Internal US government documents from 2025 revealed a different picture of Venezuela’s Tren de Aragua (TdA) than the one presented by the Trump administration. While officials publicly described TdA as a unified terrorist force linked to President Nicolás Maduro and active in the US, intelligence records, law enforcement bulletins, and drug task force assessments indicated that agencies were uncertain if TdA operated as an organized entity or posed a coordinated national security threat within the United States.
Senior administration officials characterized TdA as a centrally controlled terrorist network operating in American cities. However, internal directives and threat assessments frequently noted “intelligence gaps” regarding the group’s US operations. Questions arose about its leadership, whether its domestic activities were coordinated beyond small local groups, and if US incidents were foreign-directed or the actions of independent, profit-motivated criminals.
These sensitive documents, not meant for public release, were distributed among intelligence offices, law enforcement agencies, and federal drug task forces. They consistently highlighted unresolved issues concerning TdA’s presence in the US, including its scale, funding, and access to weapons. The documents cautioned that crucial estimates, like the number of members in the US, were frequently based on inference or extrapolation by analysts due to insufficient corroborated evidence.
Collectively, the documents revealed a significant disparity between official rhetoric and actual intelligence. While high-ranking officials used terms like “invasion,” “irregular warfare,” and “narco-terrorism,” field reports consistently depicted Tren de Aragua in the US as a fragmented, financially motivated criminal group. There was no evidence of centralized command, strategic coordination, or political objectives. The reported criminal activities were mostly opportunistic and common, including burglaries, ATM “jackpotting,” delivery-app fraud, and minor drug sales.
In March 2025, President Donald Trump issued a proclamation under the Alien Enemies Act, asserting that the gang had “thousands” of members who had “unlawfully infiltrated the United States” and were engaged in “irregular warfare and undertaking hostile actions.” He also stated that the group was “aligned with, and indeed has infiltrated, the Maduro regime,” portraying Venezuela as a “hybrid criminal state” invading the US.
Concurrently, an internal Border Patrol assessment indicated that officials could not verify these claims. The assessment relied on interview-based estimates rather than confirmed instances of gang members entering the US.
That same month, during a Fox News interview, US Attorney General Pam Bondi described TdA as “a foreign arm of the Venezuelan government,” stating its members were “organized. They have a command structure. And they have invaded our country.” Later, in a Justice Department press release announcing terrorism and drug-distribution charges against a TdA suspect, Bondi reiterated that it was “not a street gang—it is a highly structured terrorist organization that put down roots in our country during the prior administration.”
Within the intelligence community, however, documents revealed a less conclusive understanding. Despite TdA’s designation as a foreign terrorist organization by the State Department in February 2025, internal communications indicated that the group was still not well understood, even by senior counterterrorism officials. Persistent questions about TdA and newly designated Mexican drug cartels led intelligence managers to issue a nationwide order, urging analysts to quickly address the US government’s significant “knowledge gaps.”
This directive, from May 2, 2025, highlighted the extensive nature of these intelligence deficiencies. It raised unresolved questions about whether these groups possessed weapons beyond small arms, their methods of financing (bulk-cash, cryptocurrencies, or mobile payment apps), and if they received support from corrupt officials or state-affiliated facilitators abroad.
A spokesperson for Director of National Intelligence Tulsi Gabbard explained the intelligence shortfall as a result of competing priorities. The Intelligence Community reportedly could not allocate collection resources to TdA before the Trump administration labeled it a “terrorist” organization, which is where the “knowledge gaps” originated.
The tasking order clarified that these uncertainties encompassed not only TdA’s past actions but also its potential reactions under pressure. The order, from national intelligence managers in counterterrorism, cyber, narcotics, and transnational crime, noted a lack of understanding regarding how TdA and various Mexican cartels might alter their operations or tactics in response to increased US enforcement.
Records from White House-managed interagency task forces, known as HIDTA (High Intensity Drug Trafficking Areas), also revealed similar limitations, indicating that counter-narcotics officials had a restricted understanding of TdA’s activities. A July 2025 bulletin from a Northern California task force stated that existing intelligence did not “meet the Department of Justice definition of a drug trafficking organization,”. It further noted that TdA subsets “appear to operate independently of each other and do not appear to operate as part of a larger coordinated effort.”
The report observed that TdA members were “not known to have assigned roles” and that “leadership formation has not yet been identified.”
Further HIDTA reports also failed to identify the extensive narco-terror enterprise that senior officials had publicly described. A “2026 Threat Assessment” for North Texas and Oklahoma identified Mexican cartels as the primary narcotics threat, while TdA activity was described as “street level.” This assessment was based on surveys from numerous law enforcement agencies and compiled by a task force including various high-ranking officials.
Customs and Border Protection (CBP) assessments diverged significantly from the broader law enforcement views. Starting in mid-March, CBP began issuing its own intelligence, quickly attributing to TdA the “capability and intent” to conduct attacks in the United States. It ranked TdA among the “most capable” foreign terrorist groups, placing it above Hezbollah and Iran’s Revolutionary Guard Corps, even while admitting it had no knowledge of any “specific or credible threat.”
CBP and the Department of Homeland Security did not provide responses to inquiries.
Before April, CBP released a more extensive “sensitive but unclassified” assessment. This report characterized TdA as an increasing national security concern, noting its exploitation of US-bound migration and involvement in various criminal activities, including money laundering, extortion, and human smuggling. The report, compiled from various border enforcement, intelligence offices, and the FBI’s gang intelligence center, cautioned its interagency network that its conclusions were based on “analytical judgments that are not fact, knowledge, or proof” and might not always differentiate between assumptions and facts.
The report also admitted considerable uncertainty regarding TdA membership numbers, identification methods, and whether US-based groups coordinated or followed centralized leadership. Under a section titled “Intelligence Gaps,” the agency detailed unresolved matters such as the flow of criminal funds and potential areas for the network’s expansion in the US. These uncertainties led to a question that the White House had publicly asserted was already answered: “Are US-based TdA members operating under the direction of foreign-based leadership?”
The subsequent month, a classified National Intelligence Council assessment, initially reported by The Washington Post, concluded there was no evidence of TdA being directed by the Venezuelan government. When questioned about these findings, the Office of the Director of National Intelligence rejected the assessment, which reflected the consensus of most US intelligence agencies, labeling it as the work of “deep state actors” collaborating with the media.
Furthermore, the CBP report contradicted claims that the government possessed a clear understanding of TdA’s presence in the US. It stated that determining the “exact number” of TdA members was “difficult for US law enforcement and the intelligence community” due to “a lack of determinate indicators” and the “adoption of the TdA name by unaffiliated groups and persons.” These limitations were ultimately used to adjust statistics to support the administration’s portrayal of a US-based terrorist threat numbering in the “thousands.”
Over a 22-month span, CBP’s detection methods identified a maximum of 83 known TdA members at the border. To arrive at a significantly higher number, analysts reportedly used a “sample set of interviews,” estimating that “upwards of 3,000” TdA members must have crossed the border during that time. This estimate was based on the assumption that approximately “one-half of one percent” of all Venezuelan migrants entering the US via the southwest border were linked to TdA.
This same assumption also influenced the report’s perspective on Venezuelan asylum communities, which it depicted as potential risk areas influenced by “sanctuary city” policies and jurisdictions perceived as “weak” on enforcement.
In recent remarks, Trump reiterated this viewpoint, accusing Democratic-led cities of allowing gangs to operate. Speaking in Detroit, he stated that from February 1, the federal government would financially penalize cities and states that restrict cooperation with federal authorities, pledging to halt “any payments to sanctuary cities or states having sanctuary cities,” which he claimed were doing “everything possible to protect criminals.”
This speech coincided with expanded federal enforcement operations in major US cities, involving deployments and mass arrests that affected both citizens and immigrants, leading to protests and legal challenges from various states and municipalities.
Trump specifically mentioned Venezuela, stating, “I was so angry with Venezuela. They emptied their prisons, almost entirely emptied their prisons, into the United States.”
The FBI’s prior analysis contrasted with TdA’s terrorism designation. Before the 2024 election, internal FBI assessments characterized TdA as less sophisticated than typical “South American theft groups.” Its members were found to prefer “opportunistic,” often “spontaneous” crimes, primarily retail theft from large stores and exploiting other Venezuelan and South American migrants. While the bureau consistently highlighted TdA’s potential for violence, it found no evidence of coordination among US members or complex, preplanned operations.
In 2025, FBI field reports seemingly continued to concentrate on conventional crimes, with brief mentions of human, weapons, and narcotics trafficking, but lacking significant detail. An April joint report from Alabama and Tennessee field offices connected TdA to a “retail theft crew” suspected of smash-and-grab burglaries at Walmart jewelry counters. Although the report noted similar nationwide incidents with estimated losses of about $1.2 million, it implicated only one “confirmed” Tren de Aragua member and did not refer to any national security threat.
These reports contrast with public statements made by FBI Director Kash Patel, who, also in April, publicly labeled TdA as “a direct threat to our national security” and pledged to dismantle what he termed a “violent terrorist organization.” Within the bureau, records indicate that its Terrorism Screening Center formed a “Tren de Aragua Interagency Working Group” to manage watch listing updates. An April 2025 meeting, according to a distribution list, included participants from various DHS and Justice Department divisions, State and Treasury departments, intelligence and military components, and numerous state and local agencies and fusion centers.
When asked for comment, the FBI refused to address the discrepancies between its internal reports and the public characterization of TdA by its leadership. The bureau did not confirm any terrorist threat, stating only its “commitment to working with our local, state, and federal partners to combat violent gang activity in our communities, including illegal acts carried out by the Venezuelan criminal gang, Tren de Aragua.”
Regional drug task force reports also presented similar low-level descriptions of TdA activity. A June 2025 Northern California threat assessment indicated that TdA “did not appear to be directly involved in drug trafficking,” instead primarily associating the group with organized retail theft and suspected involvement in “at least two shootings.” Another assessment for North Texas and Oklahoma suggested a link between TdA and Walmart’s Spark delivery app, citing alleged identity theft used to “exploit the delivery driver profession to facilitate financial fraud.”
The following month, CBP issued a comparable warning, referencing an unattributed law enforcement report. This report claimed that TdA members had been exploiting food delivery and rideshare platforms for income and to allegedly facilitate routine criminal activity.
The bulletin stated that TdA members—including some with “direct ties to TdA leadership”—utilized services like Uber, DoorDash, and Grubhub by renting or sharing accounts acquired through personal networks or online forums. One individual, identified as “a known TdA member and Uber driver,” reportedly “frequently delivers food and drugs to individuals living in a migrant shelter.” Others were allegedly using malicious software to “steal high-fee delivery orders from other drivers.”
Walmart, Uber, GrubHub, and DoorDash did not immediately provide comments when contacted.
This document reflects numerous other reports where sporadic crimes were vaguely attributed to the group using imprecise language. In August, a law enforcement bulletin from the Texas Financial Crimes Intelligence Center on ATM “jackpotting” cautioned that suspects involved in ATM malware attacks “may be associated” with TdA.
A separate August bulletin from the New York Police Department’s Intelligence & Counterterrorism Bureau alerted partners that TdA members might be trying to infiltrate the local music scene. Officials stated that individuals “allegedly affiliated with TdA have hosted parties involving DJs,” suggesting these gatherings “may be” an attempt “to potentially further engage in, or promote criminal activity.”
In written replies, the Office of the Director of National Intelligence referenced the war in Afghanistan to clarify its approach to Venezuela. It noted that just as no evidence supported the claim that Maduro’s government directed TdA, “The Taliban was never assessed to be directing al-Qaeda’s attacks.”
