ICE Wants a Million-Subject Alert Machine. Thomson Reuters Owns the Data Stack
ICE’s own sole-source notice describes a $125 million data and monitoring plan built around Thomson Reuters records, plate data, alerts, graph analytics, risk scoring, and cleared analysts. No award is proven yet.
ICE has published its intent to build a sole-source data and alerting agreement around Thomson Reuters Special Services. The proposed ceiling is $125 million. The agency record describes continuous monitoring capacity for up to one million people and entities. It does not show an award, one million current targets, or a completed enforcement action.
This is not a contract award story. Not yet.
On July 14, Immigration and Customs Enforcement published a special notice on SAM.gov announcing its intent to sole-source Data Analytic Support Services to Thomson Reuters Special Services, or TRSS. The response deadline in the official record is July 24 at 5:00 p.m. Eastern.
Attached to that notice is the useful part: DHS’s own justification for avoiding competition.
The six-page file describes a labor-hour and firm-fixed-price blanket purchase agreement with a $25 million base year and four $25 million ordering years. That is a $125 million ceiling including options, not $125 million already spent.
The proposed service is not merely a nicer search box for public records. The agency describes a continuously refreshed identity-and-relationship monitoring layer built from commercial and public data, license-plate records, court and arrest data, location information, social media on request, graph analytics, entity resolution, model-based risk scoring, and embedded analysts cleared up to Top Secret/Sensitive Compartmented Information.
The government is not hiding the ambition. It put the architecture in the purchasing paperwork.
The procurement posture matters
DHS says it intends to establish a sole-source, single-award blanket purchase agreement. The official SAM.gov API record was still a published special notice at Kyber’s July 18 research cutoff. Its award field was empty.
Kyber did not locate a signed BPA, task order, obligation, invoice, exercised option, or notice that performance had begun under this vehicle.
That means several popular headlines would outrun the evidence:
- ICE has not been shown to have awarded TRSS $125 million under this notice.
- ICE has not been shown to have spent $125 million.
- One million people have not been shown to be enrolled in this system.
- The record does not prove voter fraud, even though the agency lists what it calls “Voters Fraud” among its mission priorities.
Procurement intent is still news when the intent is this specific. It tells the public what the agency wants, which vendor it wants, which capabilities it considers essential, and why it believes competition should be removed from the process.
Documentary excerpt from DHS J&A-26-0099, page 4 of the retrieved PDF. The quoted “up to one million” figure is planned capacity, not an operational enrollment count. View the official SAM.gov notice and attachment listing.
What ICE says it wants
The justification says the requirement supports Homeland Security Investigations across immigration enforcement, screening and vetting, lead development, targeting, criminal analysis, continuous monitoring, and real-time alerting.
It names the following products and data categories:
- Thomson Reuters CLEAR public records;
- Westlaw and Post Hire court data;
- TRSS Entity Authority;
- license-plate-recognition data;
- Kpler Terminal and MarineTraffic;
- international business and corporate-registration data;
- property records and geolocation information;
- real-time incarceration and arrest data;
- social-media data on request;
- global trade, shipping, supply-chain, and financial-risk data;
- cryptocurrency and blockchain intelligence;
- deep-web and global open-source intelligence;
- academic research and patent data.
A list in a justification does not prove every source will appear in every final order or every investigation. It does prove that the agency considers this breadth part of the contemplated package.
The document says TRSS can provide “continuous monitoring of up to one million individuals and entities with real-time alerts.” It describes automated ingestion pipelines, event-driven monitoring, graph-based anomaly detection, model-based risk scoring, and secure result delivery compatible with ICE systems.
That sentence is the center of the story. Static lookup has a beginning and an end: an analyst searches for a record. Continuous enrollment changes the model. A subject can be placed into a system that waits for new events, connects records, scores patterns, and sends something downstream when a rule or model fires.
The agency also describes TRSS’s Continuous Alerting Batch Solution, or CABS. According to the justification, CABS combines CLEAR, real-time incarceration and arrest data, nationally aggregated court records, and—on request—social-media data. The document says it can alert on last-known-location information and new “derogatory details” involving criminal, financial, associate, or other categories.
“Derogatory” is doing industrial work there. The posted record does not define the thresholds, confidence levels, source-error controls, or process for correcting a bad association.
The difference between a record and a decision
A data-broker search can return the wrong person. A court record can be stale. Arrest data can exist without a conviction. An address can be old. A plate can be misread. A relationship graph can turn coincidence into a line between two nodes. A model can assign a score without explaining what a human should do with it.
The procurement packet does not disclose:
- who may be enrolled for continuous monitoring;
- enrollment duration or removal rules;
- source refresh rates;
- alert thresholds or confidence scores;
- false-positive testing;
- model validation or demographic performance;
- required human review;
- what qualifies as an investigative lead;
- whether and how an alert can support an adverse action;
- retention for source data, alerts, audit logs, exports, backups, or legal holds;
- a process for a person to inspect or correct a bad record.
That is why the pipeline must be separated into stages.
Kyber reconstruction based on DHS J&A-26-0099. It is not a live-system diagram. The posted record does not establish enrollment rules, thresholds, retention, model validation, human-review standards, redress, or the downstream system path.
A source record is not an alert. An alert is not a valid identification. A graph link is not guilt. A risk score is not probable cause. An analyst’s lead is not an arrest. An arrest is not a conviction.
When all of those stages are collapsed into “the database found him,” accountability disappears into vendor plumbing.
The government wrote the requirement around one company’s stack
DHS says more than 50 vendors responded to a June 2025 request for information. The document says seven small businesses and ten large businesses were initially viewed as potentially capable of performing this kind of work.
Then the requirement changed.
The justification says Homeland Security Investigations revised it around proprietary capabilities. After that revision, the agency concluded only TRSS could provide the required data volume, proprietary tools, bulk access, integration, cleared personnel, and operational monitoring package.
That may be the agency’s honest technical assessment. It is not independent proof that no alternative architecture exists. The vendor responses, scoring sheets, evaluation notes, and Performance Work Statement were not published in the packet Kyber retrieved.
The circular incentive is obvious: specify the owner’s proprietary datasets, entity-resolution infrastructure, monitoring engines, and pre-trained cleared staff as one integrated requirement, then cite the lack of an identical competitor as the reason not to compete.
DHS argues that separating the work would create licensing conflicts, fragmented data rights, ingestion delays, integration risk, and additional transaction costs. Those concerns are real. They also describe vendor lock-in with a federal badge on it.
Once the agency’s workflows, staff, alerts, and downstream systems depend on one company’s proprietary entity graph, changing vendors becomes more than a procurement decision. It becomes a migration problem involving data rights, model behavior, historical records, access controls, and mission continuity. Proprietary convenience becomes institutional gravity.
What Thomson Reuters says
Thomson Reuters told 404 Media that it prohibits CLEAR from being used to identify and locate noncriminal or undocumented immigrants for deportation solely on the basis of immigration status. The company said it enforces that restriction, supports investigations involving public safety and national security, and does not offer immigration status as a CLEAR search field.
That response belongs in the record. So do its limits.
A public statement is not the operative contract. The posted justification does not include the final acceptable-use clause, audit method, breach remedy, query logs, violation history, or proof of enforcement. It also does not explain how the restriction applies to inferences created from location, associates, court data, plate data, corporate records, arrest records, or the other analytical products in the contemplated package.
“No immigration-status field” answers one narrow question. It does not answer what the combined stack can infer, who can be enrolled, what generates an alert, or what happens after the alert arrives.
DHS’s position is also clear. The agency says TRSS is uniquely capable, that continuous access is necessary to avoid degradation of enforcement and investigative operations, and that delay would seriously injure the mission.
The vendor says it has restrictions. The agency says it needs scale and continuity. The missing paper is where those claims become enforceable—or remain marketing.
The published attachment is incomplete on its face
The official SAM.gov resource service lists one public PDF named Final SSJ for Posting -Redacted.pdf. The file itself contains six pages. Each footer labels them pages 1 through 6 of 8.
The two missing pages appear to include approval material, and the justification repeatedly refers to a Performance Work Statement that is not attached. The packet also omits the final BPA, privacy terms, data-rights provisions, security controls, model documentation, and operating procedures.
That does not make the six published pages fake. Kyber retrieved them through the official SAM.gov attachment service and preserved the file hash. It makes the record incomplete.
The correct response is not to fill the gaps with vibes. It is to demand the rest.
The data-broker government contract checklist
Before an agency activates continuous monitoring built on commercial data, the public should have answers in writing.
Purpose and scope
- Which missions may use the system?
- Who qualifies for enrollment, and who approves it?
- Is “up to one million” licensed capacity, planned enrollment, or an expected operational count?
- How long can a person or entity remain monitored?
Data and inference
- What are the original sources and raw fields?
- Which fields are licensed, purchased, scraped, inferred, or model-generated?
- What is the refresh interval for each source?
- How are stale addresses, common names, expungements, bad plate reads, and identity collisions corrected?
Alerts and decisions
- What rule or model creates an alert?
- What thresholds and confidence levels apply?
- Is human review mandatory before an investigative lead or adverse action?
- Are model versions, validation results, overrides, and analyst rationales logged?
Access and sharing
- Which ICE units, contractors, partner agencies, and vendor staff have accounts?
- Is access direct, customer-configured, federated, exported, or provided through informal assistance?
- Can results flow into other systems, and can those systems preserve or retransmit them?
Retention and audit
- How long are source records, enrollment lists, alerts, scores, graphs, analyst notes, query logs, exports, backups, and legal holds retained?
- Who can audit searches and alerts?
- What happens after misuse is detected?
- Are audit results and suspension counts public?
Redress and exit
- Can a person inspect or correct a broker record used against them?
- Can the agency trace a decision back to the source field and model version?
- What gets deleted when monitoring ends?
- Can ICE export its history in an open format and leave the vendor without losing the audit trail?
If the answer is “trust the platform,” the control does not belong to the public agency. It belongs to the platform.
What readers can do now
The immediate action peg is the July 24 response deadline in the SAM.gov notice. Procurement reporters, civil-liberties groups, congressional staff, and records researchers should preserve the notice and request:
- the complete eight-page justification and approval signatures;
- the Performance Work Statement;
- all amendments, questions, responses, and competition challenges;
- the final solicitation, BPA, orders, invoices, and obligation records;
- privacy impact assessments and system-of-record notices;
- enrollment rules, model documentation, quality-control testing, and civil-rights reviews;
- operative acceptable-use, audit, suspension, and breach-remedy clauses;
- data-flow and interface records showing where alerts and derived results go;
- retention and deletion rules by data category;
- records showing whether the requirement is capacity, planned enrollment, or actual use.
Watch the posture after July 24. An intent notice can become a solicitation, an award, a cancelled action, a revised requirement, or nothing at all. Each status means something different.
For the local version of the same vendor-dependency problem, read Kyber’s investigation into Huntington’s proposed Flock surveillance agreement. For another government identity-data pipeline, read how California expanded mobile ID and built an interstate driver-data rail. And for practical contract review, see what camera cancellation does—and does not—prove.
The story is not that a database exists. Everyone already knew the state buys data.
The story is that ICE has described the system it wants in unusually blunt terms: proprietary records, plate and location data, social media on request, continuous enrollment, graph analytics, risk scoring, real-time alerts, and cleared analysts—all wrapped into one vendor’s stack.
Now the public needs the missing controls before procurement intent hardens into invisible infrastructure.
