HSI Report Ties the "mn-dvs-plates" Plate-Lookup App on Fly.io to One Person Using Subpoena Returns, State Driver Records and Identity Databases

A Homeland Security Investigations report in the Project Whipple Shield case file, approved April 7, 2026, is titled “Subpoena Returns From Fly.io and Subsequent Info” (ROI number MS02PR26MS0004-126; the defense filed it August 25, 2026 as Sant Exhibit 39, Doc. 231-3). It is the filing behind the data-layer chain WIRED described on October 28.

What the report says happened. Agents reviewing Signal chat communications obtained in the investigation “identified a URL containing the string “mn-dvs-plates[.]fly[.]dev” (defanged here for reporting)”. Then “legal process was directed to Fly.io and its integrated payment processor”. The returns list two apps on the account, “mn-dvs-plates” (created on or about 2026-02-23) and “plate-to-registration” (created on or about 2026-02-25); SSH session logs “between approximately 2026-03-26 and 2026-04-01”; a Stripe customer record “with no active subscriptions and no completed payments”; sign-up and last-seen IP data; and outbound-connection logs. The report’s own agent’s note says these records “do not include full application content or detailed transaction histories absent additional targeted legal process.”

The identity step. The report then turns to state driver-license records and “investigative resources” for “Identity, address history, and SSN-summary information”, plus phone, property and vehicle-registration records. The only data vendor the page names is CLEAR, and it names it only to say that open-source professional-profile information was “not obtained from Fly.io, Stripe, CLEAR, or other investigative-resource providers.” The page does not say which resource supplied which field, and the vendor behind “CLEAR” is not named on it. Another passage reads an open-source article as showing “an individual with the same name and Minnesota connections” had been acting as an ICE observer. The account holder’s name is redacted in the filing, and this entry does not name them.

Where WIRED’s account and the filing differ. WIRED wrote that HSI “reviewed website DNS queries and Stripe data along with data purchased from a commercial broker.” In this report the Fly.io and Stripe material is described as subpoena returns and provider exports, not purchases; the report does not name a broker, and no DNS step appears in it. DNS and WHOIS work appears in a separate report about two websites (Doc. 231-2). The Thomson Reuters name is WIRED’s; it is not on the page of Doc. 231-3.

Sourcing note. The filing is an image-only scan, so the sourcing gate’s text extractor cannot read it and this entry carries no machine-checked claims (verification: captured). Quotations were copied from an OCR read and checked against the page images.