Operation Puppet Master: DHS Undercover Surveillance of Minneapolis Protest Groups
Scope: This backgrounder summarizes what is publicly known about Operation Puppet Master and the related Project Whipple Shield — two undercover surveillance efforts run by Homeland Security Investigations (HSI) in Minnesota during the 2026 Minneapolis immigration-enforcement surge. It documents the reported targets, methods, timeline, and named government actors, and it distinguishes what is on the record from what remains a defense attorney’s characterization of records the government has not publicly confirmed. Facts are still emerging.
Sourcing caveat, up front
Nearly all public detail about Operation Puppet Master traces back to a single 26-page defense motion filed on August 13, 2026 in the U.S. District Court for the District of Minnesota. The motion, submitted by defense attorney Kevin Riach on behalf of defendant Isaac Sant, sought to compel prosecutors to disclose additional investigative material. Government documents describing the two operations were attached to that filing.
Every downstream description of HSI’s targets, tactics, and scope in this backgrounder is filtered through that one filing. The Department of Homeland Security has declined to confirm or deny specifics, stating that HSI does not comment on the existence or status of ongoing investigations or investigative methods, and referring inquiries to the U.S. Attorney’s office.
Read the operational descriptions below as credibly reported based on court-filed government records, not as findings.
Publication dates of the sources listed at the end of this document range from August 13, 2026 (first reporting, The New York Times) through August 17, 2026 (follow-on analysis).
Overview
- Program name: Operation Puppet Master (HSI-led). A second, related effort — Project Whipple Shield — was opened roughly two weeks later.
- Launch date: January 28, 2026.
- Precipitating event: The launch date fell four days after the killing of U.S. citizen Alex Pretti by a federal officer during immigration enforcement operations. A second U.S. citizen, Renee Good, was fatally shot during the same enforcement period.
- Stated purpose (Puppet Master): According to government records described in the defense motion, HSI opened the operation to investigate what the agency called an organized network of conspirators believed to threaten federal officers, and planned to embed undercover agents in groups flagged as posing such a threat.
- Stated purpose (Whipple Shield): Identifying organized efforts to disrupt federal operations. As part of this effort, investigators obtained financial records for several national labor unions.
- Duration: Publicly reported activity spans January through at least mid-2026; end dates for the operations have not been publicly confirmed.
Background: the Minneapolis enforcement surge
- Beginning in late 2025, DHS deployed approximately 3,000 federal officers to the Minneapolis–St. Paul area for roughly three months, in what the department described as its largest immigration enforcement operation ever.
- The surge produced thousands of arrests, mass protests, and the fatal shootings of two U.S. citizens — Alex Pretti and Renee Good.
- In June 2026, federal prosecutors charged 15 people with conspiring to impede or injure federal officers and to oppose immigration law enforcement.
- The undercover investigations described in the August 2026 court filing overlap in time with — and appear to have contributed evidence to — that 15-defendant conspiracy case.
For the broader immigration-enforcement context in which this operation sits, see Mass Deportation Operations Tracker.
Reported surveillance methods
The following methods are drawn from the HSI records described in the defense motion. They have not been independently confirmed by the government.
- Undercover attendance at gatherings held in churches, parks, libraries, schools, and union halls.
- Covert recording of audio and video; some undercover agents reportedly wore wires.
- Infiltration of private activist Signal chats.
- Open-source and AI-assisted image analysis, including the use of Clearview AI to identify protest participants from photographs. Riach’s filing states the software misidentified Isaac Sant, erroneously linking his name to images of multiple different people across social media and news sites.
- Financial records obtained via administrative subpoenas — subpoenas issued by HSI under its own authority, not by a court — for national organizations reportedly including the Service Employees International Union (SEIU), the Communications Workers of America (CWA), the International Federation of Professional and Technical Engineers (IFPTE), the Sunrise Movement, and Voices for Racial Justice. When investigators reviewed SEIU’s records looking for evidence of terrorism financing, court filings indicate they found only routine union transactions: annuity payments, strike payments, union dues, and pension-fund expenses.
- Surveillance of a bicycle repair collective was also reportedly among the targets.
Illustrative filing detail
The motion describes a January 31, 2026 meeting at a Minneapolis library at which an undercover officer identified in filings as “UCA 9833” listened as Sunrise Movement supporters discussed sit-ins, de-escalation tactics, and having a police liaison and safety marshal present at events. The agent’s own report noted that the group made clear its focus was peaceful protest.
A separate exhibit describes a second development at the same meeting: the undercover agent told a participant that he “could build items that might assist other groups with more ‘direct action’ protests” and that “going to jail did not bother him.” That the government’s own agent attempted to introduce escalatory suggestions — in a meeting the same agent described as peaceful — is among the details the defense has cited as evidence that the investigation sought to entrap, as well as surveil, constitutionally protected activity.
Named actors and evidentiary basis for naming them
Patriot University applies a high bar to individual naming. The individuals named in this backgrounder are named on the following evidentiary basis:
- Daniel N. Rosen — U.S. Attorney for the District of Minnesota. Named as a federal official acting in his official capacity and quoted in public statements about the June 2026 indictment. Rosen said the 15 defendants belonged to two groups he characterized as “antifa.”
- Kevin Riach — Defense attorney of record for Isaac Sant. Named as counsel who filed the public court motion that surfaced the operations, and who has made on-the-record public statements to the press about the case. Riach called the two operations a “broad and irrational investigation” driven by politics rather than criminal conduct, and disputed the “antifa” characterization.
- Isaac Auman Sant — Publicly charged criminal defendant (full legal name per docket: Isaac Auman Sant) on whose behalf the August 13, 2026 motion was filed. Named in court records and speaking publicly on his own behalf; he has stated the charges against him are politically motivated and intended to suppress dissent.
- Alex Pretti — U.S. citizen killed by a federal officer during the enforcement surge; publicly named in mainstream reporting. Named here for the factual role his death played in the timing of Operation Puppet Master’s launch.
- Renee Good — U.S. citizen fatally shot during the same enforcement period; publicly named in mainstream reporting.
- “UCA 9833” — An HSI undercover-agent pseudonym appearing in filed government records. This is the agency’s own operational identifier, not a personal name.
Individuals not named
Public reporting to date does not disclose the names of:
- The HSI supervisor or field-office leadership who authorized Operation Puppet Master or Project Whipple Shield.
- The DHS headquarters officials, if any, who approved or were briefed on the operations.
- The prosecutors, agents, or analysts who requested the labor-union financial records, or the legal basis on which those requests were made.
- The individual undercover agents deployed (other than the “UCA 9833” pseudonym).
This backgrounder does not name senior DHS or HSI officials on speculation. If and when court proceedings, congressional testimony, or Inspector General reporting establish command responsibility on the record, those names will be added with citations. For the broader DHS leadership context, see Kristi Noem — Political Accountability Profile (Secretary of Homeland Security) and Tom Homan – Border Czar (Border Czar); neither has been publicly linked in reporting to date to the specific approval chain for these operations.
Competing characterizations
Government framing
- The operations targeted an alleged organized network aiding what officials called “violent opportunists and agitators.”
- At a June 16, 2026 press conference, U.S. Attorney Daniel N. Rosen said the 15 defendants were members of two groups he characterized as “antifa.” One of those groups was identified as “Direct Action Minnesota” — which Rosen described as a left-wing coalition that trains members in “surveillance, operational planning, and rapid mobilization against law enforcement.” Rosen declined to specify the Justice Department’s definition of “antifa” when asked, saying the question was “beyond the scope” of the indictment.
- The alleged predicate conduct ranged from throwing ice chunks at federal officers and setting up blockades, to “stalking” agents through city streets.
- A grand jury presentation included a diagram linking additional organizations to the alleged conspiracy — centered on Direct Action Minnesota — including SEIU, the AFL-CIO, the Minneapolis Federation of Educators, Monarca, Democratic Socialists of America, and the Minnesota Association of Professional Employees. None of those organizations has been charged.
- DHS has declined to comment on the existence, scope, or methods of the operations, citing standard policy on ongoing investigations.
Defense framing
- Kevin Riach has called both operations a “broad and irrational investigation” and argued that financial records for national labor unions were obtained without a criminal predicate for the organizations themselves.
- Riach has publicly disputed the “antifa” label, calling it “an invention of the far right,” and has said his client had no such affiliation.
- Isaac Sant has publicly stated that the charges against him are politically motivated and intended to suppress dissent.
- Independent journalistic characterization has focused on the breadth of protected First Amendment activity — church meetings, library gatherings, union halls, and permit-oriented protest planning — swept into the investigation.
Both framings are drawn from public statements. Neither has been tested at trial as of this document’s last_updated.
Constitutional and legal questions
Because the underlying court proceedings are ongoing, the constitutional questions below are framed as questions, not conclusions:
- First Amendment retaliation. When undercover surveillance is directed at groups organizing lawful, permit-oriented protest — and when the government’s own agent reports describe the meetings as peaceful — does the investigation risk chilling constitutionally protected assembly and association?
- Financial-records authority. Reporting now confirms the instrument was administrative subpoenas — issued by HSI under its own authority, without court review. The open questions are: under what statutory provision HSI issued those subpoenas against national labor unions; whether DOJ headquarters reviewed or authorized the decision; and what articulable criminal predicate existed for organizations — including SEIU, CWA, and IFPTE — that have not been charged.
- Sensitive-location practice. Reported surveillance venues included churches, schools, and libraries. Does the operation align with any DHS “sensitive locations” policy that was in effect at the time?
- Attorney-client and religious-liberty exposure. Did undercover attendance at gatherings held in churches or in the presence of counsel raise attorney-client privilege or Religious Freedom Restoration Act (RFRA) concerns?
- Predicate for infiltration. What individualized predicate, if any, existed for embedding agents in private Signal chats and activist meetings?
Timeline (as reported)
| Date | Event |
|---|---|
| Late 2025 | DHS begins deploying approximately 3,000 federal officers to the Minneapolis–St. Paul area. |
| January 24, 2026 (approx.) | U.S. citizen Alex Pretti killed by a federal officer during immigration enforcement operations. |
| January 28, 2026 | HSI launches Operation Puppet Master. |
| January 31, 2026 | Undercover officer “UCA 9833” attends a Sunrise Movement meeting at a Minneapolis library. |
| Mid-February 2026 (approx., “roughly two weeks later”) | HSI opens Project Whipple Shield; financial records collection reportedly begins. |
| June 2026 | Federal prosecutors charge 15 defendants with conspiracy to impede federal officers. |
| August 13, 2026 | Kevin Riach files 26-page motion to compel disclosure on behalf of Isaac Sant. Attached government records describe both operations. |
| August 14, 2026 | Wire-service and mainstream coverage breaks nationally; DHS declines to comment. |
Open questions
- The full scope of organizations surveilled. Confirmed by August 2026 reporting: SEIU, CWA, IFPTE, Voices for Racial Justice, and the Sunrise Movement received administrative subpoenas; a grand jury diagram reportedly also linked the AFL-CIO, Minneapolis Federation of Educators, Monarca, Democratic Socialists of America, and Minnesota Association of Professional Employees to the alleged conspiracy. None of those organizations has been charged. The bicycle repair collective and potentially other organizations remain unconfirmed in detail.
- Whether Whipple Shield is best understood as an expansion of Puppet Master, a parallel track, or a successor operation.
- Whether the court grants Riach’s motion to compel, which would likely surface substantially more government material.
- Any congressional oversight response — hearing requests, information-demand letters, or committee-of-jurisdiction action.
- Any DHS Office of Inspector General or DHS Office for Civil Rights and Civil Liberties (CRCL) response.
- Whether financial-records requests were reviewed by DOJ headquarters or DHS Office of the General Counsel, and under what standard.
- Whether other U.S. Attorney’s offices ran parallel investigations against protest-adjacent organizations in other enforcement-surge cities.
Truth-and-reconciliation implications
Operation Puppet Master is not, at the time of writing, before any truth-and-reconciliation body. There is no US TRC. What exists is a criminal docket in Minnesota, a defense motion, and a set of government exhibits now in the public record. Under the phased US-TRC-readiness framework Patriot University uses, that combination is a Phase 1 artifact: civil-society and primary-record documentation, preserved now, so that a future commission — if and when one is authorized — has an evidentiary base to work from rather than having to reconstruct events after memory, personnel turnover, and record-destruction have done their work.
This section names what this record would contribute to that future work, and what would still be missing. It does not presume criminal conduct by any government actor, and it applies the same naming rule as the rest of this document: institutional roles are named; individuals are named only where a primary record supports it.
Sorting the record across the three accountability tracks
Patriot University sorts documented conduct into a prosecution track (plausible criminal exposure), an institutional-reform track (abuse of lawful authority that is not obviously criminal), and a truth-telling track (chilling or symbolic acts). These are provisional editorial judgments for sequencing accountability work, not legal conclusions.
- Prosecution track — unresolved on the current record. Nothing in the exhibits filed to date establishes a chargeable offense by a named federal actor. The single exhibit closest to that line is the report of an undercover officer at the January 31 Sunrise Movement meeting offering to “build items” to assist “direct action” — a fact pattern that in a broader record could touch entrapment or civil-rights-conspiracy analysis (18 U.S.C. § 241), but on this exhibit alone does not. Placement here is unresolved, not cleared.
- Institutional-reform track — the center of gravity for this operation. The primary record already establishes: administrative-subpoena reach into the finances of five national organizations that have not been charged; undercover deployment into meetings whose own agent-authored reports describe them as peaceful and permit-oriented; use of a private-vendor facial-identification tool that misidentified the defendant; and surveillance of gatherings held in the categories DHS’s prior “sensitive locations” guidance protected (churches, schools, libraries). Each is an exercise of lawful authority whose scope, not whose legality, is what a reform track would reach.
- Truth-telling track — the record already carries this. The chilling and symbolic dimensions are on the face of the exhibits: the grand-jury diagram that placed six labor and civic organizations inside a “conspiracy” frame without charging any of them; the presence of federal undercover officers in union halls and houses of worship; the labeling of a permit-oriented coalition as “antifa” from the U.S. Attorney’s own podium. A truth-telling body would not need to prove anything new; it would need to describe, publicly and under oath, what is already visible.
TRC questions this record puts on the table
Framed as questions only compulsory testimony authority (subpoena, use immunity under 18 U.S.C. § 6002, or a coordinated congressional-oversight track) could answer:
- Who inside Homeland Security Investigations, the Minneapolis Field Office, and HSI headquarters authorized Operation Puppet Master and Operation/Project Whipple Shield, and on what written predicate?
- Who at the U.S. Attorney’s Office for the District of Minnesota and at Main Justice reviewed, requested, or signed the administrative subpoenas served on SEIU, CWA, IFPTE, the Sunrise Movement, and Voices for Racial Justice, and under what statutory authority?
- What did DHS Office of the General Counsel and the DHS Office for Civil Rights and Civil Liberties (CRCL) know about either operation, and were the “sensitive locations” implications reviewed before undercover officers attended church, school, and library meetings?
- What direction, if any, did any of these decisions receive from DHS or DOJ headquarters, and did any element of the operation touch the White House?
- Who authorized the use of Clearview AI or comparable facial-identification tooling against protest participants, and what accuracy-and-misidentification review preceded that decision?
- How many other undercover officers were deployed beyond UCA 9833, into how many groups, over what period; and how many of those deployments have been disclosed to the affected people or defendants?
- Were the operations coordinated with, or replicated by, U.S. Attorney’s offices or HSI field offices in other cities that experienced enforcement-surge protests?
- Were any of these decisions taken pursuant to the administration’s National Security Policy Memorandum 7 (NSPM-7), and if so, what is the internal record of its application to First Amendment–protected activity?
Institutional-reform prompts
The record already points to a set of structural questions that do not require a criminal finding to be worth acting on:
- Administrative-subpoena authority against non-suspect national organizations. Whether HSI’s administrative-subpoena authority should be constrained by (a) an articulable-criminal-predicate requirement for the organization itself, (b) judicial pre-authorization when the target is a labor union, house of worship, press outlet, or advocacy organization, and (c) post-hoc notice to targets whose records were obtained without their knowledge.
- Undercover deployment inside constitutionally protected activity. Whether a codified, judicially reviewable predicate should be required before an undercover federal officer may enter a private meeting whose reasonably foreseeable participants include labor organizers, religious congregants, journalists, or counsel.
- DHS “sensitive locations” policy status. Restoration, statutory codification, or independent audit of the prior “sensitive locations” enforcement guidance — churches, schools, libraries — for both immigration enforcement and undercover intelligence collection.
- Third-party facial-identification tools. Standards for pre-deployment accuracy testing, mandatory disclosure of misidentifications to affected people, and a rule that a private-vendor match may not alone establish probable cause. The Sant misidentification is a live example.
- Grand-jury exhibit discipline. Guidance on the use of unindicted-organization “conspiracy diagrams” that publicly link entities the government has chosen not to charge.
- Post-shooting investigation independence. Restoration of independent civilian review for federal officer-involved fatalities, informed by the Pretti and Good shootings that framed this operation’s launch.
Preservation now, testimony later
The most durable Phase 1 use of this record is preservation. RECAP retains the Doc 212 exhibit set for now, but that is a civil-society mirror of a court docket that could be sealed, superseded, or overtaken by a plea. Concretely: independent archiving of the 32 exhibits (plus Exhibits 33–35 in Doc 217) with cryptographic hashes and multi-jurisdiction backup; statement-collection from the labor and civic organizations whose finances were subpoenaed; and preserved copies of the U.S. Attorney’s June 16 press conference video and transcript. None of this requires TRC authorization. All of it becomes harder to do later.
Primary source path
To work from primary material rather than secondary coverage:
- The case is United States v. Sant, 0:26-cr-00115 (D. Minn.), filed June 11, 2026. CourtListener docket identifier:
gov.uscourts.mnd.234416(PACER case ID 234416). Assigned to District Judge Katherine M. Menendez; discovery motions referred to Magistrate Judge David T. Schultz. Note:0:26-mc-00025(filed April 2026) is a separate case — Good v. Department of Justice, brought by Renee Good’s family — and is not the operative criminal docket. - Kevin Riach’s August 13, 2026 Motion for Discovery (formally under Rule 16 and Brady/Giglio) on behalf of Isaac Auman Sant is Document 212 in the docket — 26 pages, 32 exhibits. Three additional exhibits (Exhibits 33–35) were filed the following day as Document 217. As of this writing, the government’s response is due August 21, 2026; a motion hearing is set for August 27, 2026 at 2:30 PM, Courtroom 12W (Minneapolis) before Magistrate Judge Schultz.
- Verified RECAP exhibit filenames as of August 20, 2026 (the trailing version number increments as RECAP uploads new revisions — use the base pattern and retrieve the highest version):
- The main Riach brief (26 pp.):
gov.uscourts.mnd.234416.212.0_6.pdf - Grand jury diagram showing organizational relationships (att. 3):
gov.uscourts.mnd.234416.212.3_5.pdf - UCA 9833 Sunrise Movement report (att. 11):
gov.uscourts.mnd.234416.212.11_5.pdf - Clearview AI identification documents (att. 29):
gov.uscourts.mnd.234416.212.29_3.pdf
- Direct exhibit access via RECAP:
https://storage.courtlistener.com/recap/gov.uscourts.mnd.234416/ - CourtListener docket search:
https://www.courtlistener.com/docket/— search by docket ID or party name “Isaac Sant.”
Search hygiene note
A verbatim search for “Operation Puppet Master” returns unrelated results for an in-game item (“Operation ‘Puppet Master’ Report”) from the video game Deepwoken. Add qualifiers such as DHS, HSI, Minnesota, or Minneapolis to filter results.
Sources
Wire and mainstream reporting (all published in the initial news cycle of August 13–14, 2026, except where noted):
- The New York Times (first reporting, August 13, 2026) — https://www.nytimes.com/2026/08/13/us/politics/dhs-inquiry-immigration-protests-minnesota.html
- Minnesota Reformer (independent first-day reporting, August 13, 2026) — https://minnesotareformer.com/2026/08/13/feds-spied-on-protesters-left-wing-organizations-and-unions-during-metro-surge — notable for additional organizational detail and exhibit-level sourcing
- Democracy Docket (August 13, 2026) — https://www.democracydocket.com/news-alerts/trump-administration-dhs-twin-cities-minnesota-surveillance-operation — includes direct CourtListener exhibit links; covers Clearview AI misidentification
- CNN via AP, August 14, 2026 — https://www.cnn.com/2026/08/14/us/minnesota-immigration-protests-dhs-operation-hnk
- ABC News via AP, August 14, 2026 — https://abcnews.com/US/wireStory/documents-show-federal-surveillance-operation-minnesota-targeted-progressive-135630659
- CBS Minnesota, August 14, 2026 — https://www.cbsnews.com/minnesota/news/federal-surveillance-operation-in-minnesota-targeted-progressive-groups-unions-documents/
- MinnPost, August 14, 2026 — https://www.minnpost.com/metro/2026/08/documents-show-federal-surveillance-operation-in-minnesota-targeted-progressive-groups-unions/
- The Hill, August 14, 2026 — https://thehill.com/regulation/court-battles/6030064-dhs-secretly-monitored-minneapolis-protesters/
Labor and advocacy press (useful for union-side statements and additional organizational detail):
- Labor Notes, August 2026 — https://labornotes.org/2026/08/federal-spies-hunt-minnesota-unions-search-conspiracy-find-solidarity — includes statements from CWA Local 7250 President Kieran Knutson and MN AFL-CIO; names IFPTE as a subpoena target; cites exhibit-level detail. Use for union statements and organizational scope; not a neutral source.
- Democracy Now! (left), August 17, 2026 — https://www.democracynow.org/2026/8/17/operation_puppet_master
- Breitbart (right), August 14, 2026 — https://www.breitbart.com/immigration/2026/08/14/33484657report-details-revealed-of-doj-probe-of-groups-thought-to-be-behind-violent-ice-protests-in-minnesota/
Aggregators:
- The Marshall Project — https://www.themarshallproject.org/records/23592-operation-puppet-master
- NewsCord (13-outlet comparison) — https://newscord.org/article/dhs-agents-infiltrated-minneapolis-anti-ice-protests-under-operation-puppet-mast–Story_20260814_SecretICEAgentTriedtef45559a
Editorial note
This document was compiled from a research brief dated August 20, 2026 and updated on the same date following independent verification against multiple primary-coverage sources.
Verification status (August 20, 2026): The core facts — defendant Isaac Auman Sant, attorney Kevin Riach, the August 13 filing date, operation names “Operation Puppet Master” and “Project Whipple Shield” (or “Operation Whipple Shield” — see note below), the June 16 Rosen press conference and “Direct Action Minnesota” characterization, use of administrative subpoenas, and the SEIU/CWA/IFPTE/Sunrise/Voices for Racial Justice scope — are confirmed by multiple independent news sources including the New York Times, Minnesota Reformer, Democracy Docket, and Labor Notes.
The case docket (gov.uscourts.mnd.234416) was additionally verified directly against the CourtListener REST API using the PACER case ID. Confirmed from primary source: case name United States v. Sant, docket number 0:26-cr-00115, filed June 11, 2026; District Judge Katherine M. Menendez assigned; Magistrate Judge David T. Schultz handling discovery; Document 212 is the Riach motion (26 pages, 32 exhibits) filed August 13, 2026; government response due August 21, 2026; motion hearing August 27, 2026. The RECAP exhibit file suffixes in the primary source path above are verified as of August 20, 2026.
Naming discrepancy: The Minnesota Reformer refers to the second operation as “Operation Whipple Shield”; other outlets and the original research brief use “Project Whipple Shield.” The exact name in the underlying government records has not been independently verified by this document; see the primary source path for resolution.
This document will be updated as those materials become available.