Quick Answer: The Minnesota 15 case shows that Immigration and Customs Enforcement, through Homeland Security Investigations (HSI), used an undercover program called Operation Keyhole to surveil anti-ICE activists in the Twin Cities. Prosecutors say the work exposed a criminal conspiracy. Defense attorneys say it reflects a wider, possibly unconstitutional ICE surveillance operation aimed at opponents of immigration policy.
Attorneys for 15 Minnesota residents facing federal conspiracy charges have obtained discovery showing how far the government went to build its case. The records include intercepted Signal chats, database queries, photographs, and reports. Taken together, they describe an ICE surveillance operation that used tools built for drug cartels and terrorism financing against people organizing rapid-response networks. As WIRED reported, the scale has no clear modern parallel.
What the Minnesota 15 Case Actually Alleges
Prosecutors say the defendants ran a criminal conspiracy during Operation Metro Surge, the Trump administration's large immigration enforcement push in Minnesota that began in December 2025. According to the government, the group used encrypted Signal groups, homebuilt vehicle databases, and a centralized dispatch system to monitor DHS agents and their vehicles. The government's position is that this amounted to conspiring to block immigration enforcement, unlawfully identifying and stalking federal agents, and assaulting them.
The defense sees it differently. Kevin Riach, who represents defendant Isaac Sant, put the problem plainly: "This is the first time I've had a client who's accused of a conspiracy and went on a speaking tour." Public speech, organizing, and monitoring federal vehicles are lawful activities in many contexts, and the gap between those activities and a conspiracy charge is where this case will be decided.
Here's the part most coverage skips. The investigation's original trigger was not a single act of violence. It was a directive. Internal reporting describes the administration telling the Justice Department to "go big and go loud" against community response networks. Whether that instruction shaped the scope of the investigation is exactly what the discovery fights are about.
Operation Keyhole: An Old Program With a New Target
Operation Keyhole is not new. Prosecutors describe it as a long-standing program created by HSI's Saint Paul office in December 2008 to fund undercover work, mainly equipment and personnel costs, across Minnesota, North and South Dakota, Iowa, and Nebraska. Per the source material, it has funded at least 77 investigations into narcotics trafficking, child sexual abuse, financial crimes, and counter-proliferation.
The "CUC" prefix on the internal case designation refers to Certified Undercover Operations, a formal category with defined oversight. According to an internal 2008 DHS handbook surfaced by Unicorn Riot, parameters are reviewed every six months by a committee of senior DOJ and DHS officials. As of June 2026, Keyhole was funding six active investigations, including Project Whipple Shield, which was opened in February to look into claims of assault, stalking, and doxing against DHS personnel.
Here's what makes this matter. The program's own rules were designed for crimes like trafficking and fraud. The question now is whether a funding mechanism built for those cases can be stretched to cover political organizing without anyone deciding that it should. Oversight on paper and oversight in practice are two different things, and a six-month review by the agencies running the program is a thin check if the program's leadership sets the priorities.
Why the Scale Is the Real Story
Mike German, a retired FBI agent who worked undercover domestic terrorism cases, compares the Minnesota 15 investigation to the historical suppression of left-wing movements. The obvious reference is COINTELPRO, the FBI program that surveilled and infiltrated civil rights and anti-war groups. The less obvious one is the CIA's Operation MH/Chaos, which looked for foreign influence on the anti-Vietnam War movement.
The numbers are the clearest way to see the difference. According to a 2011 book by former CIA officer Frank Rafalko, MH/Chaos had 42 officers working the case at its peak. Court records show 119 HSI agents worked on the Minnesota 15 case alone. More than 50 of those agents took part in the investigation, and at least two dozen came from HSI's Special Operations Group.
| Program | Personnel | Stated Purpose | Era |
|---|---|---|---|
| CIA MH/Chaos | 42 officers at peak (per Rafalko) | Foreign influence on the anti-Vietnam War movement | Late 1960s–1970s |
| HSI Operation Keyhole (Minnesota 15 case) | 119 HSI agents, including 11 undercover | Conspiracy to obstruct immigration enforcement, stalking, and assault of federal agents (per prosecutors) | 2008 program; case active 2025–2026 |
| Operation Keyhole program overall | At least 77 funded investigations since 2008 | Narcotics, child exploitation, financial crimes, counter-proliferation | 2008–present |
A reasonable reader might ask whether the comparison is fair. Some of the difference is real. The Minnesota 15 case has a formal indictment, and the government's evidence is subject to court review. Still, the scale and the targets are worth watching.
The Data Trail: Why Encryption Didn't Protect the Chats
This next part is the one most security advice gets wrong. Activists often assume that end-to-end encryption, such as Signal's, is enough. Signal protects message content. It does not protect the metadata around the conversation, and in this case that metadata did much of the work.
Investigators infiltrated the group chats, which gave them the messages directly. That is the simplest route, and it is the one that matters most. The source describes roughly 15 terabytes of infiltrated Signal chats. One detail shows how the rest of the data stacked up. After a local activist shared a license-plate search tool hosted on Fly.io, a developer-focused cloud platform, HSI agents reviewed website DNS queries and Stripe payment records. They got SSH session logs, outbound connection records, the account's signup IP, and a card fingerprint from an account that had never completed a payment.
Agents then combined that with Minnesota Driver and Vehicle Services records and commercial data from Thomson Reuters' CLEAR platform. The result, according to the source, was a driver's license number, a partial Social Security number, years of address history, phone numbers, property records, and jointly registered vehicles.
So what does this mean in practice? When you run any tool, your infrastructure choices, payment records, and network logs create a second record that exists whether or not your chat is encrypted. Treat each piece of infrastructure as something an investigator can read later. If you're organizing, assume that anyone in your group chat might be a source, and keep sensitive decisions off the channels where they're easiest to collect.
Financial Tools and the Shortcut Problem
The Patriot Act created the Treasury Department's 314(a) program to speed up financial tracking for terrorism and money-laundering cases. Records show that on March 31, 2026, investigators ran 314(a) queries against 29 "subjects" in this case. Emails viewed by WIRED show agents in Los Angeles and Arizona receiving batches of records, including some involving SEIU, and a senior Minnesota HSI agent asking that they be filed "wherever these records are stored."
The concern is the mismatch. The tool is designed for terrorism and money laundering, and the case involves alleged conspiracy and assault. Former officials told WIRED that the case is part of a wider intelligence-gathering effort that began before the Minnesota deployment. The source also reports that HSI used workarounds to warrants and grand jury subpoenas to obtain phone records for several journalists covering Operation Metro Surge, as first reported by The Guardian. Court records say an administrative summons was used even though it is reserved for customs and tax violations, which the criminal charges don't involve.
Here's where it gets tricky. Each of these tools has legitimate uses. The problem is the gap between the authority a tool requires and the activity it's applied to. That gap is what defense attorneys will probably test in court.
Where the Argument Could Break Down
A responsible reading should weigh the other side. Federal prosecutors have not yet proven their conspiracy claims. Defendants are entitled to a presumption of innocence, and the government may have evidence the public hasn't seen. Charges can be filed on a theory that a jury later rejects.
The source also shows how contested the public record is. Former SEIU California president David Huerta was charged after a June 2025 protest, and the charges were dropped in July after videos contradicted the account of the arresting HSI agent. That case doesn't prove the Minnesota 15 charges are weak. It does show why independent evidence matters when one agency's account is the main source.
Many of the most serious claims rest on discovery documents, former officials' analysis, and reporting. The full scope of the investigations that NSPM 7 authorizes is still unknown, as WIRED notes. Treat the picture as a strong, detailed signal that needs more verification, not a finished conclusion.
Frequently Asked Questions
What is an ICE surveillance operation?
An ICE surveillance operation is an investigation in which Immigration and Customs Enforcement or its component Homeland Security Investigations collects information on people or groups. The Minnesota 15 case is an example. It used undercover agents, infiltrated Signal chats, financial records, and commercial data brokers. Whether a given operation is lawful depends on the authority it uses and the conduct it targets.
Is ICE spying on activists?
Court records and discovery documents reported by WIRED say HSI infiltrated activist groups in the Twin Cities, photographed cars at meetings, and reviewed financial and digital records of defendants. The government says this was a criminal investigation. Defense attorneys say it targeted lawful organizing. Courts will decide which account the evidence supports.
How did investigators identify people in the Minnesota 15 case?
Investigators combined several sources: infiltrated Signal messages, website DNS queries and Stripe payment data tied to a license-plate tool, Minnesota DVS records, and commercial data from Thomson Reuters CLEAR. Together these produced identifying details such as addresses, phone numbers, and vehicle registrations for individuals under investigation.
Why does the Operation Keyhole program matter for this case?
Operation Keyhole is the HSI undercover program that funded the Minnesota 15 investigation. It was created in 2008 for crimes like narcotics trafficking and child exploitation, and it is reviewed every six months by senior DOJ and DHS officials. The case raises the question of whether a program built for those crimes can be used for political organizing, and whether its oversight is strong enough to prevent that.
Trust the Record, Then Test It
The most useful takeaway from the Minnesota 15 case is that surveillance rarely depends on one dramatic tool. It combines infiltration, metadata, financial records, and data brokers, and each piece looks ordinary alone. If you work in advocacy, journalism, or any field that involves organized dissent, audit what your infrastructure reveals about you this week, and ask who else can see it. Pass this to anyone coordinating a community network who assumes encryption alone keeps their group safe.