You Found an Infiltrator in Your Group. Now What?

It's not as simple as kicking them out.

Spotting an infiltrator, especially the federal kind, isn't the victory some think it is. In the groups I’ve seen, identifying the infiltrator was seen as the end result, with no real thought about what would be done after that. Typically, the group reaction is about like this:

1. Suspicion

2. Accusation

3. Fracture

4. Repeat in a splinter group

The above list is simplistic but it’s fairly accurate, and that’s assuming no one got arrested. Certainly identifying the infiltrators is critical. What you do when you find them, however, is the most important part. Before we even get to that, first we need to talk about the vectors that offer them access.

Being Realistic About How They Get In

For some reason, groups often tend to rely on Hollywood stereotypes when it comes to answering the question of what an infiltrator looks like. Alternatively, they rely on the memes and inside jokes that permeate the resistance culture. The pattern, however, evidenced by case study after case study, is both clear and preventable.

Here’s what you need to know upfront:

If you are attempting to keep your group fed-free (or free of any kind of informants and infiltrators, paid or otherwise), the single most important thing you can do is ensure emotional health in your members.

For some of you, that will be an uncomfortable thing. Unfortunately for you and your group, it’s true. We see it proved out repeatedly.

When you see that a group was infiltrated, you will almost always see that the avenue of approach was a member or leader with an emotional need that cried out to be filled.

As we’ve seen over and over, unmet emotional needs and unresolved trauma cloud your judgment and push you to bypass warning signs. Your brain literally chooses to disregard the danger signals in favor of reaching the goal: not the goal that your group might have, but your personal goal of feeling worthy, needed, or validated.

Federal actors are trained in rapport-building, and other types of infiltrators often instinctively understand it. They exploit trust dynamics, looking for cracks they can widen. They play the long game, and often, their success comes from your lack of internal protocol, or lack of personal emotional health.

This is why your group must be small, tight-knit, and preferably nameless. Larger groups introduce layers of complexity, conflicting personalities, and emotional volatility. Too many voices in the decision process create leaks, whether intentional or not. People will demand to see evidence. Some will be swayed emotionally and may tip off the infiltrator or even defend them. The threat grows exponentially.

The best insulation against infiltration of any kind is a combination of two things:

1. Emotional health – which closes the most common avenue of approach.

2. A robust vetting process – which serves as a systematic barrier against manipulation.

Identifying Possible Infiltrator Presence

Infiltrators operate with patterns. While your gut might signal a problem (and you should always, always pay attention to those signals even if you shouldn’t use them as your only criteria), the real tell will be the consistency in anomalies—which is in and of itself a pattern.

Here are behaviors to watch:

• Advocates illegal activity early or often. This is stereotypical but true. The “entrapment elves,” as Will Grigg called them in 2019, have nothing to entrap if they can’t get you to do something illegal.

• Pushes for escalation without relationship equity. This means that their suggestions or encouragement come before they have earned trust. They bring the ‘credibility’ with them in the form of backstory, and this allows them to cut down on the time from insertion to entrapment. (Example: the agent in William Keebler’s group who came with a claimed military background in explosive ordance and later gave Keebler a device to use, which landed him in prison.)

• Is always available, has endless resources, or circumvents normal vetting. (Example: the informant that got into AP3 and other groups wasn’t a fed, but he used the role of a trainer to get around any and all vetting processes.)

• Provides inconsistent or overly curated backstories.

• Is always curious about everything: people, places, contacts, operations, supplies, information. Wants to be “in the know.” (This isn’t always an infiltrator; sometimes it’s someone who’s melding their identity with the group. Either way, it’s a problem.)

Instead of emotional suspicion, rely on analytical red flags. For example, if someone's personal timeline doesn't match when cross-referenced or if they offer help without understanding or appearing to care about the implications, take note. If they manage to move up the ladder fast, that’s another sign that they’re leveraging leadership emotionally, usually through praise-bombing or specific tactics meant to mirror ideological purity.

Internal Damage Without an Action Plan

Improper handling of suspected feds and other infiltrators creates chaos. Groups implode not from external threats, but from internal mismanagement of those threats. Someone makes a public accusation, factions form, and the group either fractures or devolves into distrust.

Historical cases like COINTELPRO show us this pattern: the real damage isn't just the infiltrator themselves, it's not even about whether the group figures it out, but how the group handles it when they do.

The Protocol You Don’t Have But Should

Every group should establish an infiltration protocol before one is suspected. A graded response approach allows rational escalation without wrecking the group. If your group is small enough, everyone will be on board. The larger the group, the more chance someone will either refuse to participate in this process or screw it up. In one of your state-level or even national groups, there is no way to implement a protocol with any real level of effectiveness.

Level 1: Monitor

• Quietly observe behavior.

• Begin documentation.

Level 2: Restrict Access

• Limit participation in sensitive operations or conversations.

Level 3: Internal Review

• Evaluate the evidence with an eye for truth over relationship.

Level 4: Strategic Removal

• Remove access with a neutral or non-confrontational cover story. Never make a big scene about it.

Level 5: Containment & Disinformation

• In extreme cases, feed them false data to confirm your suspicions and assess the damage.

This process has to be managed by a defined internal team, not by democratic vote or social media consensus. Again, ideally your group is small enough that everyone is on board.

Psychological Discipline and Group Health

The loudest accuser is sometimes the biggest liability. It’s in an infiltrator’s best interest to make sure that they have a clear path to operate, so you’ll often see preemptive accusations against people who are suspicious of them. Performing outrage doesn't neutralize threats, though strategy will. Your goal is containment, and that requires maturity, discipline, and a serious commitment to integrity.

Groups with strong internal health don’t need to panic because they have a plan that involves coordinated intent. Most importantly, they don’t let one person’s ego or anyone’s emotional needs dictate their operational security. I’m not advocating paranoia, but intentionality.

If you don’t have a protocol in place, you are the weak link. Finding the infiltrator is only a win if your next steps contain clarity and intentionality. Remember: be proactive, not reactive.

Premium Content: Infiltrator Identification and Protocol Plan

• Behavioral flags checklist based on LSI SCAN principles.

• Template for group response protocol with 5-level grading.

• Incident documentation format.

• Flowchart: From suspicion to containment.

• Red list of common mistakes (e.g., public call-outs, unilateral action, failure to document).

Upgrade now to get the action plan.