The Unchecked Box on ICE's Subpoena

Introduction

On February 19, 2026, DHS served a Form 3115 administrative summons on Reddit demanding subscriber data, IP addresses, device identifiers, and "any credit card or bank account number" tied to a single account: "Tired_Thumb." The form has a checkbox for child exploitation cases. On this summons, the box is blank. The legal authority printed at the top is "section 509, Tariff Act of 1930," a 1930 customs statute. The target is a U.S. citizen in Oregon who posts political speech on Reddit.

Reporting has described this tool as "formerly reserved for child trafficking cases." The government's own form has a dedicated field for that, and it is empty. The field above it carries the boilerplate "to ensure compliance with the laws or regulations administered by CBP and ICE."

This is how DHS built an unaccountable system to silence online critics of immigration enforcement: a 1930 customs statute that requires no judge, served on tech platforms that sometimes comply before any legal challenge can land. Every time someone files a motion to quash, DHS withdraws before a court can rule — and the program continues, intact, until the next subpoena.

A 1930 Customs Law and the Withdrawal Playbook

The authority being cited is 19 U.S.C. § 1509, enacted as part of the Tariff Act of 1930. The statute authorizes customs investigators to subpoena records for "ascertaining the correctness of any entry, for determining the liability of any person for duty, fees and taxes." It was written to investigate merchandise import violations. A Reddit account posting about ICE has no entry to ascertain and no duties to liability-check.

According to the Civil Liberties Defense Center's motion to quash, filed March 12, 2026, DHS added language to the summons that does not appear in the statute itself, claiming authority "to ensure compliance with the laws or regulations administered by CBP and ICE" — a mandate the statute's text does not contain. The Reddit user's posts the government was investigating contained no threats, no incitement to violence, no customs violation, and no other criminal element the summons identifies.

DHS then withdrew the administrative subpoena on March 27, fifteen days after CLDC filed. Four days after that, federal prosecutors in Washington, D.C. issued a grand jury subpoena for the same data, dated March 31, 2026, with a compliance deadline of April 14. CLDC filed a motion to quash on April 18, where it sits pending. EFF senior counsel David Greene told The Intercept the obvious thing about the escalation: "We should be very, very, very concerned that they've now taken one of these to a grand jury." Grand jury proceedings happen in secret with fewer procedural rights for the target, so when the administrative pathway produced an unfavorable court trajectory the government moved the same data demand to a process the public cannot watch.

A Pattern of Withdrawn Subpoenas Across Four Platforms

Tired_Thumb fits inside a much larger pattern. EFF's FOIA suit against DHS, filed April 22, 2026, lays it out: "Beginning in early 2025 and continuing to the present, DHS and ICE have issued administrative subpoenas under 19 U.S.C. § 1509 to technology companies, internet platforms, and service providers, including Google, Meta, Reddit, and Discord." The NYT puts the scale in the hundreds, sourced to four government officials and tech employees. The same complaint states the silencing mechanism plainly: "DHS and ICE have repeatedly withdrawn subpoenas before any court could rule on their legality, thereby evading judicial review. No court has sustained the use of 19 U.S.C. § 1509 authority in this context."

MontCo Community Watch ran the same way. On September 11, 2025, DHS served two summonses on Meta demanding identities and IP addresses for managers of a bilingual Facebook and Instagram page in Montgomery County, Pennsylvania, with about 10,000 followers. The page posted ICE sighting alerts. Meta gave the users a 10-day window to file in court. The ACLU filed an urgent motion to quash in October, and DHS withdrew the subpoenas without a ruling on legality.

Then there's the Canadian. On or about February 9, 2026, DHS served a § 1509 customs subpoena on Google targeting a Canadian citizen who has not entered the United States since 2015, per the complaint filed May 4 by ACLU DC and ACLU of Northern California. The Canadian posts criticism of Trump under a pseudonym, with the posts receiving over 100,000 views. DHS demanded "all records and other information relating to the Account(s) and any associated accounts," including his physical location movements and website visits. The statute governs U.S. merchandise imports; the target is a foreign national who hasn't set foot in the country in over a decade.

Google Already Handed Over Someone Else's Data

Google has a stated policy of notifying users when the government requests their data, with documented exceptions for emergencies and legal gag orders. In April 2025, DHS served Google with a § 1509 customs subpoena targeting Amandla Thomas-Johnson, a Cornell PhD student who had attended a pro-Palestinian protest on campus. ICE asked Google informally (no legally enforceable gag order attached) not to notify him.

Google complied. On May 8, 2025, Google handed ICE his IP addresses, phone numbers, subscriber identifiers, and the credit card and bank account numbers linked to his account. He learned later. The ACLU's published Know Your Rights document on ICE administrative subpoenas, dated April 17, 2025, states plainly that gag instructions on these subpoenas "have no legal effect" and that recipients "are free to notify the target." With no legal obligation to stay silent, Google stayed silent anyway. EFF filed deceptive trade practice complaints with the California and New York attorneys general on April 14, 2026, alleging that the public-facing notification policy is materially deceptive when ICE can override it with an informal request.

For scale, Google received 28,622 government legal requests in the first half of 2025, and Meta received 14,520 in the same period.

The 2017 Memo That Already Said This Was Out of Bounds

In 2017, CBP used the exact same statute (19 U.S.C. § 1509) to issue an administrative subpoena to Twitter demanding the identity of an anonymous account, @ALT_USCIS, that was posting government employee dissent. Twitter sued, and CBP withdrew within 24 hours. The resulting OIG-18-18 report, published November 16, 2017, concluded: "CBP's purpose in issuing the summons to Twitter was unrelated to the importation of merchandise or the assessment and collection of customs duties. Accordingly, CBP may have exceeded the scope of its authority under Section 1509." The same audit found CBP had used these summonses in 43 drug-smuggling cases between January 2015 and May 2017, roughly 20% of all summonses in that window, none involving merchandise import violations. CBP concurred with all three OIG recommendations to fix its guidance.

DHS is now running the same play eight years later with broader targets and in greater volume — and the 2017 OIG report is binding on nothing, because Twitter's lawsuit settled when CBP withdrew and no court ever ruled on the underlying statutory question. The program continues precisely because the accountability gap was never closed.

Who Benefits

DHS and the political administration get silencing. The MontCo Community Watch account posted real-time ICE sighting alerts that helped community members avoid enforcement. The Tired_Thumb account shared biographical details about an ICE agent in the aftermath of a fatal Minneapolis shooting; The Intercept characterized the user's posts as "the most aggressive posts they could find" by DHS attorneys. None of these targets has been prosecuted for any customs violation, because there are no customs violations to prosecute. The goal is identifying who is operating these accounts so the operator stops, or the next person hesitates before starting one.

PenLink and the surveillance contracting layer get money. The same warrant-bypass logic operates at the physical-device level. DHS gave PenLink a $2.3 million no-bid contract in September 2025 for its Webloc and Tangles products, followed by a $2.9 million no-bid contract in April 2026 for PenLink PLX with a potential ceiling of $8.3 million. Webloc harvests commercial advertising data on up to 500 million mobile devices globally, with historical lookback of up to three years. The revolving-door pathway is documented: James Dinkins ran Homeland Security Investigations from 2010, moved to Thomson Reuters Special Services in 2014, became TRSS CEO from 2019 through 2025 (TRSS secured $118.7 million in ICE contracts during his tenure per PRISM's procurement tally), and joined PenLink's board of advisers in 2024.

Google gets to keep ICE happy without legal exposure. Refusing an informal "request" not to notify creates friction with a major federal customer; complying produces no public record and no user complaint until much later, if ever. The EFF state AG complaints are an attempt to put a cost on the silent-compliance side of that ledger.

What Congress and Civil Society Are Doing About It

Members of Congress have started writing letters. The Wyden letter to the DHS OIG went out March 3, 2026, signed by 72 members of Congress and specifically referencing the 2017 finding while requesting a new investigation. The same day, Reps. Kelly and Jayapal sent a letter to tech companies signed by 28 members asking how they handle DHS administrative subpoenas. The EFF and ACLU open letter, published February 2026, asks ten major platforms to require a court order, give users notice, and resist gag instructions. None of those letters compels a single company to change its compliance posture. Whether anything moves depends on platforms deciding the cost of compliance has gotten higher than the cost of refusal.

What Happens Until a Court Rules

Anyone with a Google account, a Reddit account, a Discord login, or a Meta profile sits inside the operational scope of this program. The bank account number linked to a Google account can be handed to ICE under a 1930 customs law with no judge in the room, no warrant required, no notification sent to the account holder, and no public record that a demand was ever made. Google has already done it once and told nobody. DHS knows the statute does not authorize this because its own inspector general wrote the memo nine years ago. The current administration is running the program anyway, withdrawing every subpoena that produces a lawyer and escalating to secret grand jury process when the administrative route hits resistance.

The unresolved question is which platform refuses first on its own initiative, and which state attorney general calls Google's silent compliance a deceptive trade practice. CLDC's motion to quash the Tired_Thumb grand jury subpoena is pending in Washington, D.C. EFF's FOIA suit will, eventually, force DHS to disclose how many of these subpoenas have actually been issued. Until one of those produces a ruling, accounts stay in scope and the compliance call gets made behind closed doors at each platform.