The man the FBI calls the ringleader of a foiled plot to attack a UFC event on White House grounds is a 31-year-old Mexican national who overstayed a tourist visa more than two decades ago, and was later granted deportation relief under the Obama administration's DACA program. The Department of Homeland Security identified him as Abraham Hermosillo Alvarez in a press release issued June 18, laying out an immigration history that raises pointed questions about how a visa overstay became a protected "Dreamer", and then, allegedly, a domestic terror plotter.
Alvarez and four other men now face charges of conspiracy to commit murder and conspiracy to commit violence on White House grounds. The alleged target: UFC "Freedom 250," a cage-fighting event held on the White House South Lawn on June 14, attended by President Donald Trump, first lady Melania Trump, cabinet officials, members of Congress, and thousands of spectators.
The plot, as described in unsealed court affidavits, involved explosive-laden drones designed to strike nearby buildings and trigger a mass evacuation, funneling panicked crowds toward tactically positioned gunmen. Maps of sniper and drone positions were recovered. So were encrypted chat messages, firearms, tactical gear, and thousands of rounds of ammunition spread across multiple states.
DHS laid out a straightforward chronology. Alvarez entered the United States on a B-2 tourist visa. That visa expired in December 2001. He did not leave. For more than a decade, he remained in the country unlawfully, until 2014, when he was granted Deferred Action for Childhood Arrivals status.
DACA was created in June 2012 through a DHS memorandum issued under the Obama administration, after Congress failed to pass the DREAM Act. The program shields certain illegal immigrants who arrived as minors from deportation and grants them renewable work authorization. It does not confer lawful immigration status and provides no pathway to citizenship. Recipients must renew every two years.
DHS acting Assistant Secretary Lauren Bis did not hold back in the agency's statement:
"This illegal alien from Mexico should never have been allowed in our country. He was the ringleader of a failed terror attack targeting UFC Freedom 250 at the White House."
Bis added that Alvarez and his co-conspirators "now face charges of conspiracy to commit murder and conspiracy to commit violence on White House grounds. He will face justice and swiftly be removed from our country."
Alvarez's attorney, Kelly Steenbock, told Newsweek her office does not comment on pending cases.
The FBI assessed that Alvarez, known online as "Shepherd", was responsible for planning, organizing, and directing the attack. Court documents describe a multi-phase operation. First, explosive-laden drones would hit nearby buildings. The resulting panic would drive attendees toward a pre-positioned sniper team. Authorities allege the plan targeted so-called "high-value" individuals attending the event.
In one group chat message attributed to Alvarez in the affidavits, he allegedly wrote: "This is the best action I see. Position your teams in the purple dots (counter sniper and drones) Long range (circled area) (great shot) Easy out into the river."
Just The News reported that investigators identified high-value targets including President Trump, Vice President JD Vance, Elon Musk, and Israeli Prime Minister Benjamin Netanyahu. The group was motivated by a mix of extreme anti-government ideology, antisemitic beliefs, and satanic conspiracy theories.
The scope of the conspiracy stretched across four states. The four co-defendants are Tycen C. Proper, 19, of Danville, Ohio; Bryan Omar Roa, 24, of Calimesa, California; Michael Alan Thomas, 32, of Pinon Hills, California; and Daniel K. Eskridge, 32, of Kidder, Missouri.
The break came from a parent. National Review reported that the FBI was tipped off on June 10 after the parents of 19-year-old Tycen Proper alerted Knox County deputies about their son's suspicious firearms collection and online communications. That tip set a multi-state investigation in motion just days before the event.
The security implications of the alleged plot echo other recent cases involving threats to political figures. Survivors of the Butler, Pennsylvania, rally shooting have sued the federal government over Secret Service security failures, a reminder that protecting leaders at large outdoor events remains an ongoing challenge.
Proper allegedly amassed firearms, thousands of rounds of ammunition, and tactical gear at his Ohio home. He also allegedly identified potential targets including multiple members of Congress and planned to rendezvous with other conspirators in Fredericksburg, Virginia, ahead of the June 14 event.
The recruitment infrastructure ran through social media. The New York Post reported that TikTok served as the primary recruitment platform. Once a prospect proved himself to an established member, he was transitioned to encrypted Signal chats for operational planning. A criminal complaint from the U.S. Central District of California stated that "members of this group were primarily recruited through TikTok" and then moved to "a vetted (and more secure) Signal chat."
Roa's TikTok activity revealed a mix of anti-Trump, white supremacist, and antisemitic content tied to an "accelerationist" ideology, a worldview that seeks to hasten societal collapse through violence. Social media videos allegedly posted by Roa showed him firing weapons. A search warrant executed at Roa's residence and vehicle yielded a rifle, a handgun, ammunition, a tactical belt, a rifle magazine, a two-way radio, and an infrared laser target pointer.
Thomas allegedly participated in group chats discussing funding for drones and explosives. He outlined a tiered structure for participants and discussed coordinating firearms training in Southern California. A June 13 search warrant at his Pinon Hills home led to the seizure of a rifle, extended magazines, ammunition, and a pistol.
Eskridge, charged with conspiracy to commit murder on White House grounds, was identified through communications recovered from another suspect's phone. He allegedly shared images of tactical gear and participated in discussions about funding and coordinating teams. A search warrant at his Missouri residence recovered multiple firearms and additional equipment.
The case is not unlike other recent law enforcement operations targeting alleged foreign terror figures on American soil, where immigration status and criminal intent intersect in ways the public rarely sees until an arrest is made.
The Associated Press reported that the broader online planning group numbered approximately 19 to 20 individuals who communicated through a TikTok group called "Vanguard of the Old" and encrypted Signal chats, sharing maps and aerial photographs of the area around the White House. Five have been arrested so far. The investigation remains ongoing, and authorities have indicated additional suspects may be identified.
Vice President Vance told Fox News the plot "didn't even get close to the point of execution." FBI Director Kash Patel said in a joint statement with the U.S. Secret Service: "Thanks to the rapid action of the FBI, our partners, and the Department of Justice in a multi-state operation, multiple individuals are now in custody and allegedly planned attacks were stopped cold."
Breitbart noted the DHS confirmation that Alvarez overstayed his B-2 tourist visa in 2001 and was subsequently granted DACA status, a detail that has sharpened the political debate over the program's vetting standards and its role in shielding individuals from removal.
DACA has been a political flashpoint since its creation. The Obama administration established it through executive action after Congress declined to pass the DREAM Act. Supporters have long argued the program protects young people who grew up in the United States through no fault of their own. Critics have warned that the program, by design, shields individuals from the enforcement mechanisms that might otherwise flag security risks.
The Alvarez case gives those critics a concrete example. A man who overstayed a tourist visa in 2001 received DACA protection in 2014. More than a decade later, federal authorities allege he organized a multi-state conspiracy to attack an event on the grounds of the White House itself. Whether his DACA status was current at the time of his arrest remains unclear from available filings.
The broader questions surrounding Obama-era executive actions and their downstream consequences continue to surface across the legal landscape. The Supreme Court's recent refusal to hear Carter Page's FISA surveillance lawsuit is another example of how decisions made during that administration still reverberate through the courts.
If convicted, Alvarez faces federal sentencing and removal proceedings under immigration law. His co-defendants face their own serious charges. The full scope of the alleged conspiracy, including the roles of the roughly 15 additional individuals in the online planning group who have not yet been charged, may take months to resolve.
The UFC "Freedom 250" event drew thousands of people to the White House on June 14. The president, the first lady, cabinet officials, and business leaders were all present. The FBI says it stopped a plot to turn that gathering into a mass-casualty attack. And the man the government calls the ringleader was living in the United States under the protection of a program that was never supposed to shield anyone who posed a threat.
A program that grants deportation relief without conferring legal status, without providing a path to citizenship, and, as this case suggests, without reliably screening out those who would do the country harm is a program that deserves harder scrutiny than it has ever received. The question is not whether DACA recipients as a group are dangerous. The question is whether a system built on executive fiat and renewed every two years with minimal oversight can catch the ones who are.
When the government tells you someone "should never have been allowed in our country", and that same government gave him protected status, the failure isn't hypothetical. It's on the record.