LIVE · cybersecurity feed
Live wire
CVE-2026-88779 · Citrix NetScaler Flaw Exploited Before CVE PublicationCVE-2026-88779 · NetScaler CVE-2026-88779 Exploited Before PublicationCVE-2022-28368 · dompdf_project dompdf XSS flaw added to VulnCheck KEVCVE-2026-88771 · Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploitedWarlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical InfrastructureShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group MembersChina-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM PhishingCVE-2026-7273 · Zyxel GS1900 Switch Flaw Exploited, Now in EU CatalogueCVE-2026-102489 · Zammad Session Fixation Vulnerability Exploited Same Day as DisclosureCVE-2026-102490 · Zammad GmbH Zammad Vulnerability Exploited Same Day as Publication
security

ICE Has Been Dumping Protester Photos Into a Palantir Database

Newly unsealed court documents allege that the U.S. Department of Homeland Security (DHS) has been collecting information, including photographs and license plate numbers, of individuals observing Immigration and Customs Enforcement (ICE) activities and storing this data in a Palantir-built database known as Investigative Case Management (ICM). The allegations are part of a proposed…

ZeroDay News ·

Source: WIRED — Security

Newly unsealed court documents allege that the U.S. Department of Homeland Security (DHS) has been collecting information, including photographs and license plate numbers, of individuals observing Immigration and Customs Enforcement (ICE) activities and storing this data in a Palantir-built database known as Investigative Case Management (ICM). The allegations are part of a proposed class-action lawsuit filed in federal court in Maine by four observers: Elinor Hilton, Colleen Fagan, Polyxenia Pantos, and Carlyn Williams.

The lawsuit, filed under seal in September and publicly released in a redacted version on Friday, centers on the conduct of DHS agents during "Operation Catch of the Day," an immigration enforcement surge in Maine in January. Plaintiffs claim that agents created dossiers on observers, intimidated them with drive-bys of their homes, and, in one instance, subjected an observer to secondary inspection at border crossings until at least January 2027.

A key figure in the allegations is "Agent J.C.," a DHS agent identified in the filing. J.C. is accused of creating ICM records for at least six, and possibly eight, observers. He allegedly labeled two individuals filmed at a Home Depot parking lot as "Threat to Law Enforcement, Professional Protestor" and sent their photos, along with others, to a U.S. Customs and Border Protection (CBP) officer for facial recognition searches using an app called Mobile Query.

The filing details an incident on January 20, when Pantos observed and photographed an arrest in Portland, Maine. Hours later, J.C. allegedly ran the license plate of the car Pantos was near, pulling a report on the owner, Williams, from Accurint, a LexisNexis database. This report provided Williams' address, phone numbers, and cohabitants. J.C. then reportedly circulated Williams' photo to his team, asking if she was "the protestor." After another agent indicated it wasn't the woman they had dealt with, J.C. informed colleagues he was adding them to ICM.

That same afternoon, J.C. allegedly called Williams, identifying himself only as being from the Department of Homeland Security. According to Williams, J.C. warned her to encourage Pantos not to engage in such activities in the future, implying that individuals doing so might be added to a domestic terrorism watchlist. J.C. testified in a deposition that he warned Williams she would be arrested if she "continue[d] to do this," though government attorneys assert he denied referencing a "domestic terrorism watchlist."

Williams' ICM record reportedly states she was the registered owner of a vehicle used to "interrupt ICE arrests" and that her driver’s license photo matched a video of an "aggressive woman [who] interject[ed] herself into an arrest." A 2016 DHS privacy assessment indicates that ICM automatically shares subject records with CBP’s TECS system, where they function as lookout records for traveler screening at the border.

ICM is the case management system used by Homeland Security Investigations (HSI), an ICE component, to document investigations. ICE awarded Palantir a contract to build ICM in 2014, with the system based on Palantir's Gotham software, customized for operational needs. In 2022, ICE awarded Palantir a new five-year ICM support contract valued at up to $96 million, with an additional $30 million added in 2025 for a new platform called "ImmigrationOS."

Todd Lyons, former acting director of ICE, stated in an April letter to Rep. Maxwell Frost that ICE "does not maintain any kind of database of U.S. citizens protesting ICE activities" and that DHS does not keep a "separate, standalone database" of individuals not arrested or detained. DHS has called the lawsuit "meritless," asserting that it is "based on the lie that there is a database of ‘domestic terrorists’ run by DHS."

The government's motion to dismiss the lawsuit argues that the described incidents were isolated and contrary to DHS policy. It states that J.C. created records on individuals he believed were "potential threats to law enforcement" and "did not attempt to nominate any individuals to the terrorist watchlist."

Attorneys for the observers contend that DHS's actions have had a chilling effect on their First Amendment rights. The filing notes that Pantos ceased all ICE observation work after J.C.'s call to Williams, who also eventually stopped observing ICE activity. The observers are seeking a court order to archive Williams’ records, prohibit DHS from using collected information against the plaintiffs, and bar agents in Maine from threatening observers with watchlists or following them to their homes.

ShareXLinkedInWhatsAppFacebook

More News

view all →
breach

Frontline Education Breach Impacts K-12 School District Staff

Frontline Education, a prominent software provider for K-12 school districts in the United States, has confirmed a data breach that exposed the personal information of school staff. The incident, which was discovered on August 14, 2026, stemmed from a vulnerability in a third-party software product utilized by the company.

vulnerability

Google halts open-source bug bounty program amid AI spam surge

Google has temporarily suspended submissions for product vulnerabilities to its Open Source Software Vulnerability Rewards Program (OSS VRP), effective October 1, 2026. The company cited a significant increase in automated submissions, most of which were deemed invalid, as the reason for the pause.

ai

Apple tightens macOS disk access as AI agents become more powerful

Apple is implementing stricter controls for Full Disk Access in macOS, citing an increased risk to user privacy from increasingly capable and autonomous AI agents. The company indicated that future macOS versions will require users to take explicit steps to grant applications this permission. A specific rollout date and the precise mechanics of these new controls have not yet been detailed.

nation-state

doxx.net opens Agentic Defined Networking public beta, raises $38 million

doxx.net has launched the public beta of its Agentic Defined Networking (ADN) platform, which enables users and their AI agents to establish private, secure networks and communicate without intermediary servers. The company also announced it has secured $38 million in Series A funding, led by Andreessen Horowitz, with additional participation from Animo Ventures and Focal.vc. As part of the…

vulnerability

AI slop submissions force Google to freeze its open-source bug bounty

Google has temporarily halted its Open Source Software Vulnerability Reward Program (OSS VRP) for new product vulnerability submissions, effective October 1, 2026. The company cited a substantial increase in automated, AI-generated reports, most of which were invalid, as the reason for the pause. This influx of low-quality submissions overwhelmed the engineers and open-source maintainers…

nation-state

Another OpenAI Safety Expert Quits and Raises New AI Safety Concerns

David Robinson, a veteran safety expert at OpenAI, has resigned from the company, citing concerns about its culture and rapid AI development model. Robinson, who was instrumental in authoring safety reports accompanying major product launches during his three-and-a-half-year tenure, stated that he believes the company's current trajectory is unacceptable.