Threat Intelligence Briefing: Risk to Federal LEO's Attending Church
Watch the Briefing IN ADDITION to Reading It
Threat Level: High (Imminent), consistent with current CWT assessment
Specific Threat Rating: Elevated, for the cartel bounty threat targeting ICE and other federal personnel, as a sub-threat within the High environment
Summary
Open-source reporting and analyst commentary indicate Mexican cartel networks are offering tiered bounties that target DHS, ICE, and CBP personnel inside the United States. This activity includes doxxing, surveillance, and monetary offers for assault or murder. Former CIA Officer The Wright Report identified a politician who publicly encouraged gangs to act against ICE, naming Cynthia Gonzalez in his October 15, 2025 Podcast. That rhetoric feeds the incentive environment that cartels and proxy groups exploit.
For churches with congregants who work for federal law enforcement, especially ICE, this creates an elevated, specific risk within the ongoing High threat environment.
What leaders need to know now
Cartel bounty chatter is credible and public. Reported bounty tiers vary, and amounts should be treated as reported claims.
There are now two reported incidents where men climbed nearby roofs and fired shots (Charlie Kirk Assassination and the Houston ICE Facility shooting). We assess that rooftop observation and firing from nearby buildings is likely to continue as a tactic. Churches should actively monitor nearby roofs and upper story vantage points.
A named public figure, Cynthia Gonzalez, was cited by The Wright Report as publicly encouraging gangs to resist ICE. That rhetoric matters because it normalizes and amplifies targeting of federal personnel. (Wright transcript, Oct 15, 2025.)
Federal agencies cannot be relied on to protect every church. This brief assumes churches must raise their own readiness and information security if they have Federal LEO’s attending their church.
Indicators to watch for
Vehicles loitering near the church at arrival and dismissal times, including repeated slow passes.
Individuals filming or photographing cars, license plates, or building entry points.
People on rooftops, upper balconies, or other elevated positions near the church, especially right before, during, or immediately after services.
New attendees who sit in positions to observe entrances and parking lots repeatedly.
Short, repetitive communications among small groups near the property, and persons using telephones with long-range lenses or binoculars.
Online posts or messages that single out named individuals, vehicles, or service times.
These behaviors do not automatically imply hostile intent, but they should trigger heightened observation, documentation, and escalation inside the church safety team.
Analysis
Cartels are using proxy networks, including domestic gangs and opportunistic actors, to accomplish tasks they cannot easily carry out themselves. The sequence commonly seen is doxxing, surveillance, intimidation, then physical attack. Rooftop sniper or shooter attacks are low probability but high consequence. The combination of public bounty offers and political rhetoric that appears to encourage resistance against ICE increases the incentive for criminal actors to attempt strikes or intimidation.
Churches are attractive observation points because worship services produce predictable patterns of movement, vehicle locations, and known exit times. If an agent or family member is attending a church regularly, that pattern becomes exploitable.
Recommended actions for church safety teams
Information security
Immediately review public communications and take down any posts that reveal schedules, parking maps, volunteer names, or policies that advertise security weaknesses.
Roof and elevated position monitoring
Treat nearby roofs and upper story vantage points as part of the security picture. Two rooftop shooting incidents have been reported, and that trend is likely to continue.
Assign a qualified UAS operator to your team when possible. Use the UAS to clear nearby roofs and elevated positions immediately before services begin and as services end. UAS clearing should be a coordinated safety team function, performed discreetly and safely, and in accordance with local law and FAA rules.
Parking lot posture and coverage
Place trained safety volunteers on exterior overwatch 15 minutes before services begin, during transitions, and for at least 10 minutes after dismissal.
Teach volunteers what to observe, how to log vehicle descriptions and partial plates, and how to quietly coordinate inside the team.
Coordination with federal personnel that attend your church
Do not publicly identify or single out law enforcement or federal personnel.
Privately reach out to congregants you know work in federal law enforcement and offer to plan with them, if they want. Ask if they want a confidential plan for arrival and departure, UAS clearing, or information security measures. Let them set the level of involvement. Do not assume they want an escort.
Communications and reporting inside the congregation
Keep public messaging calm, brief, and focused on watchfulness. For example: “We are increasing our awareness and training extra volunteers around arrival and dismissal. If you see something concerning, please locate a safety team member.”
Do not distribute specifics that reveal security procedures. Keep plans internal.
Drills and training
Run a 30 to 45 minute drill that includes roof checks, lot overwatch, UAS clearing, and a walk-through of a break contact procedure. Practice documenting suspicious activity and the after action workflow.
Political context and accountability
This threat is not solely criminal. Public rhetoric that encourages or normalizes attacks elevates risk. The Wright Report named Cynthia Gonzalez as a public official who urged gangs to resist ICE. That kind of language matters. Churches and community leaders should call out rhetoric that inflames violence and insist on accountability for anyone who publicly encourages criminal action.
Biblical perspective
Romans 13:1 to 5 gives an important framework for understanding civil authority and lawful order. Verse 4 affirms that governing authorities are instituted by God, and that they bear the sword as a means to restrain wrongdoing. We honor God by supporting officers who serve lawfully and by protecting the flock. Vigilance is not fear. It is stewardship.
Conclusion
Keep the CWT master threat level at High. Treat the cartel bounty activity as Elevated for the specific scenario of churches with federal law enforcement attendees. Take practical, discrete actions to monitor roofs and parking lots, improve information security, and assign a qualified UAS operator if possible to clear elevated positions before and after services. Work privately with any federal employees who will engage with your team on protective measures. Avoid public disclosure of tactical vulnerabilities. Stay calm, stay watchful, and act in faith and wisdom.
Faith. Readiness. Protection in His Name.
In His Service,
Keith Graves
Founder, Christian Warrior Training
Thanks for all you do....we're back in our church again but we just went through a serious storm that took our two homes and flooded others, in the 52 years I've lived here I've never seen anything like it...thankfully our law enforcement has been vigilant about keeping looky loos and strangers out of the affected area. God bless you Keith...to my knowledge we only have one sheriff's deputy that comes up to our church when he can and it's always nice to have him here.
My church is a low threat church, but they take our safety seriously.