A 12-page internal directory obtained by 404 Media gives outsiders their best look yet at how much surveillance and data-analysis firepower sits at the fingertips of U.S. Immigration and Customs Enforcement staff. Titled "ICE Wide Analytical Tools," dated May 2024, and stamped for internal law-enforcement use only, the record was put together by the intelligence office inside Homeland Security Investigations.
Nothing about the document points to one central surveillance machine. Instead, Biometric Update's review of the file counted 115 distinct systems sorted into 11 categories, each with a short blurb and instructions on how staff can request access. Asked to respond, a DHS spokesperson gave 404 Media a now-familiar line, saying only that "[l]ike other law enforcement agencies, ICE employs various forms of technology to investigate criminal activity and support law enforcement efforts."
How one lead becomes an entire dossier
A handful of entries act as connective tissue, built to gather scattered records into a single search. Accurint, a LexisNexis product, returns addresses, phone numbers, business ties and criminal history from one query. Whooster works a similar angle, running proprietary matching across billions of public, private and phone records to pin down someone's current number and location. Internally, ICE's Investigative Case Management system links case files, arrest records and vehicle data — and, with the right sign-off, can also reach into two outside FBI networks: the National Crime Information Center and the National Law Enforcement Telecommunications System.
Chained together, these tools let a single phone number lead to a home address, that address to a registered vehicle, and the vehicle's travel history to a list of known associates — all inside one continuous search.
Mapping where phones and cars have physically been
Another cluster of tools is built to reconstruct movement in the physical world. Locate X, a Babel Street product, lets an analyst draw a boundary around a block or building and pull up which phones passed through — using location signals that typically come from advertising networks rather than cellphone carriers. The tool has previously been shown to expose visits to abortion clinics once privacy researchers got hold of it. The inventory also lists Cobwebs, whose Webloc function reporters found could track phone movement across an entire neighborhood rather than a single address.
License-plate cameras mounted on poles, patrol cars and portable units feed a parallel database, backed up by a matching program run by the Drug Enforcement Administration. Even insurers are folded in: the list includes ISO ClaimSearch, originally built to catch fraudulent claims, which reporting has shown holds roughly 1.8 billion insurance claims and about 58 million medical-bill records.
RAVEn: the in-house engine built before Palantir
Long before ICE deepened its relationship with Palantir, Homeland Security Investigations built its own analytical environment called RAVEn, and the leaked inventory gives it heavy coverage. RAVEn CORE functions as a hub for criminal-analysis tools, while other pieces of the suite handle email analysis, phone-extraction data and tips submitted by the public. RAVEn IGP, described as available to every ICE employee, plots events on interactive maps to surface patterns across time and location. A companion piece, RAVEn Mobile Device Analytics, cross-references data pulled from multiple phone extractions to reveal connections between records. Biometric Update's reporting frames RAVEn as the forerunner to the newer Palantir-built systems discussed below.
Social platforms and going undercover online
ICE's online toolkit goes well beyond scrolling public feeds. SocialNet is designed to gather scattered social-media activity, tie it to aliases and surface hidden connections in close to real time. Chameleon is described internally as a way to browse the web and build cover identities while keeping a government network hidden. Traffic Jam targets commercial sex advertisements specifically, running facial-matching software against ad images and customer reviews. ICE also maintains what the document calls "managed attribution" browsing setups, built to mask an investigator's true location and device fingerprint during these operations.
Faces, immigration files, travel and money trails
Facial recognition through Clearview AI is filed under a miscellaneous category, walled off to specific units rather than available agency-wide. The document's immigration-systems section spans citizenship records, visa data, photographs, removal history and digitized case files — but CIS2 itself, one entry within that section, is described more narrowly: it links immigration records to data pulled from the ENFORCE Alien Removal Module and the Employment Authorization Document system. On travel, the Travel Intelligence Program is said to hold more than a billion records covering 39 months of past and scheduled commercial flights. Financial tools point investigators toward FinCEN suspicious-activity and currency-transaction reports, along with systems tracking cross-border trade and money transfers.
An aging snapshot that still matters
More than two years have passed since the document was assembled, and there's no way to know which of these subscriptions are still live. Equally telling is what's absent: Palantir's ELITE mapping tool, its ImmigrationOS case-tracking system, and the Mobile Fortify facial-recognition app now used by agents in the field never show up in the 2024 list — a sign that the leaked inventory captures a starting point rather than the current ceiling of ICE's reach.
Congress, and a fight over buying data instead of asking a judge
The leak lands in the middle of a broader argument in Washington over agencies buying location data from commercial brokers rather than seeking a warrant. Sen. Ron Wyden welcomed the ATF's June decision to drop a comparable phone-tracking contract, calling that kind of purchase "an unacceptable end-run around the Fourth Amendment," even as ICE keeps shopping for similar commercial services. The Electronic Privacy Information Center's Jeramie Scott has made a related argument, telling NPR that this kind of purchasing is "contributing to an ever-expanding infrastructure of private sector surveillance."
None of this confirms that any single ICE employee can freely open every system on the list — several require separate logins or sign-off from a specific unit. What the inventory does confirm is how many different paths now exist between one small identifying detail and a much fuller digital picture of the person behind it.
