{"schemaVersion":1,"meta":{"title":"SpyLedger procurement and oversight","reviewedOn":"2026-09-09","scope":"Institutional procurement, acquisition disclosures, oversight and policy. Each record preserves its source attribution and date basis. No individual device, location or targeting data.","license":"CC BY 4.0","coverage":"A curated starting set of U.S. procurement, agency disclosures and oversight records. It is not a complete inventory of surveillance purchases.","landing":"https://ai-analytics.org/voidly/spyledger/procurement/","endpoint":"https://ai-analytics.org/spyledger/procurement.json","counts":{"records":7,"events":13,"sources":11,"awards":1},"amountNote":"Amounts are reported obligations for identified awards, not payments or product-level revenue. No cross-record total is calculated.","statusNote":"Status is the last documented position in the cited sources. Reported decisions, checked status snapshots and confirmed award records remain distinct."},"sources":[{"id":"oig-23-61","title":"CBP, ICE, and Secret Service Did Not Adhere to Privacy Policies or Develop Sufficient Policies Before Procuring and Using Commercial Telemetry Data (REDACTED)","publisher":"Department of Homeland Security Office of Inspector General","url":"https://www.oig.dhs.gov/sites/default/files/assets/2023-09/OIG-23-61-Sep23-Redacted.pdf","reviewedOn":"2026-09-09","locator":"PDF pages 1–4: cover, signed memorandum and highlights. The signed report is dated September 28; the official index lists September 29.","kind":"inspector_general","documentDate":"2023-09-28","sha256":"900593ff516765d82f41bb69c6f889a9ac3657cd8f61d135517cc7caa66ff448"},{"id":"cbp-pia-080","title":"DHS/CBP/PIA-080 CBP Commercial Telemetry Data Evaluation","publisher":"Department of Homeland Security / U.S. Customs and Border Protection","url":"https://www.dhs.gov/sites/default/files/2024-08/24_0812_priv_pia-cbp-080-commercial-telemetry.pdf","reviewedOn":"2026-09-09","locator":"PDF pages 1–2: cover, abstract and introduction. Describes an evaluation from December 2018 through September 19, 2023.","kind":"agency_document","documentDate":"2024-08-12","sha256":"f56c3101bbe6ec90868a51bed96a5483b89e8962cb82ea1873408d449268f8fb"},{"id":"ice-award","title":"Award 70CMSD25P00000138","publisher":"USAspending.gov / U.S. Department of the Treasury","url":"https://api.usaspending.gov/api/v2/awards/CONT_AWD_70CMSD25P00000138_7012_-NONE-_-NONE-/","reviewedOn":"2026-09-09","locator":"Fields: piid, description, total_obligation, date_signed, recipient, awarding_agency and period_of_performance. Dynamic award response.","kind":"award_record","documentDate":null,"sha256":"42888b31ee3bc41ed9dd1bf178c2a5176a0dcec357126b0a11b0e5ff69e1bb05"},{"id":"wyden-oig-request","title":"Letter requesting a second DHS OIG investigation of commercial location-data purchases","publisher":"Members of the U.S. Congress; published by the Office of Senator Ron Wyden","url":"https://www.wyden.senate.gov/imo/media/doc/wyden_letter_to_dhs_oig_on_ice_purchasing_location_datapdf.pdf","reviewedOn":"2026-09-09","locator":"PDF pages 1–3: requested investigation and discussion of recommendation 8.","kind":"congressional_account","documentDate":"2026-03-03","sha256":"415832ab78cafc1fe9719dea8c8088c9efd97d74886817aeda988500e9ee04d2"},{"id":"atf-congressional-announcement","title":"Wyden, Cloud Secure Major Privacy Victory as ATF Cancels Warrantless Location Data Contract","publisher":"Office of U.S. Senator Ron Wyden","url":"https://www.wyden.senate.gov/news/press-releases/wyden-cloud-secure-major-privacy-victory-as-atf-cancels-warrantless-location-data-contract","reviewedOn":"2026-09-09","locator":"June 26, 2026 announcement, opening two paragraphs. Reports a June 18 notification by ATF.","kind":"congressional_account","documentDate":"2026-06-26","sha256":"4d2cbca1af0bcf5ccb3aabdad8f63c55c482ce781a5c59df60158dd95b08cf47"},{"id":"oig-report-index","title":"OIG-23-61 report index","publisher":"Council of the Inspectors General on Integrity and Efficiency / Oversight.gov","url":"https://www.oversight.gov/reports/audit/cbp-ice-and-secret-service-did-not-adhere-privacy-policies-or-develop-sufficient","reviewedOn":"2026-09-09","locator":"Date Issued and Report Description. Index date differs by one day from the signed PDF.","kind":"inspector_general","documentDate":null,"sha256":"dcaff0f1c69dd7b0e58731418b189725813d55e324481434715f6e0a607be6ab"},{"id":"oig-recommendation-1","title":"DHS - OIG-23-61 - 1","publisher":"Council of the Inspectors General on Integrity and Efficiency / Oversight.gov","url":"https://www.oversight.gov/reports/audit/cbp-ice-and-secret-service-did-not-adhere-privacy-policies-or-develop-sufficient-0","reviewedOn":"2026-09-09","locator":"Recommendation Number 1 and Recommendation Status. Closure date and rationale are not supplied.","kind":"inspector_general","documentDate":null,"sha256":"00818d3e7af9150a9bc649d403ca3d9dd081f779bcfcd7c8da882b3560a2a846"},{"id":"oig-recommendation-8","title":"DHS - OIG-23-61 - 8","publisher":"Council of the Inspectors General on Integrity and Efficiency / Oversight.gov","url":"https://www.oversight.gov/reports/audit/cbp-ice-and-secret-service-did-not-adhere-privacy-policies-or-develop-sufficient-7","reviewedOn":"2026-09-09","locator":"Recommendation Number 8 and Recommendation Status. No dated implementation history is supplied.","kind":"inspector_general","documentDate":null,"sha256":"f174edd1a4dc06422e3199877967dc84044713a9e2c978979d6bef2852f53d7c"},{"id":"dia-20210115-memo","title":"Clarification of information briefed during DIA’s 1 December briefing on CTD","publisher":"Defense Intelligence Agency","url":"https://www.wyden.senate.gov/imo/media/doc/011521%20CTD%20Discussion%20RFI%20Response_redaction.pdf","reviewedOn":"2026-09-09","locator":"PDF pages 1–2: answers to Questions 1 and 2; memorandum U-21-0002/OCC-1.","kind":"agency_document","documentDate":"2021-01-15","sha256":"d7b37a5fe96d3f0bc64a57610aa0d5ca728e8b3cb4f7dc593ca64288232dbe10"},{"id":"nsa-20231211-letter","title":"NSA letter to Senator Wyden regarding commercially available information (attached to January 25, 2024 release)","publisher":"National Security Agency","url":"https://www.wyden.senate.gov/imo/media/doc/signed_wyden_letter_to_dni_re_nsa_purchase_of_domestic_metadata_and_ftc_order_on_data_brokers_with_attachments.pdf","reviewedOn":"2026-09-09","locator":"PDF pages 4–5: signed NSA letter dated December 11, 2023, especially the paragraph continuing onto page 5.","kind":"agency_document","documentDate":"2023-12-11","sha256":"a629054429d07e161e23f77b1805df5ab4bffeb9922f2afd3d8c5cbff5152045"},{"id":"odni-icpm504-20250206","title":"Intelligence Community Policy Memorandum 504 (01), technically amended February 6, 2025","publisher":"Office of the Director of National Intelligence","url":"https://www.dni.gov/files/documents/ICPM/ICPM-2024-504-01-IC-Policy-Framework-for-Commerically-Available-Information-Tech-Amendment-Feb2025.pdf","reviewedOn":"2026-09-09","locator":"PDF page 1: technical amendment; page 2: replacement clause A.2; pages 12–13: reporting requirements and original signature.","kind":"policy_document","documentDate":"2025-02-06","sha256":"f81210d4074e3c6db292a70b7a2ee6a9b1b55da83ff9cb07fe9dacb33ea1d50e"}],"records":[{"id":"atf-webloc","kind":"procurement","title":"ATF’s reported decision to end its Webloc contract","agencies":[{"id":"atf","name":"Bureau of Alcohol, Tobacco, Firearms and Explosives","shortName":"ATF"}],"companies":[{"name":"Penlink","role":"Vendor named in the congressional account; legal entity not resolved","sourceIds":["atf-congressional-announcement"]}],"products":["Webloc"],"identitySourceIds":["atf-congressional-announcement"],"summary":"A congressional announcement reports that ATF decided to terminate a Penlink Webloc contract and review other vendors’ use of advertising-derived data.","status":{"label":"Termination decision reported","asOf":"2026-06-26","qualification":"Lawmakers report the agency’s decision. A contract modification confirming termination and its effective date has not been located in this collection.","sourceIds":["atf-congressional-announcement"],"kind":"reported_decision"},"award":null,"events":[{"id":"atf-notification","date":"2026-06-18","dateBasis":"reported_event","title":"ATF reportedly informs lawmakers","detail":"The June 26 announcement says ATF informed lawmakers on June 18 that it had decided to terminate its Penlink Webloc contract. June 18 is a reported notification date, not a verified contractual end date.","evidenceType":"congressional_account","sourceIds":["atf-congressional-announcement"]},{"id":"atf-announcement","date":"2026-06-26","dateBasis":"document","title":"Decision made public","detail":"The announcement describes the termination decision and an agency commitment to review other vendor contracts for data sourced from advertising technology.","evidenceType":"congressional_account","sourceIds":["atf-congressional-announcement"]}],"established":[{"text":"The congressional account explicitly names ATF, Penlink and Webloc.","sourceIds":["atf-congressional-announcement"]},{"text":"The same account describes a promised review of other vendor contracts; it does not establish completion of that review.","sourceIds":["atf-congressional-announcement"]}],"unknown":["The award identifier, exact contracting entity, price and termination modification are not supplied in the reviewed source.","The effective termination date and completion of the broader vendor review remain unverified."],"relatedIds":["ice-cobweb-tangles","dhs-telemetry-audit"]},{"id":"ice-cobweb-tangles","kind":"procurement","title":"ICE’s Cobweb and Tangles license award","agencies":[{"id":"ice","name":"U.S. Immigration and Customs Enforcement","shortName":"ICE"}],"companies":[{"name":"PEN-LINK, LTD","role":"Named award recipient · UEI TRJ2YRVP4A26","sourceIds":["ice-award"]}],"products":["Cobweb","Tangles"],"identitySourceIds":["ice-award"],"summary":"A federal purchase-order record identifies Pen-Link, Ltd. and licenses for Cobweb and Tangles. Its description does not name Webloc.","status":{"label":"Award record verified","asOf":"2026-09-09","qualification":"The public award response records $2,284,750 in cumulative obligations. It establishes an award description and recipient, not a particular operational use.","sourceIds":["ice-award"],"kind":"award_record"},"award":{"identifier":"70CMSD25P00000138","recipient":"PEN-LINK, LTD","obligationsUsd":2284750,"obligationsAsOf":"2026-09-09","signedOn":"2025-09-16","sourceIds":["ice-award"],"url":"https://www.usaspending.gov/award/CONT_AWD_70CMSD25P00000138_7012_-NONE-_-NONE-"},"events":[{"id":"ice-award-signed","date":"2025-09-16","dateBasis":"recorded_action","title":"Purchase order signed","detail":"The award record identifies purchase order 70CMSD25P00000138 for Cobweb and Tangles licenses intended to gather open-source information for HSI criminal investigations.","evidenceType":"award_record","sourceIds":["ice-award"]},{"id":"ice-obligations-checked","date":"2026-09-09","dateBasis":"checked","title":"Award obligations checked","detail":"The retrieved response lists $2,284,750 in cumulative award obligations. This collection does not assign that amount to Webloc or split it between named products.","evidenceType":"award_record","sourceIds":["ice-award"]}],"established":[{"text":"The award description names Cobweb and Tangles; its recipient is PEN-LINK, LTD (UEI TRJ2YRVP4A26).","sourceIds":["ice-award"]},{"text":"The response identifies ICE as the awarding agency and reports a performance period of September 25, 2025 through September 24, 2026. These are recorded dates, not independent proof of deployment.","sourceIds":["ice-award"]}],"unknown":["Specific license features, product-level spending, privacy approvals and individual operational searches are not established.","A Webloc purchase cannot be inferred from this award description.","A verified payment amount is not supplied by this collection; obligations and outlays require separate reconciliation."],"relatedIds":["atf-webloc","dhs-telemetry-audit"]},{"id":"dhs-telemetry-audit","kind":"oversight","title":"DHS telemetry audit and the policy recommendation that remains open","agencies":[{"id":"dhs","name":"Department of Homeland Security","shortName":"DHS"},{"id":"cbp","name":"U.S. Customs and Border Protection","shortName":"CBP"},{"id":"ice","name":"U.S. Immigration and Customs Enforcement","shortName":"ICE"},{"id":"usss","name":"U.S. Secret Service","shortName":"Secret Service"}],"companies":[],"products":[],"identitySourceIds":["oig-23-61","oig-report-index"],"summary":"A DHS inspector-general audit found privacy-process failures before commercial telemetry procurement and use. The department-wide policy recommendation remains open in the checked tracker.","status":{"label":"Policy recommendation listed as open","asOf":"2026-09-09","qualification":"Oversight.gov lists recommendation 8 as open. This is the status of one recommendation; it does not establish that no policy work or safeguards exist within DHS.","sourceIds":["oig-recommendation-8"],"kind":"tracker_snapshot"},"award":null,"events":[{"id":"dhs-audit-issued","date":"2023-09-28","dateBasis":"document","title":"Inspector general issues findings","detail":"The signed audit found privacy-process and control failures at CBP, ICE and Secret Service. Its cover and memorandum say September 28; the official index separately lists September 29.","evidenceType":"inspector_general","sourceIds":["oig-23-61","oig-report-index"]},{"id":"dhs-investigation-request","date":"2026-03-03","dateBasis":"document","title":"Lawmakers request another investigation","detail":"A congressional letter requests a second DHS OIG investigation into commercial location-data purchases and oversight. Its ICE Webloc purchase assertion is attributed to press reports; the letter is not a verified award record or a completed investigation.","evidenceType":"congressional_account","sourceIds":["wyden-oig-request"]},{"id":"dhs-rec8-checked","date":"2026-09-09","dateBasis":"checked","title":"Department-wide policy recommendation checked","detail":"Recommendation 8 is listed as open in the official tracker. The page provides no dated implementation history. September 9 is the check date, not an inferred reopening date.","evidenceType":"inspector_general","sourceIds":["oig-recommendation-8"]}],"established":[{"text":"The audit concerns procurement and use of commercial telemetry data at CBP, ICE and Secret Service during the period reviewed.","sourceIds":["oig-23-61"]},{"text":"Recommendation 8 calls for a department-wide policy covering requirements and oversight of commercial telemetry data.","sourceIds":["oig-recommendation-8"]}],"unknown":["The reviewed records do not identify every vendor, product, contract or present-day use.","The congressional request does not establish whether a new investigation opened or its eventual findings.","The original report and current index differ on some other recommendation statuses. A complete status-change history has not been reconciled, so no aggregate open/closed count is published."],"relatedIds":["cbp-telemetry-assessment","ice-cobweb-tangles","atf-webloc"]},{"id":"cbp-telemetry-assessment","kind":"oversight","title":"CBP’s retrospective commercial telemetry assessment","agencies":[{"id":"cbp","name":"U.S. Customs and Border Protection","shortName":"CBP"}],"companies":[],"products":[],"identitySourceIds":["cbp-pia-080"],"summary":"CBP’s 2024 privacy assessment describes an earlier evaluation, an end to new vendor collection, and continued use of retained data.","status":{"label":"Recommendation listed as closed","asOf":"2026-09-09","qualification":"The official tracker lists recommendation 1 as closed. The linked privacy assessment supplies context; the closure date and rationale are not established by the tracker.","sourceIds":["oig-recommendation-1"],"kind":"tracker_snapshot"},"award":null,"events":[{"id":"cbp-pia-issued","date":"2024-08-12","dateBasis":"document","title":"Retrospective privacy assessment published","detail":"The assessment covers a December 2018–September 19, 2023 evaluation. CBP states that new collection from vendors ended, retained-data use continued, and renewed collection would require a new privacy assessment.","evidenceType":"agency_document","sourceIds":["cbp-pia-080"]},{"id":"cbp-rec1-checked","date":"2026-09-09","dateBasis":"checked","title":"Recommendation 1 status checked","detail":"The tracker lists the recommendation to stop telemetry use until required assessments were completed and approved as closed. It does not supply the actual closure date or closure evidence.","evidenceType":"inspector_general","sourceIds":["oig-recommendation-1"]}],"established":[{"text":"The assessment is retrospective. Its statements describe the agency’s position in the August 2024 document, not independently verified current practice.","sourceIds":["cbp-pia-080"]},{"text":"Recommendation 1 concerns required privacy assessments; closing it does not validate every procurement or use.","sourceIds":["oig-recommendation-1"]}],"unknown":["The assessment does not establish a named vendor, product, contract or amount.","The reasons and date of recommendation closure are not supplied on the checked page.","Later collection, retention and operational practice have not been independently established."],"relatedIds":["dhs-telemetry-audit"]},{"id":"dia-geolocation","kind":"disclosure","title":"DIA’s disclosed funding of commercial geolocation purchases","agencies":[{"id":"dia","name":"Defense Intelligence Agency","shortName":"DIA"}],"companies":[],"products":[],"identitySourceIds":["dia-20210115-memo"],"summary":"A January 2021 DIA memorandum says the agency funded another agency’s purchase of smartphone geolocation metadata. The purchasing intermediary and vendor are unnamed.","status":{"label":"Historical acquisition disclosed","asOf":"2021-01-15","qualification":"This is DIA’s written account of an interagency funding arrangement. It does not identify a DIA contract or establish current purchasing activity.","sourceIds":["dia-20210115-memo"],"kind":"historical_disclosure"},"award":null,"events":[{"id":"dia-memo","date":"2021-01-15","dateBasis":"document","title":"DIA describes an interagency purchase","detail":"DIA states that it funds another agency’s purchase of commercially available smartphone geolocation metadata and receives global data while separating U.S. location points. The memorandum describes approval requirements for access.","evidenceType":"agency_document","sourceIds":["dia-20210115-memo"]}],"established":[{"text":"The disclosed relationship is funding through another government agency, whose identity is not supplied.","sourceIds":["dia-20210115-memo"]},{"text":"The memorandum describes agency controls around U.S. location points. Its legal interpretation is an agency position, not a judicial finding.","sourceIds":["dia-20210115-memo"]}],"unknown":["The intermediary agency, vendor, product name, contract and spending amount remain unidentified.","The source does not establish current procurement, compliance or operating status."],"relatedIds":["nsa-netflow","intelligence-commercial-data-policy"]},{"id":"nsa-netflow","kind":"disclosure","title":"NSA’s disclosure of commercial internet metadata purchases","agencies":[{"id":"nsa","name":"National Security Agency","shortName":"NSA"}],"companies":[],"products":[],"identitySourceIds":["nsa-20231211-letter"],"summary":"A signed NSA letter confirms purchases of non-content internet netflow, including wholly domestic communications. The same letter distinguishes those purchases from specified phone and vehicle location data.","status":{"label":"Historical netflow purchases disclosed","asOf":"2023-12-11","qualification":"The agency letter describes its practice at that time. It does not name a vendor, product or contract, and it does not establish current acquisition status.","sourceIds":["nsa-20231211-letter"],"kind":"historical_disclosure"},"award":null,"events":[{"id":"nsa-letter","date":"2023-12-11","dateBasis":"document","title":"NSA confirms commercial netflow purchases","detail":"The letter confirms buying and using commercial non-content netflow for wholly domestic and U.S.–foreign communications. Its denial of buying and using location data covers phones known to be used in the United States and automobile telematics from vehicles known to be located there.","evidenceType":"agency_document","sourceIds":["nsa-20231211-letter"]}],"established":[{"text":"The disclosed data category is non-content internet netflow. It must not be recast as message content or complete browsing histories.","sourceIds":["nsa-20231211-letter"]},{"text":"The letter’s denial concerns buying and using the specified U.S. phone-location and automobile-telematics data. It should not be read as a statement about every possible acquisition route.","sourceIds":["nsa-20231211-letter"]}],"unknown":["No named vendor, product, contract, amount or dataset volume is supplied.","The letter does not establish current purchases or compliance with later policy."],"relatedIds":["dia-geolocation","intelligence-commercial-data-policy"]},{"id":"intelligence-commercial-data-policy","kind":"policy","title":"Intelligence-community rules for sensitive commercial data","agencies":[{"id":"odni","name":"Office of the Director of National Intelligence","shortName":"ODNI"}],"companies":[],"products":[],"identitySourceIds":["odni-icpm504-20250206"],"summary":"A signed policy sets assessment, approval, safeguarding and reporting requirements for sensitive commercially available information. A February 2025 amendment updates that policy.","status":{"label":"Policy and amendment documented","asOf":"2025-02-06","qualification":"The examined policy creates reporting obligations. This collection has not verified report delivery, implementation by every agency, or whether a later policy supersedes it.","sourceIds":["odni-icpm504-20250206"],"kind":"policy_document"},"award":null,"events":[{"id":"odni-policy-signed","date":"2024-12-17","dateBasis":"document","title":"Policy signed","detail":"ICPM 504 (01) replaces the May 2024 framework and establishes requirements for assessing, approving, safeguarding and documenting sensitive commercially available information.","evidenceType":"policy_document","sourceIds":["odni-icpm504-20250206"]},{"id":"odni-policy-amended","date":"2025-02-06","dateBasis":"document","title":"Technical amendment signed","detail":"The reviewed document includes the signed February technical amendment. Its reporting provisions distinguish annual internal and congressional reporting from public reporting every two years.","evidenceType":"policy_document","sourceIds":["odni-icpm504-20250206"]}],"established":[{"text":"The document expressly replaces the earlier May 2024 framework. The underlying policy and technical amendment have different signature dates.","sourceIds":["odni-icpm504-20250206"]},{"text":"Annual internal/congressional and biennial public reporting requirements are stated in the text. A reporting requirement does not prove that a report was delivered.","sourceIds":["odni-icpm504-20250206"]}],"unknown":["Actual report delivery, the first specific public-report deadline and agency-level implementation have not been verified.","This governance document identifies no particular procurement, vendor or spending amount.","The reviewed amendment is not proof that no later policy exists."],"relatedIds":["dia-geolocation","nsa-netflow"]}]}