For almost as long as it has existed, Immigration and Customs Enforcement (ICE) has drawn criticism for the methods by which its agents pursue and remove undocumented migrants. But a new report published Tuesday sheds new light on the extent to which the agency has expanded its domestic surveillance apparatus over the course of its 19-year history.

The report, from a group of researchers at the Georgetown Law Center on Privacy & Technology, paints a picture of an agency that is able to access the personal information of hundreds of millions of Americans and does so largely without accountability through extensive deals with private data brokers.

According to details in American Dragnet: Data-Driven Deportation in the 21st Century, ICE has used a combination of public records and privately acquired information to build a surveillance system that can investigate the majority of US adults with little oversight. The agency now has access to the driver’s license data of three-quarters of US adults (74 percent) and has already run facial recognition scans on the license photographs of 1 in 3 adults (32 percent). And when three out of four adults hooked up utilities like gas, water, and electricity in a new home, ICE was able to automatically update their new address.

“ICE consistently paints itself as an agency whose efforts are really focused or targeted, but we’re not really seeing that at all,” Nina Wang, a policy associate at Georgetown Law and co-author of the report, told The Verge. “Instead, what we’re seeing is that ICE has built up a sweeping surveillance infrastructure that’s capable of tracking almost anyone seemingly at any time. These initiatives were conducted in near-complete secrecy and impunity, sidestepping limitations and flying under the radar of most state officials. And ultimately, these surveillance tactics cross legal and ethical boundaries.”

The report was compiled from the results of hundreds of freedom of information requests sent to state agencies across the country and a review of more than 100,000 ICE spending contracts. In combination, these documents were used to evaluate the type of information being made available to ICE and the nature of the technology being used to process it.

The results help to illuminate the full scope of ICE’s surveillance capabilities for the first time, giving numbers to quantify the extent of programs that have been uncovered by prior research from organizations like the National Immigration Law Center or the ACLU.

Some of the findings add context to surveillance techniques that have already received public attention, like the use of data from utility companies in immigration enforcement — a practice that has been criticized for its potential to cut off undocumented migrants from enjoying basic services like power, water, or telephone connections.

The report also highlights the extent to which ICE also obtains data directly and indirectly from government services like state motor vehicle departments. Currently, 16 states and the District of Columbia allow undocumented immigrants to apply for driver’s licenses, but the Georgetown report finds that ICE can search through these records without a warrant in at least five of the 17 jurisdictions.

“The mass collection of data by ICE and other law enforcement agencies poses a tremendous risk and has a chilling effect on people accessing critical public services,” said Zach Ahmad, senior policy counsel for the New York Civil Liberties Union. “Our most vulnerable won’t be protected from perpetual surveillance, tracking, and the threat of arrest or deportation until we pass fundamental digital privacy protections and give people control over their data.”

While lawmakers in some states have passed laws to restrict ICE’s access to information from government bodies, the immigration agency has frequently been able to skirt such legislation by contracting with third-party data brokers to obtain the same information indirectly. The report cites a particularly stark example from Oregon: shortly after the state passed a law to prevent ICE from accessing driver’s license data in 2019, Oregon’s Department of Motor Vehicles signed an agreement to sell data to Thomson Reuters and LexisNexis, both of which provide data services to ICE.

Civil liberties organizations have raised concerns about the danger of public-private surveillance deals for years, but recently, the role of private companies in ICE’s monitoring operations has come under increasing scrutiny thanks to efforts from groups like the Latinx social justice nonprofit Mijente, which has led a push for organizations to end contracts with ICE.

The new report outlines “one piece of the massive puzzle that is ICE digital surveillance and policing,” Cinthya Rodriguez, an organizer at Mijente, told The Verge. “We’re calling on local governments to investigate and ultimately cut contracts that share our personal information with ICE leading to detention and deportations.”

Canadian media conglomerate Thomson Reuters is one organization that has been spotlighted by Mijente’s work and now in the American Dragnet report. Thomson Reuters formerly contracted with ICE to provide access to a huge database known as CLEAR, though the contract was allowed to expire in 2021 after the Canadian company faced pressure from activist investors.

In an email sent to The Verge, Dave Moran, head of communications at Thomson Reuters, confirmed that ICE no longer had access to the CLEAR database but said that the media company still maintained other contracts with the agency.

“Thomson Reuters is engaged by DHS-ICE to support the agency’s investigations involving crimes such as terrorism, national security cases, narcotics smuggling, organized crime, transnational gang activity and human trafficking,” Moran said. “For example, during the Miami Super Bowl, our work with ICE assisted law enforcement officials in saving over 20 human trafficking victims.”

But in a sign of how difficult it is to prevent a federal agency like ICE from accessing private data, the expired Thomson Reuters contract was quickly replaced by a deal with LexisNexis, which signed a $16.8 million contract with ICE in 2021. The details of the LexisNexis contract reportedly give ICE access to billions of public and private records, including credit history details, license plate images, and cellular phone subscriber information.

A request for comment sent through LexisNexis’ media contact form had not received a response by time of publication.

Privacy advocates hope the report will spark renewed discussion of the appropriate scope of ICE’s role in American life. “ICE continues to harvest data on millions of Americans from data brokers. It’s long past time for lawmakers to make clear that ICE and police can’t buy their way around the Fourth Amendment,” said Albert Fox Cahn, founder and executive director of the Surveillance Technology Oversight Project. “You shouldn’t be able to use tax dollars to buy our Constitutional rights. And no one should fear that they’ll face deportation simply for signing up for home electricity or buying a cellphone.”

Phone calls made to the ICE Office of Public Affairs went unanswered. The agency had not responded to email questions sent by The Verge at time of publication.