

The TRO restricts the use of Compressed Air Launchers or Munitions Launchers such as 40mm launchers to strike a person, including on the neck, unless they pose an “immediate threat of causing serious bodily injury or death”.  

In another incident on Oct. 22, an agent appeared to quickly roll down a window and spray what appeared to be a chemical irritant at protesters who were confronting federal officers near a Sam’s Club store in the Cicero neighbourhood of Chicago. 

The incident was captured in two separate livestreams, which show a few protesters near an unmarked dark grey Chevrolet Tahoe with no front licence plate. One of the protesters taps on the window of the vehicle. Someone then rolls down the window and sprays what appears to be a liquid very quickly before rolling the window back up as the car leaves the scene. One of the people filming said in the post for the livestream that this was pepper spray, although Bellingcat was unable to verify this. 

DHS did not respond directly to Bellingcat’s questions about whether it believed that the use of riot-control weapons – including during the Oct. 23 Little Village protests – was justified based on the terms of the TRO. 

Use of Force

Bellingcat also reviewed multiple videos of agents using force in arrests that appeared to be related to Operation Midway Blitz, and identified those where the force shown being used looked potentially excessive and the person being arrested did not appear to pose an “immediate threat of physical harm to others” – a requirement in the TRO for using force such as tackling or shoving someone to the ground.

On Oct. 10, a day after the TRO was issued, an ICE agent was seen dragging a teenage girl out of a car in Hoffman Estates, a suburb of Chicago, and tackling her to the ground while she shouted “I’m not resisting”. The teenager, reportedly an 18-year-old US citizen, was handcuffed and an officer appeared to put a knee on her back. DHS Assistant Secretary McLaughlin said in a post that the incident was a “burglary” arrest from 2024 which did not involve ICE – although this has been debunked by multiple news outlets. 

Bellingcat asked DHS about this specific incident and why McLaughlin’s post remains up on X despite multiple news outlets verifying that the incident took place this month in Hoffman Estates, but did not receive a response. 

This was not the only case where DHS’ version of events appears to contradict video footage of the incident posted on social media. 

On Oct. 22, a woman identified by DHS as Isabel Mata was arrested by Border Patrol agents in Little Village. A video of the incident shows multiple agents tackling her while one of them has his knee on her back to hold her to the ground. DHS stated Mata “allegedly threatened a law enforcement officer after stating she would put a hit out on Chief Gregory Bovino”. Bellingcat reviewed a video that showed the minutes before Mata was tackled by agents but did not hear any threat being made, even though Mata appeared to have been standing near the person filming.

DHS initially did not respond to Bellingcat’s questions about this incident, but after publication it sent us the same statement it made on Oct. 24 with the allegation that Mata had threatened Bovino.

Another video from Oct. 10 appears to show agents colliding with a car on Hubbard Street and dragging the driver out by her legs. The woman, identified as Dayanne Figueroa, told Newsweek that she was on her way to get coffee before work and “instead of handling the situation as a routine traffic incident”, masked armed agents forcibly removed her without questions or informing that she was under arrest.

DHS reportedly told Newsweek that Border Patrol was making a targeted arrest when Figueroa’s vehicle blocked agents and struck an unmarked government vehicle. They also said she “violently resisted” and was arrested for assault on a federal agent.

The video shows agents arresting someone, before one of their vehicles swerves into another lane and appears to hit Figueroa’s car. Multiple bystanders can be heard shouting that the agents hit Figueroa’s car first and that they were making a U-turn in the middle of the street.

Bellingcat asked DHS about the conditions under which it would consider the use of force – such as tackling or shoving people to the ground – proportionate and necessary, but did not receive a direct response to this question. 

Dispersal Orders

The TRO prohibits federal agents from “issuing a crowd dispersal order requiring any person to leave a public place that they lawfully have a right to be, unless dispersal is justified by exigent circumstances as defined by Department of Homeland Security Use of Force Policy”. 

Bellingcat has asked DHS about when agents are justified in telling people to get off the streets, or people in cars to stop following them, and whether there are any laws preventing people from following or filming federal agents from a distance. DHS did not respond to these questions in their response after this story was published.

However, we found several examples of agents telling people to leave public places when they did not appear to be impeding arrests in video footage. 

In a video recorded in Chicago’s Arlington Heights on Oct. 24, a masked man with a rifle tells someone filming to “get the f*** across the street” and “get back to your car”. The person filming is shouting that agents have assaulted a woman and slapped her phone out of her hands, and the video appears to show a woman in a scuffle with a masked agent. A separate video from the same location and date shows agents arresting a man who is on the ground. 

In some of these cases, agents appear to be pointing non-lethal weapons at civilians while ordering them to leave public spaces. A video from Oct. 16 shows agents telling protesters to “get out of the street”, pointing pepper spray at them and threatening them with arrest in Chicago’s Evanston neighbourhood.

A similar incident took place in Rolling Meadows on Oct. 19 when an officer was pictured pointing a pepper ball gun from a moving vehicle at a person filming him in a parking lot. A federal judge reportedly said the incident was “troubling” and has called for answers. 

On Oct. 20, in Berwyn, an agent pointed a gun at a woman who said she was pregnant. By the woman’s account, the agents were chasing after two people and the video shows her honking to alert those nearby. A DHS agent told Newsweek that the agent “acted to protect his life and safety of others around him and showed great restraint”.

Judge Ellis’ TRO is set to expire on Nov. 6. There is a scheduled hearing the day prior, Nov. 5, to determine if the TRO should be converted into a preliminary injunction. 

---

Editor’s Note (Oct. 31): This story was updated to include a response by the Department of Homeland Security who responded to our request for comment after publication.

Pooja Chaudhuri, Kolina Koltai, Youri van der Weide, Sebastian Vandermeersch, Melissa Zhu and Trevor Ball contributed research to this piece, alongside Fraser Crichton, Olivia Gresham, Bonny Albo and Vladimir Zaha from Bellingcat’s Global Authentication Project.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here and Mastodon here.

The post ‘Pattern of Extreme Brutality’: Tear Gas, Pepper Balls Among Weapons Deployed Against Protesters in Illinois appeared first on bellingcat.

Four masked men in police tactical vests surround a young scooter rider, cuffing his hands behind his back. One person, whose face is fully obscured with a cap, sunglasses and a balaclava, is heard on eyewitness video telling the scooter rider: “You came into this country as a J1, as an exchange student. You didn’t show up … You lied, ok?” 

“Yeah, he’s illegal, either way,” another person is heard saying, before they lead him to an unmarked car. 

Nearby, two Metropolitan Police Department (MPD) cars are seen blocking part of the lane. Uniformed MPD officers stand around the area, neither intervening nor appearing to participate directly in the arrest. 

The video was posted by Will Allen-DuPraw, whose profile says that he is a photographer and videographer based in DC, on Sept. 2. Allen-DuPraw wrote in the post that bystanders reported that authorities were stopping Latino men on scooters along Florida Avenue Northwest, a major road in Washington DC, and had arrested two. 

An urgent alert sent out on the morning of the same day by Stop ICE Alerts, a community-driven alert network for those affected by Immigration and Customs Enforcement (ICE) raids, reported similar information. The alert said that ICE, Homeland Security Investigations (HSI) – a branch of ICE focused on investigating transnational crime – and MPD were “stopping Latinos on scooters” and had arrested one or two people along Florida Avenue Northwest. 

With US President Donald Trump’s crackdown on immigration, scenes of federal agents detaining people while accusing them of immigration offences have been cropping up all over social media from around the country. An analysis of ICE arrest data by DC-based think tank Cato Institute found that in June and July alone, ICE conducted almost 9,000 street arrests nationwide of immigrants who had no criminal convictions, charges, or removal orders. About 90 percent of these were immigrants from Latin America.

The incident on Florida Avenue Northwest was one of 42 that Bellingcat and our partner Evident Media geolocated and verified using videos and photos from social media and news reports. These showed federal agent encounters in the capital, in the month or so since Trump’s federal takeover of DC on August 11. The full dataset can be downloaded here.

In the three weeks after DC was placed under federal control, Trump’s administration said more than 300 people without legal immigration status were arrested in the District. 

Like previous immigration raids that we documented in Los Angeles, the federal agents involved in the DC cases were often masked and in military wear. Some wore generic “Police” vests, while others had attire indicating specific government entities such as ICE and HSI. The vehicles they used were usually unmarked, with plates from a variety of US states.

There is one key difference, however. In LA, a state law prohibits local law enforcement from using its resources for immigration enforcement in most cases. But in DC, where no such law applies, MPD has frequently been seen working with federal officers since the federal takeover last month. 

In half of the incidents in our dataset, local DC law enforcement could be seen working alongside federal agents. Most of the DC local police were from MPD, though some were from the Metro Transit Police Department. Aside from ICE and HSI, agents from federal agencies including the US Park Police, Federal Bureau of Investigation (FBI), Drug Enforcement Administration (DEA) and Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) were also seen in the videos.

“We are definitely seeing MPD cooperate at a level we’ve never seen before, and it is resulting in people getting arrested and sent to detention,” Michael Lukens, who runs immigrant rights centre Amica, told Evident Media.

MPD has not replied to Evident Media’s queries about their cooperation with federal law enforcement agencies as of publication.

Of the cases we analysed, 22 involved the arrest of delivery drivers or tradespeople, such as workers in an air conditioning and heating truck.

In two widely shared videos, DC resident Tyler DeSue claimed agents pulled over his Uber Eats driver for having “incorrect tags” on his bike, then checked his registration and insurance and saw it was valid. DeSue said they then asked for his immigration status and detained him.

The videos DeSue posted did not show the initial encounter between the agents and the driver, but did show the arrest. DeSue can be heard in one video telling agents that the man they were questioning did not understand what they were saying, and they should use Google Translate. Another witness is heard calling the arrest “ridiculous” and questioning if the agents have “better things to do than to harass Uber Eats drivers”. 

In a second video, also posted by DeSue, agents are seen wrapping the man in chains before putting him in an unmarked car. 

Another video posted by NPR reporter Chiara Eisner on Aug. 21 shows an agent in a “Police” tactical vest handcuffing a man in front of a truck, with US Park Police nearby. When Eisner asks what is happening, a Park Police officer says this is a traffic enforcement because the man was driving a commercial vehicle on park roads. 

Evident Media asked the Department of Homeland Security (DHS) about videos of these two specific incidents, as well as whether federal agents were using race or language as factors in their stops and arrests. In response, a DHS spokesperson said: 

“What makes someone a target for immigration enforcement is if they are illegally in the US – NOT their skin colour, race or ethnicity. America’s brave men and women are removing murderers, MS-13 gang members, pedophiles, rapists – truly the worst of the worst from our communities.”

The spokesperson also claimed that the men detained in these two incidents were undocumented immigrants who entered the country illegally. They did not mention any other criminal record for the men or comment on why the men were stopped by local police in the first place. 

Lukens told Evident Media that ICE agents had been seen in areas with larger immigrant populations, such as Columbia Heights and Adams Morgan, which he described as “high-level racial profiling”.

Constitutionally, the Fourth Amendment protects anyone in the US, regardless of immigration status, from unreasonable searches and seizures by the government. 

“If you are an ICE officer and the only thing that you have to fall on or to fall back on in justifying arrest is a person’s racial makeup and what vehicle they are driving, then you have conducted an illegal stop and an illegal arrest,” Lukens said. 

---

Melissa Zhu, Eoghan Macguire, Pooja Chaudhuri and Kolina Koltai from Bellingcat, as well as Vladimir Zaha, Fraser Crichton and Bonny Albo from Bellingcat’s Global Authentication Project, contributed research to this piece.

From Evident Media, Jennifer Smart, Kevin Clancy and Zach Toombs contributed to research and production for the video report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Trump’s Takeover of DC: Traffic Stops Turn Into Immigration Arrests for Delivery Riders and Workers appeared first on bellingcat.

Armed and masked men leaping out of unmarked vehicles. Latino men taken from their places of work or while waiting for the bus. Street vendors roughly tackled to the ground and forcefully held down. 

Since early June, the streets of Los Angeles have borne witness to frequent and aggressive immigration raids that have seen people suspected of being undocumented migrants detained. Some have been rapidly deported.

Between June 6 and June 22 alone, the Department of Homeland Security (DHS) reportedly arrested 1,618 people for deportation from LA and the surrounding areas of Southern California. This averages out at about 95 people a day, and arrests and deportations have continued in the period since. 

Those numbers represent an increase over the months prior and appear to be in line with reports of apparent White House directives to up immigration-related arrests.

Bellingcat worked with our partners at Evident Media and CalMatters to gather and document social media and online footage of as many of the LA raids as possible.

We collected videos of just over 100 incidents starting on June 6, picking out sightings and what appear to be recurring trends and tactics used by officers. A full list of the incidents can be seen and downloaded here.

The footage shows officers from agencies including US Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE), which operate under DHS, arresting people in public spaces, in places of work and outside residences. In some cases, it was unclear what agency officers were with due to a lack of clear identification.

In others, officers can be seen using significant force to detain people. In most cases officers keep their faces covered, concealing their identity. Unmarked vehicles were also used on numerous occasions. 

The raids bear similarities to incidents previously investigated by Bellingcat, CalMatters and Evident Media in California. Earlier this year, agents from the El Centro Border Patrol Sector travelled over 300 miles from the US southern border to the city of Bakersfield to take part in what they said were targeted raids to apprehend immigrants with “criminal records”. 

However, just how targeted that mission was became a point of significant tension, with rights and labour groups claiming it was anything but. Of 78 people arrested, only one had been flagged for prior removal. 

In April, a federal judge issued a preliminary injunction in the wake of the Bakersfield raids barring Border Patrol from conducting warrantless raids in California’s Eastern District, stating that “you just can’t walk up to people with brown skin and say, ‘Give me your papers.’”

The American Civil Liberties Union (ACLU) and other industry and rights groups last week requested a similar injunction be put in place in California’s Central District, which includes Los Angeles. 

The head of the El Centro unit, Gregory Bovino, is now in charge of the operations across Los Angeles. Agents from his El Centro Border Patrol unit have also appeared in videos of raids in LA neighbourhoods seen by Bellingcat. Bovino even appeared at a raid involving hundreds of officers in LA’s MacArthur Park on July 7.

To be clear, it is not possible to know exactly what transpired in every incident captured in our dataset. The vast majority of videos only offer snapshots of what occurred as most raids relied on the element of surprise. Witnesses, therefore, often did not appear to start recording until raids were under way. Similarly, many of the raids captured were in public spaces such as in parking lots or at strip malls. Others did occur at private residences, but incidents are more likely to be captured in places where more members of the general public are likely to be present, such as on busy thoroughfares. This is likely reflected in the data. 

Judging by the number of people detained in LA over the last few weeks, the videos also only capture a portion of all the incidents that have actually taken place. Despite that, the available videos suggest a few trends that may offer clues as to the tactics being deployed by agents across the city. 

From Pasadena to Long Beach, and from Playa Vista to Baldwin Park, incidents have been recorded across LA. Some have even stretched beyond Los Angeles County, with raids recorded in Oxnard, Santa Ana and Fontana.  

With billions in new funding heading for ICE operations in the near future, some believe what has happened in Los Angeles could be just the start of an even bigger immigration crackdown across the US. President Donald Trump also appeared to suggest as much in a June 16 Truth Social post, stating that he wanted to expand detention and deportation efforts to other cities like Chicago and New York.

Raids at Work

A striking number of videos showed people being arrested at what appeared to be their places of work. These included arrests at car washes, food stands and swap meets.

In one incident on June 22 at Bubble Bath Hand Car Wash in Torrance, numerous agents can be seen swarming the facility and approaching blue-shirted employees. One bystander told local broadcaster ABC7 Eyewitness News that she was able to stop the arrest of an employee by advising him not to answer questions. However, others were roughly handled by agents, some of whom appeared to be wearing ballistic armour and carrying guns.

Emmanuel Karim, the manager of Bubble Bath Hand Car Wash – who can be seen in the video angrily remonstrating with agents asking them “what are you doing here?” – told Bellingcat in a phone call that  officers did not provide warrants or identification. 

He had previously told the media that two of his workers were taken during the raid.

In total, our dataset documented 12 raids that appeared to specifically target car washes, including one that hit the same car wash twice. Industry group CLEAN Carwash Worker Center, however, has documented a much higher number. As of July 4, they told Bellingcat they had information detailing raids in at least 55 carwash locations, with some experiencing multiple raids over the month of June. CLEAN said they had documented at least 96 arrests, including of both carwash workers and customers.

Another video from June 8 in Westchester showed a street vendor wrestled to the ground and surrounded by agents near his stall with their weapons drawn. 

In another case on June 22, street food vendor Celina Ramirez clung to a tree as federal officers pulled up and arrested her outside a Home Depot in the Ladera Heights neighbourhood. A bystander told ABC7 Eyewitness News that officers did not provide identification as to who they were, nor did they provide a warrant. While some wore Border Patrol identification, there were also plain clothes officers. All appeared to be masked.

The nature of such arrests has led some to claim that officers are racially profiling workers they may pass at the likes of street food stalls while also targeting businesses they assume will have a high proportion of Latino workers, such as car washes. 

The ACLU lawsuit describes a “systematic pattern” where “individuals with brown skin are approached or pulled aside by unidentified federal agents, suddenly and with a show of force, and made to answer questions about who they are and where they are from”. 

Such practices, where agents do not identify themselves or explain why an individual is being arrested are “contrary to federal law”, the ACLU lawsuit states.

Bellingcat asked DHS about the claims within the ACLU lawsuit as well as incidents at car washes and with the street vendors in Westchester and Ladera Heights. DHS did not comment specifically on the Westchester and Ladera Heights incidents. They also did not respond to the owner’s claims that agents did not provide a warrant or identification when they raided the Bubble Bath Hand Car Wash in Torrance. 

But in an email sent after this article was initially published DHS Assistant Secretary, Tricia McLaughlin, responded to details in the ACLU lawsuit, stating that: “DHS targets have nothing to do with an individuals’ skin colour. What makes someone a target is if they are in the United States illegally. These types of disgusting smears are designed to demonise and villainise our brave ICE law enforcement. ”.

McLaughlin added: “DHS enforcement operations are highly targeted, and officers do their due diligence. We know who we are targeting ahead of time. If and when we do encounter individuals subject to arrest, our law enforcement is trained to ask a series of well-determined questions to determine status and removability.”

Strip Malls and Home Depot Parking Lots

On June 16, a video of a bystander questioning two ICE agents handcuffing and arresting a man in LA county’s Hacienda Heights was shared online. The man said his name is Leo Torres and when the bystander questioned whether the agents had a warrant for his arrest they replied: “This is a public place, we don’t need a warrant.”

Torres was picked up outside an area that appears to be a strip mall. Our dataset showed 25 incidents at such facilities. But raids were captured on video most regularly near outlets of one brand in particular. 

In total, incidents were recorded outside or close to 17 different Home Depots – a common place for day labourers to pick up materials for their work or to pick up work itself.

For example, in a video captured on June 19 an agent in a Border Patrol uniform can be seen chasing a man in the parking lot of a Home Depot in Burbank. 

In another incident on June 22, a man was pinned to the ground in a Home Depot parking lot in Gardena. Signs displaying prices of items for sale can be seen at the start of the video that match the font used at Home Depot locations.

In another incident on June 9, video footage uploaded from multiple angles showed officers running after and questioning a man near a Home Depot in Huntington Park. The footage also showed other officers chasing others who were nearby.

While it was not possible to identify the vast majority of the people detained in the videos gathered, the raids at Home Depots bear a striking similarity to the Bakersfield operation conducted by El Centro Border Patrol earlier this year. 

Back then, eight of just over 50 videos gathered by Bellingcat, Evident and CalMatters appeared to take place in Home Depot parking lots.  

Bellingcat asked DHS if agents had been targeting Home Depots without necessarily having warrants for people they expected to encounter there but did not receive a direct response on this question.

Masked and Unmarked

Identifying who or, indeed, what agency is carrying out a particular raid in the videos collected is not a simple task. Many agents wear masks or keep facial features covered, concealing their identity.

Because it is often unclear who these agents are, many videos show bystanders asking agents for identification, a warrant, a badge number or who they are with. In one video on June 23 at a Home Depot in Inglewood, an officer is asked for his badge number by a bystander who is filming a man being taken away. The officer briefly flashes his badge before dashing into the back of a car that speeds away.

Similarly, officers can be seen wearing plain clothes instead of uniforms in many videos, thus making it difficult to ascertain which agency they belong to.

Some have warned that the heavy use of masks and shielding of identity makes it easier for fraudsters or imposters to pretend to be federal officers or law enforcement to commit crimes. There have already been a number of cases where this has happened in the last month, including in Philadelphia, New York and Los Angeles. However, acting ICE Director, Ted Lyons, has said officers are covering their identity to protect themselves and their families from harassment.

A new bill being proposed called the “No Secret Police Act” would require local, state, and federal officers from covering their faces during operations in California. 

Unmarked vehicles are also regularly seen being used by arresting officers in videos. Bellingcat was able to identify several instances where the same unmarked cars appeared in separate videos in different parts of the city. The cars were identifiable by their number plates. 

Other vehicles being used by officers, including Border Patrol vehicles that bear individual identifying numbers, could also be seen in multiple videos.

In an emailed response to questions sent after this article was initially published, a DHS spokesperson said: “When our heroic law enforcement officers conduct operations, they clearly identify themselves as law enforcement while wearing masks to protect themselves from being targeted by highly sophisticated gangs like Tren de Aragua and MS-13, criminal rings, murderers, and rapists.”

Use of Force and Intimidation

Several videos in the dataset appear to show significant force being used by agents.

A number of incidents featured heavily armed or aggressive officers. Agents can be seen carrying rifles, handguns, and wearing military wear, from camouflage uniforms to helmets and ballistic vests.

One notable instance was the June 16 raid at the Sante Fe Springs Swap Meet that reportedly saw dozens of agents, many of whom were heavily armed, raid a popular swap meet where families were in attendance. Border Patrol filmed this raid and posted a video on their Instagram account. The video shows a number of officers carrying weapons, wearing protective gear, preparing for the raid and walking through the swap meet. A sign which reads “Family Fun Live Music Shopping” can be seen in the video. The raid reportedly resulted in the arrest of two individuals. Businesses there have since complained that the raids have put people off from coming back.

In another incident on June 29, video footage showed the arrest of two men on a street in Santa Ana. Agents appeared to use batons on both men as they lay on the ground. An eye witness stated that agents used pepper spray after one of the men was already on the floor. Federal officials later told local news outlet, KTLA, that one of the arrested men was a Mexican national present in the US illegally, although they did not detail how officers first engaged with the two men or if they were individuals known to law enforcement. The same officials also said to KTLA that officers were attacked by “a violent mob” protesting the detainments before all suspects were arrested. 

Other incidents showed officers pointing guns at a man trying to escape in a car and another who was trying to take a photo of a federal agent’s licence plate. One man could be seen with blood pouring from his head after officers smashed his car window and dragged him from his vehicle in another incident captured in the dataset.

On June 24, during an ICE raid in the Fashion District in Los Angeles, agents from multiple agencies were seen tackling a man, Luis Hipolito, pushing him on top of a curb. A video shows one officer put an arm around his neck as multiple agents pile on top of him and appear to punch the back of his legs. Moments later, he begins convulsing on the ground. 

Hipolito is a US citizen and was apparently filming the arrests of street vendors in the area. As reported by the LA Times, officers ordered Hipolito to leave the scene. When he did not, an officer sprayed him in the face with a substance, the LA Times reported. Video shows Hipoloito swinging his arm in response but it is not clear in the video if his hand connected with the officer. He is being charged with assault for allegedly punching an agent before he was tackled and wrestled to the ground. Hipolito’s family has since said that he did not intentionally touch the agent and that he had been blinded by what they said was pepper spray to his face. They said it was a natural reaction to being unable to see after being pepper sprayed. The LA Times reported that DHS Assistant Secretary Tricia McLaughlin had said the actions of Hipolito and another US citizen had “kept ICE law enforcement from arresting the target illegal alien of their operation.”

There have been numerous reports of US citizens being detained by ICE. In one June 12 incident, a video showed a US citizen being chased and detained by Border Patrol before being eventually let go. Before leaving, however, one of the officers asks: “Why did you run?”

While it is not clear if the only reason they sought to detain this individual was because he ran, that would seem to align with a promotional video published on the Customs and Border Protection YouTube page where an officer can be heard saying, “If they run, we go”.

In response to questions from Bellingcat about whether force used by officers was always proportional or if there were instances where any had gone too far, DHS responded after this article was initially published. McLaughlin said that agents are trained to “use the minimum amount of force necessary to resolve the situation in a manner that prioritises the safety of the public and our officers”. 

She added: “Resisting arrest places those being arrested, the agents, and the community at risk. Law enforcement is now facing a nearly 700 percent increase in assaults while carrying out enforcement operations. But this will not deter [Customs and Border Protection] – we will continue enforcing the law and protecting American communities.”

---

This article was updated on Wednesday July 9, 2025, to include responses from the Department of Homeland Security which were received after initial publication time.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Masked, Armed and Forceful: Finding Patterns in Los Angeles Immigration Raids appeared first on bellingcat.