ICE Buys $6.7M of LexisNexis Records for Palantir

The interesting part of this contract is not the money. $6.7 million is small change next to the $159 million ceiling on ICE's Palantir work. The interesting part is one sentence in the requirements: the database must talk to Palantir. A commercial file assembled from your utility bills, your old addresses and your phone numbers is being wired into the targeting layer of a federal enforcement agency, and the wiring is now a contractual obligation.

Key Takeaways

• ICE plans to pay LexisNexis Risk Solutions $6.7 million for continued access to commercial personal records, according to procurement documents published August 10, 2026 and first reported by 404 Media.
• The procurement requires that the database "be able to application programming interface (API) with ICE applications, such as but not limited to, Palantir platform, PenLink, and ICE Data Analytics."
• LexisNexis markets LexID and the Accurint Virtual Crime Center as drawing on more than 82 billion public and proprietary records from more than 10,000 sources.
• ICE states the purpose as "all aspects of ICE screening and vetting, lead development, and criminal analysis activities," including spotting perceived fraud before it "can materialize."
• The same documents ask for an AI driven identification system able to "infer the identity of the end user" and bulk facial matching across large scale image databases.

What Did ICE Actually Buy?

A subscription to a private dossier system, plus the integration work to make it queryable from inside ICE's own analytics stack.

This is not a new relationship. ICE signed a contract with LexisNexis worth up to $22.1 million in 2021, first reported by The Intercept, which gave thousands of agents keystroke access to jail booking data refreshed as often as every 15 minutes. In February 2023, EPIC and more than 80 organizations asked DHS not to renew it. It was renewed. It is being renewed again.

What has changed is the destination. Earlier contracts bought a search box that an agent typed a name into. This one buys a feed. And it sits alongside the agency's other broker channel: we covered ICE's $125 million CLEAR contract with Thomson Reuters and its expansion into voter fraud work. Two of the largest data brokers in the United States, two contracts, one analytics platform in the middle.

What Is LexID and Where Does Its Data Come From?

LexID is a persistent identifier that LexisNexis attaches to a person so that scattered records can be collapsed into one file. The company says its linking technology resolves and manages more than 276 million United States consumer identities.

Do the arithmetic that the marketing copy leaves out. 82 billion records across 276 million identities averages roughly 297 records per person. At $6.7 million, ICE is paying about two and a half cents per adult identity for a file that already exists whether or not that person has ever been accused of anything.

The inputs are mundane, which is what makes them work:

• Credit header data. The identifying top slice of a credit file: name, current and former addresses, date of birth, Social Security number fragments, employer.
• Utility and telecom records. Electricity, gas, water, cable and cell subscriptions, which tie a name to a physical address faster than almost anything else.
• Property, court and jail records. Deeds, liens, filings, bookings, release dates.
• Phone numbers and email addresses. Linked forward and backward across every account they have appeared on.
• Vehicle and licence data. Registrations, driver records where state law permits sale.

Note the classification trick. LexisNexis states that products in this family are not consumer reports under the Fair Credit Reporting Act, which keeps them outside the disclosure and dispute machinery that governs credit reporting even though credit header data feeds them.

Why Does the Palantir Integration Matter?

Because a search box requires a suspicion first, and a data pipeline does not.

Palantir was awarded roughly $30 million in April 2025 to build ImmigrationOS for ICE, as the American Immigration Council documented, with a total potential value of $159 million if all options are exercised. PenLink, the second application named in the LexisNexis requirement, sells phone location and communications analysis tooling. ICE Data Analytics is the agency's own layer.

Put those three together and the LexisNexis file stops being a lookup and becomes a join key. A phone number surfaced by location tooling resolves to a LexID. That LexID pulls addresses, relatives, prior employers, vehicles. And the stated purpose is not investigation of known cases but "lead development" and identifying fraud "before crime and fraud can materialize," which describes generating suspects rather than checking them.

The obvious objection is that this only affects people ICE is already looking for. History says otherwise. Systems built for one population get queried against others, as the Flock licence plate reader logs showing an officer running his girlfriend's plate 124 times made painfully clear.

Who Should Treat This as an Operational Problem?

Anyone whose work brings them into contact with people a federal agency wants to find.

Immigration reporters, legal aid staff, NGO caseworkers, clinic volunteers. None of these people are targets of this contract on paper. All of them are one hop away from someone who is, and identity graphs exist to traverse hops. A source who calls a reporter from a phone registered in their own name has created a linkable record.

Two further things worth holding together. ICE has confirmed use ofzero click spyware capable of reading encrypted messages, so commercial records and device compromise sit in the same toolbox. And the custodian is not a fortress: LexisNexis was itselfbreached through an account protected by the password Lexis1234. A dossier built about you is also a dossier that can leak about you.

What Can You Actually Do About It?

Less than you would like, and the honest answer starts with the limits rather than the steps.

Credit header sourcing is the hard wall. That data reaches brokers through the credit reporting system, and no general consumer switch removes it. Deletion requests aimed at people search sites take down the public facing profile, not the underlying identity resolution used in a government product. Treat every step below as friction, not erasure.

• File the LexisNexis consumer requests. The company runs a consumer disclosure and rights portal where you can request your file and, in some cases, a security freeze. Request the file first so you know what exists.
• Use California DROP if you qualify. The single request deletion system carries real penalties for brokers who ignore it, and we broke down the fines and deadlines brokers now face. Other states have narrower analogues.
• Check the CFPB list. The bureau publishes a directory of consumer reporting companies including LexisNexis Risk Solutions, with the contact routes each one is obliged to honour.
• Compartmentalise contact details. Separate numbers and separate email addresses per role, never crossed. The value of an identity graph comes from shared identifiers; give it nothing to share.
• Keep new records out. Registered agent services, PO boxes, and trusts for property all slow the rate at which fresh links are minted. Existing records stay.

The Part Worth Remembering

No warrant appears anywhere in this transaction. A commercial firm assembled the file, a purchase order moved it, and the requirements document named the platform it lands in. Coverage that fixates on the $6.7 million misses the sentence about the API, which is the only line in the document that changes what the agency can do.

Buying the file is only one of two channels. The other is compelling it, and there ICE leans on administrative subpoenas that no judge ever signs — paper sent straight to a platform, which the platform is free to push back on.

The posture that follows is unglamorous: assume the file exists, assume it is queryable, and design your contact details and your source protection around that assumption rather than around a deletion form you hope worked.