Loading story…
A legal dispute is unfolding over DHS efforts to identify an anonymous Instagram/Facebook user who posted about ICE activity, with the account holder (represented by the ACLU of Pennsylvania) arguing the posts are innocuous and protected by the First Amendment. DHS has asserted the group was “stalking and gathering of intelligence” on federal agents involved in ICE operations, while the user argues DHS has not cited any specific post constituting a threat and that reporting or livestreaming publicly occurring immigration operations is constitutionally protected speech. The case includes a motion to quash a subpoena seeking subscriber and account metadata (including contact details and IP-related information), and notes that Meta previously refused to provide identifying information for the accounts.
The dispute is occurring amid heightened public scrutiny of ICE following the reported shooting death of Renee Nicole Good and broader protests, which have increased the visibility and impact of shared footage of ICE operations. Separate federal-court testimony reported in Minnesota adds to the broader context: an FBI special agent’s sworn testimony reportedly contradicts an ICE agent’s prior under-oath account in a related enforcement incident and raises questions about whether the ICE agent followed training during the interaction that preceded Good’s killing, further intensifying attention on ICE conduct and the public’s efforts to document it.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
An anonymous individual identified as Doe, represented by the ACLU of Pennsylvania, sought to quash the DHS subpoena for identifying information tied to Facebook and Instagram accounts posting ICE sightings. Doe argued the posts were protected First Amendment activity and that DHS had not identified any specific threats or criminal conduct.
Meta refused to turn over the requested subscriber and access data absent additional information from DHS and gave the anonymous account holder an opportunity to challenge the subpoena. This enabled the user, represented by the ACLU of Pennsylvania, to move to quash the demand.
DHS sought subscriber and access information tied to certain Facebook and Instagram accounts associated with posts about ICE sightings. DHS claimed it had received information alleging the accounts were stalking or gathering intelligence on federal agents involved in ICE operations.
Amid scrutiny over Ross's conduct in the Muñoz-Guatemala incident and the later shooting death of Renee Nicole Good, DHS publicly defended Ross's actions. The FBI did not immediately comment, according to the report.
In federal court in Minnesota, FBI special agent Bernardo Medellin testified that he heard most or all of the June encounter and never heard Muñoz-Guatemala ask for a lawyer, contradicting a key claim Jonathan Ross had made under oath. Ross also conceded it was fair to say he had not previously made that claim in interviews or pretrial preparation.
During a June enforcement encounter in Minnesota, ICE agent Jonathan Ross and other agents attempted to apprehend detainee Roberto Carlos Muñoz-Guatemala. The incident later became central to federal court testimony about what was said during the stop and whether agents followed safe positioning practices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting indicates the U.S. Department of Homeland Security (DHS) has significantly increased its use of **administrative subpoenas**—which do not require judicial approval—to obtain identifying information for anonymous social media accounts that criticize **ICE** or post information about ICE agent locations. According to the New York Times (as cited by TechCrunch), DHS sent **hundreds** of subpoenas to major platforms including **Google, Meta, Reddit, and Discord**, and some companies reportedly complied in at least some cases; Google said it notifies users when possible and challenges subpoenas it views as **overbroad**. Separately, a court filing disclosed that the **IRS improperly overshared** immigrants’ personal data with DHS/ICE under an April 2025 IRS–DHS data-sharing arrangement intended to support certain non-tax criminal investigations under **IRC Section 6103** exceptions. After ICE requested **1.28 million** addresses, the IRS could verify **47,289** individuals, and for a subset (reported as **under 5%** of verified matches) the IRS mistakenly provided ICE with **additional address information** beyond what ICE had supplied, raising concerns that the interagency data-sharing deal increased exposure of sensitive taxpayer information.
Jun 29, 2026
The US Department of Homeland Security has reportedly used **administrative subpoenas** to pressure tech companies to disclose identifying data about anonymous accounts and individuals critical of the Trump administration, including accounts sharing information about local **ICE immigration raids**. The reporting highlights that administrative subpoenas—unlike judicial subpoenas—do not require a judge’s approval and can seek metadata and account-identifying details (e.g., login times, devices, and associated email addresses), raising concerns about oversight and potential chilling effects on speech. Separately, the anti-ICE alert service **StopICE** reported its app and website were attacked, with users receiving texts claiming their information had been “compromised and sent to the authorities,” alongside disparaging messages about the developer. StopICE administrators and the developer disputed claims that sensitive personal data (names, addresses, GPS/location histories) was stolen, stating the service does not collect/store that information, while also noting the platform faces heavy hostile activity including frequent **DDoS** attempts; the service blamed a **US Customs and Border Protection (CBP)** agent for the attack, though that attribution was not independently confirmed in the reporting.
Jun 29, 2026
Lawyers from the Electronic Frontier Foundation (EFF) are representing three US labor unions in a lawsuit against the Trump administration, challenging a social media surveillance program that they argue infringes on First Amendment rights. The unions claim that the program, which requires nearly all US visa applicants to disclose all social media handles used in the past five years, has had a chilling effect on free speech and union engagement. This policy, implemented under the Trump administration but proposed during the Obama era, also mandates that noncitizens on F, M, and J visas make their social media accounts publicly viewable. The surveillance initiative, known as "Catch and Revoke," is a collaborative effort between the Department of Homeland Security, the State Department, and the Department of Justice, and uses AI to monitor visa holders' social media for expressions of support for Hamas, Palestine, or antisemitism. Individuals found to express views deemed anti-American or non-conforming risk having their visas or immigration benefits revoked. In a related legal development, a federal court in Massachusetts ruled that the executive orders underpinning these surveillance measures were unconstitutional, temporarily halting enforcement actions based on social media activity. The government is expected to appeal this decision. Separately, the Trump administration has been accused of pressuring Facebook to remove a large group page used to track and publicize the locations of ICE agents in Chicago. The Department of Justice contacted Meta after reports that the group, which had over 84,000 members, was being used to dox ICE agents, leading Facebook to remove the group for violating its policies against coordinated harm. Attorney General Pam Bondi stated that the DOJ would continue to work with tech companies to eliminate platforms that could incite violence against federal law enforcement. The White House has claimed a dramatic increase in attacks on ICE officers, though independent reporting has found no public evidence to support the scale of these claims. Meta, Facebook's parent company, confirmed the removal of the group but did not specify the exact policy violation. The actions taken by both the government and social media platforms highlight the intersection of immigration enforcement, online speech, and civil liberties. These developments have raised concerns among advocacy groups about the potential for overreach and the suppression of lawful dissent. The ongoing legal battles and policy debates underscore the contentious nature of social media monitoring in the context of US immigration and law enforcement. Both the surveillance program and the removal of online groups reflect broader efforts by the Trump administration to control narratives and activities related to immigration on digital platforms. The outcomes of these legal and policy actions are likely to have significant implications for privacy, free expression, and the rights of both citizens and noncitizens in the United States.
Jun 29, 2026