On October 6, writing about AI-built dossiers, I imagined the moment "a dossier stops being a document and becomes a subscription, re-run whenever your life changes." That piece put a retail price on the file ("About $500 a month is what that era looks like at retail") and asked who a federal purchase ban would bar from buying it. My answer: "police and intelligence agencies."
This piece is about that buyer — shopping wholesale. Before you file it under outrage, a confession: most of what follows is paperwork. The headline number is a ceiling, the key record is a procurement form, and the label that matters most, "full and open competition," covers a narrower contest in federal law than it suggests in plain English. (Stay with me; the paperwork is the plot.)
In July, Immigration and Customs Enforcement (ICE) planned to award the work to Thomson Reuters Special Services (TRSS) without competition. In August, citing "industry feedback," it dropped that plan. On September 17, 2026, it signed a blanket purchase agreement worth up to $125 million with the same company, and the award record codes it "FULL AND OPEN COMPETITION." ICE said it received just one offer.
Was it a real competition? On paper, yes. Whether anyone else had a realistic shot, the public record can't tell you — and that gap is the story.
What ICE said it wanted in July
Why skip competition at all? ICE's July justification (an agency's written case for a no-bid award) proposed a five-year agreement worth up to $125 million, invoking an exception for unique or highly specialized services only one source can provide.
Hadn't other companies answered the call? They had. More than 50 vendors responded to a 2025 request for information, and ICE's market research initially found seven small and ten large businesses capable of this type of work. Then "HSI's requirement was revised for a proprietary requirement" (HSI is Homeland Security Investigations, ICE's investigative arm), and ICE concluded only TRSS could fulfill it. That sequence, Biometric Update noted, "does not, by itself, establish a violation of federal procurement rules."
So what was the requirement? According to Wired, the document called TRSS "the only contractor" able to provide "continuous monitoring of up to one million individuals and entities," with "real-time alerts" and "model-based risk scoring," plus "real-time alerting on last known location data" for people recently jailed or in contact with law enforcement, and something called "academic risk flagging" that it does not explain. The data, it said, had to be readily accessible to support "the presidential mandate of the identification of Voters Fraud, Immigration Fraud and National Security," as Democracy Docket reported.
(Every one of those phrases comes from the July plan, which ICE withdrew. The final agreement's work statement isn't public.)
A new code, a reversal and one offer
What changed between July and September? First, the code. On August 10, the Department of Homeland Security (DHS) re-coded the requirement under the industry code for credit bureaus in its acquisition forecast, the second re-coding in two months. The forecast describes the work as including "identifying potentially criminal and fraudulent behavior before crime and fraud can materialize." Is ICE buying credit reports? Not necessarily, Biometric Update cautioned; ICE "has not publicly explained its selection," and the change "could enlarge the group of bidders classified as small."
Second, the plan. On August 12, ICE updated its notice: "In response to industry feedback, the government no longer intends to sole source this requirement." The feedback itself was not made public, FedScoop reported.
Third, the award. The record signed September 17 names TRSS, shows "$0.00" obligated, keeps ordering open until September 29, 2031, carries the credit-bureau code and describes the work only as "DATA ANALYTIC SUPPORT SERVICES." Biometric Update called the one-bid outcome "notable," given the reversal "only weeks earlier."
What "full and open" means on a GSA schedule
So how does a one-bid contest earn the words "full and open"? Through the General Services Administration (GSA) schedules — standing contracts that companies hold and agencies order against. This agreement runs against a GSA schedule contract held by TRSS.
By statute, the procedures GSA sets for its schedules count as "competitive procedures," provided participation has been "open to all responsible sources" and orders "result in the lowest overall cost alternative" for the government. Federal acquisition rules agree that using the schedules "is a competitive procedure." So the label is how the law classifies a schedule order — but the contest ran among companies that already hold a schedule contract. Which companies received the final requirement, what ICE changed and why TRSS alone bid are, in Biometric Update's words, "what remains unclear from the public record."
Is one bid unusual? Not very. In 2010, the Government Accountability Office found one-offer competitions steady at "about 13 percent" of obligations in each year it studied, with factors that include "a strong incumbent, sometimes coupled with overly restrictive government requirements" (findings about federal contracting in general). Biometric Update had noted in August that TRSS "could ultimately win," given its "proprietary data, existing ICE integrations and cleared personnel."
What Thomson Reuters says CLEAR holds
What would CLEAR, Thomson Reuters' records platform, know about you? The company's own privacy statement spells out what CLEAR holds: the platform "generally offers access to core identity and vital statistics, including names, government-issued identifiers, driver's-license details, and death records," plus "marriage and voter-registration records," "federal and state court filings," "asset-ownership records" and more, and "law-enforcement subscribers may see more than financial-services users."
The data comes partly from "third-party business partners (including private data providers and data brokers)," and the statement carries a blunt notice: "We may sell your sensitive personal data." It concedes that "under some local data broker laws, we may be deemed a data broker," and a Thomson Reuters company is on California's data broker registry.
Who gets to search it? Its customers "include law enforcement agencies, welfare agencies, accredited financial institutions, law firms, and corporate compliance and fraud prevention teams." You can't — the products "are not licensed to everyone in the general public" — though you can ask for your own records.
(Disclosure: Reuters, the news agency, shares a parent company with the contractor; this piece cites no Reuters reporting.)
One caution: CLEAR is named in the withdrawn July plan, but with the work statement unpublished, no one outside ICE and the company can say which of these records, if any, the agreement covers.
Isn't this what investigators have always done?
The strongest objection is that little of this is new. ICE has bought Thomson Reuters data since 2008, Wired reports. From 2020 to 2025, the defense technology company CACI provided ICE a "continuous monitoring and alert service," with around $106 million obligated, according to FedScoop, and ICE's 2025 request for information said the service "must be able to monitor a million individuals or entities of interest."
Thomson Reuters makes its case plainly: its investigative products "are not surveillance tools and do not have surveillance capabilities." Much of CLEAR's data, "such as court and property records," is "publicly available," and "all of this data is licensable directly from third parties"; CLEAR "does not include information about an individual's citizenship or immigration status"; and its "standard terms do not allow the redistribution of CLEAR data to third parties." It told NPR it bars using CLEAR to find noncriminal immigrants or undocumented people for deportation "solely on the basis of the individual's immigration status," and that "we enforce it." On October 8, ExecutiveBiz reported that TRSS "has announced up to $127.8 million in recent federal contract awards," for work in "fraud detection, financial crime analysis, child exploitation investigations and public safety."
The defense crosses party lines. In 2024, the Biden White House strongly opposed the Fourth Amendment Is Not For Sale Act, calling responsible access to commercially available information "critical to scores of vital missions," including helping victims of child exploitation. That year the Fraternal Order of Police said the data lets investigators "connect the dots."
I take that case seriously. But set two claims side by side. The vendor says its tools "are not surveillance tools"; ICE's July plan described "continuous monitoring" with "real-time alerts." The vendor says its data is licensable from third parties; ICE called TRSS "the only contractor" able to provide the service. Both may be honest descriptions from different ends — and the documents that would settle it aren't public. Asked by FedScoop what safeguards prevent misuse, a DHS spokesperson said: "We will not comment on law enforcement sensitive methods."
In Germany, the threshold comes before the click
What would a rule look like? Germany has one, because its highest court insisted.
On February 16, 2023, Germany's Federal Constitutional Court held that the provisions letting police in Hesse and Hamburg run automated analysis of stored data were unconstitutional "because they do not contain sufficient thresholds for interference," falling "far short of the constitutionally required threshold of an identifiable danger." The powers "allow the police, with just one click, to create comprehensive profiles of persons, groups and circles," the court wrote, and could expose "many persons who are legally innocent" to police measures if the software wrongly flagged them.
Was that a ban? No. "In principle, it can be justified," the court said of automated analysis. What it demanded was order: to let police run the analysis before any identifiable danger exists, the legislature itself must fix "the type and scope of usable data and the permissible data processing methods," and where authorities fill in the details, they must document them and "publish their determinations."
Hesse had bought Palantir's Gotham software in 2017 and run it as hessenDATA, and its police had used the power "thousands of times each year." Hesse's provision could continue to apply, with some restrictions, until September 30, 2023, at the latest. Hamburg's was void.
Then the legislators moved. Hesse's parliament rewrote the law by June 2023 so hessenDATA could keep running. The new text, in force from July 12, 2023, sets tiered thresholds, names the kinds of police data that may be merged, requires an administrative rule that must be published and bars any direct connection to internet services (though results of targeted searches of government registers and individually saved internet records may be added as a supplement). Hamburg's government conceded its rule was not precise enough to ensure proportionality in each case and rewrote it on Hesse's model (in force February 5, 2025).
It is not a tidy success story. In June 2024, the GFF, a civil-liberties litigation group, "lodged a constitutional complaint against the amended Hessian Police Act." That December, Hesse amended the law again and allowed AI systems in the same analysis. As of October 9, 2026, the complaint is still pending.
To be clear, the comparison is between rules: Hesse's provision, as the court described it, applied to "personal data that has already been lawfully obtained" by police, while ICE is buying commercial records and analysis. But the questions Germany made legislators answer (which data, which methods, what threshold, published where) are the ones the American paperwork leaves open. DHS does publish privacy documents: an assessment of HSI's "commercial license plate reader data services" and a records notice whose analysis tools cover datasets "including commercial data and open sources." Neither sets a threshold like Germany's, and I could find no federal statute that does.
Five years of orders, four already placed
The agreement itself obligated "$0.00," but as of October 9, 2026, federal spending records list four orders under it, all signed September 29 and together worth about $7.2 million, each described only as "data analytic support services" for ICE or one of its offices or programs. The scenario below isn't on the public record. It's my extrapolation from documents that exist, and I would be glad to be wrong.
Start with the subscription I imagined on October 6. ICE's July plan described the wholesale edition: "continuous monitoring," "real-time alerts," "real-time alerting on last known location data." Picture an order that buys it for whatever list of people ICE chooses (the July figure was up to one million) and re-runs each file whenever a court docket, a deed or an address changes.
Then put a model on top. ICE's IT office is seeking help with its "enterprise strategy for artificial intelligence and data," including STELLA, a platform that "functions as a large language model" (a separate requirement, outside this agreement). The July plan already listed "model-based risk scoring," and Germany's court warned that such software can "begin autonomously producing further evaluations in the manner of 'predictive policing'." (FedScoop reports ICE recently retired an AI use case that predicted whether noncitizens would try to evade detection; why is unclear.)
Then widen the circle. ICE's July plan said TRSS data would check "school, benefit, immigration and other eligibility requirements," and Thomson Reuters markets CLEAR to school districts for "residency verification." Imagine a residency check, a benefit renewal and an immigration alert drawing on the same file — each defensible alone, together a portrait no one decided to paint.
The split runs through both parties
Who else is uneasy? People who agree on little else.
On the libertarian right, Cato's Patrick Eddington told FedScoop that most of the available research shows "you can't anywhere near consistently predict who is going to turn into a criminal," and software that encourages the belief is "a prescription for constitutional rights violations at scale." Rep. Andy Biggs of Arizona and two fellow Republicans introduced H.R. 7816 in March, a bill that would, among other things, stop law enforcement and intelligence agencies from "obtaining certain commercially available information" (its Title II is the Fourth Amendment Is Not For Sale Act). It "is in the first stage of the legislative process," per GovTrack, and its ban reaches records from communications providers, online accounts and devices, including location information, not obviously the court and property records at CLEAR's core.
From the progressive and civil-liberties side, a coalition including Public Citizen and the ACLU asked two Senate committees in August for that act, oversight hearings and contract transparency, arguing that the government "should not be permitted to purchase their way around the Fourth Amendment." The Center for Democracy & Technology's Jake Laperruque told FedScoop that "lawmakers have given them a bulldozer and simply trusted it will always be someone safe behind the wheel."
Set those voices beside the Fraternal Order of Police and a Democratic White House, and the fault line runs through each party rather than between them.
What does this mean for you?
Ask Thomson Reuters what CLEAR holds on you. The privacy statement linked above lets you request "a copy of your personal information," limited to "the records referring unambiguously to you," and residents of certain states can also opt out of the sale or sharing of their information. Its own caveat applies to all of it: these rights "do not apply to everyone, they are not guaranteed."
Know the deletion limits before you ask. Unless the law requires more, the company typically suppresses records only if you are "a judge, public official, or member of law enforcement," can show a "risk of physical harm" or are a victim of identity theft. It cannot delete what comes from government sources such as court dockets, and if your details change, "you will likely reappear." If an error sits in the source records, it may point you to "the originating source of the data."
Californians: file one DROP request. It reaches every registered broker, the Thomson Reuters company included, and brokers have had to process requests since August 1, 2026. Public records stay out of reach; my October 6 piece explains how to file.
Check your voter registration. Confirm your voter registration status with your state. Election experts and officials have raised concerns that the government's use of commercial data for immigration and election investigations "will lead to false matches," Democracy Docket reported. (No public document shows this agreement touches voter rolls; this is simple prudence.)
Tell your members of Congress which rule you want. Civil-liberties groups want hearings and contract transparency; police groups say the data helps them "connect the dots." Both deserve a hearing, and so does Germany's question: what threshold comes before the click?
Watch the agreement, not the headline. Search its number, 70CMSD26A00000008, in federal spending records. As of October 9, 2026, the largest of the four orders (about $2.7 million) is for ICE's Student and Exchange Visitor Program; none describes the work beyond "data analytic support services," so the next orders, and any work statement ICE releases, are where to look.
The lesson, as I see it
Biometric Update described the August reversal precisely: it "concerns how ICE planned to award the work, not whether the agency still wants the data, monitoring and investigative capabilities described in the deleted document." Whether the final requirement asks for less, the public can't tell. "Full and open" names a procedure; it can't tell you who could realistically bid, or what the agreement lets ICE do with your file.
Germany's court allowed the analysis on conditions: the threshold, the data list and the published rules come first — and even there, the rules have since loosened and face a pending challenge. Here the order runs the other way: a five-year ordering window is open, and whatever limits the agreement sets sit in a work statement the public hasn't seen.
What to watch: the next orders, ICE's AI and data request (responses due October 16), the pending German complaint and a House bill that hasn't moved since March. If I could ask Congress for one thing, it would be Germany's order of operations: publish the requirement, the threshold and the oversight before the next orders. As I wrote in that broker-data piece, building a dossier will keep getting cheaper. Finding out what's in the government's copy shouldn't get harder at the same time.
The paperwork says "full and open." So far, that's the most open thing about it.