Undercover Agents in Church Gyms, Spy Tools at Military Commands: How Far Immigration Surveillance Has Grown

Court records show federal agents spied on unions, churches and peaceful protest groups. New leaked files tie the same agency to military commands. And the money behind it has roughly tripled.

By Rich Vandall · Oct. 29, 2026

Federal agents went undercover in anti-ICE meetings in Minneapolis churches, libraries and gyms this year. They joined activists' Signal chats, ran license plates outside a church and pulled bank records from some of the country's biggest unions. None of those unions or groups has been charged with a crime.

That picture comes from nearly 30 internal Department of Homeland Security reports made public in August, first reported in detail by The Guardian (The Guardian). This week, files from the hack of DHS employee records added a new piece: the same investigative branch has agents posted inside U.S. military commands, with access to phone-tracking software (Reason).

Both stories sit on top of the fastest expansion of immigration enforcement money in the agency's history. Here is what the records show, and how much has changed.

Operation Puppet Master

In January, as protests swelled in the Twin Cities after federal officers killed Renee Good and Alex Pretti, DHS opened an inquiry it called "Operation Puppet Master." Its stated aim was to find a "network of conspirators" organizing against Immigration and Customs Enforcement (The Guardian).

The work was done by Homeland Security Investigations, or HSI, the branch of ICE normally assigned to trafficking, smuggling and cartel cases. The records say it followed President Trump's executive order last year that labeled "antifa" a domestic terrorist organization (The Guardian).

The reports came out as evidence in the federal case against 15 Minneapolis protesters, who are charged with conspiring to impede immigration officers. All 15 have pleaded not guilty (Fox 9). The 94-page indictment does not accuse any of them of injuring an officer or charge any serious violence (The Guardian).

What the agents did

According to the released reports:

• Undercover at meetings. Agents attended community meetings in the Twin Cities and New York, including a virtual Hunter College event on "ICE brutality," a labor-center meeting, a park meeting and a Direct Action Minnesota meeting at a church. They recorded audio (The Guardian). One agent traveled to a meeting in Ann Arbor, Mich. (The New Republic).
• Pushing toward "direct action." At a Jan. 31 Sunrise Movement training at the Minneapolis library, the agent's own report called the group focused on peaceful protest. The agent then told an attendee he worked in construction, could build items for "direct-action" protests, and didn't mind going to jail (The Guardian).
• Inside Signal chats. Another undercover agent joined activists' Signal groups (The Guardian).
• Lying when asked. At a church event, agents logged attendees' license plates. When a man asked two of them if they were ICE, one said no (The Guardian).
• Bank records without a judge. Using administrative subpoenas, which need no court approval, DHS obtained wire-transfer records involving the Service Employees International Union and sought Communications Workers of America data from the Federal Reserve Bank of New York. It also got financial records tied to the Sunrise Movement (The Guardian).
• Unions named as "connected." The government's documents linked the AFL-CIO, SEIU, the Minneapolis Federation of Educators, the Minnesota Association of Professional Employees, the Democratic Socialists of America and Showing Up for Racial Justice to the alleged conspiracy. None has been charged (The Guardian).

The church that had a court order

One of the surveilled sites was University Baptist Church in Minneapolis's Dinkytown neighborhood. In February, a federal judge in Massachusetts had barred DHS from immigration enforcement at churches in the denomination it belongs to, including "investigation" and "interview" (MPR News).

Agents watched the church at least three times between April and June, photographing cars and running plates. On May 28, an undercover agent joined a martial-arts training in the church gym and sparred with attendees. Her hidden recorder fell to the floor, and she came back about three minutes later to get it (MPR News). The church's interim pastor said leaders learned of it only from the court filing.

Kevin Riach, a lawyer for one defendant, called the operation a "mass spying campaign" in his filing and is asking the court to force the release of the rest of the reports. Judge David Schultz heard arguments Aug. 27 (Fox 9). The Despoiler could not find a public ruling as of Oct. 29.

Mike German, a former undercover FBI agent, told The Guardian it is unusual for DHS rather than the FBI to lead a terrorism-style investigation. He also noted the meetings were open to the public, which he said is a sign the groups weren't criminal (The Guardian).

DHS said HSI does not comment on ongoing investigations or methods. The U.S. Attorney's Office in Minnesota declined to comment (The Guardian).

New this week: HSI inside military commands

The DHS employee files leaked Oct. 28 list HSI liaisons at U.S. Special Operations Command, Africa Command and Southern Command, plus an HSI contractor tied to Central Command, Reason reported Oct. 29. The Special Operations and Central Command links had not been reported before (Reason).

The liaisons are listed as users of three surveillance systems:

• PenLink, which can track one person's phone or collect data on every phone in an area
• FALCON, Palantir-built software that merges government and commercial records
• RavenGo, tied to DHS's in-house RAVEN system

The HSI unit chief over the liaisons also belongs to a user group that appears linked to Liberty Crossing, headquarters of the Office of the Director of National Intelligence. ICE did not respond to Reason (Reason).

The Despoiler's own count of the leak found 195 Ohio records, clustered around ICE and Border Patrol offices in Cleveland, Middleburg Heights, Westerville, Cincinnati and Port Clinton. The records show which accounts could open PenLink (The Despoiler).

How much surveillance has grown

The short answer: the money has roughly tripled, spending on surveillance technology has risen roughly tenfold since 2013, and the paper trail meant to check it has shrunk.

ICE ran on about $6 billion a year a decade ago and about $10 billion a year before 2025. The July 2025 budget law added $75 billion over four years, which works out to roughly $29 billion a year at a steady pace — more than all other federal law enforcement agencies combined (NPR). ICE says its officers and agents went from about 10,000 to 22,000 in a year.

A June report by Mijente, Just Futures Law and Surveillance Resistance Lab tracked ICE and CBP contracts with 11 surveillance-technology companies. Those contracts doubled from 2024 to 2025, to more than $310 million, then hit a record $513 million in 2026 (Truthout, Criminal Justice Journalists). Palantir alone got $81 million from ICE in 2025 and $97 million in 2026, and DHS signed a Palantir purchase agreement with a $1 billion ceiling in February (Truthout, FedScoop).

Privacy impact assessments are the public reports DHS must file before it uses new systems that collect personal data. FedScoop counted 24 in 2024, eight in 2025 and none in 2026 as of mid-March. DHS's inspector general has said the department obstructed his office's work (FedScoop).

Where the spy tools come from

Much of the software that does the analysis is American: Palantir, PenLink and Clearview AI are U.S. companies. But several of the tools that crack phones, read messages, scan faces and watch the border come from firms rooted overseas, most of all in Israel.

Added up, those six deals come to about $312 million, and about $243 million of it, nearly four of every five dollars, went to firms with Israeli roots. The figures span different years, and some are contract ceilings or earmarks rather than money spent, so treat the total as a rough measure, not an audit. The Despoiler could not find a complete public count of foreign-rooted surveillance contracts across DHS.

Paragon's track record shows what this kind of tool can do in a government's hands. In June 2025, an Italian parliamentary committee confirmed Italy had used Graphite to hack the phones of immigrant-rights activists, and Citizen Lab found a Naples journalist had also been targeted (Wikipedia).

What's coming next: ERO ONE

ICE is fast-tracking a roughly $100 million intelligence program called ERO ONE, The American Prospect reported Oct. 14. It would hire 142 intelligence contractors with top-secret clearances across 26 cities to map targets' "network, link and relationship" ties, including family members, household members and acquaintances (The American Prospect).

The work statement was posted Sept. 18. A DHS forecast puts the formal solicitation around Dec. 10, with an award expected around February. An ACLU analyst told the Prospect it looks like the building of an internal spying agency. DHS did not respond to the Prospect's questions (The American Prospect).

What to watch

• ☐ Judge Schultz's ruling on releasing the rest of the Operation Puppet Master reports
• ☐ The Minnesota 15 trial, and whether any charges are dropped
• ☐ ERO ONE: the Dec. 10 solicitation and who bids
• ☐ The leaked liaison files: whether DHS or the Pentagon explains HSI's role at Special Operations and Central Command
• ☐ Ohio: any sign of similar undercover work at protests here

Know of federal agents at meetings or protests in the Miami Valley? Send tips to thedespoilerdayton@proton.me or via Signal.

Related: Hacker Leaks Work Details of More Than 40,000 Homeland Security Employees · Troops at Home: What the Military Is Doing on U.S. Soil