Full Report
Armed and masked men leaping out of unmarked vehicles. Latino men taken from their places of work or while waiting for the bus. Street vendors roughly tackled to the ground and forcefully held down. Since early June, the streets of Los Angeles have borne witness to frequent and aggressive immigration raids that have seen people […] The post Masked, Armed and Forceful: Finding Patterns in Los Angeles Immigration Raids appeared first on bellingcat.
Analysis Summary
This document summarizes an investigation into aggressive immigration enforcement actions occurring in the Los Angeles area, detailing the tactics used by federal agencies like CBP and ICE based on publicly available video evidence.
# Incident Report: Escalated Immigration Enforcement Raids in Los Angeles
## Executive Summary
Between early June and mid-July 2025, federal immigration agencies, primarily CBP and ICE under DHS, conducted widespread, aggressive enforcement operations across Southern California, leading to over 1,600 arrests in a two-week period. The operations frequently involved unmarked vehicles, masked officers, and the use of significant force, mirroring tactics seen in prior operations. Response efforts have included legal challenges seeking injunctions against these warrantless tactics.
## Incident Details
- **Discovery Date:** Early June 2025 (Start of documented surge)
- **Incident Date:** Early June 2025 – Present (Ongoing raids documented up to July 7)
- **Affected Organization:** General public/Undocumented migrants in Southern California; US Citizens mistakenly detained.
- **Sector:** Government Enforcement/Civil Rights Environment
- **Geography:** Los Angeles County and surrounding areas (Pasadena, Long Beach, Oxnard, Santa Ana, Fontana).
## Timeline of Events
### Initial Access
- **Date/Time:** Beginning early June 2025.
- **Vector:** Direct physical apprehension in public spaces, workplaces, and residences. Likely driven by White House directives to increase arrests.
- **Details:** Operations characterized by masked officers, unmarked vehicles, and aggressive physical takedowns.
### Lateral Movement
- **Details:** The investigation collected footage spanning operations across numerous jurisdictions, indicating widespread geographic deployment rather than movement through a singular network infrastructure. The movement was physical, targeting specific demographic locations.
### Data Exfiltration/Impact
- **Impact:** Detention and rapid deportation of suspected undocumented migrants (1,618 arrested between June 6 and June 22). Incidents also included the detention of US citizens. Operational impact involved visible community disruption and use of force.
### Detection & Response
- **How it was discovered:** Bellingcat, Evident Media, and CalMatters collected and documented over 100 incidents via social media and online footage.
- **Response actions taken:** Civil rights groups (ACLU) filed requests for a preliminary injunction in the Central District (Los Angeles) following a prior injunction issued in the Eastern District related to Bakersfield raids.
## Attack Methodology
This incident is characterized by physical enforcement actions, which correlate to standard law enforcement operational tactics rather than typical cyberattack phases, though tactics align conceptually with reconnaissance, engagement, and impact:
- **Initial Access:** Physical approach using surprise, marked by unmarked vehicles and masked personnel.
- **Persistence:** Not applicable (physical operation).
- **Privilege Escalation:** Not applicable (agency authority asserted).
- **Defense Evasion:** Concealing officer identity (masked faces) and using unmarked vehicles to reduce immediate public identification of the operating agency.
- **Credential Access:** Not applicable.
- **Discovery:** Targeted areas based on demographic profiling or through known high-density areas (workplaces, public thoroughfares).
- **Lateral Movement:** Wide geographical deployment across LA County and surrounding counties.
- **Collection:** Physical apprehension and detention of individuals.
- **Exfiltration:** Physical removal (deportation) of detained individuals.
- **Impact:** Detainment of individuals, including reports of US citizens, and the use of significant force.
## Impact Assessment
- **Financial:** No specific costs reported, beyond operational costs of agencies involved.
- **Data Breach:** Not applicable (Not a cyber intrusion). Focus was on physical apprehension. Reports of US citizens being detained suggest procedural failures leading to wrongful detention.
- **Operational:** Significant public disruption and visible, aggressive enforcement in public and private spaces across Southern California.
- **Reputational:** Increased public scrutiny and negative press regarding enforcement methods, leading to legal challenges.
## Indicators of Compromise
*(Adapted to physical enforcement indicators)*
- **Network indicators:** N/A
- **File indicators:** Data set of 100+ documented incident locations/videos (Defanged: Investigator's incident database).
- **Behavioral indicators:** Use of unmarked vehicles; officers with covered faces; aggressive, forceful detainment tactics; questioning of individuals who flee ("If they run, we go").
## Response Actions
- **Containment measures:** Legal efforts by ACLU and partners to secure injunctions against un-warranted raids in the Central District.
- **Eradication steps:** Not applicable.
- **Recovery actions:** Releasing individuals who were confirmed US citizens or otherwise did not meet detention criteria (e.g., the June 12 incident).
## Lessons Learned
- **Key takeaways:** High-profile enforcement operations rely heavily on surprise and visible force, leading to potential misidentification of individuals, including US citizens. The use of unmarked cars and obscured identities hinders accountability.
- **What could have been done better:** DHS acknowledged training requires use of "minimum force necessary," suggesting potential overreach in some recorded incidents. The June 2025 operation may have resulted in widespread detention without strict adherence to warrant requirements, as alleged by civil rights groups.
## Recommendations
- **Prevention measures for similar incidents:** Implement clearer identification protocols for enforcement agents (visible badges/marked vehicles) during non-emergency public operations. Adhere strictly to existing court injunctions regarding warrantless searches, especially following the April ruling in the Eastern District.