ICE parked protester photos in a Palantir case database, unsealed filing shows

A partially unsealed court filing made public Friday alleges that DHS agents built dossiers on people watching ICE arrests — photos, license plates, and other identifiers — and stored them in Investigative Case Management, the Palantir-built case system ICE’s Homeland Security Investigations unit uses, WIRED reports. The filing is part of a proposed class action in federal court in Maine by four observers: Elinor Hilton, Colleen Fagan, Polyxenia Pantos, and Carlyn Williams. It was filed under seal in September; a redacted version surfaced Friday.

The spine of the paper is “Operation Catch of the Day,” a Maine immigration surge this past January. One agent, labeled “J.C.” in the filing, created ICM records on at least six observers; the government puts the number at eight. He tagged two people filmed at a Home Depot parking lot “Threat to Law Enforcement, Professional Protestor” and sent photos to Customs and Border Protection for a facial-recognition search through an app called Mobile Query.

ICM is the case-file system HSI agents use to open and track investigations. ICE awarded Palantir the contract to build it in 2014 on the company’s Gotham software, customized for ICE operations. A 2022 five-year support contract was initially valued at up to about $96 million; in 2025 the agency added nearly $30 million for a platform called ImmigrationOS.

On January 20, Pantos briefly watched and photographed a Portland, Maine arrest from a few car lengths away beside a spouse’s car. Hours later, the filing says, J.C. ran the plate through Accurint — a LexisNexis lookup tool for law enforcement that returned Williams’s address, phone numbers, and cohabitants — circulated a photo asking whether that was “the protestor,” then told colleagues he was “adding them in ICM now.” That afternoon he called Williams identifying only as “the Department of Homeland Security.” Williams says he told her to encourage Pantos “not to do anything like that in the future because people who are doing things like that might get added to a domestic terrorism watchlist.” In a deposition, J.C. said he warned she would be arrested if she continued; government attorneys say he denied referencing a domestic-terrorism watchlist.

Subject records agents create in ICM automatically share into CBP’s TECS system as “lookout records” that can pull a traveler into secondary inspection at the border, according to a 2016 DHS privacy assessment cited in the coverage. The filing also describes drive-bys of observers’ homes and at least one observer flagged for secondary inspection until at least January 2027.

DHS calls the case “meritless” and says the lawsuit rests on “the lie that there is a database of ‘domestic terrorists’ run by DHS.” Former acting ICE director Todd Lyons wrote Rep. Maxwell Frost in April that ICE “does not maintain any kind of database of U.S. citizens protesting ICE activities.” Protect Democracy attorney JoAnna Suriani, representing the observers, says the government is treating First Amendment accountability as criminal suspicion. Plaintiffs ask the court to archive Williams’s records, bar use of the collected information against them, and stop Maine agents from watchlist threats and home followings.

This is not the automatic license plate network fight that landed in an Oklahoma courtroom the same news cycle. Flock is a camera vendor selling travel histories to police. ICM is an investigative case file ICE already owns, built by Palantir, that can auto-feed a border lookout. One story is about querying a nationwide plate map without a warrant. The other is about parking a bystander’s face and plate inside a federal case system after they stood a few car lengths from an arrest.

Watching from the curb was enough, the unsealed paper says, to get a plate run, a photo circulated, and a name parked where border officers can see it. That is the First Amendment chill the observers are asking a Maine court to stop — not a theoretical watchlist, but a case file that already behaves like one at the checkpoint.