Full Report
DHS agents not only tracked and intimidated people observing ICE activity in Maine, but stored information about them in a Palantir-built database, newly unsealed court filings say.
Analysis Summary
# Incident Report: Surveillance and Data Profiling of ICE Observers
## Executive Summary
Department of Homeland Security (DHS) agents allegedly conducted systematic surveillance and intimidation of individuals observing Immigration and Customs Enforcement (ICE) activities in Maine. Personal data, including photos and license plate numbers, was collected and stored in a Palantir-built "Investigative Case Management" database, effectively creating criminal-style dossiers on First Amendment-protected activities. The incident has resulted in ongoing legal action regarding the government’s use of surveillance technology to track law-abiding citizens.
## Incident Details
- **Discovery Date:** October 2, 2026 (Public reporting of unsealed filings)
- **Incident Date:** Ongoing; specific border flags active until January 2027
- **Affected Organization:** ICE Observers / Civil Rights Activists
- **Sector:** Government / Civil Society
- **Geography:** Maine, USA / US Border
## Timeline of Events
### Initial Access
- **Date/Time:** Undisclosed (Ongoing period of surveillance)
- **Vector:** Physical surveillance and open-source monitoring.
- **Details:** DHS agents identified individuals observing ICE activities at public locations and border crossings.
### Lateral Movement
- **Details:** Not applicable in a traditional network sense; however, data was moved from field observations into the centralized Investigative Case Management (ICM) database.
### Data Exfiltration/Impact
- **Details:** Personal Identifiable Information (PII) including photographs, license plate numbers, and home addresses were ingested into a Palantir-built database. This data was used to create dossiers on non-criminal actors.
### Detection & Response
- **How it was discovered:** Through legal discovery and depositions in the court case *Hilton v. Noem*.
- **Response actions taken:** Civil rights attorneys (Protect Democracy) filed suit to stop the surveillance and challenge the legality of the database entries.
## Attack Methodology
- **Initial Access:** Physical stalking and observation of protesters.
- **Persistence:** Long-term storage of dossiers in the ICM database; administrative "flags" on individual travel records.
- **Privilege Escalation:** Use of federal law enforcement authority to access non-public databases for personal data enrichment.
- **Defense Evasion:** DHS maintains the case is "meritless" and denies the existence of a specific "domestic terrorist" database.
- **Credential Access:** N/A
- **Discovery:** Reconnaissance of observers' homes and vehicle movements.
- **Lateral Movement:** Ingestion of local field data into federal-level databases.
- **Collection:** Gathering of photos and license plate data.
- **Exfiltration:** Transfer of civilian data into a restricted law enforcement environment (Palantir ICM).
- **Impact:** Intimidation of citizens and restriction of movement through border secondary inspections.
## Impact Assessment
- **Financial:** Legal costs associated with the *Hilton v. Noem* litigation.
- **Data Breach:** Compromise of privacy for an undisclosed number of observers/protesters.
- **Operational:** Disruption of travel for affected individuals (mandatory secondary inspections).
- **Reputational:** Significant public outcry regarding the weaponization of Palantir technology against First Amendment activities.
## Indicators of Compromise
- **Behavioral indicators:** Unmarked vehicles performing "drive-bys" of private residences; unexpected secondary inspections at US border crossings.
- **Database indicators:** Entry in the Investigative Case Management (ICM) system without an underlying criminal investigation.
## Response Actions
- **Containment measures:** Litigation seeking an injunction to stop the surveillance.
- **Eradication steps:** Legal requests for the deletion of dossiers and removal of border flags.
- **Recovery actions:** Ongoing court proceedings to restore the First Amendment rights of the plaintiffs.
## Lessons Learned
- **Key takeaways:** Federal law enforcement databases built for criminal investigations can be easily repurposed for political surveillance.
- **What could have been done better:** Stricter oversight and auditing of database entries are required to ensure data collection is tied to legitimate criminal predicates rather than protected speech.
## Recommendations
- **Prevention measures:** Implementation of strict "Privacy by Design" principles in government contracts with private data firms (e.g., Palantir).
- **Policy:** Establish clear legislative barriers preventing the use of Palantir-built tools for the surveillance of non-criminal protesters.