ICE Awards Thundercat $9.97M for an ITIN Data Subscription Months After Two Courts Blocked the IRS Channel

ICE placed an order with Thundercat Technology LLC whose federal award record reads, verbatim: “THIS ORDER PROVIDES ITIN DATA SUBSCRIPTION SERVICE AND ANALYTICS FOR HSI AGENTS IN FRAUD INVESTIGATIONS.” Award 70CMSD26FR0000045, $9,968,353.56, start date June 8, 2026.

An ITIN — Individual Taxpayer Identification Number — is the number the IRS issues to people who must file taxes but cannot get a Social Security number. In practice it is the identifier of someone who is working, paying federal tax, and is very likely undocumented. It exists because the tax system needed a way to collect from people the immigration system will not recognize.

Two courts had already closed the direct route. On November 21, 2025, Judge Colleen Kollar-Kotelly (D.D.C.) blocked the IRS from further sharing of taxpayer addresses with ICE in Center for Taxpayer Rights v. IRS, finding the arrangement violated the Administrative Procedure Act. On February 5, 2026, Judge Indira Talwani (D. Mass.) went further — a 42-page order blocking the entire program, not merely the address sharing. An appeals court has also found ICE submitted mass requests lacking the identifying information the statute requires for disclosure.

Four months after the second order, ICE bought a subscription to the same category of data on the commercial market.

Why the procurement record matters more than the characterization. Senator Ron Wyden called the arrangement an end-around of both taxpayer privacy law and a court order. That is his characterization, and it is the contested part. What is not contested is the paper: the government’s own award description names ITIN data, names HSI as the consumer, and is dated after both injunctions. A court order binds the IRS’s disclosure of taxpayer records. It does not bind a vendor’s sale of a dataset, because the vendor was never a party. The injunction and the purchase are not in conflict as a matter of law — which is precisely the mechanism. What the state may not compel another agency to hand over, it may be able to buy.

This corpus has recorded the identical structure in the location-data thread: the FBI confirming warrantless purchase of commercial data (March 2026), NPR documenting purchase-instead-of-warrant as a standing practice, and 72 lawmakers demanding a DHS OIG probe. The ITIN contract extends it from where people are to who is paying taxes without status.

Note the vendor. Thundercat is a large federal IT reseller, not a data broker — the federal record shows it as the awarding vehicle for ICE’s ShadowDragon SocialNet, Flashpoint, DarkBlue, and Traffic Jam licenses, and for orders described as “BULK DATA ACQUISITION, ANALYSIS AND SYSTEM INTEGRATION SUPPORT” going back to 2023. The reseller layer means the award description names the capability but not the underlying data source: who actually holds and sells the ITIN records is not disclosed in the contract record.

Sourcing note. The award number, the exact obligated amount, the verbatim description, and the June 8 start date were independently retrieved from USAspending.gov on 2026-09-14 rather than inherited — the capture ledger gave the date as June 5 (the publication date of the 404 Media story) and the amount as “$9.97 million.” June 8 is the award record’s own start date; the rounded figure is close but the exact obligation is $9,968,353.56. The ledger also inverted the two rulings, describing February 2026 as the narrower address-only order; the reporting has it the other way — Kollar-Kotelly’s November order concerned addresses, Talwani’s February order blocked the program. Neither court order was read here, and the case numbers are not recorded; Center for Taxpayer Rights v. IRS is named by FedScoop. The characterization that this contract circumvents those orders is Wyden’s, not a finding — no court has been asked whether the purchase violates them. The identity of the data source behind the subscription is unknown and is the obvious FOIA target.