Loading story…
Court filings in USA v. Isaac Sant et al. allege that ICE Homeland Security Investigations (HSI) conducted an extensive surveillance operation against Minnesota immigration-raid activists linked to Direct Action Minnesota (DAMN). The defense and an amicus brief from the Foundation for Individual Rights and Expression, the Cato Institute, and the Society for the Rule of Law and Democracy say HSI deployed undercover personnel, collected license-plate data, monitored encrypted Signal chats, and issued subpoenas for financial records under operations known as Puppet Master and Whipple Shield. The filings also allege use of Clearview AI facial recognition to examine defendant Isaac Sant’s prior political activity.
The allegations have been tied to the White House’s September 2025 action on countering domestic terrorism and organized political violence, described as NSPM-7. Petitioners argue that the policy treated left-wing political activity as a terrorism indicator and enabled counterterrorism financial-investigation capabilities to be redirected toward domestic political investigations. The government’s response to the allegations was not included in the referenced reporting.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
FIRE, the Cato Institute, and the Society for the Rule of Law and Democracy filed an amicus brief supporting discovery sought by defendants in USA v. Isaac Sant et al. The brief alleged that federal law-enforcement authorities used NSPM-7 to target First Amendment-protected political activity.
A July 22, 2026 image extracted from the phone of HSI undercover agent 5022, also identified as “Sarah,” was included in a Project Whipple Shield report filed as part of Document 231.
Treasury Secretary Scott Bessent stated that counterterrorism financial capabilities developed through OFAC, FinCEN, and IRS Criminal Investigation were being mobilized against what he called an emerging domestic threat.
HSI Special Operations Group agents Jason Prasnikar and Marco Salterelli allegedly wore hard hats and safety vests as cover while collecting activists' license-plate information near St. John's Church in St. Paul.
Internal HSI records reportedly show that 20 Special Operations Group agents were assigned to surveil a de-arrest-tactics training in Loring Park, Minneapolis. The event was canceled because of weather.
An HSI officer reportedly used Clearview AI facial-recognition software to investigate defendant Isaac Sant's alleged prior political activity. The reported results linked Sant to a 2018 Defending Rights & Dissent image and a 2015 Baltimore-protest documentary.
Seven HSI undercover agents reportedly monitored an activist event near 24th Street in Minneapolis.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A legal dispute is unfolding over **DHS efforts to identify an anonymous Instagram/Facebook user** who posted about ICE activity, with the account holder (represented by the **ACLU of Pennsylvania**) arguing the posts are *innocuous* and protected by the **First Amendment**. DHS has asserted the group was “stalking and gathering of intelligence” on federal agents involved in ICE operations, while the user argues DHS has not cited any specific post constituting a threat and that reporting or livestreaming publicly occurring immigration operations is constitutionally protected speech. The case includes a motion to quash a subpoena seeking subscriber and account metadata (including contact details and IP-related information), and notes that **Meta previously refused** to provide identifying information for the accounts. The dispute is occurring amid heightened public scrutiny of ICE following the reported shooting death of **Renee Nicole Good** and broader protests, which have increased the visibility and impact of shared footage of ICE operations. Separate federal-court testimony reported in Minnesota adds to the broader context: an **FBI special agent’s sworn testimony** reportedly contradicts an ICE agent’s prior under-oath account in a related enforcement incident and raises questions about whether the ICE agent followed training during the interaction that preceded Good’s killing, further intensifying attention on ICE conduct and the public’s efforts to document it.
Jun 29, 2026
Lawyers from the Electronic Frontier Foundation (EFF) are representing three US labor unions in a lawsuit against the Trump administration, challenging a social media surveillance program that they argue infringes on First Amendment rights. The unions claim that the program, which requires nearly all US visa applicants to disclose all social media handles used in the past five years, has had a chilling effect on free speech and union engagement. This policy, implemented under the Trump administration but proposed during the Obama era, also mandates that noncitizens on F, M, and J visas make their social media accounts publicly viewable. The surveillance initiative, known as "Catch and Revoke," is a collaborative effort between the Department of Homeland Security, the State Department, and the Department of Justice, and uses AI to monitor visa holders' social media for expressions of support for Hamas, Palestine, or antisemitism. Individuals found to express views deemed anti-American or non-conforming risk having their visas or immigration benefits revoked. In a related legal development, a federal court in Massachusetts ruled that the executive orders underpinning these surveillance measures were unconstitutional, temporarily halting enforcement actions based on social media activity. The government is expected to appeal this decision. Separately, the Trump administration has been accused of pressuring Facebook to remove a large group page used to track and publicize the locations of ICE agents in Chicago. The Department of Justice contacted Meta after reports that the group, which had over 84,000 members, was being used to dox ICE agents, leading Facebook to remove the group for violating its policies against coordinated harm. Attorney General Pam Bondi stated that the DOJ would continue to work with tech companies to eliminate platforms that could incite violence against federal law enforcement. The White House has claimed a dramatic increase in attacks on ICE officers, though independent reporting has found no public evidence to support the scale of these claims. Meta, Facebook's parent company, confirmed the removal of the group but did not specify the exact policy violation. The actions taken by both the government and social media platforms highlight the intersection of immigration enforcement, online speech, and civil liberties. These developments have raised concerns among advocacy groups about the potential for overreach and the suppression of lawful dissent. The ongoing legal battles and policy debates underscore the contentious nature of social media monitoring in the context of US immigration and law enforcement. Both the surveillance program and the removal of online groups reflect broader efforts by the Trump administration to control narratives and activities related to immigration on digital platforms. The outcomes of these legal and policy actions are likely to have significant implications for privacy, free expression, and the rights of both citizens and noncitizens in the United States.
Jun 29, 2026
The US Department of Homeland Security has reportedly used **administrative subpoenas** to pressure tech companies to disclose identifying data about anonymous accounts and individuals critical of the Trump administration, including accounts sharing information about local **ICE immigration raids**. The reporting highlights that administrative subpoenas—unlike judicial subpoenas—do not require a judge’s approval and can seek metadata and account-identifying details (e.g., login times, devices, and associated email addresses), raising concerns about oversight and potential chilling effects on speech. Separately, the anti-ICE alert service **StopICE** reported its app and website were attacked, with users receiving texts claiming their information had been “compromised and sent to the authorities,” alongside disparaging messages about the developer. StopICE administrators and the developer disputed claims that sensitive personal data (names, addresses, GPS/location histories) was stolen, stating the service does not collect/store that information, while also noting the platform faces heavy hostile activity including frequent **DDoS** attempts; the service blamed a **US Customs and Border Protection (CBP)** agent for the attack, though that attribution was not independently confirmed in the reporting.
Jun 29, 2026