Federal immigration authorities conducted surveillance of left-wing activists using undercover agents and purchased data

Federal immigration authorities conducted surveillance of left-wing and immigrant-rights activists through undercover agents, purchased personal data, and facial recognition technology, according to court records disclosed Thursday in a Department of Justice case against 15 Minneapolis protesters.

DHS started the Operation Puppet Master inquiry in January to find a network of people working against ICE. The inquiries followed a Trump executive order from last year labeling antifa a domestic terrorist organization behind riots against ICE.

The operation grew as community opposition to ICE swelled in Minnesota after the killings of Renee Good and Alex Pretti. Investigators targeted activists, protesters, and mainstream progressive groups opposing the Trump administration’s immigration policies.

The government alleged that AFL-CIO, SEIU, the Minneapolis Federation of Educators, the Minnesota Association of Professional Employees, DSA, and SURJ were connected to the conspiracy. None of those organizations has been charged with a crime.

DHS obtained financial records of unions and nonprofits for a domestic terrorist financing inquiry. Investigators used administrative subpoenas to obtain wire transfers to and from SEIU from financial institutions. They asked the Federal Reserve Bank of New York for financial data on the Communications Workers of America. DHS also obtained financial records tied to the climate nonprofit Sunrise Movement.

Undercover agents posed as activists to spy on community activities, including a Sunrise Movement training on 31 January at the Minneapolis public library. One agent told an attendee he worked in construction, said jail did not bother him, and shared his phone number. Another undercover agent joined Signal chat groups used by activists involved in protests.

Agents monitored a Hunter College virtual meeting focused on ICE brutality and responding to state violence. They also surveilled a Minneapolis labor center meeting, a park meeting on protest tactics, and a Direct Action Minnesota meeting at a church. They made audio recordings of the surveilled events.

An undercover agent recorded audio at a church gymnasium boxing session, then retrieved a recorder that fell to the floor. At an anti-ICE church event, agents wrote down attenders’ license plate information. Two agents falsely told a man who asked if they were ICE that they were not.

The 94-page indictment alleges no injuries to specific ICE officers and no serious violence charges. Homeland Security Investigations does not discuss particular open investigations or methods, and pointed questions to the Minnesota office of the Department of Justice, which declined to comment.

Defense lawyer Kevin Riach filed the records seeking more disclosures and described the allegations as wild conspiracy claims tied to political retribution. Riach said the investigations were a broad spying operation and that undercover agents helped run the groups they infiltrated, at times pushing people to talk about or commit crimes.

Emilia Gonzalez Avalos, executive director of Unidos MN, said the records show an effort to intimidate, punish, and politically repress disagreement. Mike German, a former FBI agent who advocates for civil liberties, described the situation as unusual because DHS rather than the FBI leads probes into possible terrorist activity.

German said DHS used administrative subpoenas, which do not require judicial approval, to obtain records. He said the government appeared to justify surveillance through guilt by association instead of narrow probes of specific alleged crimes. German said the probes fit a long history of the government targeting left-wing activists and labor organizers, with spying powers greatly expanded after 9/11.

Large numbers of people across the United States demonstrated against the Trump administration’s deportation push, with protests at ICE detention centers and organizing in Minneapolis and Chicago. Mijente, a Latinx rights grassroots group, has documented a growing surveillance regime since Trump’s first term through its No Tech for ICE campaign. Jacinta González, a Mijente member and head of programs at MediaJustice, said, “They were going into people’s neighbourhoods, into people’s workplaces and arresting large numbers of people.”

After 680 food processing workers were arrested across Mississippi in August 2019, Mijente found ICE relied on data broker information to plan its operations. Data brokers sell personal information gathered from web browsers, libraries, phones, credit cards, banks, police departments, and other agencies regardless of the buyer’s intent.

Mijente identified Equifax as a data broker central to ICE’s surveillance infrastructure. Palantir FALCON Tipline, built for ICE to collect and process public tips, helped ICE carry out raids on undocumented food processing workers. Palantir tools such as Gotham and Foundry combine data from brokers and government sources.

Current U.S. law lets government agencies, including police, obtain personal data from commercial companies without a warrant. ICE purchased broker data to find immigrants and migrants held in jails across states, arrest them upon release, and bypass sanctuary laws. ICE also uses facial recognition on protesters and undocumented immigrants, and AI advances make it easier to cross-reference large datasets.

Section 702 of the Foreign Intelligence Surveillance Act, a law letting ICE obtain information through data brokers, has expired. The government extended surveillance certificates until March 2027.

ICE’s payments to a core set of commercial data brokers increased from $4.9 million in 2018 to $14.5 million in 2025, according to a report by Mijente, Just Futures Law, and the Surveillance Resistance Lab. Mijente used Oligrapher, LittleSis’s free power mapping tool, in its No Tech for ICE campaign to expose law enforcement ties to data brokers and tech firms. The Palantir Payroll project uses Federal Election Commission records to trace Palantir government contracts and executive donations to politicians.

A hacker calling themselves Department of Peace published personal data of more than 40,000 DHS employees online after a breach earlier this year. The stolen data includes names, job titles, e-mails, phone numbers, and office locations for border agents, immigration agents, cybersecurity staff, and senior officials.

The hacker said the data came from an Okta single sign-on system that DHS staff and contractors use to access the department’s central network. About 21,000 records involve CBP employees, 10,000 involve ICE and HSI employees, and nearly 1,000 involve CISA staff. The leaked records appear to have been taken around mid-August, based on timestamps.

The leaked records equal roughly one-fifth of DHS’s approximately 220,000-person workforce. Okta stated its systems are secure and it has no evidence its data was compromised.

Around 4,500 users, including ICE agents and deportation officers, belong to an Active Directory group named Headspace_users. Headspace had an $82,500 ICE contract that ended in 2023 for mental health software for ERO employees, and a spokesperson says Headspace has not served DHS or ICE since 2023.

Dozens of Active Directory groups reference Penlink, a web surveillance firm with a longstanding ICE contract that claims to track hundreds of millions of mobile devices. Penlink groups range from a few local users to more than 2,000 HSI users nationally, including one for Penlink PLX, which captures real-time intelligence from calls, texts, web use, and social media.

More than 200 CBP users are linked to Mobile Fortify, a facial recognition app that CBP and ICE agents use to identify people and check immigration status. The data includes Active Directory groups for ChatGPT access by senior DHS officials and for probes into the Chinese hacking groups Salt Typhoon and Volt Typhoon.