ICE’s Homeland Security Investigations is engaged in far-reaching spying against left-wing activists that rivals the FBI and CIA crackdowns on the Civil Rights and anti-war movements.

Attorneys for 15 Minnesota residents facing [federal conspiracy charges](http://google.com/url?q=https://www.courtlistener.com/docket/73489496/united-states-v-sant/\&sa=D\&source=docs\&ust=1790197146587297\&usg=AOvVaw0UdkZaJYSL2FNwpf9CWVZ4) have obtained evidence of a sweeping, possibly unconstitutional spying operation carried out by Immigration and Customs Enforcement against left-wing social movements in [Minnesota](https://www.wired.com/story/ice-crashing-us-court-system-minnesota/) and beyond.

The high-profile Minnesota 15 prosecution makes clear that the Department of Homeland Security (DHS), flush with federal funds and newly hired personnel, is now President Donald Trump’s primary tool against dissent, with a powerful array of post-9/11 investigative authorities brought to bear against everyday Americans organizing their communities.

Nothing of this scale has been seen in the United States, experts say, since the federal government’s counterinsurgency against the New Left and the anti-war movement in the 1960s and 1970s.

Among the records revealed during the discovery process in these cases are dozens of reports, audio transcripts, emails, intercepted Signal chats, photographs, database queries, and more. They reveal the inner workings of the domestic terrorism investigations, running under the names Project Whipple Shield and Operation Puppet Master, authorized by the controversial [National Security Presidential Memorandum 7](https://www.wired.com/story/an-anarchists-conviction-offers-a-grim-foreshadowing-of-trumps-war-on-the-left/).

Published following Charlie Kirk’s assassination in September of last year, NSPM 7 instructs federal law enforcement to use every tool available against organizations and people who criticize the administration's policies and espouse "anti-Christian" ideas. The full scope and extent of the investigations it authorizes remains unknown.

Defense attorneys for the Minnesota 15 claim that the prosecution stems from a broader nationwide surveillance operation aimed at opponents of the Trump administration’s immigration policies. One attorney in the case directly compares the DHS-run campaign to the FBI’s infamous Counterintelligence Program, or COINTELPRO, which unconstitutionally surveilled, infiltrated, and blackmailed racial justice, civil rights, and anti-war movements from the 1950s through the early 1970s.

Three former law enforcement officials who reviewed filings concur, telling WIRED that the case is almost certainly part of a wider intelligence-gathering operation that began long before the administration invaded Minnesota in December 2025.

Dueling motions in the case over discovery of DHS’s surveillance program reveal that personnel with Homeland Security Investigations—one of ICE’s two components—repurposed funding mechanisms and investigative tools for serious criminal probes and turned them on domestic dissenters. Operation Keyhole, the HSI undercover program that bankrolled the Minnesota 15 prosecution, dates back to 2008. As of June 2026, it was underwriting a half dozen active undercover investigations in the Minneapolis–Saint Paul area.

Around 120 HSI agents, many drawn from specialized units across the country that have served as the leading edge of the administration’s militarized immigration enforcement operations, were assigned to the case—including 11 undercovers. They used highly invasive surveillance techniques, including the deployment of Reaper drones and Patriot Act tools usually restricted to money laundering and terrorism investigations. Undercover operatives also [infiltrated churches](https://www.mprnews.org/story/2026/08/15/federal-surveillance-of-minneapolis-church-may-have-violated-court-order) in apparent violation of a court order.

...

An [internal ICE document](https://storage.courtlistener.com/recap/gov.uscourts.mnd.234416/gov.uscourts.mnd.234416.212.1_5.pdf) laying out the scope of Operation Puppet Master—which led to the indictment of the Minneapolis 15—ends by noting, “This case has also been accepted under CUC Op Keyhole.” According to [prosecutors](https://storage.courtlistener.com/recap/gov.uscourts.mnd.234416/gov.uscourts.mnd.234416.263.0_1.pdf), Operation Keyhole is a long-standing program created by HSI’s Saint Paul office to fund “undercover activity”—primarily equipment purchases and personnel costs—in a region covering Minnesota, North and South Dakota, Iowa, and Nebraska. The program has funded at least 77 investigations into “narcotics trafficking, child sexual abuse, financial investigations, and counter-proliferation” since it started in December 2008.

The CUC prefix, per an internal 2008 DHS handbook [unearthed by the independent media outlet Unicorn Riot](https://media.unicornriot.ninja/wp-content/uploads/2018/06/ice-undercover-operations.pdf), refers to Certified Undercover Operations, a formal designation with clearly defined oversight mechanisms, procedures, and reporting requirements. Operation Keyhole’s parameters are reviewed every six months by a committee comprising senior DOJ and DHS officials. As of June 2026, when it was last renewed, Keyhole funded six active investigations, including Project Whipple Shield, which was initiated in February to probe claims of assault, stalking, and doxing of DHS agents and other federal employees, and underpins the Minnesota 15 indictment.

At least 11 undercover agents working under Operation Keyhole infiltrated Twin Cities anti-ICE activists, participating in martial arts and know-your-rights trainings, marches, general strikes, and community meetings. They also infiltrated activists’ communications network for identifying possible undercover ICE vehicles and dispatching activists to tail them through the Twin Cities, and penetrated several activist group chats on Signal, transmitting their contents back to other HSI colleagues for analysis and eventual inclusion in the indictment.

Activist conferences as far away as Seattle, Michigan, [Chicago](https://www.wired.com/story/chicago-area-cops-helped-hsi-spy-on-minnesota-anti-ice-activists/), and New York City were placed under surveillance as part of the investigation, and HSI teams photographed and ran the license plates of every car parked in the lot of a meeting location or seen transporting activists. There is also drone footage from unarmed Customs and Border Protection Reaper drones of the activists moving around the Twin Cities area.

The undercovers were part of a much broader group of more than 50 HSI agents, including at least two dozen from HSI’s little-known Special Operations Group, that took part in the investigation and surveillance of the defendants, both digital and in-person. Feds with decades of experience on complex financial crimes, drug cartel investigations, human trafficking, and organized crime were pulled into the Minnesota 15 investigation.

Several of the Minnesota 15 case agents are from out of state and appear in court records for the prosecutions of anti-ICE activists in other cities. This includes Los Angeles–based HSI agents [Robert Kurtz III](https://www.nacdl.org/getattachment/6e8dd2ce-b13a-43c3-87d6-5935837a1618/gov-uscourts-cacd-988767-1-0.pdf), who specializes in financial fraud, and Ryan Ribner, who allegedly [assaulted](https://emptywheel.net/2026/01/12/dhs-assaulting-protesters-because-goons-believe-they-are-vicious-horrible-people/) SEIU California president David Huerta at a June 2025 protest of an ICE enforcement operation, arrested him, and then claimed the then 58-year-old Huerta attacked federal law enforcement. (Huerta’s charges were [dropped](https://www.courthousenews.com/justice-department-drops-criminal-charge-against-labor-leader-david-huerta/) in July after videos contradicting Ribner’s account surfaced.) HSI records show Ribner was also involved in at least two prosecutions of Southern California residents who physically confronted ICE and Border Patrol agents last year.

Other agents from the conspiracy investigation have also been involved in recent high-profile incidents. Tim Gerber, the “team leader” of an HSI Special Operations Group squad, led the investigation of former CNN host Don Lemon for reporting on a protest at a Minneapolis Church where an ICE agent was a pastor. Fellow SOG agent Yue Her was present at the scene of a 2025 incident when Renee Good’s killer, ICE Special Response Team agent Johnathan Ross, was dragged by the car of a man he tried to apprehend.

“This operation does not seem in any way limited to Minnesota,” says Spencer Reynolds, a former DHS attorney and counterterrorism lawyer who now works at the NAACP Legal Defense Fund. “As we saw with the boots on the ground in the streets, with Greg Bovino leading CBP and Border Patrol special forces units on sweeping raids across the country, this is the intelligence and undercover investigative apparatus that is running in parallel to the door-kicking.”

...

“Broad monitoring of social media, communications, and financial transactions are used to link an ever increasing number of people as potential subjects of investigation and prosecution,” German says. “These are exactly the kind of intelligence activities J. Edgar Hoover adopted to suppress the Civil Rights and anti-war movements in the 1960s.”

The key difference today, German says, is the vast pool of data available to the feds.

HSI used highly invasive measures—including scrutiny of wire transfers, PayPal reimbursements, and other financial transactions; forensic digital analysis of website traffic; 15 terabytes worth of infiltrated Signal chats; and information from a commercial data broker—to identify individuals under investigation.

After a local activist uploaded a license-plate search tool on Fly.io, a developer-focused public cloud platform, to an infiltrated Signal chat, HSI agents reviewed website [DNS queries and Stripe data](https://www.documentcloud.org/documents/28831278-govuscourtsmnd2344162313-5/) along with data purchased from a commercial broker. This gave HSI access to SSH session logs, outbound connection records, the Fly.io account’s signup IP, and a Stripe card fingerprint on an account that had never completed a payment. Agents fused that with Minnesota DVS records and commercial data from the Thomson-Reuters CLEAR platform to produce a driver's license number, Social Security number summary, years of address history, phone numbers, property records, and jointly registered vehicles.

Documents concerning financial records requested through the Treasury Department’s 314(a) suspicious activity reporting program—created by the Patriot Act to enable speedy tracking of finances for terrorism and money-laundering investigations—show that the feds targeted [records of 29 “subjects”](https://www.documentcloud.org/documents/28831304-fincen-infosharing/) during queries conducted on March 31, 2026. [Emails](https://www.documentcloud.org/documents/28831299-00035229-redacted/) viewed by WIRED between several HSI agents based in Los Angeles and Arizona show that batches of records were turned over pursuant to those inquiries, including some dealing with SEIU that a senior Minnesota HSI agent sent to a LA-based colleague to be filed [“wherever these records are stored.”](https://www.documentcloud.org/documents/28831317-govuscourtsmnd2344162441-1/)

...

The Minnesota 15 case is the clearest example yet of DHS pursuing the Trump administration’s efforts to crack down on what have long been upheld as First Amendment–protected activities. But it’s unlikely alone.

Riach, the defense attorney, says the HSI reports show the agency is complicit in what he called “the new COINTELPRO.”

“What we saw during the immigration surges last year was that ICE is the administration’s paramilitary force, the projector of strength,” Riach says. “Here, we see that HSI are taking the FBI’s place as the investigative secret police—it’s the classic one-two punch of authoritarian regimes around the world.”