Exposed

They're Hiding How
They Found You

Parallel construction is how the government launders the true source of an investigation into a clean-looking case. Agencies have done it for decades. Most defendants never find out.

par·al·lel con·struc·tion

A law enforcement practice of building a separate evidentiary trail to hide the true—often unconstitutional—origins of an investigation. Evidence laundering.

New · Case File 003 Mall of America plot: the affidavit never says how the FBI first found him → Learn More
The Problem

What Is Parallel Construction?

The Fourth Amendment protects you from unreasonable searches and seizures. Evidence obtained illegally—without a warrant, through mass surveillance, or in violation of your rights—is supposed to be inadmissible in court.

Parallel construction is how law enforcement gets around that.

When agencies like the NSA, DEA, or FBI obtain information through methods they don't want disclosed—warrantless wiretaps, bulk databases, classified programs, confidential sources they want to protect—they pass tips down the line. The receiving agents then "reconstruct" the investigation using ordinary methods, creating a clean paper trail that hides the true origin.

You never learn how they really found you. Your attorney can't challenge what they can't see. The jury never hears the truth.

The Process

How Evidence Gets Laundered

01

Hidden Collection

An intercept, a bulk phone-records query, a cell-site simulator, a foreign-intelligence database search, or a source the agency won't name. The evidence could be challenged—or thrown out—if its source were known.

02
03
04

Clean Evidence in Court

The prosecution presents only the reconstructed trail. The original source never appears in a report, an affidavit, or testimony. Defense attorneys can't challenge what they don't know exists.

Their Playbook

Common Techniques

These are the cover stories that show up again and again in reporting on concealed investigations.

📡

The "Anonymous Tip"

Intelligence from a hidden source is repackaged as an anonymous call or online report. No caller ID. No way to trace. Nearly impossible to challenge.

🚗

The Pretextual Stop

Officers already know who they're looking for and what they'll find. They follow the target until a minor violation—a broken taillight, a missed signal—gives them a reason to stop the car.

Reported: Reuters, Aug. 8, 2013

👤

The Confidential Informant

A source is directed toward a target the government already knows about. The case's origin becomes a person instead of a program—and the informant's file is fought over in discovery, if it's ever disclosed.

📋

Report Scrubbing

Agents are told to leave the true source out of reports, affidavits and testimony. Prosecutors may not know either. The paper trail is clean by design.

Reported: Reuters, Aug. 5, 2013

🔄

Multi-Agency Handoffs

Information passes through several agencies, each adding a layer of separation. By the time it reaches court, the chain is too convoluted to unravel.

📱

StingRay Concealment

Cell-site simulators track phones. FBI agreements with local police have called for prosecutors to seek dismissal of a case rather than disclose the device.

Document: Erie County FBI agreement, 2012

The Stakes

Why This Matters

Parallel construction doesn't just bend the rules—it takes away a defendant's only chance to challenge how the evidence was gathered. The scale of what could be hidden is enormous.

278,000+
Non-compliant FBI searches of FISA-acquired data, including searches on protesters and Jan. 6 suspects
Source: FISA Court opinion, Apr. 2022 (released May 2023)
~4,300
Times Baltimore police used a cell-site simulator since 2007, according to sworn testimony
Source: AP, Apr. 9, 2015
4 billion
Call records added every day to the Hemisphere database—whose users were told never to mention it in any official document
Source: New York Times, Sept. 1, 2013
The document specifically directs agents to omit the SOD's involvement from investigative reports, affidavits, discussions with prosecutors and courtroom testimony. … Agents are instructed to then use "normal investigative techniques to recreate the information provided by SOD."
— Reuters, "U.S. directs agents to cover up program used to investigate Americans," Aug. 5, 2013

When the government hides how it found evidence:

  • Defendants can't challenge searches they don't know happened
  • Courts can't enforce constitutional protections
  • Prosecutors may not know the truth either
  • Juries decide cases on incomplete information
  • Innocent people can't prove misconduct
The Record

When It Was Exposed

Despite efforts to keep it secret, journalists, courts and watchdogs have documented the practice—and the systems that feed it—for more than a decade.

AUG 5, 2013

Reuters exposes the DEA's Special Operations Division

A secretive DEA unit passed leads from intercepts, wiretaps, informants and a massive phone-records database to agents nationwide—with instructions to hide the source. A DEA training document called the process "parallel construction."

Read the investigation →
SEPT 1, 2013

The Hemisphere Project: AT&T call records back to 1987

The New York Times revealed a program giving drug agents access to AT&T call records stretching back to 1987, with about 4 billion records added daily. The training slides told users: "All requestors are instructed to never refer to Hemisphere in any official document."

New York Times →
OCT 25, 2013

First Section 702 notice to a criminal defendant

Months after the Supreme Court relied on the government's notice obligations in Clapper v. Amnesty International, prosecutors told Jamshid Muhtorov they intended to use evidence derived from warrantless Section 702 surveillance—the first such notice to any criminal defendant.

Lawfare →
APR 7, 2015

USA Today: The DEA tracked billions of calls for decades

From 1992 until 2013, the DEA used administrative subpoenas—no judge required—to collect logs of billions of calls from the U.S. to as many as 116 countries. The program was a model for the NSA's later bulk collection.

USA Today →
APR 2015

StingRay secrecy goes on the record

An FBI agreement released after a lawsuit showed a New York sheriff's office promising to "seek dismissal of the case" at the FBI's request rather than disclose its cell-site simulator. Days later, a Baltimore detective testified his department had used the device about 4,300 times since 2007.

The agreement → AP on Baltimore →
JAN 9, 2018

Human Rights Watch: "Dark Side"

A Human Rights Watch report concluded that parallel construction keeps potentially illegal surveillance hidden from judges and defendants, violates fair-trial rights, and should be banned.

Read the report →
OCT 8, 2019

FISA Court: FBI searches violated the Fourth Amendment

A declassified FISA Court opinion (issued Oct. 18, 2018) found the FBI's procedures for searching Section 702 data were not consistent with the Fourth Amendment, citing repeated improper searches.

Read the opinion →
MAY 19, 2023

278,000+ non-compliant FBI searches

A newly released FISA Court opinion described more than 278,000 non-compliant FBI queries of FISA-acquired data, including searches on Jan. 6 suspects, people arrested at 2020 protests, and more than 19,000 donors to a congressional campaign.

Read the opinion →
NOV 20, 2023

Hemisphere never died—it was renamed

Sen. Ron Wyden revealed the program continues as "Data Analytical Services," allowing often-warrantless searches of trillions of domestic phone records going back to 1987.

Wyden's letter →
JUNE 12, 2026

Section 702 lapses—but collection doesn't stop

Congress let Section 702's statutory authority expire for the first time since 2008. Collection continues under FISA Court certifications valid until March 17, 2027.

EFF → Brennan Center →
Case Files

Watching the Origins of Live Cases

We track federal cases where the public record leaves a question about how an investigation actually began. We don't take sides on guilt. We ask one thing: is the government's origin story the whole story?

Watching

The public record documents how the case began. We track filings for anything that changes that.

Open Questions

The public record leaves a gap in how the investigation began, or the origin depends on sources the defense hasn't seen.

Notice Filed

The government has given notice of FISA-derived evidence (50 U.S.C. § 1806(c)) or is litigating classified material under CIPA.

Confirmed

A court, the government, or primary documents establish that the case's true origin was concealed.

FileCaseCourtStatusReviewed
003 United States v. MohamudMall of America plot · 2026 D. Minn. Open Questions Oct 7, 2026
002 United States v. KramerPittsburgh-area ISIS plot · 2026 W.D. Pa. Open Questions Oct 7, 2026
001 United States v. CagleAtlanta airport threat · 2025 N.D. Ga. Watching Oct 7, 2026
Case File 003

United States v. Sheikhdoon Abdullahi Mohamud

Mall of America ISIS-inspired plot (2026) — The Origin Gap

Open Questions
Court
U.S. District Court, D. Minnesota
Docket
No. 26-mj-760 (ECW)
Charge
18 U.S.C. § 924(h) — firearm received for a federal crime of terrorism (predicate: § 2339B)
Maximum
15 years
Next date
Preliminary hearing, Oct. 19, 2026
Last reviewed
Oct. 7, 2026

The official record

On October 6, 2026, FBI agents arrested 18-year-old Sheikhdoon Abdullahi Mohamud of Richfield, Minnesota, moments after he paid an undercover FBI employee $600 in cash for an AK-47-style rifle, four 30-round magazines and about 200 rounds of ammunition. The FBI had made the rifle inert before the sale. Prosecutors say he planned a mass shooting in support of ISIS at the Mall of America during the Hmong Arts Celebration on October 24, and allege he said part of his motivation was that he believed the mall was owned by Jews.

The case rests on nearly two years of messages between Mohamud and a paid FBI confidential source ("CHS1") on Telegram, Signal, Discord, TikTok and SimpleX. The FBI's affidavit says CHS1 has worked with the Bureau since 2017 and is "motivated by patriotism and monetary compensation." In September 2026, CHS1 asked if he was "100%" sure and told him, "if you want to back out, we will remain brothers." Mohamud allegedly replied that he was "100% commited [sic]."

The gap

The FBI's sworn affidavit lays out the case in detail from December 2024 forward. It never says how the FBI first found a then-16- or 17-year-old in Richfield, or who messaged whom first. The investigation dates "since about December 2024," and the informant contact "in or about December 2024."

Full case file The paragraph-by-paragraph timeline, the informant's role, the entrapment question, and what to watch next

Open questions

No stated origin

The affidavit cites no tip, no platform report and no earlier investigation as the starting point. It also says it does not set out everything the government knows—standard language, but the starting point is precisely what parallel construction would leave out. A missing origin isn't proof of anything. It's the question.

A paid source from the first documented contact

The earliest contact described is with a paid informant—not a parent, a teacher, a tip line or a platform. If the source was pointed at Mohamud because of something the government doesn't want to disclose, such as a database query or a foreign-intelligence hit, the informant becomes the clean origin story. Only the source's tasking records can answer that.

The investigation began when he was a minor

He is 18 now, so he was 16 or 17 when the FBI opened its case. Juvenile status affects which records exist, who can see them, and what the defense can obtain about the early months of the investigation. The affidavit also records an attempted FBI interview at his home in May 2025.

The government supplied the means

Mohamud told the court he has no job, no car and no money. The rifle, magazines and ammunition came from the FBI. That's an entrapment question more than a parallel-construction one, and it has been documented in FBI terrorism stings before (Human Rights Watch, 2014). To be fair to the record: the affidavit shows the informant offering him a way out, and prosecutors will point to that.

What the defense should ask

  1. What first brought Mohamud to the FBI's attention, and on what date—a tip, a platform referral, a database query, or foreign intelligence?
  2. Who initiated the first contact with CHS1? Was CHS1 tasked to him, and on whose information?
  3. CHS1's full file: payments, tasking orders, prior cases since 2017, and every communication with Mohamud (Brady and Giglio material).
  4. Will the government file notice under 50 U.S.C. § 1806(c) that it intends to use information derived from FISA or Section 702 surveillance?
  5. Will the government seek protective orders under the Classified Information Procedures Act (CIPA)? That would signal classified material in the case.

What would change our rating

Up to Notice Filed

A FISA notice, a CIPA § 4 motion, or a sealed filing about the investigation's origin.

Down to Watching

A documented, independent starting point—such as a dated tip or platform referral—disclosed to the defense.

Note: Sheikhdoon Abdullahi Mohamud is charged by complaint and is presumed innocent. The allegations describe planned mass violence against shoppers, and nothing here minimizes that. Our only question is whether the court and the defense will be told how this investigation really began.

Sources (9)
  1. U.S. Attorney's Office, D. Minn., press release, Oct. 7, 2026
  2. Criminal complaint and FBI affidavit, No. 26-mj-760 (ECW)
  3. MPR News, Oct. 7, 2026
  4. KSTP, Oct. 7, 2026
  5. CBS Minnesota, Oct. 7, 2026
  6. Star Tribune, Oct. 7, 2026
  7. 18 U.S.C. § 924(h) (Cornell LII)
  8. 50 U.S.C. § 1806 (Cornell LII)
  9. Human Rights Watch & Columbia Law School, "Illusion of Justice", July 21, 2014
Case File 002

United States v. Jonathan Hunter Kramer

Pittsburgh-area ISIS-inspired plot (2026) — Two Tips, Three Years Apart

Open Questions
Court
U.S. District Court, W.D. Pennsylvania
Docket
Mag. No. 26-1518; indictment announced Oct. 6, 2026
Charge
18 U.S.C. § 924(h) (predicate: § 2339B) — one count
Maximum
15 years
Custody
Detained pending trial
Last reviewed
Oct. 7, 2026

The official record

On September 12, 2026, FBI agents stopped Jonathan Hunter Kramer, 21, of Valencia, Pennsylvania, in the parking lot of a Cranberry Township hotel. According to the FBI's affidavit, his bags held rifle magazines and boxes of ammunition, his hotel room held a semiautomatic rifle with a scope and bipod, and his home held about 30 knives. The Justice Department says he had five magazines and 190 rounds in total. Prosecutors allege he was preparing an ISIS-inspired attack; the FBI believes he created and used the SimpleX account "Hamza Al Rashid." Federal prosecutors announced a one-count indictment on October 6.

This was the FBI's second investigation of Kramer. The first, in 2023 when he was a minor, began with an anonymous tip about a Telegram user; he was charged by Pennsylvania authorities and was released from a juvenile facility in March 2026. On March 19, 2026, an anonymous online tip told the FBI he was ordering "mysterious" packages and "talking to his friends from before." The FBI says it identified and interviewed that tipster on April 1—someone "closely associated" with Kramer. An FBI confidential source began chatting with "Hamza Al Rashid" on June 29, and agents watched him in person on July 16–17.

The gap

The affidavit explains how the 2026 case restarted, but not what the FBI was collecting between 2023 and 2026—or what put agents outside Kramer's house on the morning of September 12.

Open questions

An open file from 2023

The FBI already had a full investigation on Kramer: a 2023 search of his parents' home, a recorded pledge of allegiance to then-ISIS leader Abu Bakr al-Baghdadi, and his old Telegram and Discord accounts. Did any monitoring continue while he was in the juvenile system, and did any of it shape the 2026 case before the March tip?

Why that morning?

Agents saw Kramer leave home at about 10:04 a.m. on September 12, the day he allegedly obtained the rifle. The affidavit doesn't say what put them there. Much of the rest of that day—the Uber ride, the disposable phone, the parking-lot handoff—was pieced together afterward from Uber records, a Walmart employee and store video. That's normal police work. It's also the shape a reconstruction takes.

The unidentified individual

Grainy store video appears to show Kramer taking something from an unidentified person's trunk in a Walmart parking lot—what the FBI says "appeared to be a long black bag that could have accommodated a rifle." As of October 7, the indictment names Kramer alone. Who was that person, and did the FBI know about the handoff before it happened?

The source got there first

The affidavit says the FBI's source began chatting with "Hamza Al Rashid" on June 29, and that the FBI learned of the account from the SITE Intelligence Group on or about July 9. Who pointed the source at that account ten days earlier, and how did the FBI connect it to Kramer?

What the defense should ask

  1. Everything the FBI held or collected on Kramer between the 2023 case and the March 19, 2026 tip, including while he was in juvenile custody.
  2. What prompted surveillance of his home on the morning of September 12?
  3. The identity of the person in the Walmart parking lot and any relationship to law enforcement.
  4. The confidential source's tasking, payment and communication records.
  5. Any notice under 50 U.S.C. § 1806(c) or any CIPA filing.

Note: Jonathan Hunter Kramer is presumed innocent. His 2023 case gave the FBI legitimate reasons for continued interest. The question here isn't whether he posed a threat; it's whether the official origin of this investigation is the complete one.

Correction Oct. 7, 2026: An earlier version of this file said Kramer had been adjudicated for a felony-level offense as a juvenile and could not legally buy a gun, and quoted the U.S. Attorney calling the investigation "covert." The FBI's affidavit says his 2023 juvenile charges did not include a felony, and we could not find the "covert" quote in any official statement. We also previously described a rifle being handed to him; the affidavit describes a bag. We regret the errors.

Sources (5)
  1. U.S. Attorney's Office, W.D. Pa., complaint press release, Sept. 15, 2026 (updated Sept. 17)
  2. FBI affidavit in support of criminal complaint, Mag. No. 26-1518, sworn Sept. 13, 2026
  3. U.S. Attorney's Office, W.D. Pa., indictment press release, Oct. 6, 2026
  4. WPXI, Sept. 15, 2026
  5. WPXI, Sept. 16, 2026
Case File 001

United States v. Billy Joe Cagle

Atlanta airport threat case (2025) — A Documented Origin

Watching
Court
U.S. District Court, N.D. Georgia
Charges
18 U.S.C. § 37(a), § 875(c), § 922(g)(1); state charges pending (as of Nov. 2025)
Plea
Not guilty (Nov. 14, 2025); insanity notice filed
Last reviewed
Oct. 7, 2026

The official record

On October 20, 2025, Atlanta police arrested Billy Joe Cagle, 49, of Cartersville, Georgia, inside the domestic terminal at Hartsfield-Jackson International Airport. He was unarmed. Authorities say that on a FaceTime call he said, "I'm at the airport, and I'm gonna go rat-a-tat-tat"; the person on the call drove to the Cartersville Police Department, which alerted Atlanta police. An AR-15-style rifle was found in his pickup at the terminal curb; police said it belonged to his wife.

He was charged federally on October 21 with attempted violence at an international airport, interstate threats and possession of a firearm by a felon. At his detention hearing, prosecutors said he has schizophrenia and bipolar disorder and had stopped taking prescribed medication. In December 2025 his lawyers filed notice of an insanity defense. As of September 2026, mental-health evaluations were still pending and no trial date was set.

Our assessment

The public origin here is specific and well documented: a reported threat on a call, a trip to the police station, and a police timeline. The federal role follows from the charges themselves—violence at an airport is a federal crime, and tracing a gun found with a convicted felon is routine. We've downgraded this file to Watching.

Questions still worth asking

  1. Did any federal agency hold records on Cagle before October 20, 2025, including phone-record queries through Data Analytical Services (formerly Hemisphere)?
  2. Was any surveillance or location data used to find him inside the terminal?
  3. Will the government file any FISA notice or CIPA motion? Nothing has been reported so far.

Note: Billy Joe Cagle is presumed innocent. His defense argues this was a psychiatric crisis, not a criminal plan. We keep this file open because it shows the questions any defense should ask, even when the origin looks clean.

Update Oct. 7, 2026: We removed earlier claims that the federal response was "atypical" and that Cagle fit a "documented pattern" of targeting vulnerable people. The public record doesn't support them.

Sources (7)
  1. U.S. Attorney's Office, N.D. Ga., press release, Oct. 21, 2025
  2. AP via PBS NewsHour, Oct. 21, 2025
  3. FOX 5 Atlanta, Oct. 23, 2025
  4. WSB-TV, Oct. 29, 2025
  5. Atlanta News First, Nov. 14, 2025
  6. WSB-TV, Dec. 4, 2025
  7. WABE, Sept. 10, 2026
Standards

How we build a case file

  • Public records only: court filings, government releases, and named news reporting.
  • Every factual claim links to a source, and every file shows when we last reviewed it.
  • Defendants are presumed innocent. We don't defend the conduct alleged; we question how cases begin.
  • We downgrade our own files when the record answers the question.
  • We publish corrections on the file itself. Spot an error? Tell us.
Take Action

How to Fight Back

Parallel construction thrives in secrecy. Awareness, legal challenges and policy reform can expose it.

⚖️ If You're Facing Charges

  • Ask your attorney about parallel construction
  • Request all discovery about how the investigation began
  • Ask whether the government will give notice of FISA or Section 702 evidence (50 U.S.C. § 1806(c))
  • Challenge "anonymous tips" and pretextual stops
  • Find out whether StingRays or other surveillance tools were used

📝 Questions for Your Attorney

  • How did this investigation actually begin?
  • Did it start with a confidential informant—and who contacted whom first?
  • Has the government disclosed every source of information?
  • Were federal agencies involved before local police?
  • Has the government sought any protective order under CIPA?

📢 Demand Reform

  • Require disclosure of how every investigation began
  • Require notice of surveillance used to start a case, not just evidence used at trial
  • Limit warrantless searches of Americans in Section 702 data
  • Push for StingRay transparency
  • End qualified immunity so officers face consequences
Learn More

Resources & Organizations

⚡
Electronic Frontier Foundation
Digital rights and surveillance accountability
🏛️
ACLU
Constitutional rights litigation
🌍
Human Rights Watch
"Dark Side" report on secret evidence origins
📚
Brennan Center
Section 702 tracker and FISA reform
🚫
Ban Qualified Immunity
End legal shields for government misconduct
⭐
Ohio Coalition to End QI
State-level qualified immunity reform
🛡️
Police Against Immunity
Law enforcement voices for accountability

The Constitution Means Nothing If They Can Hide How They Violated It

Parallel construction lets the government break the rules and cover its tracks. Spread the word. Demand transparency. Fight back.

Join the Movement Read the Case Files