U.S. Immigration and Customs Enforcement’s Homeland Security Investigations agreed last month to a $3 million deal with mobile forensics expert Magnet Forensics for the software, plus training and installation, according to federal procurement records.
The new capability will give HSI — which has been buying up hardware to crack into phones over the past year — access to evidence on locked phones during criminal investigations, even if they’re password-protected or otherwise encrypted.
- What the contract covers in ICE’s Magnet Forensics deal
- Who is Magnet Forensics and how it partners with Grayshift
- Why HSI needs this capability for digital investigations
- Privacy, warrants, and oversight for phone extractions
- Part of a broader investigative toolkit at ICE
- What to watch next as ICE deploys new mobile forensics
What the contract covers in ICE’s Magnet Forensics deal
A listing for the contracts on a federal procurement database describes software licenses used to extract digital evidence, process multiple devices, and produce forensics reports. Though the notice does not specify a product, it closely matches GrayKey, a popular law enforcement tool that allows police to bypass iPhone passcodes when they have lawful authority and to pull data from iOS devices in some cases, as well as some Android models.
The license model usually includes both during device unlocking and post-extraction analysis to let agents/digital forensics examiners triage or “cull” through vast amounts of evidence on mobile phones, tablets, and removable media. Such contracts also typically cover maintenance, updates to accommodate new operating system releases, and training for field offices and lab employees.
Who is Magnet Forensics and how it partners with Grayshift
GrayKey, which comes from the Atlanta company Grayshift and made a name for itself with its iPhone hacking techniques (equally as specialized), was the original until inventiveness outpaced it. Thoma Bravo Private Equity in 2023 put Magnet Forensics and Grayshift in-house together to combine device access products and forensic analysis software under a single financial roof. Magnet’s software is reportedly commonly in use among police and federal agencies parsing through app data, chats, geolocation, and cloud artifacts after a lawful extraction.
GrayKey’s powers depend on the device model and operating system. On some phones that means full file system extraction; on others, targeted or partial access (especially when a device is in an “after first unlock” state). The vendor works to ship updates in an infinite game of cat-and-mouse with new security protections in iOS and Android, a competition tracked by academic researchers and digital forensics investigators.
Why HSI needs this capability for digital investigations
HSI pursues a wide range of crimes — child exploitation, human smuggling, narcotics trafficking, financial fraud, export violations — and in many instances phones are the primary evidence store. Investigators in these cases regularly have to deal with encrypted messaging, ephemeral apps, and locked devices. “(Quick access) is key to determining whether an agent uncovers probable cause, identifies co-conspirators, or is able to act quickly in efforts to disrupt a network.”
Issue #3: Digital evidence volume is a difficulty that will always persist. Studies cited by the National Institute of Justice have raised alarms about growing backlogs in state and federal forensic labs, fueled both by the number of seized devices per case and by complexity introduced into modern apps. Extraction and parsing automation tools allow labs to scale with the assurance of evidentiary integrity and chain-of-custody.
Privacy, warrants, and oversight for phone extractions
Lock-breaking is still tightly restricted by law and agency policy. The Supreme Court decision in Riley v. California mandates a warrant for most cell phone searches. DHS agencies, including HSI, operate under internal policies that demand supervisory signatures on the search document and search warrant outside of very limited exceptions.
Groups such as the ACLU and the Electronic Frontier Foundation, which protect civil liberties online, have cautioned that powerful extraction tools can pull in highly sensitive data — health information, location history, intimate communications — beyond what is necessary for an investigation. DHS’s Inspector General has elsewhere recommended that components tighten up documentation, auditing, and access controls with respect to digital searches to minimize overcollection and reduce risks of improper access.
Procurement records suggest this deal is for licenses instead of a custom system, and that usually includes features like baked-in logging, role-based access, and case-level auditing. The effectiveness of those controls will depend on how HSI structures governance such as warrant validation, scope limitations, and retention schedules that are compliant with the Federal Records Act and agency privacy impact assessments.
Part of a broader investigative toolkit at ICE
The new deal comes after ICE had already purchased GrayKey licenses in a previous procurement to the tune of $5 million and supplements other investigative platforms that are already being used throughout the agency.
Public records reveal that ICE and its components have purchased investigative tools, as well as mobile forensic equipment like Cellebrite’s UFED, Palantir’s analytics software, and a range of facial recognition systems developed by vendors including Clearview AI. HSI also purchases through resellers such as Panamerica Computers to streamline field deployment and support.
The mobile forensics market continues to be competitive. Cellebrite, Magnet/Grayshift, and up-and-comers such as Paragon compete on the range of devices covered, speed, and post-extraction analytics. Agencies assess more than just headline performance; they consider cost per license seat, training overhead, lab throughput, and courtroom reliability: whether it is able to draw reproducible results and generate defensible reports in light of Daubert.
What to watch next as ICE deploys new mobile forensics
Some important factors include the number of licenses/labs covered, whether the early preference is for the acquisition of field triage kits vs. central lab deployments, and performance — successful extraction rates, time-to-evidence, and backlog reduction.
Transparency reports, Inspector General audits, and DHS Privacy Office assessments can reveal how frequently the tools are used, what kinds of cases they’re being used for, and with what legal process.
For investigators, the contract offers swift access to vital information. For the public, it adds urgency to the demand for clear guardrails that keep extractions targeted and accountable. Both will determine how this $3 million investment transforms HSI’s digital forensics landscape.