Government Describes CUC Keyhole on the Record: a 2008 HSI St. Paul Funding Vehicle, 77 Investigations

On September 10, 2026 the government filed a supplemental brief (Doc. 263) describing CUC Operation Keyhole on the record for the first time. It came after an August 27 discovery hearing at which, in the government’s own words, “it became clear how important ‘Operation Keyhole’ is to the defendants’ motion for discovery.” The government moved for leave on September 1; Magistrate Judge David Schultz granted it September 2 and set a September 11 deadline.

What the government says Keyhole is. A certified undercover operation administered exclusively by the Special Agent in Charge, HSI St. Paul — whose area of responsibility covers Minnesota, North Dakota and South Dakota, and historically included Iowa and Nebraska. It was first certified on December 22, 2008 by the then-Director of the ICE Office of Investigations, following review by the Undercover Review Committee. Statutory authority is cited to 8 U.S.C. § 1363a and 19 U.S.C. § 2081.

Its function, per the brief, is financial: undercover work “bear[s] higher costs than other investigative activities,” and a CUC lets an SAC office share undercover assets across investigations. The brief’s own section heading states the position — Keyhole “functioned as a funding source, not an investigative tool into Defendants’ Conduct.”

The numbers, all new to the public record:

• 77 separate criminal investigations have been approved under CUC Keyhole since 2008
• Across areas the brief lists as “including but not limited to, narcotics trafficking, child sexual abuse, financial investigations, and counter-proliferation” (an open list; the brief gives no breakdown of the 77 by area)
• Last reviewed by the URC in June 2026, recertified by the HSI Executive Associate Director on June 29, 2026; next reauthorization due December 31, 2026
• As of that June recertification, six active investigations were using Keyhole — one of them Project Whipple Shield
• Operation Puppet Master was approved for inclusion January 2026; Project Whipple Shield in March 2026
• Puppet Master had already “ceased undercover activity under CUC Keyhole” by the June review

The government states the other five active investigations are unrelated to these defendants and to the targets of Puppet Master and Whipple Shield, and argues that disclosure would endanger undercover agents and informants in those matters. On the law it argues the defendants have shown no materiality under Rule 16, calling the request a “fishing outing into an unrelated operation.”

What this resolves, and what it does not. This corpus recorded in January that Puppet Master was “accepted under CUC Op Keyhole” and flagged the undisclosed boundary as the finding — while stating plainly that nothing established Keyhole as a national political-surveillance operation. That discipline holds up. On the government’s account Keyhole is regional, not national; predates this administration by sixteen years; and is an accounting-and-assets vehicle rather than a program with a political mission. If accurate, the honest reading is that the nesting is less sinister than the sentence made it look, and the corpus’s refusal to overclaim was correct.

Three things nonetheless remain live. First, this is the government’s characterization in an adversarial filing resisting discovery, not a produced record — no certification memorandum, reauthorization document or audit has been disclosed. Second, the account is internally notable: an operation certified in 2008 (the brief does not say for what; it lists narcotics, child sexual abuse, financial and counter-proliferation work among its uses) absorbed two domestic political-surveillance investigations in January and March 2026, which is a fact about what the vehicle was used for regardless of what it was built for. Third, Defendant Sant contests the premise of the filing itself — his opposition (Doc. 258) notes that AUSA Tory Sailer emailed defense counsel Jill Brisbois on September 1 saying he “looked into this further yesterday and learned to [sic] operational purpose of the Keyhole is not how it was characterized at the hearing,” and argues the government offers no plausible explanation for why this information was unavailable before. Sant has asked for an evidentiary hearing on the scope and purpose of Operation Keyhole; Schultz said he will rule on that request after the supplemental briefing, and gave Sant seven days from the September 10 filing to respond.

The exclusivity claim and the Ann Arbor and Chicago operations. The brief says Keyhole is administered exclusively by the SAC HSI St. Paul (MN/ND/SD). Two Sant exhibits show undercover work outside Minnesota on Minnesota-originated requests: an HSI Detroit Metro Airport agent in a church sanctuary in Ann Arbor, Michigan on April 8, 2026 (case DD02PR26MS0003), and an HSI Chicago undercover operation at an April 2 tour stop (case CH02PR26MS0004, Doc. 297 Ex. J). The case numbers do not settle whether either ran under Keyhole. Each begins with a local office prefix (DD02, CH02) but ends with the Minnesota case’s serial: Ann Arbor’s PR26MS0003 matches Puppet Master’s MS02PR26MS0003, and Chicago’s PR26MS0004 matches Whipple Shield’s MS02PR26MS0004, and Chicago’s report says in terms that it supports “the current Project Whipple Shield investigation.” That pattern suggests the local numbers are collateral cases opened under the Minnesota investigations, not independent Detroit or Chicago investigations, so the numbering does not place either operation outside St. Paul’s CUC. Doc. 263 names only Puppet Master and Whipple Shield as the cases included in Keyhole, and does not mention collateral cases, Ann Arbor or Chicago; whether the collaterals drew on Keyhole funds is not established. No HSI numbering key has been located; this is a reading of the serials, not a fact. See 2026-04-08–hsi-undercover-operation-zion-lutheran-church-ann-arbor and 2026-04-02–hsi-chicago-undercover-operation-breaking-the-ice-tour-co-prosperity-whipple-shield-collateral.

Sourcing note. Every figure and date above is quoted or paraphrased directly from Doc. 263, retrieved from RECAP and read in full (8 pages, 38 occurrences of “Keyhole”). Nothing here is inferred from press coverage. The government’s factual assertions are recorded as its assertions; none has been independently verified against a produced document, and the defense has not yet responded.

Correction note, 2026-10-17. The paragraph on Ann Arbor said the case number put that operation “outside St. Paul’s CUC.” It does not: the serials of the Ann Arbor and Chicago case numbers match the Minnesota cases, and the Chicago report names Whipple Shield (paragraph above, now rewritten). The areas list is also open-ended (“including but not limited to”), and the brief does not say what Keyhole was certified for.