American Dragnet

Since its creation in 2003, ICE has consistently marketed itself as a law enforcement agency that targets “criminal aliens,” a term the agency has used to describe noncitizens who have had contact with law enforcement, regardless of whether they were actually convicted of an offense.36 ICE uses the language of the criminal legal system to defend deportation rhetorically, but it also relies heavily on criminal legal system infrastructure to carry out enforcement operations. Over the last two decades, the immigrant rights movement has done powerful work to reveal the ways that ICE uses police and jails to investigate people for deportation, including through the notorious mandatory fingerprint sharing scheme known as Secure Communities (S-Comm), which established a system by which fingerprint scans taken by state and local law enforcement are automatically compared against a database operated by DHS, alerting ICE to possible immigration violations.37

What has received less attention, however, is ICE’s deployment of a much broader array of data-sharing and data collection programs that amass information from sources outside of law enforcement.38 As cities and states have enacted sanctuary policies limiting law enforcement cooperation with immigration officials, ICE has progressively expanded its surveillance toolkit to include troves of data beyond what can be provided by state and local police. ICE has turned toward government agencies like DMVs, asking for driver information and requesting face recognition searches on entire license photo databases. It has ramped up investments in contracts with private data brokers, buying access to billions of pieces of data sourced from places like credit agencies and utility companies. 

This section traces the evolution of surveillance by ICE and its predecessor, INS. It illustrates the shift from programs that rely on information collected by law enforcement to programs that draw data from a far wider-ranging array of sources, including private companies and government entities with no law enforcement authority. It then tracks this expansion in terms of dollar expenditures, showing a dramatic increase in investments in the latter type of surveillance programs. As Finding 2 and Finding 3 further explain, it is the data collected outside the law enforcement context that ICE has used to weave its surveillance dragnet.

A. The federal government built its immigration enforcement system on top of already unjust systems of policing and punishment.

For most of the 20th century, large scale deportations were ad hoc and episodic, usually driven by xenophobic reactions to particular political events. Examples include the first deportations under the Chinese Exclusion Act and the militarized border sweeps to return Mexican workers under the mid-20th century initiative that the government named “Operation Wetback,” after the racial slur.39

In 1986, however, the government began to build up a bureaucracy for systematized immigration enforcement, increasingly exploiting the same “law and order” politics that brought about the era of mass incarceration to justify the criminalization of immigrants. That year, driven by pressures created by Reagan-era mandatory minimum sentencing guidelines that overcrowded jails and prisons, Congress passed the Immigration Reform and Control Act (IRCA), which required that noncitizens convicted of certain criminal offenses be deported “as expeditiously as possible.”40 Ten years later, in 1996, the Illegal Immigration Reform and Immigrant Responsibility Act (IIRIRA) radically expanded the number and types of offenses that could subject a person to (often mandatory) detention and deportation.41 After the passage of IIRIRA, the number of people detained and deported expanded dramatically and in tandem with the skyrocketing number of people incarcerated through the criminal legal system.42 In subsequent years, Congress continued to use the construct of criminality to expand grounds for deportation and to roll back legal protections for people in immigration custody and in immigration court.43

As the legislature was using the framework of the criminal legal system to expand the statutory basis for deportation, the agencies tasked with immigration enforcement were relying on the resources of state and local police to investigate people for deportation. In 1988, the INS launched a pair of programs, eventually consolidated into the Criminal Alien Program (CAP), which placed federal immigration enforcement officers in jails and prisons to identify and arrest people for removal. Eight years later, Congress authorized 287(g) agreements, named for their authorizing provision in the Immigration and Nationality Act to allow state and local police to enforce immigration law. While many 287(g) programs deputized police officers operating in the field, most of them trained officers to operate in jails and prisons, identifying individuals in police custody whom INS could deport.44 After its creation in 2003, ICE has continued to rely on CAP and 287(g) agreements to investigate potential targets for deportation among those who have been brought into the criminal legal system.

One consequence of building immigration enforcement systems on top of criminal enforcement systems is that Black and Brown immigrant communities, already suffering brutal and discriminatory targeting by local law enforcement, are doubly policed and, when that policing results in judicial intervention, doubly punished.

In 2008, ICE expanded its cooptation of policing infrastructure to include digital infrastructure with the launch of the Secure Communities program. The keystone of S-Comm is a fingerprint-sharing initiative that automatically sends the fingerprints of any person who is booked by federal, state or local law enforcement to the FBI and ICE.45 While several states initially resisted enrolling in S-Comm, the Obama administration stated that participation was mandatory.46 As a result, all 3,181 law enforcement jurisdictions in the country—in all 50 states, the district and five U.S. territories—were enrolled in the program.47 In 2014, after years of intense pressure from the immigrant rights movement, President Obama and DHS Secretary Jeh Johnson suspended S-Comm but replaced it with the substantially similar Priority Enforcement Program (PEP), leaving the biometric information sharing processes across the country unchanged.48 That enabled President Trump to issue an executive order immediately restarting S-Comm five days after his inauguration.49 Although President Joe Biden revoked that order in early 2021,50 the fingerprint-sharing program still remains in place today.

These data-sharing programs and cooperative agreements with law enforcement agencies became cornerstones of U.S. immigration enforcement. Just three years after the launch of S-Comm, the number of people deported under the program made up 20% of total deportations that year.51 As of 2020, about 70% of ICE arrests resulted from ICE officers being notified of a person’s impending release from jail or prison.52 The increasing levels of cooperation between immigration officials and law enforcement also coincided with an explosion in the number of deportations from the U.S. Between 1955 and 1988, the year that the INS launched CAP’s predecessor programs, the U.S. never deported more than 30,000 people in a year. After 1988, immigration enforcement never deported fewer than that number of people in a year. Following ICE’s creation in 2003, the number of people deported annually never dropped below 200,000, hitting a high of 432,448 in 201353—the year that Obama sought to pass immigration reform legislation.54

Despite how entrenched ICE’s reliance on state and local law enforcement has become, the legal authority for many of these initiatives remains unclear. No statute explicitly authorizes the fingerprint sharing program or requires state and local law enforcement to participate.55 The same is true for many other forms of information sharing, such as the inclusion of civil immigration records in the form of “Immigration Violator Files” in the FBI’s crime database.56 The surveillance strategies described in this report, which are made possible by digital technology and infrastructure developed over the last 20 years, simply were not contemplated by the legal and policy frameworks relating to immigration, much less to privacy and civil rights generally. Limiting ICE’s enforcement practices through litigation has been an uphill battle since the first legal challenges to the Chinese Exclusion Act, which established a precedent of extreme deference to the executive on matters related to immigration.57

B. After 9/11, ICE aggressively expanded its data sources beyond police and corrections agencies.

While ICE’s initiatives to draw information from state and local police were rolled out with great publicity, its efforts to reach data streams from sources outside of law enforcement have been extremely secretive. ICE began broadening the scope of its data collection in response to the events of Sept. 11, 2001, as part of an overarching federal initiative to radically increase domestic surveillance under the auspices of the “war on terror.” Before 9/11, immigration authorities rarely investigated cases outside of the criminal context. The INS did not have personnel dedicated to finding and deporting people who had overstayed their visas or individuals with outstanding final removal orders (referred to as “abscondees”).58 The INS was explicit that enforcing those types of cases was not a priority.59 The agency seldom pursued people with removal orders, and its investigators did not work abscondee cases as a matter of policy.60

One of the main reasons the INS generally did not pursue visa overstays or people with outstanding removal orders was that it struggled to find them. As the agency noted, abscondees were mostly living within the community, not incarcerated in jail or prison.61 When the Department of Justice (DOJ) Inspector General audited the INS’s Detention & Deportation program, it found that the lack of address information was one of the most frequently cited reasons for the failure to issue a surrender notice informing people of their deportation date.62 Although since the 1940s federal law had required permanent residents and visa holders to register their addresses with the government and notify federal officials of address changes,63 those requirements were rarely enforced and few people complied with them, which meant that federal address registries were largely unhelpful for INS investigations.64 

The INS considered new ways to accumulate more information to target these cases but did not ultimately follow through on implementing them. For instance, some INS officials suggested that the agency go to DMVs and data brokers for address data:

If there is no known last home or work address for the alien, searches are frequently not practical … The District Director in Miami, along with D&D managers elsewhere, noted that access to nationwide motor vehicle and credit bureau data bases [sic], as well as access to Social Security data, would help locate aliens.65

Those recommendations were not adopted.

Everything changed after 9/11. When it was discovered that two of the 15 9/11 hijackers had overstayed a visa, government officials used that fact to reshape the discourse on American immigration enforcement. “For terrorists, travel documents are as important as weapons,” the 9/11 Commission wrote, concluding that “more effective use of information available in U.S. govern­ment databases could have identified up to 3 hijackers.”66

Suddenly, tracking visa overstays and people with outstanding removal orders became a top priority, with a clear focus on targeting Muslim and Arab people.67 In January 2002, Deputy Attorney General Larry Thompson launched the Absconder Apprehension Initiative, establishing 40 immigration agent positions across seven cities to “locate, apprehend, interview, and deport” people in the broader community.68 According to the program’s guidelines, immigration agents were to prioritize targeting people who came from “countries in which there has been Al Qaeda terrorist presence or activity.”69

Within one year, however, it was clear that the program faced the same constraints that hampered similar initiatives in the past: a lack of reliable data. At the start, the INS had set out to deport all 314,000 noncitizens with final orders of removal in the U.S.,70 but after six months, the Absconder Apprehension Initiative teams were only able to apprehend 712 people.71 The GOA conducted an analysis showing that AAI’s immigration enforcement efforts had been frustrated by unreliable address records in government databases and again recommended that the government adopt other methods of obtaining that information, such as purchasing it from data brokers.72

Ultimately, the INS would pass on the task of investigating visa overstays and people with outstanding final removal orders to its successor. ICE inherited the teams that the INS created in February 2002 to locate immigrants with outstanding final removal orders, organized under the National Fugitive Operations Program.73 ICE also promptly created two new offices, the Fugitive Case Management Unit and the Fugitive Operations Support Center, to send the teams information and leads on people who could be deported.74 In June 2003, ICE also established the first unit to identify and remove visa overstays: the Compliance Enforcement Unit, which was rebranded as the Counterterrorism and Criminal Exploitation Unit in 2010.75

ICE began systematically securing new troves of data that it could use to pull people into detention and deportation. Unlike the data fueling prior initiatives, this new data came overwhelmingly from sources outside of law enforcement, including agencies and offices within federal, state and local governments, as well as from the private sector. As ICE sought to remedy the data shortages that hindered previous efforts to pursue cases, it amassed records far beyond what was provided by state and local police, allowing the agency to track a significantly larger number of people. With these efforts, the reach of ICE surveillance far exceeded that of the already massive databases maintained on arrestees and visa holders, usurping data sets that easily included the majority of people in the U.S.

C. ICE contracts reveal a huge expansion in surveillance capacity.

Over the past decade, ICE has invested heavily in programs to track large swaths of the general population. Our review of over 100,000 ICE spending transactions from 2008 to 2021 reveals that the agency’s annual spending on surveillance programs grew more than fivefold during this period, skyrocketing from about $71 million to about $388 million per year.76 To analyze ICE’s surveillance spending throughout this period in more detail, we categorized each of the agency’s contract transactions by the primary surveillance service that it provided. Those categories are defined in Sidebar 1. The full list of surveillance contracts we identified and our calculations of ICE spending are included in the Appendix.

Our categorization of ICE transactions offers insight into the magnitude of the agency’s spending on surveillance programs as well as the scope of the information that those programs provide. For example:

• In total, ICE spent a little over $1.3 billion on geolocation providers from 2008 to 2021. The broadest and most controversial of those contracts is one that allows ICE to access a license plate scanning database provided by Vigilant Solutions. The database contains high-speed photos of license plates from passing vehicles, along with the date, time and GPS coordinates of where the image was captured.78 Vigilant’s database consists of two types of license plate scans: those collected by private businesses—known as commercial license plate data—and those collected by law enforcement agencies.79 According to documents obtained by the ACLU of Northern California, Vigilant’s collection of commercial license plate scans are collected in places like toll roads, parking lots and garages, as well as by private vehicle repossession agents across 47 states,80 covering metropolitan areas encompassing approximately 54% of the U.S. population.81 Using that database, ICE can automatically compare new plate scans against a hot list of vehicles it is looking for.82 In 2014, Obama DHS Secretary Jeh Johnson had cited privacy concerns to drop plans for ICE agency-wide access to the database, but Trump DHS officials penned an agency-wide contract for access to the Vigilant data at the end of 2017.83

ICE spent roughly $96 million on biometrics in this period. One of the first ICE biometrics contracts, dated July 18, 2008, awarded $3,000 for a five-year contract for “services with the State of Rhode Island RMV services to access the face recognition database to recognize criminal aliens”84—placing the first known ICE DMV searches in the waning days of the Bush administration, roughly five years earlier than previously known. One of the most recent biometrics contracts, from September 2020, secured $224,000 for ICE’s Dallas mission support office to use face recognition software from Clearview AI, a company known to have trained their algorithms on images scraped from public websites and social media pages without their subjects’ knowledge.85 

ICE spent roughly $97 million on data brokers in this period. The primary contractor that has provided this service is Thomson Reuters, which offers a person-search database called CLEAR. The version of CLEAR built for law enforcement includes data from a massive range of different sources, including driver’s licenses and vehicle registrations; credit headers, which contain the names, addresses, phone numbers and other personal information at the top of credit reports, collected in real-time from all three major credit reporting agencies; and, as discussed in Finding 3, address records from over 80 national and regional telephone, cable, gas, electricity and water companies across the country.86 ICE’s contract for the CLEAR database began in 2017 and was allowed to lapse in February 2021.87 The agency appeared to replace this service with a new contract with LexisNexis Special Services, which offers a similar database.88

• ICE spent roughly $252 million on access to government databases in this period. The key database in this category is Nlets, the International Public Safety and Justice Network (formerly known as the National Law Enforcement Telecommunications System). As discussed in Finding 2, Nlets is a network operated by a nonprofit organization that allows ICE agents across the country to warrantlessly search 34 states’ DMV databases for immigration enforcement purposes, including the databases of five of the 16 states that offer undocumented people the ability to apply for drivers’ licenses.89 Under Trump, ICE expanded many of its surveillance investments; in few other areas was this expansion more pronounced than in ICE’s access to government databases.
• ICE spent roughly $389 million on telecom interception in this period.90 The key vendors expanding ICE’s wiretapping capabilities are JSI Telecom and Penlink, which sell interception equipment.91 ICE uses Penlink equipment to track a person’s phone calls or internet use in real time and collect a person’s email and social media activity for later searches.92 Although authorized on a case-by-case basis, each wiretap benefits from ICE’s information stockpiles. ICE shares records obtained from wiretaps in its case management system using Penlink’s custom-built software, allowing the agency to map connections between people.93 ICE intercepts communications on such a scale that the agency needs half a dozen contractors to make sense of it all – wiretap translation services and storage contracts make up over half of ICE’s telecom intercept spending.
• ICE spent roughly $569 million on data analysis in this period. That amount includes spending on ICE’s third biggest contractor by dollar amount – Palantir Technologies. From 2008 to 2021, ICE awarded a total of $186.6 million to Palantir alone. Palantir’s custom-built programs link together databases from a vast array of government and private sources, allowing ICE agents to access and visualize an interconnected web of data pulled from nearly every part of an individual’s life. ICE has access to so much data, from so many sources, that its third-largest contractor is not a data provider but rather a company that helps ICE make sense of that data. 

In addition to co-opting information from the state government and private sector, ICE also reached into federal sources. Soon after its founding, ICE’s Fugitive Operations Support Center began accessing information on Americans held in federal databases at the Department of State, the Department of Labor, and the Department of Housing and Urban Development, using that information to find people to detain and deport.94 

As Finding 4 discusses, the agency even used interview data from unaccompanied children at the border to investigate people for deportation. Beginning in a trial in 2017 and then under a formal 2018 policy, ICE used the information given by unaccompanied minors as well as any guardians who stepped forward to take them under their care to find and arrest those guardians. ICE engaged in that practice under a Memorandum of Understanding with the Department of Health & Human Services Office of Refugee Resettlement, an agency charged by federal law with protecting the welfare of children who arrive unaccompanied at the border.95

D. By pulling in data from every source available to it, ICE’s surveillance programs have cast a dragnet over the whole U.S. population.

The massive scale of ICE’s surveillance programs have turned the agency into a key component in what Anil Kalhan, professor at Drexel Kline School of Law, has called “the immigration surveillance state.”96 According to Kalhan, ICE surveillance has “transformed a regime of immigration control, operating primarily on noncitizens at the border, into part of a more expansive regime of migration and mobility surveillance, operating without geographic bounds upon citizens and noncitizens alike.”97 University of California Irvine professor Ana Muñiz recognized a similar shift within a specific immigration enforcement system, the Enforcement Integrated Database. She argues that increased data collection and data-sharing arrangements transformed the database from “a case management system to a mass surveillance system.”98

While Congress has authorized ICE to exercise certain limited investigative powers,99 Congress has never explicitly authorized the massive scale of its surveillance programs. Consider Secure Communities. As Kalhan noted in 2013, the Visa Reform Act directed federal agencies to ensure that databases are “readily and easily accessible” to federal immigration officials “responsible for determining an alien’s admissibility ... or deportability.”100 But Congress never explicitly authorized the “routine bulk transmission to DHS of all state and local identification records” involved in Secure Communities.101 That's true of other ICE surveillance programs as well. Congress has never explicitly authorized ICE to routinely seek bulk records about the public from state agencies or private companies.