HSI Opens Project Whipple Shield, Using Warrantless Administrative Summonses Under Customs Authority to Take Years of Union and Nonprofit Financial Records Under a 'Domestic Terrorist Financing' Theory

Opening

Roughly two weeks after opening 2026-08-13–operation-puppet-master-hsi-infiltrates-minnesota-anti-ice-community, Homeland Security Investigations opened a second investigation: Project Whipple Shield, named for the Bishop Henry Whipple Federal Building, headquarters of the federal immigration operation in Minnesota.

Where Puppet Master targeted an activist network, Whipple Shield targeted the money — and the people who supported the targets. HSI’s stated purpose was to “uncover the funding sources behind the anti-ICE antifa ring targeting the Federal Whipple Building and the cell’s organizational structure.”

It obtained years of financial records from labor unions and nonprofits using HSI-issued administrative summonses — issued by the agency itself, with no warrant and no judge, under 19 U.S.C. § 1509 (customs-summons authority, not an immigration or grand jury instrument — see “The mechanism, precisely” below).

What Happened / Key Facts

The escalation is the structure. Puppet Master, opened January 28 four days after a federal officer killed Alex Pretti, sought to “unmask the agitators conspiring to exploit the civil unrest to riot, destroy federal property, and assault personnel protecting these facilities.” Whipple Shield, opened Feb. 11, two weeks later, extended to “sophisticated, organized campaigns” supporting those accused. Charge a handful publicly, then use the resulting investigative authorities to map everyone connected to defending them.

The mechanism, precisely. HSI’s own summons forms (HSI Form 3115, “Department of Homeland Security Summons — To Appear and/or Produce Records”), served on FedWire and the Clearing House Interbank Payment System, state their authority in plain text on the face of the document: “Issued under authority of section 509, Tariff Act of 1930, as amended by Pub. L. No. 95-410 (19 U.S.C. § 1509); 44 F.R. 2217; Homeland Security Act of 2002.” That is a customs-summons authority, not 8 U.S.C. § 1225(d)(4) (an immigration-specific tool), not an IRS-style summons, and not a grand jury subpoena — no judicial officer approves it, and each form doubles as a nondisclosure order: “You are requested not to disclose the existence of this summons for an indefinite period of time.” The PayPal/Venmo instrument used against Voices for Racial Justice is described in HSI’s own ROI narrative as an “administrative subpoena” rather than a “summons” — the government’s internal terminology is not fully consistent between the two instruments, though the underlying authority (agency-issued, no warrant) is the same. Both instruments were signed by Steven Schrank, Special Agent in Charge, HSI Saint Paul (the bank summonses) or served by named case agents (the PayPal/Venmo subpoena, SA Terri Botterbusch). Source: Doc. 212-6, 212-7, 212-8, 212-9, 212-10 (US v. Sant, 0:26-cr-00115, D. Minn.), read directly from the archived page images at 300dpi.

Requested vs. produced — both are documented, not merely alleged. These were not summonses issued and left unanswered. HSI’s own ROIs record service and return:

• SEIU — Summons HSI-MS-2026-037088, served on FedWire March 20, 2026, requesting “FEDWIRE Funds Service transfers” for four named SEIU entities (South St. Paul, two Minneapolis addresses, St. Paul) “from January 1, 2023, until present.” FedWire’s return was received April 8, 2026, and HSI’s own ROI reports a “preliminary analysis” finding “numerous wire transactions… for various types of debits and credits to include annuity payments, strike payments, strike supplies, investments, union member dues, retiree dues, medical expenses, and pension fund expenses.” The category is broader than the entry previously stated (“wire transfers from various financial institutions”) — it is essentially the union’s full FedWire transaction history for the period, not a targeted subset.
• CWA, IFPTE, and Sunrise Movement/Sunrise Movement Education Fund — a single summons (HSI-MS-2026-037704, issued 3/9/2026, served on the Clearing House Interbank Payment System per its cover sheet — Doc. 212-8) requested records for all four together: CWA (national headquarters and multiple named bank accounts — Northwest Savings Bank, United Business Bank, a Business DDA account, Truist), the International Federation of Professional and Technical Engineers, explicitly labeled on the summons as “(CWA)” — i.e., named as a CWA affiliate, not a separate target — and, as two separate line items with their own address blocks, “Sunrise Movement Education Fund” and “Sunrise Movement” (Doc. 212-8 p.3, read at 300dpi). The distinction matters: these are legally separate entities (the Education Fund a 501(c)(3), Sunrise Movement itself a 501(c)(4), with different permitted activities), and the summons names both individually rather than treating them as one target. The same summons number also drew a second response from Fedwire (Doc. 212-9, Federal Reserve Bank of New York letter to SA Amber Tallas, dated 4/17/2026, responding to “a Department of Homeland Security Summons dated March 9, 2026”) — i.e., the identical instrument reached two separate payment-clearing systems, not CHIPS alone as this entry previously stated. Fedwire’s own search-term log confirms positive hits on both *SUNRISEMOVEMENTEDUCATIONFUND* and *SUNRISEMOVEMENT* AND (WASHINGTON* OR DC* OR WDC*) — meaning wire-transfer records for both entities were located and produced, not merely requested. The summons’s own language requests “any and all records” on these entities from January 1, 2023 through March 9, 2026 — not a request narrowed to “donations and PAC spending.” No PAC-specific or donation-specific framing appears on the face of the document; that characterization does not trace to the primary summons and has been removed.
• Voices for Racial Justice — a Minneapolis racial-justice training organization; HSI’s ROI (approved 4/2/2026, SA Terri Botterbusch) documents an administrative subpoena to PayPal/Venmo (HSI-MS-2026-037346 and -037348), served March 7, 2026, with results returned March 20, 2026. PayPal/Venmo’s response is confirmed in the ROI as producing account holder details, a linked phone number, transaction records, and account summaries for at least two separate PayPal accounts tied to the organization — not merely a request pending response.

A union’s political action committee spending is among the most protected categories of associational activity in American law; what the record actually shows HSI took is broader still — a national union’s full multi-year FedWire transaction ledger, taken by agency summons under a terrorism-financing theory, with no judicial officer in the loop.

“The Conspiracy” slide. HSI agents prepared a conspiracy diagram (Doc. 212-3, Grand Jury Exhibit 1A page 5) and presented it to the grand jury that returned a 94-page indictment — HSI Agent Desmond Garcia testified about it directly (Ex. 4, 27:4-11). The diagram depicted 18 unions, political organizations and community groups radiating from a Direct Action Minnesota (DAMN) hub. Correction: the slide’s own edge label on each of the 18 spokes reads only “Council Member” — asserting each organization’s membership status relative to the DAMN hub, not overlapping membership between the 18 organizations themselves. That broader reading, which earlier reporting and earlier passes through this corpus both carried, is not what the exhibit itself depicts or asserts; see 2026-08-13–operation-puppet-master-hsi-infiltrates-minnesota-anti-ice-community for the full corrected organization list. The AFL-CIO, the Minneapolis Federation of Educators, the Minnesota Association of Professional Employees, and SEIU Local 26 are among the 18 “Council Member” spokes.

Eighteen distinct organizations — a labor federation, a teachers’ local, a veterans’ group, a racial-justice group, a bicycle repair collective — rendered as spokes in a chart titled “The Conspiracy,” under a government seal, shown to the body that decides whether to indict. Sunrise Movement is not among the 18 — a direct visual read of Doc. 212-3 at 300dpi (2026-08-13 pass) found neither Sunrise Movement nor Sunrise Movement Education Fund on the chart. Sunrise’s presence in this record is confined to the financial-summons instrument and to the surveillance narrative below; it was not presented to the grand jury as a node in HSI’s own conspiracy diagram.

No stated predicate connects Sunrise Movement to the investigation’s subjects. The two ROIs that open Puppet Master and Whipple Shield (Doc. 212-1, 212-2) — the documents where HSI would state why any organization drew scrutiny — name no organizations at all; both describe only a generic “organized network of conspirators” and “sophisticated, organized campaigns.” The one ROI that discusses Sunrise Movement in narrative detail (Doc. 212-11, approved 3/6/2026) documents two undercover agents (UCA 9833, UCA 5022) attending a public, publicly-advertised “Resistance Skills Training with Sunrise Movement Twin Cities” at the Minneapolis Public Library on January 31, 2026 — and states in HSI’s own words that “it was made clear that the Sunrise Movement organization focused on ‘peaceful’ protests.” The only note in the file adjacent to “direct action” is that UCA 9833 — the government’s own operative — volunteered unprompted that he “works construction and could build items that might assist other groups with more ‘direct-action’ protests,” an offer made by HSI’s agent to an unnamed attendee, not a statement about Sunrise Movement’s own conduct or planning. No later ROI in the reviewed set returns to Sunrise Movement with any additional predicate. On the documents reviewed, a nationally-scoped climate-advocacy organization was named individually — twice, as two separate legal entities — on a customs-authority summons demanding “any and all records” back to January 2023, with the only substantive investigative narrative about it describing a public training session HSI’s own agent characterized as peaceful. That absence of a stated predicate is itself the finding; it should not be extended to “HSI had no predicate” — only an undisclosed one, or none, is consistent with what these documents show.

The government’s characterization. The Washington Examiner described the investigation as one into “what prosecutors say was a well-funded and highly organized conspiracy among antifa militants in Minnesota to methodically impede Immigration and Customs Enforcement operations,” and reported that HSI labelled its financial inquiry “protest domestic terrorist financing” (Washington Examiner, Aug. 17, 2026; KSTP, Aug. 13, 2026). DAMN was described as a network of “violent opportunists” operating “both online and in person.”

The defense objection. Defense attorney Kevin Riach argues HSI obtained union financial records with “zero criminal predicate to do so”, that in all cases “the people or organizations being surveilled were engaging in First Amendment-protected activities,” and that the government “dreamed up a conspiracy” reaching far beyond the indicted defendants to major labor unions “with no evidence.”

Official response. Minnesota Attorney General Keith Ellison named both operations and called the surveillance “appalling and alarming,” describing it as directed at “Minnesotans for exercising their constitutionally protected, basic First Amendment rights.” A DHS spokesperson said: “HSI does not comment on the existence or status of specific on-going investigations, nor on investigative methods,” and referred inquiries to the U.S. Attorney’s Office for the District of Minnesota (KSTP).

Why It Matters

This is the half of the story the coverage under-reports. Operation Puppet Master got the headlines because undercover agents in church basements is a vivid image. Whipple Shield is the more consequential program: it reached organizations that were never accused of anything, took years of their banking records without a judge, and rendered them to a grand jury as nodes in a terrorism conspiracy chart.

The predicate chain is the mechanism. Emptywheel traced it: Bondi’s high-profile “trophy arrests” supplied the conspiracy predicate for the Minnesota 15 indictment, which in turn supplied the investigative authorities for the broader infiltration. Prosecution operated as a surveillance-expansion wedge. Separately, in Minnesota federal prosecutors have voluntarily dismissed at least eight cases against people accused of assaulting federal officers (KSTP, Aug. 13, 2026), but the records the predicate cases helped justify taking have already been taken.

Administrative summonses are the load-bearing tool — and the specific authority is a customs statute, not an immigration one. The bank-facing instruments (FedWire, CHIPS) invoke 19 U.S.C. § 1509, the Tariff Act of 1930’s customs-summons power, retooled here for a domestic-terrorism-financing theory with no customs nexus stated on the form. Not a warrant, not a grand jury subpoena, not even the immigration-specific 8 U.S.C. § 1225(d)(4) — agency-issued process requiring no judicial finding, carrying its own indefinite nondisclosure order. The distinction is what makes the volume possible, and it is the thing least likely to survive scrutiny on a challenge that reaches its statutory basis. It is also the thing most portable to the next jurisdiction.

It reached beyond Minnesota. The same investigation tasked HSI Detroit Metro Airport to put an undercover agent into a church sanctuary in Ann Arbor on two days’ notice — see 2026-04-08–hsi-undercover-operation-zion-lutheran-church-ann-arbor, where the agent received the collection basket, counted the cash, and logged the QR code on the donation slip. A church collection basket entered a financial investigation whose stated subject was terrorist financing.

Open Questions

• The full list of all 18 organizations on the grand jury “Conspiracy” slide — resolved 2026-08-13 by direct 300dpi visual read of Doc. 212-3; full list in 2026-08-13–operation-puppet-master-hsi-infiltrates-minnesota-anti-ice-community
• Whether any recipient of an administrative summons has moved to quash, and with what result — checked 2026-08-20, re-checked 2026-08-28: no public quash motion located (CourtListener at daily rate cap on 08-28 re-check — tooling-limited, not re-verified as absent that day; general web search also rate-limited on a subset of engines that day, so today’s attempt is not a fresh independent confirmation, only a repeat of the 08-20 finding). Notable contrast with the structurally identical Sept-Oct 2025 DHS subpoenas to Google/Meta, which four Doe plaintiffs did move to quash in N.D. Cal. See whipple-shield-class-level-harm-deploy-disposition
• Which financial institutions complied and whether any refused or notified their customers — checked 2026-08-20, updated 2026-08-28: no evidence found of any recipient organization notifying individual members/donors that their records were reviewed. HSI’s own ROIs confirm FedWire and PayPal/Venmo did comply and produce records (212-5, 212-10). Correction: Doc. 212-9 is a second Fedwire response (Federal Reserve Bank of New York, 4/17/2026), not a CHIPS response as this entry previously stated — it answers the identical summons number (HSI-MS-2026-037704) that Doc. 212-8’s cover sheet shows served on CHIPS, meaning the same instrument reached two payment-clearing systems. Fedwire’s response confirms positive search-term hits for both SUNRISEMOVEMENTEDUCATIONFUND and SUNRISEMOVEMENT, i.e. records for both entities were located and produced, not merely requested. Whether CHIPS itself (the entity actually served per 212-8’s cover sheet) separately produced records is still not confirmed in this document set — its response letter, if any, was not located among 212-1 through 212-31.
• The statutory authority claimed for the administrative summonses, and whether it supports records unrelated to customs or immigration violations — resolved 2026-08-28: 19 U.S.C. § 1509 (Tariff Act of 1930 § 509, as amended), stated on the face of the FedWire and CHIPS-directed summons forms themselves (Doc. 212-6, 212-8). This is customs-summons authority with no customs nexus stated on the form for a domestic-terrorism-financing theory — the statutory mismatch itself is now documented, not just suspected. Whether a court would sustain that authority for this use remains untested; no challenge has been located.
• Whether comparable financial process issued in any other jurisdiction touched by this investigation
• Whether the 94-page indictment survives the pending challenge to its predicate
• What predicate, if any, brought Sunrise Movement onto the CWA/IFPTE summons — resolved as a negative, 2026-08-28: no predicate is stated anywhere in the reviewed ROI set. Neither case-opening ROI (212-1, 212-2) names any organization; the one ROI with substantive Sunrise Movement content (212-11) describes a public training HSI’s own agent says “focused on ‘peaceful’ protests,” with the only “direct-action” language volunteered by HSI’s own undercover agent to an unnamed attendee, not attributed to Sunrise Movement or its staff. Sunrise Movement also does not appear on the “Conspiracy” grand jury exhibit (Doc. 212-3, confirmed 2026-08-13). This is a documented absence, not a proven absence of any predicate that exists elsewhere in the file (grand jury transcript excerpts 212-4/212-27 were not read in full, see us-v-sant-0-26-cr-00115-doc-212-full-roi-set remaining gaps).

Deploy Disposition (human-layer note)

This entry’s harm is class-level, not individually nameable — see whipple-shield-class-level-harm-deploy-disposition for the full confirm-the-absence writeup. Every union-PAC donor and community-org Venmo/PayPal user in the 2023-2026 window is inside the dataset and does not know it; manufacturing an individual victim would misstate an indiscriminate mechanism as a targeting story. The available on-record human voice is institutional: CWA Local 7250 President Kieran Knutson, CWA President Claude Cummings Jr., Minnesota AFL-CIO President Bernie Burnham, and Minneapolis Federation of Educators’ Marcia Howard have all spoken on the record about their own organizations’ records being taken; SEIU co-signed a joint statement. IFPTE and Voices for Racial Justice have not yet been located making a standalone statement.

Cross-References

• 2026-08-13–operation-puppet-master-hsi-infiltrates-minnesota-anti-ice-community
• 2026-04-08–hsi-undercover-operation-zion-lutheran-church-ann-arbor
• 2025-12-04–bondi-weaponizes-tax-law-against-antifa
• 2026-01-12–mn-ag-ellison-sues-dhs-over-operation-metro-surge
• whipple-shield-class-level-harm-deploy-disposition
• us-v-sant-0-26-cr-00115-doc-212-full-roi-set