The Data Supply Chain

ICE is paying LexisNexis millions for personal data, and that data feeds Palantir. 404 Media has the contract. That's the story, and it matters more than most things filed under "surveillance scandal" precisely because nothing in it malfunctioned. Every component performed to spec.

Start with what LexisNexis actually sells, because "public records" conjures the wrong picture — a courthouse index, a property deed, something a librarian could hand you. LexisNexis Risk Solutions is an aggregation business. Credit-header data: the identifying top layer of your credit file, which moves under far weaker protections than the financial detail below it. Utility hookups. Address histories. Phone numbers. Vehicle registrations. Relatives, roommates, known associates. A long tail of commercial exhaust you generated by the act of existing inside a market economy. None of it was collected for law enforcement. All of it is available to law enforcement for a fee. And this isn't new — The Intercept documented a roughly $22 million ICE contract with the same vendor back in 2021. The pipe has been running. This is a renewal of plumbing.

Then the second hop. The data doesn't land in a spreadsheet. It goes into Palantir, which has run ICE's case-management stack for years and in 2025 picked up a contract to build out something branded ImmigrationOS. Palantir's product isn't storage; it's resolution. Merging records across sources until scattered fragments cohere into a person, then a household, then a network, then a ranked list of humans an agent should go find.

Now watch the accountability drain at every hop.

A warrant is a thing a judge signs. A subpoena is a thing a court supervises. A purchase order is a thing a contracting officer approves on a Tuesday. It's tempting to call this a workaround — Carpenter said in 2018 that the government needs a warrant for your historical cell-site location, and the market noticed immediately that "compel" and "buy" are different verbs with entirely different paperwork. But that's too generous to the doctrine. Carpenter was explicitly narrow, the Court went out of its way to say so, and courts have largely declined to extend it to commercial brokers. Credit headers and address histories were probably never covered at all. Which is the worse story, not the weaker one: the purchase-order route guarantees we never get the case that would test whether this data should be protected. No compulsion, no defendant, no suppression motion, no doctrine. This isn't an evasion of Carpenter. It's a guarantee that Carpenter never grows. You never have to argue the third-party doctrine when the third party has a sales team.

Then the laundering of error. Broker files are wrong constantly — merged identities, stale addresses, the cousin who used your mailing address once in 2019. In a credit context, a wrong record produces a denied application and a dispute process, grim but nominally contestable. Fed into an entity-resolution system, a wrong record doesn't stay a record. It becomes a match. The match becomes a link in a graph. The link becomes a lead. The lead becomes a door at six in the morning.

That last hop is mine — an inference, not a documented case, and I'm going to mark it as one, because inference delivered in the cadence of a record is the precise thing I'm indicting Palantir for. What isn't inference: provenance dies at the merge. By the time the output renders, there is no field on the screen reading "this connection rests on a utility bill that belonged to somebody else." And this is where the frame holds rather than breaks. The error isn't a malfunction of the system; error tolerance is in the spec. Nobody in this chain is paid for accuracy. LexisNexis is paid for coverage, Palantir for resolution, ICE for arrests. A wrong record propagating cleanly to a door is the system performing exactly as purchased.

The responsibility diffuses just as perfectly, which is the design's real achievement. LexisNexis sells data and makes no arrests. Palantir writes software and selects no targets. ICE runs the operation on what the tools returned. Each link sits exactly one degree from the consequence, and each can say, honestly, that it wasn't them.

Here's the older pattern wearing the new clothes. Public records were made public so that citizens could watch the state — that was the entire architecture, the whole point of the transparency. Aggregation inverts the telescope. The state buys the public record back, refined and cross-linked and inference-ready from a private vendor, and points it at the public. A commons harvested, enclosed, processed, and rented back to the government as an instrument aimed at the people it was built to protect.

But enclosure isn't finally a question of who owns the data. It's a question of who has standing in it. The people inside these files cannot see the record, cannot contest it, cannot exit it, and are not party to any transaction concerning them at any hop in the chain. Standing survives right up to the merge and not one step past it. And notice who is in the files: non-citizens, mixed-status households, people for whom the dispute process was never realistically available and for whom a wrong address is not a denied credit application. The error rate lands hardest exactly where the capacity to object is lowest. That is not incidental to the design — it is what makes the design viable. A market selling this data about people who could afford lawyers would have been regulated a decade ago.

The oversight machinery we have is built for the wrong verb. It watches for the state taking. This is the state shopping — and not even only shopping. Federal money doesn't merely access the aggregation industry; it funds and shapes it. The resolution at which these dossiers exist, the reason it's worth correlating a utility hookup to a vehicle registration to a roommate, is partly a function of who's buying. ICE contracts are a subsidy for building the capability the government then claims to be merely picking up off the shelf.

Prediction: whatever reform eventually arrives will regulate the sale of data to law enforcement, leave the demand-side subsidy entirely intact, and never touch the inference layer — because an inference isn't data, it's a conclusion, and conclusions have no chain of custody. We'll spend years arguing about the invoice while the state keeps paying to build the thing it promised to stop buying, and the thing gets quietly, steadily better at being certain.