As the White House pushes to intensify internal leak investigations, Immigration and Customs Enforcement is quietly renewing a cybersecurity contract that governs how employee activity on agency systems is monitored, recorded, and preserved for investigation.
The operation, known as Cyber Defense and Intelligence Support Services, is presented as a routine security effort focused on network monitoring, incident response, and basic security hygiene. But new contract records reviewed by WIRED spell out how ICE is working to expand and enhance the collection of digital logs and device data for internal investigations and law enforcement use.
Records show ICE is moving ahead with a recompete—the process of reissuing and renewing a major federal contract—as Department of Homeland Security leadership expands leak investigations and steps up monitoring of how employees use agency systems. Contract documents outline methods for maintaining comprehensive records of digital activity and using automated tools to flag patterns and anomalies, while more closely linking cybersecurity operations with ICE investigative offices to speed the use of that data in internal casework.
Beyond insider monitoring, the contract describes a broad cybersecurity operation, covering constant surveillance of ICE networks, automated alerts for suspicious behavior, and routine analysis of logs pulled from servers, workstations, and mobile devices. A core requirement is that this data be stored and organized so incidents can later be reconstructed step by step, whether for security reviews or formal investigations.
The work is managed by ICE’s Office of the Chief Information Officer, which runs the agency’s security operations center, but the contract is designed to move information across offices. Cyber findings are meant to be shared with investigative and oversight units, including Homeland Security Investigations and ICE’s Office of Professional Responsibility, which handles employee misconduct. The structure allows digital activity data collected for cybersecurity purposes to be quickly routed into internal inquiries when investigators request it.
ICE did not respond to a request for comment.
The expansion of internal monitoring comes as the Trump administration has framed dissent inside federal agencies as a threat, moving to aggressively identify and remove career officials viewed as ideologically misaligned with the administration, particularly in national security and law enforcement roles.
Since returning to office, the Trump White House has portrayed internal dissent in explicitly loyalty-based terms—as opposed to misconduct, malfeasance, or efforts to deliberately undermine the government—framing political disagreement with the president’s goals as grounds for firing.
