Contractor teams build dossiers on people flagged as ‘threat originators’
ICE’s Office of Professional Responsibility, based in Washington, D.C., has spearheaded the expansion of the program over the past year, according to contractors, federal documents and former Homeland Security Investigations agents. Under prior administrations, the office was best known for investigating ICE agents for wrongdoing, though it also used a few outside analysts to watch the internet for threats to senior leadership. Contractor teams now scour the internet with sophisticated surveillance tools for commentary the agency regards as potentially dangerous, preparing daily reports and dossiers on threat actors that identify the poster’s name, location, date of birth, workplace, Social Security number, vehicle registration and criminal history when possible.
To unmask anonymous online critics, DHS has sent hundreds of subpoenas to social-media companies, according to people familiar with the matter. Its agents have tracked down Americans at work and on the road, asking them to sign letters acknowledging that their online speech about ICE “may” be a crime. In recent months the government has also resorted to grand jury subpoenas, which carry more legal weight, to identify users. DHS says it is trying to protect its agents and their families from “coordinated campaigns of violence” that have fueled an 8,000% increase in death threats since Trump took office. An agency spokesperson said ICE’s investigative methods abide by the Constitution and that the agency respects civil liberties and privacy interests. “Any allegation DHS and ICE are attempting to ‘squash’ free speech is categorically FALSE,” the spokesperson said. “ICE investigates all credible threats towards its employees, officers and families.”
Civil-rights lawyers and former DHS staffers say the approach has swept up people expressing opinions protected by the First Amendment. “As far as I can tell, all of this is about people saying naughty things about ICE and immigration enforcement,” said Lauren Regan, a civil-rights attorney who has represented multiple people investigated by the government over their online speech, including the Reddit user Tired_Thumb. “Nothing that comes close to true threats.”
DHS sent administrative subpoenas to Reddit for the information of 11 accounts that had posted “content critical of federal actions” between July and December of last year, the company’s most recent transparency reporting period, according to a person familiar with the matter. Reddit determined that the users were engaged in protected activity under the First Amendment and objected to each, the person said, and DHS eventually withdrew the requests. Ben Lee, Reddit’s chief legal officer, said the company routinely objects to government requests that are “overbroad or threaten users’ privacy or civil rights, including their First Amendment rights.”
The Wall Street Journal identified 10 people — nine Americans and one Canadian — who pushed back against DHS’s attempts to unmask them through the two types of subpoenas. Judges have upheld four grand jury subpoenas. No charges have yet been filed in these cases; the agency abandoned three, while three more are pending. Attorneys told the Journal they began to see a spike in subpoenas for U.S. citizens’ information around September 2025, the month the threat contract launched. Joshua Koltun, an attorney who has represented two Americans whose identities were the subject of social-media subpoenas in recent months, posed the question directly: “Are these being used for actual investigations of purported crimes, or are they being used to build a watchlist?”
In the case of the Reddit user Tired_Thumb, DHS initially issued an administrative subpoena to Reddit in January and February seeking the poster’s name, address, billing records and any associated accounts related to their online activity, without an explanation or any indication of what law, if any, the user may have broken, the Journal reported. The Journal obtained the user’s Reddit activity from that period through archival data, identifying three comments that mentioned ICE, including two that carried the initials “ACAB.” In one January comment, Tired_Thumb weighed in on a thread about a local news article that identified Ross as the agent who had killed Good two days before. After another user speculated that Ross would move to Florida or Texas, where he would be hailed as a hero, Tired_Thumb mentioned various states and a city where Ross had lived, information that has been reported by news outlets. “Hopefully he moves up to Stillwater State Penitentiary,” Tired_Thumb added. DHS has said Ross acted in self-defense; he hasn’t faced charges.
The legal nonprofit Civil Liberties Defense Center filed a motion seeking to quash the subpoena, arguing that its client was exercising protected free speech. The federal government withdrew the original subpoena and responded with a grand jury subpoena requesting roughly an additional month of social-media activity, dating back to December 2025. During that period, Tired_Thumb replied to a post that claimed to identify an ICE agent who assisted another officer as he dragged a woman by the arm across a Minnesota street in a viral video, as onlookers yelled that she was pregnant. The user looked up the name on a public records search website and shared the agent’s phone number in a comment, pasting the link to the source seconds later, and wrote “Abolish ICE and erase all borders” a few days before. Tired_Thumb didn’t make any other comments about the agency in this period, Reddit data shows. As of last month, the government was still attempting to learn Tired_Thumb’s identity. Grand jury proceedings are continuing six months after the original summons was issued; the user’s motion to quash the grand jury subpoena was recently denied, and a judge granted a motion to stay the case while an appeal makes its way through a higher court.
Three months after Tired_Thumb learned of the government investigation, a New York poll worker named Paigelynne Gonyea received a voicemail from a man identifying himself as an agent with Homeland Security. “We were just calling you in reference to a post that we believe you made on Instagram where you doxxed an ICE agent back in January,” the caller said. Shortly after, two agents from ICE’s OPR arrived at the voting site where she was working, holding printed screenshots from her account, she said, including the post in question, which included a photo of Ross, the immigration officer who killed Good. The file that agents were holding also contained Gonyea’s address, date of birth and what looked like a picture of her taken at airport security, she said. The agents told her to take down the post and asked her to sign a letter acknowledging she had been informed that she “may” have violated federal law. The agents visited multiple other people about online speech that day, delivering the same letter, according to a county elections official.
Gonyea, a 40-year-old author and influencer, said she was only able to find one post that spoke about a specific ICE agent: “I think today is a great day for Jonathan Ross to be indicted!” — a reference to the Minnesota Star Tribune article that first named Ross. An ICE spokesperson said Gonyea doxxed an agent’s home address and showed the Journal a different screenshot, which appeared to be from Gonyea’s Instagram account, showing a photo of Ross with the caption “The killer’s name is Jonathan Ross of,” with the rest of the text redacted. Meta declined to weigh in on the existence of the image ICE shared. Gonyea said she doesn’t recall posting any agent’s address and can’t find evidence of the alleged post; she is exploring legal action.
One person compared ICE officers to Nazis on X in January, including writing that “All ICE Agents need to be put down like the dogs they are.” She was visited at home by ICE agents roughly four months later, after a court ordered the social-media company to turn over her information. The plainclothes agents told her not to post like that again, then left, the woman said. She hasn’t faced charges but has curbed her speech on social media.
Several U.S. citizens who have come under scrutiny posted information about immigration officers — from the locations of agents carrying out enforcement to officer names to home addresses. The Trump administration considers the “organized doxxing of law enforcement” to be a form of domestic terrorism, and DHS has asserted that videotaping law enforcement on the job and posting the footage online constitutes doxxing. When a local news outlet reported that Jonathan Ross was the agent who killed Renee Good, DHS called the reporting “reckless behavior” and said the paper should “delete their story immediately.” Constitutional scholars and defense attorneys say sharing a federal law enforcement officer’s personal information is generally not considered a crime without evidence of criminal intent, a historically high bar in court. The Supreme Court has held that true threats aren’t protected by the Constitution, but political hyperbole is, noting in a landmark decision that the “language of the political arena” is often “vituperative, abusive, and inexact.”
In the past year, the Justice Department has successfully prosecuted several Americans in cases involving speech about ICE officers online, including an Oklahoma man convicted of threatening to kill federal agents after he wrote “we as US citizens should be gunning down these domestic terrorists” on X, along with several other posts about agents needing to be shot. Two women were found guilty of stalking in Los Angeles after they followed an ICE agent’s vehicle while livestreaming on the popular “ice_out_ofla” Instagram account and ended up at his home; both have said they thought his car was headed to an immigration raid. The Justice Department didn’t respond to requests for comment.
ICE spending on surveillance technology and consultants surged to $258 million during Trump’s first full year back in the White House, a 57% increase from the same period a year earlier, according to the Journal’s analysis. ICE has inked at least six contracts that involve scanning public records for “threats,” paying out nearly $50 million since 2020; more than half of those funds were obligated since last January, and another award potentially worth up to $50 million the agency continues to extend. To help build the program, OPR turned to Amivero, a small, Virginia-based technology firm better known for software development than intelligence gathering, which secured a contract of over $8 million last September to monitor social media for threats and plans to interfere with ICE enforcement. Amivero subcontracted the work to Guidehouse, a global consulting firm; Amivero and Guidehouse didn’t respond to several requests for comment.
The notice for the initiative calls for monitoring nearly 20 social sites, including Reddit, Discord, Snapchat and LinkedIn, and the use of public documents such as DMV records and police reports to identify and map key relationships of users who have been flagged as a “threat originator.” It also requires analysts to use machine learning to analyze and detect risks, including through AI-powered “anticipatory threat intelligence,” which identifies trends or patterns of potential threats before they come to fruition. The initiative identified so many potential threats early on that the small-staffed OPR needed to recruit the help of the HSI Office of Intelligence to handle them all, according to former ICE employees and federal notices; HSI Intelligence is now leading anti-doxxing and threat mitigation efforts for the ICE workforce through contract services, according to an agency spokesperson, who declined to comment on specific investigative activities, saying “these efforts are focused on credible threats of violence directed against the ICE workforce.” The program receives oversight from the ICE Privacy Office, in consultation with DHS’s Privacy Office, and the ICE Privacy Office is down to two full-time staffers, according to former government employees. OPR has investigated at least 131 incidents of doxxing and threats towards agency personnel between January 2025 and March of this year, according to a court declaration filed in April, including for posting personal information of ICE employees on social media or fliers in an attempt to identify them and “anti-ICE group chats.”
Danielle Citron, a law professor at the University of Virginia who specializes in cyberstalking, privacy and civil rights, said the campaign reflects “the weaponization of privacy in ways that privilege the powerful, and in particular, law enforcement.” “Law enforcement who are serving the public, they’re hiding their names,” she added. “They’re hiding their faces.” In another case, a special agent tracked down David Streever while he was on vacation, five months after he emailed then-acting ICE director Todd Lyons after Alex Pretti’s death and called him “a monstrous human being.” Streever has alleged that DHS’s behavior is retaliation for protected speech and will have a chilling effect on the public.
Regan, the civil-rights attorney, said the absence of charges leaves those investigated without a forum to challenge the government’s reading of the law. “They’re not actually filing any criminal charges where we can challenge the vagueness, the overreach and the abuse of that statute,” she said. “If they just want to use this as an intimidation tactic, it’s not even a fair fight.”