Leaked ICE inventory maps sprawling surveillance and analytics ecosystem

A leaked U.S. Immigration and Customs Enforcement (ICE) document offers one of the clearest views yet of how investigators can move from a name, face, telephone number, or location to a much larger body of information drawn from immigration files, commercial databases, travel records, financial reports, social media, and vehicle-tracking systems.

The 12-page inventory, dated May 2024, and marked “Unclassified/Law Enforcement Sensitive,” was produced by the Homeland Security Investigations (HIS) Office of Intelligence. It lists 115 named systems and services across 11 categories, along with brief descriptions of their purposes and instructions for obtaining access.

The document does not describe a single master database. Instead, it depicts an access environment in which ICE personnel can request entry to a broad range of government and privately operated systems and then bring information from those systems into common investigative, mapping and link analysis tools.

404 Media, which obtained and published the document, said it is unusual to see so much of ICE’s technological capacity gathered in one place.

A Department of Homeland Security spokesperson told the publication that ICE, like other law enforcement agencies, uses technology to investigate criminal activity and support law enforcement operations.

The inventory is now more than two years old and cannot be treated as a current or exhaustive accounting. Some subscriptions may have expired, systems may have been replaced, and newer capabilities do not appear.

But it provides a baseline showing that much of the infrastructure supporting ICE’s current data-driven enforcement operations was already in place before the second Trump administration began expanding immigration enforcement.

Tools for assembling a person

The most consequential part of the inventory may be its group of “primary cross-purpose systems,” which can connect information from otherwise separate sources.

Accurint, a LexisNexis public records service, is described as allowing investigators to search people, addresses, businesses, telephone numbers, and criminal records.

The results can be imported into visualization systems for mapping and link analysis.

Whooster, another commercial service, is described as providing real-time person and telephone information by using proprietary algorithms to link and match billions of public, private, and telephone record datasets.

ICE’s Investigative Case Management (ICM) system allows users to query people, vehicles, businesses, cases, and arrests.

The inventory says ICM can also access the Federal Bureau of Investigation’s FBI’s National Crime Information Center and the National Law Enforcement Telecommunications System, although separate credentials and permissions are required.

Together, these systems provide the connective tissue for investigations. A telephone number can lead to an address, an address to a vehicle, and the vehicle to travel patterns or associated people.

The document does not establish that every source is automatically fused or continuously updated, but it shows that ICE had tools for bringing their results into a common investigative workflow.

That finding reinforces the central argument of a privacy coalition report examined by Biometric Update in June.

The report argued that the most important concern is not any individual face, fingerprint, or iris system, but the ability to connect biometric identifiers with immigration records, social relationships, location histories, and commercial data.

RAVEn provides an internal analytical layer

The inventory devotes substantial space to RAVEn, an HSI analytical environment developed before ICE expanded its relationship with Palantir Technologies.

RAVEn CORE is described as a repository for criminal analytical tools. Other components support email analysis, mobile device extraction, lead tracking, and the receipt of tips from the public.

RAVEn IGP, ICE’s geospatial platform, allows personnel to identify patterns and trends by plotting events across location and time.

The document states that this component was available to all ICE employees. ICE also has said it is available internally to ICE employees via the Homeland Security Investigations Innovation Lab framework.

RAVEn Mobile Device Analytics can search information from multiple cellphone extractions and display connections among the recovered records.

The result is not simply an archive. It is a collection of tools capable of turning raw records into maps, networks, and investigative leads.

RAVEn does not appear to be the endpoint of that development. Subsequent reporting has documented ICE’s use of Palantir’s ELITE application to display potential enforcement subjects on a map and assign confidence scores to addresses.

Palantir has also worked on ImmigrationOS, which is intended to support lifecycle tracking, prioritization and enforcement operations. Neither ELITE nor ImmigrationOS appears in the 2024 inventory.

Facial recognition and biometric identification

The document lists Clearview AI under miscellaneous systems, saying facial recognition licenses were controlled by an ICE unit and access was granted under specific circumstances.

Other entries include EDDIE, described as a biometric processing system used by ICE Enforcement and Removal Operations to identify people, and DAVID, a photograph lineup application used in law enforcement situations.

The immigration systems section includes databases holding citizenship and immigration records, visa information, photographs, removal data, and digitized immigration files.

CIS2, for example, contains immigration records and identifiers and incorporates data from the ENFORCE Alien Removal Module and Employment Authorization Document system.

The inventory does not show Mobile Fortify, the NEC-powered application that has since allowed ICE and Customs and Border Protection officers to collect faces and other identifying information in the field. Nor does it include ICE’s later iris-recognition contract with BI2 Technologies.

Biometric Update previously reported that Mobile Fortify is connected to a much larger DHS identity ecosystem and that ICE has considered extending mobile facial recognition to state and local officers operating under its 287(g) agreements.

The application therefore represents an evolution from the fixed and database-oriented capabilities shown in the inventory toward biometric identification during street-level encounters.

Location data and vehicle movements

The document shows ICE personnel could request access to several tools capable of reconstructing physical movement.

Locate X is described as allowing investigators to draw a digital boundary around an address or area and identify mobile devices that were present there using commercially obtained mobile data.

The tool, made by Babel Street, has drawn scrutiny because its underlying information can originate with ordinary smartphone applications and the digital advertising industry.

Cobwebs provides automated collection of publicly available information combined with risk analysis and network visualization. Its Webloc capability has been associated with searches of advertising-derived cellphone location records.

The inventory also includes the Law Enforcement Archival Reporting Network, which compiles data from fixed, portable, and vehicle-mounted automated license plate readers.

The Drug Enforcement Administration’s National License Plate Reader Program provides another tactical alert and query system, while ISO ClaimSearch adds vehicle and insurance claim information.

The combination can allow investigators to connect a person to a vehicle, identify where that vehicle has been recorded, and compare those movements with addresses, associates, or other investigative events.

Biometric Update reported this month that the Bureau of Alcohol, Tobacco, Firearms and Explosives canceled its Webloc contract after congressional scrutiny, even as ICE continued exploring commercial advertising and location data services.

ICE’s interest shows that the capability represented in the 2024 inventory has not disappeared, even where individual contracts or vendors have changed.

Social media and undercover online investigations

ICE’s online capabilities extend beyond reviewing public posts.

SocialNet is described as gathering open source and social media information, capturing digital traces, mapping aliases, and exploring connections in near real time. Fivecast ONYX and Cobwebs collect publicly available information and combine it with network analysis and risk scoring.

Traffic Jam tracks domestic and international online sex advertisements and customer reviews.

The inventory says it uses AI, machine learning, geospatial mapping, and facial information to identify people and groups.

Travel, financial and intelligence records

The travel systems section describes access to the proprietary Travel Intelligence Program database, which the document says contained more than one billion records covering 39 months of past and future commercial airline travel.

Other systems provide arrival and departure records, visa and passport data, passenger and vehicle information at land border crossings, aviation registrations, and commercially available satellite, vehicle, and maritime datasets.

Financial tools include access to Financial Crimes Enforcement Network reports, the Data Analysis and Research for Trade Transparency System and the Southwest Border Transaction Record Analysis Center.

These sources can expose bank suspicious activity reports, currency transaction records, and cross-border trade or money transfer patterns.

The inventory also points ICE users toward federal and regional information sharing environments, court records, state corporate databases, military records, sanctions information, and municipal data services.

Access to each system may be governed by separate rules, agreements, and credentials, but the catalog makes them visible as parts of the same investigative landscape.

STAR appears to manage access rather than investigative data

The document also sheds light on STAR, which appears repeatedly in the “Request Access” column.

ICE personnel are directed to submit a “STAR Account Access Request” for systems including Accurint, Locate X, SocialNet, LEARN, and Panjiva. That pattern supports the description of STAR as a centralized account provisioning or access gateway.

The document does not spell out the acronym, describe STAR as a repository, or support the claim that STAR itself performs tracking and identity resolution. Instead, it appears to be one mechanism through which authorized personnel seek access to systems that perform those functions.

A snapshot of an expanding system

The inventory should not be read as proof that every ICE employee has unrestricted access to every system. Some tools require separate accounts, unit approval, or active credentials from other agencies.

Clearview access, for example, is described as limited to specific circumstances.

Nor does the document show how frequently each system was used, what legal process was required for a search, or how results were validated before enforcement action.

What it does show is the breadth of the architecture available to ICE investigators and the number of ways that information can be carried from one system into another.

The leaked inventory documents the middle layer that makes the larger system possible – the access routes, commercial subscriptions, and analytical platforms through which a face, telephone number, vehicle, or address can become the starting point for assembling a much more extensive picture of a person.

Article Topics

BI2 Technologies  |  biometric identification  |  biometrics  |  Clearview AI  |  facial recognition  |  ICE - U.S. Immigration and Customs Enforcement  |  location data  |  Palantir  |  surveillance  |  U.S. Government