DHS Ran a Mass Spying Campaign Against Anti-ICE Protesters

Key Takeaways

• Newly disclosed internal DHS records reveal that "Operation Puppet Master" — launched in January 2026 — sent undercover agents to community meetings, infiltrated Signal chats, and obtained financial records of major unions and nonprofits as part of a surveillance operation targeting groups opposing Trump's immigration crackdown in Minnesota.
• Organizations swept into the investigation include the AFL-CIO, SEIU, the Democratic Socialists of America, the Sunrise Movement, and Minneapolis public school teachers' unions — none of which have been charged with any crime.
• DHS used administrative subpoenas, which require no judicial authorization, to obtain financial records from banks and the Federal Reserve Bank of New York.
• Civil liberties experts describe the operation as a "mass spying campaign" that fits a historical pattern of the US government using terrorism frameworks to target left-wing political organizing.

Nearly 30 internal DHS investigative reports were released this week as part of a criminal case the Department of Justice has filed against 15 Minneapolis protesters. 

The records, first reported by the Guardian, document a surveillance operation called "Operation Puppet Master," launched in January 2026, that DHS described as an effort to identify a "network of conspirators" organizing against US Immigration and Customs Enforcement.

What the records show is a sprawling investigation that extended far beyond any specific alleged criminal activity. 

Undercover DHS agents attended a Sunrise Movement resistance training at the Minneapolis public library, where they noted that speakers discussed "peaceful" protests, recruitment, de-escalation, and having a "police liaison" at events — and then an undercover agent told a participant he "works in construction and could build items that might assist other groups with more 'direct-action' protests," gave out his phone number, and said "going to jail did not bother him."

Agents attended meetings at churches, labor centers, public parks, and a virtual event at Hunter College in New York about "ICE brutality." They joined Signal groups of activists involved in protests. They documented the license plates of attendees at an anti-ICE event at a church. 

They made audio recordings. At one church gymnasium event, an agent participated in boxing and sparring practice while covertly recording — until the recorder "erroneously fell to the floor."

DHS also used administrative subpoenas — which require no judicial authorization — to obtain financial records. Wire transfers from SEIU, one of the largest unions in the US, were subpoenaed. 

The Federal Reserve Bank of New York was asked to provide financial data from the Communications Workers of America. Records related to the Sunrise Movement were obtained as part of an inquiry the records describe as "domestic terrorist financing."

The organizations swept into the investigation also include the AFL-CIO, the Minneapolis Federation of Educators, the Minnesota Association of Professional Employees, the Democratic Socialists of America, and Showing Up for Racial Justice. None have been charged with any crime.

What This Is — and What It Isn't

The DHS operation was launched under the framework of Trump's executive order designating "antifa" a "domestic terrorist organization." 

It led to a criminal case filed in June against 15 protesters — a 94-page indictment that, despite alleging a vast conspiracy to organize against ICE, contains no allegations of injuries to specific ICE officers caused by any defendant, and no charges of serious violence.

Mike German, a former FBI agent and civil liberties advocate, was direct about what the records describe: "You're talking about meetings that are open to the public, where they are recruiting among the public, saying: 'Please come to this protest.' It's hardly a challenge to 'infiltrate' this kind of meeting, and that should be a clue this isn't a criminal group."

German also flagged two structural anomalies. First, DHS — not the FBI — was leading operations that would typically fall under FBI jurisdiction for alleged terrorist activity. Second, the use of administrative subpoenas to obtain financial records bypasses the judicial authorization requirement that normally applies to such access. 

The government, he said, appeared to be relying on "guilt by association" to justify surveillance rather than narrower investigations focused on specific alleged criminal activity.

Kevin Riach, an attorney for one of the indicted protesters, described the records as evidence of a "mass spying campaign" in which undercover agents "participated in organizing and directing the groups they were surveilling, at times working to entice people into discussing or committing crimes." He called the conspiracy allegations "wild" and "born from the fantasies of political retribution that animate the Trump Administration."

Why This Is an Internet Freedom Story

The infiltration of Signal groups sits at the center of this case, and it matters beyond the specific political context. 

Signal is the most widely used encrypted messaging application among activists, journalists, lawyers, and civil society organizations globally — precisely because it's designed to resist exactly this kind of surveillance. 

The DHS operation didn't break Signal's encryption. It used undercover agents to join the groups — a reminder that encryption protects content in transit but doesn't protect against surveillance that happens inside the communication.

The broader pattern is one that anyone who cares about online freedom should recognize. The framework of "terrorism" has been expanding to cover political dissent for decades — German noted the acceleration after 9/11 — and the digital surveillance tools built for genuine counterterrorism investigations don't stay in that lane. 

They get applied to unions, nonprofits, community organizers, and anyone else the government decides to frame as a threat.

We've written about governments shutting down the internet during protests in India and Bangladesh, surveilling protesters with facial recognition in Russia and the UK, and using legal systems to silence journalists in Mexico and Kuwait. 

The US case is different in mechanism but not in logic: the use of surveillance infrastructure — covert agents, financial subpoenas, infiltrated communications — to monitor and ultimately prosecute people whose activity was, by the government's own evidence, peaceful, public, and constitutionally protected. 

That's not counterterrorism. That's political surveillance with a terrorism label attached to it.