Operation Puppet Master Was Accepted Under 'CUC Op Keyhole' — A Certified Undercover Operation of Undisclosed Scope

Opening

The Operation Puppet Master case-opening report closes with one sentence that the Minnesota surveillance coverage has almost entirely passed over:

“This case has also been accepted under CUC Op Keyhole.”

Verified directly in our archived copy of the primary document (Doc. 212-1, text layer, not OCR). The same page records that AUSA Kristian Weir accepted the investigation for federal prosecution.

If Keyhole is what HSI’s own terminology says it is, Puppet Master is not the program. It is one investigation inside a program.

What “CUC” means

“CUC” is ICE terminology for Certified Undercover Operation — not a case, but a formally administered framework through which individual investigations are authorized, funded, equipped and managed.

ICE’s Undercover Operations Handbook (April 14, 2008, public) describes what a CUC can carry: undercover identities, covert communications, leased surveillance vehicles, recordings, bank accounts, business credit cards, and other technical and operational resources maintained specifically for the operation. Certification requires an Undercover Review Committee and higher-level approval. Individual investigations can be placed within a CUC and draw on its authorization and resources.

So the sentence is not decorative. It states that Puppet Master was slotted into a pre-existing, certified, resourced structure — one whose name, scope, authorization date, and other member investigations are all undisclosed.

Why this is the “much bigger” question

Keyhole’s boundaries are unknown, and that is the finding. DHS has not publicly confirmed Keyhole’s relationship to Puppet Master or Whipple Shield, and no public ICE or HSI document explains its mission. Nothing disclosed so far establishes that Keyhole was a national political surveillance operation — and that must be stated plainly rather than implied.

But three things make the undisclosed boundary consequential rather than merely curious:

1. A certified operation is by construction larger than any one investigation inside it. That is what certification is for. If Puppet Master was accepted under Keyhole, Keyhole predates it and was built to hold more than it.

2. Undercover activity already crossed state lines. The Ann Arbor church operation (2026-04-08–hsi-undercover-operation-zion-lutheran-church-ann-arbor) shows the Minnesota investigation tasking a Michigan field office. Whether that ran on Keyhole’s authorization is not established — but the question is now unavoidable.

3. The undercover presence PREDATES Puppet Master. HSI records show undercover monitoring before the case formally opened on January 28. At a publicly advertised ICEWatch training on December 3, 2025, an undercover agent reported that participants were being taught to document ICE activity, notify others of agents’ presence, and lawfully observe enforcement. An agent later volunteered for an “action” team involved in planning protest activity.

   Point 3 is the structural one. If agents were already inside these groups in December, the January 28 case opening did not start the surveillance — it gave existing surveillance a case number. And the thing that existed before the case number is Keyhole.

The predicate, in the government’s own words

The case-opening report states its purpose without euphemism. It is not opened to investigate a crime. It is opened:

“to document the integration of Homeland Security Investigations (HSI) Undercover Agents (UCAs) into groups, organizations, or other gatherings identified by intelligence information and other sources as potentially threatening to law enforcement”

Note the standard: groups identified by intelligence information as potentially threatening. Not groups suspected of a crime.

The synopsis dates the predicate to “Since November 28, 2026” — an evident typo for 2025, but it places the origin before Renee Good was killed on January 7, 2026, which cuts against the tidy four-days-after-Pretti framing (including in our own earlier entries). The Minneapolis killings accelerated something already running.

The administrative trail that should exist

Certified Undercover Operations are designed to leave records. The handbook describes formal applications, certification memoranda, and periodic review. ICE’s Office of Professional Responsibility said as recently as May 2026 that it conducts biennial financial audits of the agency’s Certified Undercover Operations.

That matters for what can be asked for: Keyhole should not be an ephemeral codename. There should be an application, a certification decision, an authorization scope, financial audit records, and a list of investigations accepted under it.

Defense attorney Kevin Riach has specifically asked the government to produce additional records concerning Keyhole after finding the reference in the case-opening report.

What we do NOT know — state this before publishing

• What Keyhole authorized, when it was certified, and by whom
• What other investigations were accepted under it, in Minnesota or elsewhere
• Whether the Ann Arbor operation, the Clearview searches, or the church recordings ran on Keyhole’s authorization
• Whether Keyhole is regional or national
• Whether the “action team” volunteering constitutes inducement — the records do not establish it

Every one of those is a question the documents raise and do not answer. The honest claim is that the named operations sit inside an unnamed structure, not that the structure is nationwide.

Coverage status

Essentially uncovered. As of 2026-08-20 the Keyhole nesting appears in Biometric Update (2026-08-20, tier 2, a biometrics trade outlet) and a New Republic Substack piece. None of the outlets that broke and drove the Minnesota story — NYT, Guardian, KSTP, Minnesota Reformer, CBS, AP, Democracy Now — has reported it. Credit Biometric Update for surfacing it; the corpus contribution is that we hold the primary document and can verify the sentence directly.

Cross-References

• 2026-08-13–operation-puppet-master-hsi-infiltrates-minnesota-anti-ice-community
• 2026-02-15–project-whipple-shield-hsi-financial-surveillance-minnesota-unions
• 2026-04-08–hsi-undercover-operation-zion-lutheran-church-ann-arbor
• prosecution-as-surveillance-wedge
• criminalizing-dissent-the-descending-gradient
• us-v-sant-0-26-cr-00115-doc-212-full-roi-set