--- title: ICE Is Running One of the Largest Anti-Left Surveillance... description: ICE's Homeland Security Investigations ran a surveillance operation against left-wing activists tied to the Minnesota 15 conspiracy case. Around 120 HSI... canonical: https://daily.dev/posts/ice-is-running-one-of-the-largest-anti-left-surveillance-ops-in-us-history-8zwgzxafz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ICE Is Running One of the Largest Anti-Left Surveillance Ops in US History | daily.dev og:description: ICE's Homeland Security Investigations ran a surveillance operation against left-wing activists tied to the Minnesota 15 conspiracy case. Around 120 HSI... og:url: https://daily.dev/posts/ice-is-running-one-of-the-largest-anti-left-surveillance-ops-in-us-history-8zwgzxafz og:image: https://api.daily.dev/og/posts/8ZwGZXaFz.png og:image:alt: ICE Is Running One of the Largest Anti-Left Surveillance Ops in US History og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ICE Is Running One of the Largest Anti-Left Surveillance Ops in US History **[Hacker News](https://daily.dev/sources/hn)** · 10 min read · 0 upvotes · 0 comments ## Summary ICE's Homeland Security Investigations ran a surveillance operation against left-wing activists tied to the Minnesota 15 conspiracy case. Around 120 HSI agents, including 11 undercovers, used Reaper drones, infiltrated Signal chats totaling 15 terabytes, and Patriot Act financial tracking tools normally reserved for terrorism cases. After a local activist uploaded a license-plate search tool on Fly.io to an infiltrated Signal chat, agents reviewed DNS queries, Stripe data, SSH session logs, and the account's signup IP, then combined it with DMV records and Thomson-Reuters CLEAR data to produce a driver's license number and other personal records. Attorneys compare the operation to COINTELPRO. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did federal investigators identify someone who deployed a tool on Fly.io without using a warrant? Homeland Security Investigations agents obtained DNS queries, Stripe payment data, SSH session logs, outbound connection records, and the account's signup IP for a Fly.io-hosted license-plate search tool, reportedly by purchasing data from a commercial broker rather than using a warrant. They then combined this with Minnesota DVS records and Thomson-Reuters CLEAR data to produce a full identity profile, including driver's license and Social Security number summaries. _Developers weighing the privacy risks of hosting personal projects can track surveillance reporting like this on daily.dev._ ### What is Operation Keyhole and how does it relate to the Minnesota 15 indictment? Operation Keyhole is a Certified Undercover Operations program started by HSI's Saint Paul office in December 2008 to fund undercover activity across Minnesota, the Dakotas, Iowa, and Nebraska. As of June 2026 it funded six active investigations, including Project Whipple Shield, which probed alleged assault, stalking, and doxing of federal agents and underpins the Minnesota 15 conspiracy indictment. _Readers following the scope of federal surveillance programs can keep up with reporting like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 454 comments across hackernews (as of 2026-10-28). **TL;DR:** Commenters largely view the surveillance operation as alarming evidence of authoritarian overreach, drawing comparisons to COINTELPRO and debating whether 'police state' or outright 'fascism' is the accurate label, while a vocal minority argues the targeted activists' own violent conduct justified a harsh response. **Sentiment:** 2% positive · 18% mixed · 80% skeptical **The case for** - Some argue the targeted activists engaged in real violence (firearms, fireworks used as weapons) and that consequences were therefore warranted. - A few note ICE has a legitimate mandate to enforce immigration law and that obstructing agents should carry consequences. **The pushback** - Many see the surveillance scope (drones, infiltrated Signal chats, Patriot Act tools) as disproportionate and reminiscent of authoritarian states. - Commenters point to disparate sentencing, e.g. harsh decades-long terms for activists versus pardons for Jan. 6 participants, as evidence of politically motivated enforcement. - Several highlight specific deaths/shootings by ICE agents as unaccounted-for violence undermining claims of lawful conduct. - Technical users are troubled that Fly.io infrastructure (SSH logs, DNS queries, signup IP) was apparently handed over readily to investigators, questioning the platform's data-request vetting. **By community** - hackernews (heated): A long, contentious thread where most participants condemn the operation as authoritarian overreach, but a persistent minority defends ICE's actions and disputes the framing of the Minnesota 15 case, leading to extensive back-and-forth arguments. **Hottest debate:** Whether the Minnesota 15 activists' actions (fireworks, firearms) justified both their sentencing and the scale of ICE's surveillance, versus viewing the response as a politically motivated, fascist-style crackdown. **Open questions** - Did Fly.io scrutinize or challenge the legal requests before handing over SSH logs, DNS queries, and account data? - How widespread is this kind of surveillance and data-fusion tactic against other activist groups beyond the Minnesota 15 case? **Highlights** > indeed, the actual case report (https://www.documentcloud.org/documents/28831278-govuscourts...) states: "technical and network-activity records from fly.io included: SSH session logs (CSV format) listing multiple "New SSH session" entries for with verified=true between approximately 2026-03-26 and 2026-04-01, timestamped in UTC. outbound-connection records (CSV format) reflecting numerous TCP port 443 connections originating from internal fly.io addresses to external IP addresses attributed to AMAZON-02 (Amazon Web Services) in the US and Cloudflarenet (Cloudflare)". > — [john\_strinlai on hackernews · 4 comments](https://news.ycombinator.com/item?id=50273455) > > After a local activist uploaded a license-plate search tool on Fly.io, a developer-focused public cloud platform, to an infiltrated Signal chat, HSI agents reviewed website DNS queries and Stripe data along with data purchased from a commercial broker. This gave HSI access to SSH session logs, outbound connection records, the Fly.io account’s signup IP, and a Stripe card fingerprint on an account that had never completed a payment. Agents fused that with Minnesota DVS records and commercial data from the Thomson- Reuters CLEAR platform to produce a driver's license nummber, Social Security number summary, years of address history, phone numbers, property records, and jointly registered vehicles. Wow, I wonder how they got SSH session logs?! The breadcrumb trail here is chilling. > — [multiplegeorges on hackernews · 6 comments](https://news.ycombinator.com/item?id=50273269) > I always come back to this: https://ia800601.us.archive.org/9/items/umberto-eco-ur-fasci... > — [rc-research on hackernews · 1 comments](https://news.ycombinator.com/item?id=50273917) > IIRC, people involved in this case made extremely telling comments about the political alignment of the protestors. They despise them either way, the guns are just used as pretext to elevate it to the next level, especially since the people among them who didn't have guns or do anything violent didn't escape the wrath. They almost certainly would not have gotten slaps on the wrist, those are reserved for 'our good boys'. They would have still gotten their lives ruined, just not in quite the same dramatic fashion with showy century-long sentences, but just the routine 'you're going away for a long time' treatment. > — [tavavex on hackernews](https://news.ycombinator.com/item?id=50274302) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50272749) · 546 points · 454 comments ## Similar posts on daily.dev - [FBI investigating MN Signal groups tracking ICE, Patel says](https://daily.dev/posts/fbi-investigating-mn-signal-groups-tracking-ice-patel-says-kfvhbsxqx) · Hacker News · 0 upvotes · 0 comments - [How hackers fight back against ICE surveillance tech](https://daily.dev/posts/how-hackers-fight-back-against-ice-surveillance-tech-3fnwhl9fd) · The Register · 0 upvotes · 0 comments - [Who’s Stalking Whom? ICE Uses Social Media and Phone Surveillance System to Track Protesters](https://daily.dev/posts/who-s-stalking-whom-ice-uses-social-media-and-phone-surveillance-system-to-track-protesters-skuieg741) · Security Boulevard · 0 upvotes · 0 comments - [Homeland Security has reportedly sent out hundreds of subpoenas to identify ICE critics online](https://daily.dev/posts/homeland-security-has-reportedly-sent-out-hundreds-of-subpoenas-to-identify-ice-critics-online-lwuh8bumb) · Hacker News · 1 upvotes · 0 comments - [Fight for the Future, EFF, Others Push Back Against Growing ICE Surveillance](https://daily.dev/posts/fight-for-the-future-eff-others-push-back-against-growing-ice-surveillance-uqwylh9zi) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#data-privacy](https://daily.dev/tags/data-privacy), [#fly-io](https://daily.dev/tags/fly-io) [View this post on daily.dev](https://daily.dev/posts/ice-is-running-one-of-the-largest-anti-left-surveillance-ops-in-us-history-8zwgzxafz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ICE Is Running One of the Largest Anti-Left Surveillance Ops in US History","url":"https://daily.dev/posts/ice-is-running-one-of-the-largest-anti-left-surveillance-ops-in-us-history-8zwgzxafz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ice-is-running-one-of-the-largest-anti-left-surveillance-ops-in-us-history-8zwgzxafz"},"datePublished":"2026-10-28T14:08:48.727Z","dateModified":"2026-10-28T15:31:18.686Z","description":"ICE's Homeland Security Investigations ran a surveillance operation against left-wing activists tied to the Minnesota 15 conspiracy case. Around 120 HSI...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3496f4f07c66a705425e601405b73a26?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3496f4f07c66a705425e601405b73a26?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ice-is-running-one-of-the-largest-anti-left-surveillance-ops-in-us-history-8zwgzxafz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"data-privacy,fly-io","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"ICE Is Running One of the Largest Anti-Left Surveillance Ops in US History"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ice-is-running-one-of-the-largest-anti-left-surveillance-ops-in-us-history-8zwgzxafz#faq","mainEntity":[{"@type":"Question","name":"How did federal investigators identify someone who deployed a tool on Fly.io without using a warrant?","acceptedAnswer":{"@type":"Answer","text":"Homeland Security Investigations agents obtained DNS queries, Stripe payment data, SSH session logs, outbound connection records, and the account's signup IP for a Fly.io-hosted license-plate search tool, reportedly by purchasing data from a commercial broker rather than using a warrant. They then combined this with Minnesota DVS records and Thomson-Reuters CLEAR data to produce a full identity profile, including driver's license and Social Security number summaries. Developers weighing the privacy risks of hosting personal projects can track surveillance reporting like this on daily.dev."}},{"@type":"Question","name":"What is Operation Keyhole and how does it relate to the Minnesota 15 indictment?","acceptedAnswer":{"@type":"Answer","text":"Operation Keyhole is a Certified Undercover Operations program started by HSI's Saint Paul office in December 2008 to fund undercover activity across Minnesota, the Dakotas, Iowa, and Nebraska. As of June 2026 it funded six active investigations, including Project Whipple Shield, which probed alleged assault, stalking, and doxing of federal agents and underpins the Minnesota 15 conspiracy indictment. Readers following the scope of federal surveillance programs can keep up with reporting like this on daily.dev."}}]} ```