Leaked ICE Document Maps 115 Surveillance Tools

TL;DR: A 12-page inventory titled "ICE Wide Analytical Tools," dated May 2024 and marked "Unclassified/Law Enforcement Sensitive," was published by 404 Media on July 23, 2026 after being obtained from inside Homeland Security Investigations ^[8]. The chart, produced by the HSI Office of Intelligence, lists 115 named systems across 11 categories, with one-line descriptions and the email address or portal where ICE staff can request access ^[1]^[2]. The categories run from Administrative/Resources to Vehicle & License Plate Readers, and cover phone geolocation and phone records (Locate X, PLX/PenLink, Whooster), facial recognition (Clearview), social-media mining (SocialNet/Maltego, Cobwebs, Fivecast ONYX), travel records (a "proprietary" database the document says contains "over one billion records" of commercial airline travel), license-plate readers, and anonymized undercover browsing (Chameleon, SILO, CrossTalk). The chart does not list newer ICE capabilities (Palantir's ELITE, the ImmigrationOS contract, Mobile Fortify) because those came later. A DHS spokesperson told 404 Media ICE "uses technology to investigate criminal activity and support law enforcement operations" ^[2].

What the Document Is

The inventory is not a classified leak. Its banner reads "UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE." It is also not a procurement document in the spend-the-money sense; it does not list contract values. It is, in effect, an internal Yellow Pages. Each row pairs a tool name with a one-sentence "Purpose," a "Request Access" link, and a "Telephone Number." Most rows point to an ICE service desk, a STAR account request form, a vendor portal, or a role mailbox. Two rows, Clearview and the DAVID photo line-up application, instead name individual staff members as the approvers ^[1].

404 Media obtained the document and published it on July 23, 2026 ^[8]. Biometric Update, which published a detailed walk-through the next day, said the inventory offers "one of the clearest views yet of how investigators can move from a name, face, telephone number, or location to a much larger body of information" ^[2].

The inventory is two years old. Some subscriptions may have lapsed, some tools may have been replaced, and newer capabilities are not yet reflected. Treat the chart as a baseline map of what ICE investigators could reach in 2024, not a current price list.

Tools for Assembling a Person

The most consequential rows sit in "Primary Cross-Purpose Systems," the category that connects data across the rest of the document. Accurint, which the document describes as a LexisNexis "Public records database," lets investigators "Search people, addresses, businesses, phone numbers, & criminal records that can be imported into internal & external data visualization tools, including mapping and link analysis." Whooster "provides real-time person and phone data using proprietary algorithms linking and matching billions of public, private, and telephone record data sets" ^[1].

PLX is the PenLink commercial tool "to analyze phone data," described as "law enforcement analytical COTS software that is used to analyze and exploit telephone evidence collected during criminal investigations." The document asks investigators to download the PLX Remote Desktop Connection .rdp file ^[1]. Our earlier reporting on the broader PenLink / Cobwebs contract chain sits in the related coverage below ^[3]^[7].

The chart devotes a long page to ICE's own RAVEn stack: RAVEn CORE, the Repository for Analytics in a Virtualized Environment, "replacing for FALCON"; RAVEn EA handles email evidence; RAVEn IGP is the ICE Geospatial Platform, described as "Available to all ICE employees"; RAVEn MD runs Mobile Device Analytics across multiple phone extractions; RAVEn LT is a Lead Tracker ^[1]. Biometric Update's read: RAVEn is "not simply an archive" but a set of tools that turn raw records into maps, networks, and leads ^[2].

Hidden on the Administrative/Resources page is a tool most readers will recognize from a bank statement: ScanWriter, "a data entry automation software developed by Personable that converts bank and credit card statements, bills, and receipts into excel files" ^[1]. Anyone whose bank or card statement has ever been subpoenaed is now on an ICE analyst's spreadsheet pipeline.

Where the Photos and Faces Come From

Under "Miscellaneous," Clearview appears: "Facial Recognition licenses controlled by CIEU. Access given out under specific circumstances." The access-request column names two individual staff members rather than a help desk, one of only two rows in the document where that happens ^[1]. EDDIE, listed under Immigration Systems, is "The biometric processing system for the identification of persons (ERO)." DAVID, in Administrative/Resources, is "A photo line-up application used for the identification of individuals in law enforcement situations" ^[1].

Those three tools predate the Mobile Fortify street-level facial recognition system and the $25 million BI2 iris contract that have become more visible parts of ICE's later biometric build-out. Biometric Update explicitly flagged that the inventory "does not show Mobile Fortify" or the BI2 contract ^[2]. Our coverage of that later build-out sits in the related links ^[4]^[5].

Phones, Plates, and Movement

Two tools sit on the "Miscellaneous" page that anyone who has followed an ICE contract will recognize. Locate X is "Geolocation tool for researching mobile devices. It allows investigators to draw a digital fence around an address or area, pinpoint mobile devices that were within that area from mobile data sources." Cobwebs "provides user-targeted automated collection of publicly available data from a range of online sources, and couples this with risk analytics and network visualizations" ^[1]. Biometric Update noted that Locate X's underlying data originates with ordinary smartphone apps and the digital advertising industry, and that Cobwebs's Webloc capability has been associated with searches of advertising-derived cellphone-location records ^[2]. Our reporting on the warrantless side of that chain is in the related links ^[6]^[7].

The LPR page is short. LEARN, "Law Enforcement Archival Reporting Network," is hosted by Vigilant Solutions and "compiles data from fixed, portable, or vehicle-mounted automated License Plate Readers (LPRs)." DEASIL NLPRP is DEA's National License Plate Reader Program Tactical Alert and Query System. ISO ClaimSearch is the National Insurance Crime Bureau's database of vehicle and insurance-claim information ^[1].

Online Undercover, Without Leaving a Trail

The "Miscellaneous" page also lists the tools that let ICE analysts pretend to be someone else online. Chameleon "offers a means to conduct online investigations, web research, and undercover work by providing anonymization, managed attribution, and data collection capabilities to its users. It also provides advanced investigative tools for long-term evidence collection." SILO "conducts online research without exposing analysts' digital fingerprint" from a cloud-based browsing interface. CrossTalk is "a browser tool created by the FBI to assist with internet research by automating the submission of search terms to third-party websites, extracting the data, and organizing the data in a card or Adobe file." CrossTalk access requires an active LEEP account ^[1].

For social-media analysis, the chart lists SocialNet (Maltego), "gathers open source and social media information and captures online digital tracks, maps against aliases, and explores connections in near real time"; Fivecast ONYX, which "provides user-targeted automated collection of publicly available data from a range of online sources, and couples this with risk analytics and network visualizations"; Namech_k, which "searches across hundreds of social networks and domain extensions, all at once"; and Tellfinder, which "uses artificial intelligence to uncover patterns in online data, such as advertisements, review forums, and discussion boards, to assist human trafficking investigations" ^[1].

Travel and Money, at Industrial Scale

Under "Travel / Consular Systems," ARC/TIP stands out: "The proprietary Travel Intelligence Program (TIP) database unlocks over one billion records containing thirty-nine months of past and future commercial airline travel, previously unavailable due to no other system containing the vast collection of data" ^[1]. UPAX pulls "Visa, ESTA, EVUS, GES, NCIC & Nlets, ENFORCE, PNR-linked data, business, & vessel info" and "can also search the TSDB (Terrorist Screening Database), which is the unclassified version of TIDE." Panjiva covers "U.S. and foreign companies and entities engaged in international trade." Orbital Insight is a GIS and mapping tool with "commercially available satellite, vehicle and vessel datasets" ^[1].

Under "Financial and Business," the chart points to FinCEN, with access to SARs, CTRs, and CMIRs, and to TRAC DIG, the Southwest Border Transaction Record Analysis Center Digital Information Gateway, run by the Southwest Border Anti-Money Laundering Alliance. The "Cyber Network Intrusion" page runs to sixteen entries, among them Chainalysis, Ciphertrace, Coinbase, Crosslink, Recorded Future, RiskIQ, Shodan, and VirusTotal, the same commercial vendors any private threat-intelligence team would buy. Every one of the sixteen is reachable through the same ICE licensing mailbox ^[1].

What to Watch

The missing tools. Biometric Update flagged that the document does not list Palantir ELITE, ImmigrationOS, Mobile Fortify, or the BI2 iris contract ^[2]. A second, follow-up inventory reflecting the post-2024 ICE build-out is the obvious next target for any future leak.

Location-data pressure. The Bureau of Alcohol, Tobacco, Firearms and Explosives canceled its Webloc contract after congressional scrutiny, Biometric Update reported, even as ICE continued to explore commercial advertising and location-data services ^[2]. Watch for the next Webloc-class cancellation or renewal fight.

The "Unclassified//Law Enforcement Sensitive" label. The chart names access approvers, lists FBI tool endpoints and DHS help-desk numbers, and carries a marking that falls short of classification. How a document at that marking left the agency is the more interesting follow-up story than the chart itself.