The list that gives it away

Homeland Security built an internal chart. It called it "The Conspiracy." Eighteen names were on it.

One was the AFL-CIO, the largest union federation in the country, representing millions of workers. Another was a tiny bike-repair shop in Minneapolis.

Same chart. Same list of "conspirators." That's not this desk's interpretation — it's what a real government slide, filed in federal court, actually says. And it's the clearest sign yet of what happens when a policy written to stop violence gets pointed at whoever the government decides is inconvenient instead.

What the order actually promised

In September 2025, President Trump signed a directive called NSPM-7. The pitch was simple: stop "organized political violence" before it happens, by tracking down the money and networks behind it. It told the FBI, the Justice Department, and the IRS to go after the funders and organizers behind violent acts — not just the people throwing punches, but whoever's paying for it.

That's the promise. Here's what it's actually done.

Spying on unions and advocacy groups — not violence suspects

That "Conspiracy" chart came from a real surveillance operation, one Homeland Security ran under this same order and called "Operation Puppet Master." Court filings made public in August 2026 show federal agents pulled years of bank records from the Sunrise Movement, a youth climate group, and two major labor unions — the Service Employees International Union and the Communications Workers of America. Undercover agents sat in on meetings at churches, parks, libraries, and union halls. In one case, an undercover agent posing as a construction worker offered to build equipment for protests — pushing the exact activity he was supposedly there to stop, not just watching for it.

To be clear: showing up on a government chart isn't a crime, and nobody named here — the AFL-CIO, the Sunrise Movement, any union, or that bike shop — has been charged with anything. That's exactly the point. This is what "stopping political violence" looked like in practice: financial records and undercover agents pointed at people going to meetings, not people caught planning attacks.

A single person, targeted — he says — for something that isn't even illegal

This order is written around groups. Its own language targets "networks, entities, and organizations" — the funders and networks behind violence, not any one person's social media account. That's the promise. Here's what one content creator says happened to him, with no organization involved at all — a single account, not independently confirmed by this desk or anyone else beyond one outlet repeating his own telling, and reported here with that limit stated plainly.

Ed Choi, a Los Angeles content creator who posts as @etchaskej (over 600,000 followers on TikTok, co-founder of the "Asian Things" page), says two federal agents came to his home, banged on his door for close to 20 minutes calling his name, then sat outside in a car for up to two hours. Choi says a neighbor warned him they were still there. His attorney got involved — and Choi says the agents told his lawyer they were acting under NSPM-7.

Choi's own explanation for why: he'd shown ICE officers' faces in his content, for accountability. He denies doxxing anyone or condoning violence. That's his account of events — this desk hasn't gotten independent government confirmation of why agents actually came to his door, and it isn't asserting that as settled fact. But it's worth being precise about what showing someone's face on camera actually is, legally. DHS has taken a broader public position on this — stated months before NSPM-7 even existed, and not a response to Choi's case specifically: DHS Assistant Secretary for Public Affairs Tricia McLaughlin said in September 2025 that "videotaping ICE law enforcement and posting photos and videos of them online" counts as doxing, and that the government "will prosecute those who illegally harass ICE agents to the fullest extent of the law."

Courts disagree with that general position, repeatedly. Seven federal circuit courts have ruled that the First Amendment protects the right to record police and other officers performing their duties in public. Doxxing is a specific, different thing — publishing someone's private information, like a home address, not their face while they're doing their job in public. Filming isn't that. Courts have said so seven times over.

So set the theory aside and look at what one person says happened to him: a single content creator, not part of any organization named anywhere in this piece, describes a 20-minute door-pounding and a two-hour stakeout, citing a memo written to target networks — over what he says was the reason: activity federal courts have already ruled is legal. This desk isn't confirming that's actually why agents came. It's reporting what he says happened, and being precise about what the law actually says regarding the activity he describes.

Going after nonprofits' bank accounts

The same day this order was signed, the Justice Department opened an investigation into the Open Society Foundations, one of the largest nonprofit funders in the country. Six months later, the FBI and IRS had built a joint unit specifically to dig through nonprofits' finances for ties to "domestic terrorism." A December 2025 memo from the Attorney General reportedly told prosecutors to prioritize tax charges against "extremist groups" and put cash rewards on the FBI's tip line for reporting suspected domestic terrorism — tools aimed at money and paperwork, not violence.

Copying the playbook at the state level

Florida used this same "domestic terrorist" framing to brand the Council on American-Islamic Relations — a mainstream Muslim civil rights group — a terrorist organization by executive order. A federal court blocked it in March 2026. Florida didn't stop: it passed a new state law in April 2026 and came after CAIR again in July, triggering a second lawsuit the same day. One court win didn't end it — it just showed the playbook can be run again.

The one place it actually caught real violence

To be fair: this order has produced one real domestic-terrorism prosecution, tied to an actual attack. Sixteen people were charged after a 2025 assault on an ICE detention facility in Texas that included shots fired at a police officer. Nine were convicted at trial — the ringleader got 100 years, others 30 to 70 — and seven more pleaded guilty. It's the first time terrorism charges have stuck against anyone linked to "antifa." That's real. It's also the one case out of everything above that actually involves violence, not a union meeting or a nonprofit's tax return.

The deaths this order is now tangled up in

None of this happened in a vacuum. Four months after this order was signed, an ICE agent named Jonathan Ross — publicly identified by multiple news outlets — shot and killed Renée Good, a U.S. citizen and mother who had just dropped her kid at school, during an immigration raid in Minneapolis. Video showed her steering wheel turned away from him, not toward him, when he fired. The Vice President said Americans should thank the agent. Four senior Justice Department officials quit over the government's refusal to investigate. No charges have followed against Ross.

Seventeen days later, two other agents shot and killed Alex Pretti, a nurse who'd been filming them and had put his arm around a woman one of the agents had shoved to the ground. A government review reportedly found no evidence he had a weapon — contradicting what officials said at first.

This order didn't cause either death — both came from a separate immigration operation that started months after this order was signed. But the protests that followed both killings are exactly what "Operation Puppet Master" then targeted. The surveillance grew directly out of the backlash to two deaths this policy had nothing to do with.

Who's pushing back

More than 3,000 nonprofits signed a letter opposing this order within days of it being signed. The ACLU called it an effort "to investigate and intimidate critics." The Brennan Center said most of it is aimed at speech and nonviolent protest, not violence — protected activity, not a threat. Thirty-one members of Congress demanded it be pulled entirely, warning it "dangerously conflate[s] constitutionally protected speech and political dissent with terrorism." And the lawsuits over the surveillance itself are still active — the CAIR fight in Florida shows this isn't settled, it's ongoing.

What this piece is not saying

This isn't saying the order caused Renée Good's or Alex Pretti's deaths — both came from a separate immigration operation that started months after the order was signed. It's only saying the protests after those deaths are part of what got surveilled under this order. It isn't saying the AFL-CIO, the Sunrise Movement, either union, or that bike shop did anything wrong — showing up on a government list isn't a charge, and none of them have been charged with anything. It isn't taking a position on whether the people convicted in the Texas ICE-facility case are guilty — that's a matter of court record, reported here as an outcome, not a verdict this desk is passing judgment on. And it isn't saying Jonathan Ross has been charged or disciplined for shooting Renée Good — he hasn't been. He's named here because multiple news outlets already publicly identified him, not because this piece is accusing him of a crime. And it isn't saying federal agents did anything wrong when they visited Ed Choi, or confirming why they came — this desk has only Choi's own account of that, repeated by one outlet, not independent government confirmation of it.

What can I do

There's no settings menu that fixes a national security order. What's real: 31 members of Congress already went on record demanding this be pulled, and a federal court already blocked one specific abuse of it (the CAIR case in Florida) — meaning pressure and lawsuits are actually moving, not dead ends. If you're part of a union, nonprofit, or advocacy group that could be touched by this, the ACLU has published specific guidance for what local officials can do to push back, and groups like Charity & Security Network and Protect Democracy are tracking new enforcement actions as they happen.

Why this is a BL:UF story

A policy gets sold on what it promises. This is what it actually did: a union with millions of members and a bike-repair shop on the same government "conspiracy" list, nonprofits' bank records pulled apart, and a Muslim civil rights group branded "terrorists" by a state government using the same playbook — while the one real terrorism case it produced took years to build and involved actual violence, not a meeting at a union hall. That gap between the sales pitch and the actual target list is the story.

The Receipts