DHS Exempted Itself from Normal Law for Undercover Investigation Into Protesters

Tucked in at the bottom of a bombshell document released last week detailing DHS’ undercover operations in Minneapolis is a curious note.

“This case has also been accepted under CUC Op Keyhole,” it reads.

In Homeland Security Investigations lingo, CUC refers to “Certified Undercover” (CUC) operations in which DHS — typically in consultation with the Justice Department — grants agents and informants authorization to engage in otherwise illegal activities as part of the investigation. A CUC also exempts the agencies from laws that would typically prohibit them from actions like creating shell companies, setting up fake bank accounts, and other types of aggressive investigative steps.

These authorities are typically granted for operations against drug cartels, international money launderers, and other dangerous targets of federal law enforcement, experts told TPM. Now, the Minneapolis documents show, HSI is deploying these tactics against protesters using their First Amendment rights to oppose the Trump administration. Undercover agents monitored a No Kings Rally, a protest of the Iran War, and entered a local church in which a court had barred DHS from conducting some investigations. It’s part of a broader effort that the federal government launched after the killing of Charlie Kirk to criminalize opposition to the president, enlisting terrorism and anti-gang laws and tactics against non-violent protesters.

It’s a break from decades of precedent in HSI’s focus, John Tobon, a former HSI Special Agent in Charge in Honolulu who retired in January 2025 as Assistant Director of the Countering Transnational Crime Division, told TPM. Though it’s attached to immigration enforcement, HSI has traditionally investigated a wide range of federal crimes, including drug trafficking, money laundering, child abuse rings, large-scale immigration fraud, and more.

“In my 30 years, the only time that HSI has been tasked with investigating assaults on a federal officer has been during the first Trump administration and during this Trump administration,” Tobon told TPM.

Former HSI officials told TPM that a Certified Undercover operation typically works as an umbrella for several different investigations that exist within it. It’s not clear what investigations “Op Keyhole” covers, though investigations involving undercover agents in the Twin Cities and financial transactions by labor unions were incorporated into Keyhole, the filings said.

“HSI does not comment on the existence or status of specific on-going investigations, nor on investigative methods,” a DHS spokesperson told TPM in a statement.

There’s also typically a high level of oversight from DHS and DOJ headquarters during these operations. Opening a Certified Undercover operation requires approval from senior agency officials — the deputy attorney general has to advise on it, former HSI officials told TPM. Under previous administrations, agents have been expected to regularly write reports to Washington; boards at DHS headquarters periodically review elements of undercover operations.

The investigations into Minneapolis protesters ramped up in March, filings show. Since then, the DOJ has also run an initiative called Joint Task Force Vanguard, which reported to then-Deputy Attorney General Todd Blanche, now the Senate-confirmed attorney general. Vanguard is the task force through which federal prosecutors are implementing National Security Presidential Memorandum 7 (NSPM-7), the September 2025 White House directive to law enforcement to treat progressive beliefs as indicators of domestic terrorism.

The HSI documents that mentioned “Op Keyhole” were released in a prosecution brought by Vanguard that locals have come to call the “Minneapolis 15.” There, federal prosecutors brought conspiracy charges against 15 Minneapolis protesters, dubbing them “antifa” members and accusing them of attempting to impede federal operations. There’s no claim of an injury to any officer; one defendant is accused of side-swiping a government car with her vehicle; another is accused of swatting a notebook out of a federal officer’s hands.

The DOJ installed two prosecutors with backgrounds in counterterrorism and organized crime investigations to run Vanguard, TPM was first to report. Both specialties involve extensive use of undercover informants. One of the co-directors, a longtime organized crime prosecutor named Brian W. Lynch, marched on the Capitol on January 6, TPM exclusively reported.

These tactics may have landed HSI in hot water in Minneapolis.

Per a filing released last week by attorney Kevin Riach in the “Minneapolis 15” case, an undercover agent attended a meeting put on by a group called Left Jab at University Baptist Church (UBC) in Minneapolis in May. Left Jab described itself on a GoFundMe page as an “anti-racist, queer friendly, *always free* and beginner oriented, Mixed Martial Arts class” focused on “Personal and Community Self Defense.”

An HSI report that Riach released described an agent attending a sparring session, saying that it was part of an investigation into impeding law enforcement and assaults on federal officers. After the agent left the class and the church, she realized that she had dropped her surreptitious recording device on the floor of the church’s gym, according to the report. She returned to pick it up.

For DHS, conducting that kind of surveillance at UBC could mean more trouble. In February, a federal judge issued a temporary injunction forbidding DHS from taking actions “in whole, or in part, to enforce the immigration laws” at a group of Baptist churches, in which UBC was included. The injunction barred DHS from conducting “arrest, seizure, search, interrogation, questioning, interview or investigation” while enforcing immigration law.

In a Thursday court filing, UBC argues the Left Jab surveillance broke the court’s order. Exhibits filed in court showed instances of surveillance outside the church three other times in April and June; they filed pictures of a large sign outside the church reading “FEDERAL AGENTS NOT PERMITTED ON PREMISES.”

Attorneys for religious groups in the injunction case asked a judge on Thursday to determine whether DHS violated the order and should be held in contempt.

Emails filed in that case show that DOJ admitted that the HSI reports that Riach released “were accurate,” per an exchange with trial attorney Cody Giles.

“The HSI investigations were not planned nor undertaken to enforce the immigration laws of the United States,” Giles wrote, arguing that the surveillance did not violate the court order. Giles cited HSI memos saying that the investigations were focused not on immigration enforcement, but on assaults on federal law enforcement and impeding federal operations. He also declined a request from attorneys for the churches for information about other investigations that may have taken place at UBC after the injunction went into effect.

Kevin Friedl, an attorney for Democracy Forward on the case, replied that he believed “these were clear violations of the order.”

“We are also extremely disturbed by DHS’s refusal to confirm whether it has conducted additional enforcement operations at the church,” he wrote.

House Democrats have begun to respond to the mounting revelations around how NSPM-7 has prompted government surveillance on protesters. In a letter released on Tuesday, more than two dozen House Democrats led by Reps. Delia Ramirez (D-IL), Jim McGovern (D-MA), and Ayanna Pressley (D-MA)asked the Secretary of State Marco Rubio and Treasury Secretary Scott Bessent to provide details on how it’s being implemented.

“Defining political opposition as an existential threat does not make communities safer — it degrades civil liberties, expands state surveillance, enables violence by state actors, and mirrors the repressive tactics of authoritarian regimes worldwide,” Ramirez wrote.