Acting ICE Director David Venturella sent an all-staff email — later leaked to The Intercept — announcing the agency’s new “Doxing Mitigation Initiative.” The vendor: ZeroFox, an AI-driven cybersecurity firm that continuously scans social media, surface web, and dark web sources to find, map, and scrub an individual’s personal information from public view. This kind of covert government surveillance app capability has raised alarm among civil liberties advocates in other contexts as well.
Contract award ID 70CMSD26C00000006 tells the less flattering version of the story. Awarded in July 2026, worth $14.57 million with $13 million already obligated, it routes directly to ICE’s Homeland Security Investigations Office of Intelligence. The stated purpose: software licenses supporting law enforcement operations. Three bids received. One winner.
ZeroFox’s platform automates PII removal from data broker sites, monitors for hostile mentions across the dark web, and executes takedowns through what the company calls a Global Disruption Network. Legitimate capability. Real technology. The question is who controls the targeting.
The Track Record: Why ZeroFox’s History Changes the Calculus
The firm now embedded inside ICE’s intelligence office has a documented pattern of flagging the wrong people as threats.
Cybersecurity expert Richard Forno at the University of Maryland, Baltimore County, didn’t mince words. “It’s plausible that this tech could be used to seek out whistleblowers… you’re kind of setting up a honey pot situation to figure out who the leakers are.” The scenario he describes: ICE leadership seeds sensitive information, waits for it to surface in press reports, then uses ZeroFox’s monitoring surveillance infrastructure to triangulate the source.
That’s not a fringe concern. ZeroFox has been here before:
- In 2015, the firm handed Baltimore authorities a list of “threat actors” that included peaceful Black Lives Matter organizers, reportedly flagged because of follower counts and real-world activity.
- After January 6, 2021, FBI agents gave the tool a derisive nickname after it reportedly failed to surface extremist signals leading up to the Capitol attack.
This is the firm now embedded inside ICE’s intelligence office.
ZeroFox is owned by private equity firm Haveli Investments, which acquired it for roughly $350 million in 2024. The company also employs Bryan Ware, former DHS assistant director for cybersecurity under the first Trump administration — a personnel overlap that reflects how tightly private surveillance vendors and federal security leadership have become intertwined.
The Accountability Question Nobody Wants to Answer
Protecting agents from harassment and shielding an agency from public oversight are not the same thing — and that distinction matters here.
Sophia Cope, senior staff attorney at the Electronic Frontier Foundation, acknowledged the legitimate stakes plainly: doxxing is a real safety risk, and ICE agents face genuine threats. But she drew a hard line. If this program shields the agency from public accountability over information that is already publicly available, “that’s a serious concern and flies in the face of our democratic values.”
Two anonymous ICE officials voiced separate, starker concerns:
- One described the program as sounding like “inside surveillance.”
- Another said: “I frankly don’t trust the feds with that. I’m not really keen on giving my PII to a company that doesn’t have a solid track record with government contracts.”
Protecting federal agents from targeted harassment is a reasonable position. But handing $15 million to a firm that once classified peaceful protesters as physical threats — and asking it to manage the digital identities of the people enforcing immigration law — is exactly the kind of arrangement that deserves scrutiny before it becomes standard practice across every federal agency with a budget and an enemies list. Other revelations, such as a secretly tracking users scandal tied to a White House app, underscore how these concerns extend well beyond ICE.
