Google Handed a Student Journalist's Bank Numbers to ICE. No Judge.

TL;DR: Google gave ICE a British student journalist's credit card numbers, bank account numbers, IP addresses, phone numbers, physical addresses, and a full list of his Google services, all without a judge signing off. ICE used an "administrative subpoena," which any federal agency can issue internally with zero court oversight. The subpoena came with a gag order, so Google couldn't even tell the student before handing over his financial data. The EFF and ACLU have now sent letters to seven major tech companies demanding they stop rolling over for these requests.

What Happened

Amandla Thomas-Johnson is a British journalist and student who attended Cornell University. He's published work in Al Jazeera and The Guardian. In 2024, he spent five minutes at a pro-Palestinian protest at a campus job fair targeting companies that supplied weapons to Israel. Cornell banned him from campus ^[1].

When President Trump took office and issued executive orders targeting students who protested in support of Palestinians, Thomas-Johnson and fellow student Momodou Taal went into hiding. Then ICE came for his Google data ^[1][2].

Here's what ICE demanded, and what Google handed over:

Usernames and physical addresses
An itemized list of every Google service tied to his account
IP addresses and IP masking services
Telephone and subscriber numbers
Credit card and bank account numbers

The subpoena arrived within two hours of Thomas-Johnson's visa being revoked. Google complied without telling him first ^[1][3].

No Judge Needed

The tool ICE used is called an administrative subpoena. It's not the kind of subpoena you see in courtroom dramas. No judge reviewed it. No court approved it. ICE agents issue these internally, stamped by their own agency ^[1][2].

Administrative subpoenas can't legally compel the content of emails, your search history, or location data. But they can demand metadata and identifying information: names, addresses, phone numbers, IP addresses, and yes, financial account numbers linked to your account ^[3].

Here's the part that should make you uncomfortable: companies aren't legally required to comply. Administrative subpoenas aren't court orders. Google chose to hand over Thomas-Johnson's bank details. They could have pushed back. They could have asked a judge to review the request. They didn't ^[3].

The subpoena also included a gag order. Google couldn't notify Thomas-Johnson that his data was being demanded until after it was already handed over. He found out months later, in April 2026, when Google sent him a belated email ^[1].

"I was quite surprised to see that I didn't have that opportunity" to fight the subpoena, Thomas-Johnson told The Intercept ^[1].

This Isn't an Isolated Incident

ICE has been weaponizing administrative subpoenas against protesters, activists, and journalists for months. This is part of a pattern:

$28.7 billion budget: ICE's 2025 budget nearly tripled from the year before, with a significant chunk going to surveillance technology ^[4].
1.2 billion face images: DHS maintains a facial recognition database of 1.2 billion photos, including images of U.S. citizens taken at airports ^[5].
8 billion social media posts: ICE contractor Zignal Labs monitors 8 billion social media posts for surveillance purposes ^[6].
DHS monitoring Reddit: A leaked January 2026 DHS bulletin revealed agents monitoring a Reddit user who called for peaceful protests, building behavioral profiles from their posts about sports and movies ^[7].

Thomas-Johnson attended a five-minute protest. That was enough to trigger visa revocation, ICE investigation, and the surrender of his financial records by one of the world's largest tech companies.

EFF and ACLU Fire Back

The Electronic Frontier Foundation, which is now representing Thomas-Johnson, teamed up with the ACLU of Northern California to send a letter to seven major tech companies: Google, Amazon, Apple, Discord, Meta, Microsoft, and Reddit ^[3].

The letter makes three demands:

Stop complying automatically. Require DHS to get court confirmation before companies disclose any user data.
Challenge gag orders. Push back on orders that prevent notifying users.
Notify users first. Give people enough advance notice to challenge subpoenas on their own before complying.

The EFF accused the companies of "failing to challenge unlawful surveillance and defend user privacy and speech" ^[3].

Google has not commented.

What You Can Do

Minimize What Google Knows

Don't link bank accounts or credit cards to your Google account unless absolutely necessary. Use a payment method that doesn't tie directly to your primary bank. Review your linked financial data at myaccount.google.com.

Compartmentalize Your Accounts

Use separate email accounts for activism, journalism, and personal life. If ICE subpoenas one account, the others aren't automatically swept up.

Use Services That Fight Back

Some companies have stronger track records of challenging government requests. Check EFF's "Who Has Your Back" reports. ProtonMail and Tutanota are built to resist this kind of demand.

Know Your Rights

If you receive notice that your data was disclosed, contact the EFF or ACLU immediately. Administrative subpoenas can be challenged retroactively, and companies can be pressured to change their policies through litigation.

The Bottom Line

Google didn't need a court order to hand over your bank account numbers. ICE didn't need a judge to demand them. A five-minute protest was enough to put a student journalist in the crosshairs of a federal agency with a $28.7 billion budget and access to 1.2 billion face images.

The infrastructure is already built. The legal mechanisms already exist. The question is whether tech companies will keep rolling over every time ICE sends a letter, or whether they'll start requiring the judicial oversight that the Fourth Amendment was supposed to guarantee.

Google's silence on this case tells you which way they're leaning.