Leaked Memo Discloses ICE Contract With ZeroFox to Scrub Agent Identities From the Web

A leaked internal memo signed by Acting ICE Director David Venturella, reported by The Intercept on September 2, 2026, disclosed a contract awarded to the AI cybersecurity firm ZeroFox in July 2026. The federal award record shows $13,000,000 obligated (USASpending 70CMSD26C00000006, signed 2026-07-10); see the note on the dollar figure below. The contract establishes a “Doxing Mitigation Initiative” that continuously scans social media, the surface web and the dark web to find and remove ICE personnel’s personal information from public view. It routes through the Homeland Security Investigations Office of Intelligence.

Set beside the rest of this agency’s procurement record, the contract describes a directional asymmetry rather than a contradiction. The same agency assembling bulk identity infrastructure on the public — the LexisNexis-to-Palantir pipeline of August 2026, the September pre-solicitation for recurring nationwide voter-file acquisition — is separately paying to make its own officers unfindable. Surveillance capacity accumulates in one direction while identifiability is engineered out in the other.

Personal-safety concerns for federal officers are real and are not the question this entry records. The question is what a continuous scrub-and-remove capability does to identification of agents in the specific contexts where identification is the mechanism of accountability: a wrongful-death claim, a civil-rights suit, a journalist confirming who was present at an operation. Those are the cases in which a name in a public record is the only durable link between an act and the person who performed it.

The disclosure came via a leaked memo and a whistleblower, not a public announcement — which is itself the pattern. The award had been running for roughly two months before it became publicly known.

The dollar figure — RESOLVED 2026-09-15 against the federal award record.

USASpending award 70CMSD26C00000006: recipient ZEROFOX INC (UEI TQDAJ722E397) as a direct prime, not through a reseller; $13,000,000 obligated; DEFINITIVE CONTRACT, FIRM FIXED PRICE; signed 2026-07-10, period of performance 2026-07-13 to 2027-07-12 (potential end identical — no option years); FULL AND OPEN COMPETITION AFTER EXCLUSION OF SOURCES, negotiated proposal, 3 offers received; NAICS 541519, PSC 7B20; awarding office ICE Investigations and Operations Support, Dallas.

So: $13 million is confirmed. The $14.57 million figure does not appear in the federal record and should not be used. The ledger’s “roughly $13 million obligated” was right; its award figure was not. The July award date the Intercept reported is confirmed to the day.

A discrepancy that matters more than the number. The federal description reads: “THIS AWARD PROVIDES ICE HOMELAND SECURITY INVESTIGATIONS OFFICE OF INTELLIGENCE WITH SOFTWARE LICENSES IN SUPPORT OF ONGOING LAW ENFORCEMENT OPERATIONS AND INVESTIGATIONS.” The phrase “doxing mitigation” appears nowhere in it, nor does any reference to removing personnel information.

The HSI Office of Intelligence routing matches the leaked memo exactly, and the award value, date and recipient all corroborate. But the public procurement record describes this as law-enforcement software licensing. Two readings are open and this entry does not choose between them: the Doxing Mitigation Initiative may be one funded activity under a broader license purchase, or the procurement description may be generic to the point of being uninformative. Per feedback_absence_in_wrong_document, the contract description is not the document that would settle what the money buys — the statement of work is, and it is not public.

So the citable form is: ICE awarded ZeroFox a $13M firm-fixed-price contract through HSI’s Office of Intelligence in July 2026; a leaked internal memo reported by The Intercept describes a Doxing Mitigation Initiative operating under it. Do not write that the federal record describes a doxing contract. It does not.

Sourcing note, updated 2026-09-15. The existence, value, date, recipient and HSI routing of the contract are now independently confirmed against the federal award record (above). What still rests on the single tier-1 report — The Intercept, from a leaked memo it obtained — is the characterization of what the contract does: the Doxing Mitigation Initiative, the continuous surface/dark-web scanning, and Venturella’s signature. Those are reported, not verified. The remaining documentary route is a FOIA for the statement of work, which would establish whether removal requests cover officers' conduct in an official capacity or only home-address-class personal data. That distinction is not established and is load-bearing for any piece using this entry.