Homeland Security Investigations agents issued a subpoena to outdoor retailer REI in March, demanding transaction records for every person in the Minneapolis–St. Paul region who had purchased a particular dark green beanie from the company since 2024, according to new court filings reported by WIRED. The demand was part of a federal investigation into protesters who demonstrated at a church led by a pastor who simultaneously served as an acting ICE field office director. REI didn't answer questions about whether it handed over the data or how many customers were swept up in the request.

The REI subpoena was one of 92 sent by HSI as part of its probe into the defendants, the filings reveal. Other targets of the subpoenas included social media platforms, airlines, telecommunications providers, a car rental firm, and a state employment agency. At least one airline subpoena allegedly requested not only historical flight information about a defendant, but also asked the carrier to send HSI a "lookout notification" about the defendant's future travel plans. The lawsuit involves 39 defendants, including both protesters and journalists who tried to cover the event—among them former CNN host Don Lemon. The US Attorney's Office in Minnesota, which is handling the case for the government, didn't respond to questions about why it was necessary to identify everyone in Minnesota who bought the beanie from REI, or why the subpoena specifically targeted REI customers when the beanie is available on other platforms.

The subpoenas are officially called 1509 customs summonses, a legal tool designed to request information related to imports and exports. Senator Ron Wyden of Oregon said that "customs summonses only allow DHS to request information directly related to compliance with customs laws," calling the demand that REI search two years of customer data "flat-out absurd." According to a recent letter written by Wyden and Representative Pramila Jayapal, big tech companies sometimes ignore the government's request for silence when not legally required, but companies in more heavily regulated sectors have told Congress they've complied due to fear of regulatory retaliation. These summonses can be issued without oversight from a judge or jury, and companies receiving them are typically instructed to keep their existence secret.

Companies have responded to the recent wave of customs summonses in markedly different ways, revealing a fractured landscape of corporate cooperation with the Trump administration's use of the legal tool. Attorneys for Georgia Fort, a journalist and defendant in the Minnesota case, wrote in a court filing that they were "stunned" when they discovered the government had obtained logs detailing six months of Fort's calls and texts from T-Mobile after the telecom provider received a customs summons—Fort was never notified by either T-Mobile or the government. Google, by contrast, refused to comply with a customs summons seeking information about Fort's YouTube viewers and subscribers. Reddit announced that during the second half of 2025, it received DHS administrative subpoenas seeking information about 11 Reddit accounts that posted critical comments about ICE actions, and after Reddit objected on First Amendment grounds, the agency withdrew them.

The total number of 1509 summonses sent since the start of the Trump administration—and how many people have had their personal information collected by DHS as a result—remains unknown, the report notes. Mario Trujillo, a senior staff attorney at the Electronic Frontier Foundation who has been monitoring DHS subpoenas sent to tech companies, said that "DHS has proved time and time again that they can't be trusted as the stewards of applying this law correctly." Congress could pass legislation restricting how the agency uses 1509 customs summonses or add penalties when they're misused, but until then companies and their customers are left to navigate the requests on their own. The opacity of the system means most targets only learn about these data sweeps if a company defies the silence request or if the target discovers it after the fact through litigation—a discovery mechanism that leaves the vast majority of surveillance invisible and uncontested.