Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
As white House pushes to step up insider leak investigations, quietly revamps Immigration and Customs Enforcement Cyber security The contract that governs how employee activity on agency systems is monitored, recorded, and archived for investigation.
The operation, known as Cyber Defense and Intelligence Support Services, is offered as a routine security effort focused on network monitoring, incident response, and basic security hygiene. But new contract records reviewed by WIRED illustrate how ICE is working to expand and enhance the collection of digital records and device data for internal investigations and law enforcement use.
Records show that ICE is moving forward with recompetition — the process of reissuing and renewing a major federal contract — as DHS leadership expands leak investigations and steps up monitoring of how employees use the agency’s systems. Contract documents outline methods for maintaining comprehensive records of digital activity and using automated tools to report patterns and anomalies, while linking cybersecurity operations more closely with ICE investigative offices to expedite the use of that data in internal litigation.
Beyond internal monitoring, the contract describes a broad cybersecurity process, covering continuous monitoring of ICE’s networks, automated alerts for suspicious behavior, and routine analysis of logs pulled from servers, workstations and mobile devices. A key requirement is to store and organize this data so that incidents can later be reconstructed step by step, whether for security reviews or formal investigations.
The work is managed by ICE’s Office of the Chief Information Officer, which runs the agency’s Security Operations Center, but the contract is designed to move information across offices. The cyber findings are supposed to be shared with investigative and oversight units, including Homeland Security Investigations and ICE’s Office of Professional Responsibility, which handles employee misconduct. The structure allows digital activity data collected for cybersecurity purposes to be quickly directed to internal inquiries when requested by investigators.
ICE did not respond to a request for comment.
The expansion of domestic surveillance comes as the Trump administration has framed dissent within federal agencies as a threat and has moved aggressively to identify and remove career officials seen as ideologically inconsistent with the administration, particularly in National security and law enforcement roles.
Since returning to office, the Trump White House has shown internal dissent Explicitly loyalty-based terms– As opposed to misconduct, wrongdoing, or efforts to intentionally undermine the government – Framing political disagreement with the president’s goals as grounds for impeachment.