ICE relies on covert browsing infrastructure to monitor online activity

Immigration and Customs Enforcement (ICE) has built a covert browsing capability that allows investigators to monitor social media, online communities and dark web forums without revealing a government presence, according to a leaked internal inventory and federal procurement records.

The documents show ICE using “managed attribution” platforms that conceal investigators’ identities, locations and technical fingerprints as part of a broader surveillance architecture for identifying, analyzing and preserving online activity.

Managed attribution does more than shield federal computers from malware. It allows investigators to construct plausible online identities, control what websites see, and maintain those identities over time without exposing an ICE network, government device, or federal law enforcement presence.

Two platforms stand out in the May 2024 inventory prepared by the HSI Office of Intelligence. Authentic8’s SILO has a documented ICE purchasing history stretching across multiple contracts and vendors.

Chameleon, described as supporting anonymized investigations, undercover activity, and long-term evidence collection, was available through HSI’s analytical environment, although the contract that placed it there remains hidden from public view.

Together, the systems form a concealed browsing layer within ICE’s broader investigative architecture.

Social media monitoring and analytical tools can identify the account, community, or person investigators want to examine. SILO and Chameleon allow agents to enter those spaces without being recognized as federal investigators.

A surveillance capability grows

The scale of the investment has grown. On September 11, 2025, ICE awarded Slam Technical Services a contract to provide SILO licenses for the HSI Office of Intelligence.

Public spending records show approximately $457,000 obligated under an award that could reach $1.47 million if all options are exercised.

Less than two weeks later, President Donald Trump signed National Security Presidential Memorandum 7 (NSPM-7), directing a government-wide campaign against domestic terrorism and organized political violence.

The proximity of those developments does not establish that the SILO contract was awarded to implement NSPM-7. It does, however, show that when the administration expanded its domestic security initiatives, ICE already possessed an expanding infrastructure capable of quietly monitoring online activity without revealing who was watching.

NSPM-7 focuses on violence, threats, property destruction and other criminal conduct, while directing agencies to identify the individuals, organizations and networks associated with political violence. In that environment, managed attribution gives investigators a way to enter online communities and conduct research without disclosing their identity or affiliation.

How managed attribution hides the watcher

As a remote browser isolation platform, SILO executes web content inside Authentic8’s cloud environment rather than directly on an investigator’s computer.

The user receives a streamed interface while potentially malicious code remains separated from the government device.

That architecture protects investigators from malware and restricts the uncontrolled movement of information. It also provides concealment.

Websites do not see the investigator’s local network, ordinary device configuration, or authentic browser fingerprint.

The environment can be configured to present a different technical profile and apparent location, allowing investigators to enter social media platforms, geographically restricted services, or dark web forums without immediately signaling a connection to federal law enforcement.

Managed attribution goes beyond using a virtual private network. A credible online identity depends on consistency. Its network location, browser characteristics, operating system signals, cookies, and account history must fit together over time.

A persona that appears to log in from one type of device in one city and then abruptly reappears with an incompatible browser profile somewhere else may trigger automated security systems or alert the people being investigated.

Platforms such as SILO are designed to manage those details so an investigative identity can persist without attracting suspicion.

SILO becomes institutional infrastructure

ICE’s public SILO purchasing trail extends back at least to 2020, when the agency placed an order through Panamerica Computers. A 2021 award expressly identified Authentic8 SILO software licenses and included an August. 17 transaction for $31,773.

ICE later moved the licensing work to Slam Technical Services. A 2022 delivery order paid $37,014 for a one-year renewal running from September 2022 through September 2023.

Those purchases were comparatively modest. The September 2025 award was an order of larger magnitude and placed SILO directly inside HSI’s national intelligence organization.

The progression suggests that managed attribution had moved from a specialized investigative tool into institutional infrastructure.

Chameleon appears beside SILO in the May 2024 inventory, but the two systems were provisioned differently.

Personnel seeking SILO and several other commercial services were directed through ICE’s STAR account process. Access to Chameleon was handled through the agency’s Repository for Analytics in a Virtualized Environment.

RAVEn is HSI’s centralized analytical ecosystem for storing, searching, and analyzing investigative information. It replaced the earlier FALCON environment and includes capabilities for email and mobile device analysis, geospatial mapping, lead management, and the processing of tips and other investigative records.

The inventory describes Chameleon as a platform for online investigations, web research, and undercover activity that provides anonymization, managed attribution, and data collection capabilities. It also supports long-term evidence collection.

That establishes that HSI possessed access to the technology. The inventory does not identify the manufacturer, contract number, or purchasing office responsible for acquiring it.

No publicly available ICE award reviewed identifies Chameleon by name. The strongest evidence about its likely supplier comes instead from the Drug Enforcement Administration (DEA).

A Justice Department acquisition forecast expressly identified a continuing DEA requirement as “Ntrepid, LLC/Project Chameleon” and listed delivery order 15DDHQ23F00000286 as the incumbent contract.

DEA awarded the order to Ntrepid in September 2023 for system support. Federal spending records show approximately $2.52 million obligated, while procurement records place its potential value at about $2.56 million.

The relationship continued through bridge arrangements and a new competition.

On July 2, 2026, DEA issued a solicitation formally titled “Managed Attribution Systems (Chameleon).” It sought an agency-wide system allowing investigators to conduct secure online research and collect evidence while concealing their government networks, devices, and identities.

ICE has separately contracted with Ntrepid. A federal contracting data service lists purchase order HSCETE16P00050 as a $221,589 acquisition by ICE’s Information Technology Division but describes the product only as “software.”

The record does not provide a statement of work, line-item description, or other documentation identifying what ICE purchased. The overlap is significant but not conclusive.

Ntrepid is the confirmed provider of DEA’s Project Chameleon, ICE separately bought software from Ntrepid, and HSI later listed Chameleon among the tools available through RAVEn.

No document reviewed expressly connects the ICE purchase order to the platform.

ICE may have acquired Chameleon under that order, through a reseller, or as part of a broader RAVEn contract. The agency could also have obtained access through an interagency arrangement. Those remain possibilities rather than established facts.

The technology was already known elsewhere within the Department of Homeland Security (DHS). A 2017 Federal Protective Service privacy document said investigators would use non-attribution services including Anonymizer and Chameleon during criminal investigations and undercover online activity so those operations could not be traced to the department.

The contracting uncertainty illustrates a recurring problem surrounding government surveillance technology. Product names can disappear behind generic descriptions, reseller agreements, and larger analytical platform contracts.

A system may become operational even as the public record obscures who supplied it, how much it cost, and which office controls access.

The systems that find the target

SILO and Chameleon should also be distinguished from the systems that collect, search, and analyze online information.

The HSI inventory lists SocialNet, Fivecast ONYX, and Cobwebs, which gather publicly available information and map relationships among accounts, aliases, and other identifiers.

ICE has also used Giant Oak Search Technology (GOST), a social media and identity screening platform whose analytical methods grew out of Defense Advanced Research Projects Agency-funded military intelligence research in Afghanistan.

Saifr acquired GOST in February, 2024.

Giant Oak later adapted similar behavioral science and machine learning techniques into a commercial system for searching online information and identifying links among people, accounts, and records.

ICE awarded Giant Oak a 2017 indefinite-delivery contract for open source and social media analytics with a potential ceiling of $37 million.

Federal records show approximately $7.8 million was obligated under the vehicle through August 2022, distributed across numerous delivery orders.

Other ICE contracts funded earlier data analysis and threat monitoring services.

These systems perform complementary functions. GOST, SocialNet, Fivecast, and Cobwebs can help analysts identify the person, network, or online space they want to examine.

SILO and Chameleon let them conduct that examination without disclosing that the visitor is the government.

Information found through covert browsing can then be evaluated against records already held in immigration, investigative, or commercial databases. It can be preserved as evidence, entered into case management systems, or used to generate additional leads.

The capability has developed alongside a broader institutional expansion of ICE’s online monitoring.

WIRED reported in October 2025 that ICE was seeking contractors to support a round-the-clock social media surveillance program from targeting centers in Vermont and California.

The planned teams were expected to scan Facebook, TikTok, X, and other platforms to identify and locate people for enforcement action.

That expansion changes the significance of tools such as SILO. A managed-attribution browser used by a small investigative team in a limited criminal case is one thing. The same infrastructure supporting national targeting centers, contractor workforces, and continuous social media review creates a much larger surveillance environment.

Rules written inside the department

Internal DHS records released through the Freedom of Information Act show how ICE has attempted to govern this activity.

Department components used Social Media Operational Use Templates to explain why personnel wanted to monitor social media, whether false accounts would be used, and how personally identifiable information would be handled.

HSI and ICE’s Office of Professional Responsibility were authorized to interact with people undercover. ICE Enforcement and Removal Operations (ERO) faced tighter restrictions on creating false identities or communicating surreptitiously.

Internal emails from 2019 nevertheless showed that ICE’s Combined Intelligence Unit, staffed by both HSI and ERO personnel, wanted SILO accounts for field intelligence officers.

The unit proposed using “program accounts” to examine publicly available social media before and after interviews with people in ICE detention and to compare online information with what detainees said.

The records do not conclusively establish whether that particular proposal was approved. The contracting trail does establish that ICE repeatedly purchased SILO, while the leaked inventory shows that the platform was available through a formal account access process by May 2024.

The risk of treating managed attribution as neutral background infrastructure had already surfaced elsewhere in government.

A July 2021 investigation by Republican minority staff of the Senate Committee on Commerce, Science, and Transportation found that the Department of Commerce Investigations and Threat Management Service (ITMS) had sought fiscal 2021 funding for Authentic8’s SILO Toolbox.

The report described ITMS as having evolved into what investigators called “a proxy spy unit operating outside the Intelligence Community.”

It said SILO was intended “to assist government agencies with intelligence and evidence gathering, as well as undercover operations, by providing a global cloud-based infrastructure for controlling multifaceted databases.”

The report said investigators could not determine whether ITMS received the requested funding. Procurement records show, however, that the Commerce Department had already placed a $19,030 order through Slam Technical Services in January 2020 for a SILO Toolbox renewal.

The available record does not identify ITMS as the user. It confirms a Commerce purchase, but not that the controversial unit itself operated the platform.

The distinction is important because ITMS was already monitoring online speech.

Senate investigators found that the unit tracked social media accounts critical of the 2020 Census, recorded posts in a Social Media Tracker, and reportedly searched many account holders through classified databases while attempting to associate their comments with foreign disinformation.

Officials ultimately concluded that the posts were protected speech and did not pose a national-security threat.

The case demonstrated how surveillance initially justified by security concerns can move toward monitoring criticism and political expression, particularly when the systems, authorities, and approval processes remain largely concealed inside an agency.

Oversight follows the data, not the tool

The murky nature of the infrastructure also helps explain why privacy oversight is difficult to follow.

DHS policy requires programs involving personally identifiable information to undergo a Privacy Threshold Analysis. The Privacy Office then determines whether a more detailed Privacy Impact Assessment (PIA) or coverage under a System of Records Notice (SORN) is required.

SILO is not primarily a database. DHS can therefore treat it as access infrastructure rather than as a surveillance system requiring a standalone public assessment.

Public DHS privacy postings do not appear to include a SILO-specific PIA or SSORN. Nor does there appear to be a public ICE assessment of Chameleon by name.

Instead, oversight is pushed downstream into the activity conducted through the browser and the systems where the information is eventually stored.

That approach may comply with existing privacy procedures, but it leaves the public with little information about how frequently managed attribution is used, which units receive access, how long online personas persist, or what information is retained after an investigation ends.

It also allows Congress to examine surveillance technologies one product at a time without confronting the larger system that connects them.

The analytical platforms identify the person. The monitoring tools find the account or community. Managed attribution places an investigator inside that environment without revealing a government presence.

Case management and intelligence systems preserve what the investigator finds and connect it to other records.

What emerges is not a single surveillance database, but an architecture in which separate tools can function as parts of the same investigative process.

The browsing itself can be concealed. The contracting pathway can be concealed. And the standards governing how the technology is used remain largely internal.

The result is an expanding capability governed mainly by agency approvals and policy, with Congress and the public learning how it operates through leaked inventories, fragmented procurement records, and sporadic Freedom of Information Act disclosures.

Article Topics

DHS  |  government purchasing  |  ICE - U.S. Immigration and Customs Enforcement  |  law enforcement  |  national security  |  surveillance  |  U.S. Government