Surveillance
Identifying and pursuing enemies of the state starts with surveillance. ICE is well equipped.
Since the beginning of the second Trump administration, DHS has been on a tear, acquiring brand new technologies to greatly expand its surveillance capabilities. The kinds of tools recently made available to ICE have potential applications which far exceed any rationale for their use and necessity in immigration law enforcement.
The agency is hardly strapped for cash. The One Big Beautiful Bill Act (OBBBA), passed in July 2025 with the exclusive approval of Congressional Republicans enormously expanded funding for ICE, raising its annual budget to $11.8 billion with an additional $75 billion for discretionary spending between 2026 and 2029. Overall, DHS received an extra $170 billion in funding through the OBBBA, with $16 billion of that set aside for spending on technology. DHS’s budget for FY2026 stands at $350 billion.
Data analytics
Palantir provides the backbone of ICE’s mass surveillance apparatus. It has assisted US intelligence for 20 years, starting with the CIA in 2005, and has worked with DHS on several occasions since 2011. Data brokers and spyware tools supply ICE with secrets, but information gleaned from even the most insidious sources is of limited use without structure. Palantir helps ICE make sense of its data with custom-made tools that converge those information streams into massive databases and turn their contents into actionable field operations strategies.
In short, Palantir serves the police state by streamlining the data analysis process and freeing up ICE’s resources and manpower to destroy democracy with maximal efficiency.
On February 12, 2026, DHS essentially wrote Palantir a blank check for $1 billion.
Investigative Case Management (ICM) system
The Investigative Case Management (ICM) system was the central data management and analysis, information sharing, and case management tool used by ICE and developed by Palantir beginning in 2014. The system was designed to enhance information access, investigative efficiency, and collaboration. Its sprawling database consolidates records from across DHS and includes data shared by other federal law enforcement agencies like the FBI and CIA, partnered state and local police departments, government agencies not engaged in law enforcement, state DMVs, and obtained through private businesses like data brokers and data intelligence firms. The vast size and scope of the ICM database allows ICE to assemble highly detailed dossiers on its targets, build case files, and connect them with other DHS investigations. Though it was initially conceived to be used predominantly by HSI, ICM was quickly incorporated into the workflows of other ICE divisions, and accessed frequently by personnel from other DHS agencies. The ICM system has ostensibly been replaced by ImmigrationOS.
ImmigrationOS
In April 2025, ICE awarded Palantir a $30 million contract (70CTD022FR0000170 (P00009)) to create ImmigrationOS, a custom data management platform that helps the agency identify targets, build dossiers on them, and plan operations. ImmigrationOS serves DHS’s broader effort to maximize and diversify its data collection strategies by pulling together massive quantities of data gathered from countless public and private sources and funneling them into a central repository. The software sifts through the DHS database, organizes its records for easy access, and analyzes the information to generate leads, plan enforcement operations, and coordinate deportations.
Little else is known about how ImmigrationOS works, how it’s being used, or what it’s capable of. What we have learned about it comes from information revealed in government contracts, leaked internal documents and communications from ICE and Palantir, and court filings from lawsuits against ICE.
In the limited-sources justification document for the Palantir contract, ICE lays out the following objectives for ImmigrationOS:
Targeting and Self-Deportation capabilities, continue to refine the deployed operational solutions that streamline identification of aliens who are out of status, prioritize based on risk factors, provide targeting data to the field in support of daily apprehension operations and informed custody determinations, and track the status of deported aliens, allowing for Officers and Agents to have real time data in the field. This operational capability is critical to current mandated Mission operations and allows for the streamlined selection and apprehension of illegal aliens based on ICE enforcement priorities—especially affiliates of known transnational criminal organizations (TCOs), violent criminals, and visa overstays, and accurately report metrics of alien departures from the United States.
Enhance and continue to support the End-to-End Immigration Lifecycle operational solutions to make optimized, resource-informed decisions ot manage the status and movement of aliens. These solutions are critical to current mandated mission operations to support a streamlined end to end immigration lifecycle from identification to removal, with increased efficiency in deportation logistics, minimizing time and resource expenditure, and increased efficiency in the management of the overall immigration status and history of a person through their immigration lifecycle.
Interestingly, the limited-sources justification says that the previously existing ICM system already provided the capabilities required to fulfill EO14159.
ICE currently employs Palantir’s commercial software as the Investigative Case Management (ICM) System. This proprietary product of Palantir has already been configured specifically for ICE’s operational needs and meets all critical requirements required by Executive Order 14159 - Protecting the American People Against Invasion.
The ImmigrationOS project is less of an overhaul of the ICM system than it is an expansion intended to supercharge its data collection and analysis capacities for more precise and efficient targeting.
The ICM System provides seamless data integration, advanced analytics, and case management capabilities that are essential for supporting complex investigative operations. This integration enables ImmigrationOS to deliver unparalleled data-sharing capabilities, streamlined workflows, and enhanced decision-making tools, allowing ICE to more effectively manage immigration enforcement and investigative activities while ensuring operational efficiency, data accuracy, and compliance with federal security and privacy requirements.
Enhanced “data-sharing” and “decision-making tools” are particularly salient features given ICE’s recent scramble for private data and the rapid growth of the network of state and local law enforcement agencies partnered with ICE through 287(g) agreements.
Enhanced Leads Identification & Targeting for Enforcement (ELITE)
To see what Palantir’s project looks like in practice, we can turn to Enhanced Leads Identification & Targeting for Enforcement (ELITE), a tool quietly developed for ICE under its ImmigrationOS contract (70CTD022FR0000170 (P00012)). ELITE provides officers in the field with a searchable list of potential targets and their suspected locations shown as markers on a heat map. They can filter their searches by age, race, location, legal status, or unique identifiers like A-Number. The software’s “Geospatial Lead Sourcing” feature allows officers to narrow their search to within an area they’ve selected on the map. When a user selects a marker on the map, a dossier for the associated target appears containing the individual’s photo, biographical information, and their suspected address with a confidence score indicating its accuracy. ICE decides where to focus its operations using the ELITE map to identify neighborhoods with the highest densities of potential targets.
Social media monitoring
The Trump administration is openly leveraging the power of federal law enforcement against its opponents to criminalize dissent and cow resistance. ICE is keen to help—the agency has been investing heavily in technologies that monitor online activity and track the behavior of individual Internet users. ICE says its surveillance of online social networks is intended “to identify potential threats against the agency, its personnel and facilities,” though in practice, it’s targeting users who merely express their disapproval of ICE's conduct. In fact, ICE is issuing thousands of administrative subpoenas to web and social media companies like Google and Meta demanding them to disclose the identities and user data of individuals who criticize DHS and the Trump administration online.
Zignal Labs
In September 2025, DHS signed a five-year, $5.7 million contract to license Zignal Labs’ social media monitoring software. Zignal Labs uses artificial intelligence to sort through troves of social media content—it says as many as 8 billion posts each day—and identify material that its law enforcement clients find threatening. The company has previously worked with the Secret Service, the Marines, the Department of State, and the Israeli Defense Forces. This most recent procurement provides ICE Homeland Security Investigations (HSI) with “real-time data analysis for criminal investigation" using Zignal Labs’ software. Of course, it’s impossible to separate the Zignal Labs contract from the broader context of ICE’s ongoing efforts to silence dissidents online and in the streets using sophisticated surveillance technologies. A service capable of monitoring social media activity en masse to sniff out instances of, say, “anti-law enforcement” rhetoric online, is perfectly suited to assist an autocratic government intent on eliminating opposition.
Remote access spyware
Graphite
Paragon is an Israeli cyber-intelligence company founded by former Israeli Prime Minister Ehud Barak and a former commander of the IDF’s Unit 8200, Ehud Schneorson The company is best known for its flagship spyware product, Graphite, which is capable of breaking into any smartphone and accessing all of its encrypted and unencrypted data. Graphite is a so-called “zero-click” spyware, meaning it can be installed on a target’s device without any interaction from them at all. They don’t have to click a link or download a file—often just receiving a malicious message is enough for this kind of spyware to be deployed. Graphite can remotely access all the data stored on a device, including messages, photos, location services, and even encrypted WhatsApp messages. It can also activate the device’s camera and microphone to effectively spy on its owner.
In late 2024, ICE awarded Paragon a $2 million contract to license Graphite for two years. However, Graphite’s deployment was initially paused awaiting review of its compliance with an executive order limiting federal use of spyware technologies that threaten national security or have been used by foreign governments for political repression. The hold was lifted in September 2025, and Graphite is currently available to ICE. Paragon has previously worked with US federal law enforcement, providing Graphite to the Drug Enforcement Agency (DEA) in 2022.
In 2024, an investigation by the Citizen Lab discovered that Graphite was used to target several Italian journalists and activists. The Italian government denies it spied on them, though Paragon quickly cut ties with its Italian customers after details of the investigation became public in February 2025. Similar spyware tools from Paragon’s competitors, particularly NSO Group, are implicated in several high-profile cases of violence and human rights abuses against journalists, activists, and members of civil society perpetrated by authoritarian regimes around the world.