Tracking Organized Crime: From Operation to Lawfare

There is an official definition of a transnational gang, and it is worth reading before anything else. Homeland Security Investigations and the FBI describe these organisations as using borderless operational techniques to sustain illicit economies, evade investigators, and maximize financial gain — projecting power across multiple countries through cross-border communication, financial manipulation, digital systems, and targeted violence. MS-13 is the standing exemplar.

What that definition is missing is coordination. Not communication — the definition has plenty of that. Coordination in the sense that matters to a prosecutor: who acted on whose behalf, and what did each party stand to gain.

The definition describes an operation without operatives. It gives you a network that plans, moves and strikes for its own enrichment, and no vocabulary at all for the layer above that — the arrangement in which one party supplies the capability and another supplies the purpose. No category for a commissioning relationship. No field for a beneficiary who never touches the act. No language for a state renting violence it can subsequently deny.

That arrangement is precisely what European courts have spent two years documenting. And an operation cannot be held to account if the framework has no place to record on whose behalf it was carried out. The gain sits with one party, the exposure with another, and the definition can only see the second.

The category has to stretch a long way. At one end, organisations with territorial ambition and their own foreign policy. At the other, MS-13 — the version American courts actually process, prosecuted through racketeering statutes built for enterprise crime, where the predicates are robbery, extortion and kidnapping. A single definition covering both will describe what they have in common, which is profit-seeking enterprise, and miss what distinguishes them, which is who else benefits.

This is the first and least visible form of concealment: not a document withheld, but a question the framework was never built to ask.

What the Courts Actually Found

The Vilnius case is the clearest. Prosecutors traced an IKEA store fire to Russian military intelligence through a chain of organisers, sub-organisers and further intermediaries running more than twenty deep. The perpetrator was a minor at the time, promised €10,000 and a car. The charge was terrorism. The store was reportedly selected in part because the company had withdrawn from Russia and its brand colours resemble the Ukrainian flag.

Three days later, the Marywilska 44 shopping centre in Warsaw burned. Polish prosecutors convicted three Ukrainian nationals of participating in an organised group operating across Poland, Lithuania, Latvia, Ukraine and Russia for the purposes of sabotage and terrorism. One defendant had been instructed to film the fires so the footage could be circulated on Russian media.

In London, the Leyton warehouse fire targeted a unit storing Starlink equipment and generators bound for Ukraine. Three men were convicted of aggravated arson at the Old Bailey; the two organisers, Dylan Earl and Jake Reeves, had already pleaded guilty and became the first people convicted under the National Security Act 2023 — a statute written precisely because the prior toolkit could not reach paid third parties acting for a hostile state.

In Düsseldorf, a German-Iranian was convicted over a synagogue plot in Bochum, tasked by a former Hells Angels member who had relocated to Iran. The court found Iran behind that man. In Melbourne, all three alleged direct offenders in the Adass Israel Synagogue firebombing have been charged under Victorian state law, and Australia's position is that Iran used criminals and organised crime members to disguise its involvement. The relevant minister said there was no reason to think the people who carried out the attack knew who was directing it.

Europol's response tells you the scale. Its Operation Grimm task force identified more than 1,400 people linked to what the agency now calls violence as a service in its first year, making 280 arrests alongside action against more than 15,000 online accounts. Analysts describe the recruitment of teenagers as a deliberate method of avoiding accountability, since minors cannot be tried as adults — targeting young people in care, in institutions, or disengaged from society, through social media and gaming platforms.

The recurring operational signatures are consistent across every one of these judgments: layered intermediary chains, open-market recruitment through messaging apps, a filming requirement so the client can verify and publicise the deed, deliberate use of minors, and non-payment of the recruit. What the network sells is not violence. It is deniability.

The Charging Gap Is the Business Model

Every one of these prosecutions stops at roughly the same depth. The arsonist is convicted. The recruiter is sometimes convicted. The instigator sits outside the jurisdiction, and the client is named in a judgment without ever being charged.

This is not incompetence. It is the structural consequence of how criminal law is built. Arson statutes are conduct-based and provable. Terrorism and national-security offences carry a subjective element — knowledge, purpose, direction — that requires establishing what the defendant understood about who was paying. When the entire architecture is designed to ensure the perpetrator cannot know, the graver charge becomes unreachable by construction.

American courts have made the same finding, and made it precisely. In 2022 the Islamic Revolutionary Guard Corps offered Rafat Amirov — a vor, the highest rank in the Russian Mob — $500,000 to murder the Iranian-American journalist Masih Alinejad in New York, after two earlier plots to kidnap her had failed. Amirov, living in Iran, received her home address from his contacts there and passed it to an associate in Georgia. A jury convicted both of murder-for-hire and attempted murder in aid of racketeering; Judge Colleen McMahon sentenced them to 25 years each. When that failed the IRGC turned to Farhad Shakeri, an asset living in Iran, who hired a man he had served time with in the New York State prison system; those two received fifteen and ten years. In a separate case a jury convicted Asif Merchant of murder-for-hire and attempting an act of terrorism transcending national boundaries after he testified that the IRGC had sent him to arrange assassinations on American soil.

So the framework can describe a state client. It has the statutes, the vocabulary and the appetite — when the target is an American. Every one of those prosecutions was built on harm that landed inside the United States. The gang definition, which governs the cases where it does not, still has no category for a payer at all.

It also explains how these judgments read. Courts name what they can establish and stop there — which is why the finding is "Iran" rather than a directorate, "Russian military intelligence" rather than a handler, and in the London arsons targeting properties connected to the Prime Minister, counter-terrorism police said they found no evidence tying the anonymous account to any specific person or organisation at all. Three cases, three different ceilings: agency, state, nobody. The vagueness is not editorial caution. It is the precise altitude at which each investigation ran out of evidence.

Legislatures have responded by attacking the layer they can reach: recruitment. Sweden created a standalone offence of involving a minor in criminal activity, punishable by up to four years, and lowered the age of criminal responsibility from fifteen to thirteen for serious offences. The United Kingdom's National Security Act 2023 was drafted to reach paid intermediaries. These are real responses. They also concede the point — the client remains out of range.

The Same Structure, Turned Inward

The arrangement is not limited to states renting foreign criminals. Its defining feature — an effect produced without an attributable act — appears wherever a designation carries a consequence that no tribunal ever tests.

The Alien Enemy Validation Guide, filed as an exhibit in litigation by the ACLU, is a scoring rubric: up to 81 points across 20 items in six categories, with eight points sufficient to support removal after consultation with a supervisor. Tattoos are worth four points. Dress associated with the target organisation, including high-end streetwear and Michael Jordan logos, is another four. Texting a known member adds six. Sending money via Venmo or CashApp adds three. Two tattoos clears the threshold.

A Border Patrol El Paso Sector intelligence document, also filed by the ACLU, determined that Chicago Bulls attire, clocks and rose tattoos are typically related to Venezuelan culture and are not indicators of membership. The rubric, the consequence, and the internal refutation sit in the same docket.

At the far end of the same scale: 66 strikes on alleged drug vessels since September 2025, 221 dead. The administration produced a classified legal opinion justifying lethal force against a secret list of at least two dozen cartels and suspected traffickers, classifying them as enemy combatants. No per-vessel evidence has been published. The Republican chairmen of both Armed Services Committees said they were satisfied with the Pentagon's explanation of one strike that killed two survivors and would not pursue further oversight.

In each case: a label applied by an authority, a severe consequence, and no adjudication. Designation by rubric produces removal. Designation by secret list produces a missile. The evidentiary basis is never tested because no mechanism is available to test it.

Follow that rubric downstream and the two halves of this article turn out to be one mechanism at two scales. A tattoo is worth four points. Eight points supports removal. Removal proceeds under the Alien Enemies Act, invoked in March 2025 against members of Tren de Aragua as a designated foreign terrorist organisation. On 15 March a group of alleged members were put on planes to El Salvador, and the district court's order not to remove them arrived after the aircraft had left United States airspace. The Supreme Court vacated that order as legally erroneous and brought in the wrong court. Everything since — a criminal contempt threat against government officials, two petitions for mandamus, a District of Columbia Circuit panel splitting three ways on 14 April 2026 — has concerned whether a district court may enforce its own orders. Whether the men on those planes were members of anything has still not been decided by any court.

That is the definitional gap arriving at its destination. At the top, a category with no slot for who a network works for. At the bottom, a category with no evidentiary floor for who belongs to it. The same imprecision that prevents the framework from naming a client also prevents it from testing a membership claim — and between the tattoo and the deportation flight there is no point at which evidence is required. One layer of the chain has since been named: the government identified the then-Secretary of Homeland Security as the official responsible for the transfer decision. That is more than most records in this account contain, and it came only because a judge threatened prosecution to get it.

On 6 May 2026 the same instrument was pointed at a political category. The administration's national counterterrorism strategy named three principal threats: narcoterrorists, Islamist groups, and — for the first time in any official US counterterrorism document — violent secular political groups, including antifa and what the strategy calls radically pro-transgender ideology. Its author, Sebastian Gorka, described the intent as mapping them at home, identifying their membership, mapping their ties to international organisations, and using law enforcement tools to cripple them operationally.

Two facts sit against that document. The Center for Strategic and International Studies, tracking domestic extremism for a decade, attributes 152 attacks and 112 deaths to right-wing extremists against 35 attacks and 13 deaths to left-wing actors. And in September 2025 the Justice Department deleted from its website a study showing right-wing violent extremism outpacing all other categories of domestic terrorism. The evidence was removed before the assessment that contradicts it was published.

In July 2026 the strategy went international. The Secretary of State convened senior officials from governments worldwide to launch what the White House called a global offensive against radical left terrorism, arguing that counterterrorism doctrine has carried a blind spot toward extremist violence from the political left. The threat was described in specific operational terms: militants travelling between Europe and the Americas to participate in each other's attacks, funnelling propaganda, training materials and target information through shared encrypted channels, moving through underground networks of safe houses, financing and sustaining operations.

Cross-border movement, encrypted coordination, shared logistics, financing: that is the transnational gang definition, word for word in substance. The framework has no category for coordination when the subject is a criminal network working for a state, and a fully articulated one when the subject is a political movement. The category is not missing because coordination is difficult to describe. It is missing selectively.

And the label carries no charge. There is no federal domestic terrorism offence in the United States. What the designation carries instead is FBI assessment authority, sentencing enhancements, funding flows and investigative priority — consequences that attach without any charging decision a court could review.

The instrument also runs in reverse. Between 26 and 27 July 2026, a coordinated cyberattack hit more than 30 Minnesota municipal water systems, with utilities in at least seven states reporting incidents since. A state assessment obtained by CNN put the likely desired impact as loss of system pressure and potential contamination of the water supply. A preliminary federal assessment identified Iranian-affiliated actors as probably responsible while stressing it could change; Minnesota IT Services stated it had attributed the activity to no specific actor; federal officials said they were wary of false flags. At a Cabinet meeting on 31 July the President rejected the attribution and assigned responsibility to the state's governor. Designation applied to a domestic political category on an intelligence assertion; designation withheld from a foreign state against one. Same discretion, opposite directions, no tribunal in either.

One of those mechanisms does its work before anything is found. In January 2025 clemency was granted to roughly 1,600 people charged over the Capitol attack. Watchdog counts of how many have since been arrested, charged or convicted of unrelated crimes range from at least 40 to about 97 — one in sixteen — depending on whether state cases and mere arrests are included. The offences include child molestation, for which one recipient was sentenced to life in February 2026, reckless homicide, stalking, and plots against law enforcement officials. Several recipients have argued that the pardon should also cover unrelated convictions, and in November 2025 one was explicitly re-pardoned for weapons charges that had nothing to do with January 6. The structural point is narrower than the recidivism, and CREW makes it plainly: a pardon carries no monitoring or parole. It does not only void the finding — it removes the supervision that would have continued after it. An accountability mechanism that can be switched off in advance, in bulk, and then extended to conduct it never covered is not a mechanism that a criminal network needs to evade.

The Entities With Something at Stake

Follow the organisations rather than the individuals and the exposure becomes legible, because organisations file documents.

The seriousness of the conduct does not decrease. Only the existence of something able to examine it. Apollo faces two independent mechanisms and a quantified investor loss. A nine-figure payment from a foreign state's national security adviser to a sitting president's family faces nothing at all — no case, no consent sought, no forum that can hear it. That is why a corpus keyed on court dockets is structurally blind to the bottom of its own subject matter.

The Enforcement Capacity That Would Have Looked

The removals began with the people whose entire job was to find this kind of thing.

On 24 January 2025, four days into the term, the inspectors general of nineteen federal agencies were fired. Of the cabinet departments, only the watchdogs at Justice and Homeland Security survived. The dismissals arrived as brief emails from the Office of Presidential Personnel late on a Friday; recipients lost access to their government accounts and were barred from their offices. The eight who sued had, between them, oversight of more than $5 trillion in annual appropriations and 3.5 million federal employees.

A 2022 statute requires thirty days' notice to Congress before an inspector general is removed, together with a substantive, case-specific rationale. Neither was provided. On 24 September 2025 Judge Ana Reyes ruled the firings unlawful — and declined to reinstate anyone, reasoning that the President could simply fire them again after supplying the notice the law required. The mechanism engaged, found for the plaintiffs, and produced nothing. What the statute protected was a procedure, not a post.

The offices that remain have lost 16.6 percent of their workforce since January 2025, a steeper reduction than government staffing overall, and the council that coordinates them is now set to be led by a political appointee. An analysis of the fired inspectors general's enforcement record found that the recoveries generated by their work exceeded the savings claimed by the cost-cutting initiative that followed them.

Between January 2025 and the present, the American units whose remit covered precisely this territory were dissolved or reduced.

KleptoCapture and the Kleptocracy Asset Recovery Initiative ended on the Attorney General's first day, with attorneys directed back to prior posts and resources committed to eliminating cartels and transnational criminal organisations. The FBI's Foreign Influence Task Force and its Washington field office public corruption squad were disbanded. The National Cryptocurrency Enforcement Team was disbanded by a memo from Todd Blanche, then deputy attorney general, with the Fraud Section directed to cease cryptocurrency enforcement and refocus on immigration and procurement fraud. The SEC's own foreign-bribery unit was quietly disbanded after its chief and deputy departed. The Consumer Protection Branch, more than 100 attorneys, was disbanded in September. The Tax Division was dissolved after nearly a century, having regularly recovered two to three times its annual budget.

The units that survived contracted. The Justice Department's foreign-bribery unit fell from 32 prosecutors to 22, with enforcement paused from February to June 2025 and the investigative docket reportedly cut in half during the pause. The Public Integrity Section, which prosecutes elected officials and government employees, fell from 36 attorneys to two full-time by September 2025. Six core foreign-bribery enforcement actions were brought in 2025, against 22 the previous year — the lowest single-year total since 2006. A budget proposal would eliminate all future funding for the country's largest anti-crime task force in its current form.

Units are one way capacity leaves. People are the other, and it leaves no organisational trace. In February 2025 the acting deputy attorney general sent a memo headed "Terminations" demanding details of every FBI employee who had worked on January 6 investigations; the bureau turned over roughly 5,000. Eight senior officials had already been fired, among them those overseeing cyber, national security and criminal investigations. Agents who worked the 2020 election investigation known internally as Arctic Frost were dismissed without hearing or inquiry, the director describing them publicly as corrupt actors who had weaponised law enforcement. A former acting director of the bureau is among those now suing over what their complaint calls a White House-directed purge. Dissolving a unit removes a capability that can be counted. Removing the people who worked a disfavoured case category removes the capability and tells everyone still employed which investigations end a career — and that second effect appears in no budget line and no organisational chart.

The Kleptocracy Asset Recovery Initiative is the one worth pausing on. It covered the demand side of corruption: foreign officials who took bribes or stole public funds and laundered the proceeds through the US financial system, sometimes with the help of American fixers and intermediaries. That is precisely the corridor-and-intermediary structure the European arson judgments describe, applied to money instead of fire. The unit that investigated it no longer exists.

Concealment With a Docket Number

Three cases are live right now, and each tests a different mechanism.

Phang v. Blanche (D.D.C., Judge Emmet Sullivan). The defendant is Todd Blanche, the acting Attorney General. After the Epstein Files Transparency Act compelled disclosure, the Justice Department released approximately 3.5 million pages while withholding 2.5 million more from over 6 million identified as potentially responsive. The stated grounds: victim information, child sexual abuse material, and anything jeopardising an active federal investigation — the last category undisclosed in scope, with the department declining to say whether an investigation into Epstein's associates remains open. On 25 June, Sullivan found Blanche had likely violated the statute, noting he had made procedural arguments for dismissal without responding substantively to the allegations, and rejecting the claim that the plaintiff suffered no concrete harm when she had identified half a dozen stories she could not report. On 2 July the department declined to comply, offering in-camera review instead. On 26 July Sullivan ordered production for court review. The department is appealing. Separately, the public page count has been falling — down to roughly 2.7 million and fluctuating — after survivors' attorneys reported that nearly 100 survivors' personal information appeared in the release.

Burnley v. United States, No. 1:26-cv-10364 (D. Mass., Judge Leo T. Sorokin). The first wrongful-death suit arising from the maritime strike campaign, brought over the 14 October 2025 strike that killed two Trinidadian nationals travelling home from Venezuela. Plaintiffs plead the Death on the High Seas Act and the Alien Tort Statute. The court set a briefing schedule running to 16 July 2026. As of this writing the case is fully briefed and awaiting decision — and none of that briefing appears in the free public docket archive, because no one has purchased it. The government's fullest legal defence of the strike campaign exists, is filed, and is functionally unread.

Just Futures Law v. ICE, No. 1:25-cv-8995 (S.D.N.Y.). A FOIA action to compel production of records on the agency's contracts with Cellebrite and Paragon.

The Noise Is Part of the Story

Any investigation into this territory now runs through a layer of manufactured material, and honesty requires saying so.

Three examples encountered in the course of this research. A viral post asserted that European wildfires had begun simultaneously and that 160 arsonists had been arrested in Spain and France — the figure was real but French only, referred to people detained or questioned rather than charged, and came from a prime minister who in the same statement attributed the currently burning fires to carelessness. A second post attributed to a sitting prime minister a threat to inflict power outages and railway accidents on an EU state; the full primary statement is public in the original language and contains no such words, and the sentence appears on a single domain belonging to a network that a French government watchdog identified as a foreign influence operation and that researchers say is designed to influence AI model outputs rather than human readers. A third welded a genuine congressional committee text — describing two Spanish cities as located in Moroccan territory, in an explanatory report accompanying a House bill — to an unrelated foreign military financing line in the same document, producing a claim that money had been appropriated to prepare a specific operation.

In each case a real document was the raw material. The distortion was the attribution. That pattern matters for two reasons: it is the reason careful sourcing is not optional, and it is itself a form of concealment — burying a real record inside noise is functionally equivalent to withholding it.

What Follows

The through-line here is not that these events form a single operation. They do not, and claiming so would be the fastest way to make a documented record dismissible. What they share is a structure: an action taken, a consequence delivered, and an accountability mechanism that was dissolved, overruled, never invoked, unreachable, compartmented, self-audited, captured, or simply had no category for the question.

That structure is measurable. It requires no theory of motive, no inference about coordination, and no classified source. It requires only the ability to ask, for each action, three questions: what authority existed, was it exercised, and where did the capacity go.

The answers are in appropriations reports, SEC filings, procurement records, prosecutors' statements, and court dockets — most of which nobody reads, one of which is a $3 purchase away from becoming public. The record is not missing. It is unassembled.