A Watchdog's Warning, Ignored
On August 26, 2026, the Electronic Frontier Foundation published a compiled list of about 15 administrative subpoenas that Immigration and Customs Enforcement (ICE) and the Department of Homeland Security sent to Google, Meta, Reddit, X, T-Mobile, and PayPal/Venmo between March 2025 and April 2026 (EFF, "A List of ICE Subpoenas to Tech Companies"). Five of those subpoenas invoked 19 U.S.C. § 1509 — a customs-inspection statute meant to verify import duties — to compel disclosure of subscriber identities. That is the same authority DHS's own Office of Inspector General flagged nearly a decade ago: a November 16, 2017 report found CBP violated its own § 1509 policy in roughly one of every five uses between January 2015 and May 2017, an investigation triggered by a summons CBP sent to Twitter demanding the identity behind the @ALT_USCIS parody account — a summons DHS withdrew within a day of Twitter suing (DHS OIG press release, Nov. 16, 2017).
Administrative subpoenas are not new, and using them for legitimate customs and immigration enforcement is not inherently improper. Investigators regularly need subscriber records — names, IP addresses, session logs — to verify identity or trace fraud, and unlike a search warrant, an administrative subpoena doesn't require prior judicial sign-off precisely because it's supposed to be limited to routine, low-sensitivity records. That design has a defensible logic: it lets agencies move quickly on the kind of basic verification work that doesn't implicate substantive rights. The problem EFF documents is not that DHS uses subpoenas — it's what they've been used for.
What the List Shows
According to EFF's tracking, the subpoenas repeatedly targeted people engaged in constitutionally protected activity: community-watch accounts documenting ICE raids, individuals who publicly criticized the agency, and international students who attended protests. Specific examples include a March 2025 subpoena to Facebook and Google targeting Cornell student Momodou Taal after he attended a pro-Palestinian protest — later withdrawn — and a September 2025 subpoena to Meta seeking to unmask the MontCo Community Watch accounts tracking immigration enforcement in Pennsylvania, withdrawn in January 2026 after a court challenge. A February 2026 Reddit subpoena targeting a user known as "Tired_Thumb" was withdrawn in March 2026, then replaced with a grand jury subpoena — suggesting DHS treated the administrative route as a first attempt rather than a genuine records-verification need. Separately, in May 2026, federal prosecutors in Washington subpoenaed a Reddit user for posting "expletive ICE" and an X user for a sarcastic post about an officer involved in a shooting, seeking their names, addresses, and banking information (MediaPost, May 28, 2026).
"ICE has conducted unlawful investigations into dozens of individuals who have documented ICE activities in their communities, social media users who criticized the government, and international students who attended a protest." — EFF, August 26, 2026
EFF's follow-up piece documents that some companies have quietly resisted. Meta told DHS in September 2025 that a subpoena lacked "statutory authorization" and planned to notify the affected user, though it ultimately complied after the user separately fought back in court. Reddit's transparency report states it objected to demands targeting users "engaged in protected activity under the First Amendment," and law enforcement withdrew those requests. Twitter's 2017 lawsuit remains the clearest precedent: DHS folded within a day of being sued (EFF, Aug. 19, 2026).
The Proportionality Problem
That pattern — quiet resistance followed by withdrawal once challenged — is itself the tell. If these subpoenas rested on solid statutory footing, DHS wouldn't retreat the moment a company or user pushed back; it would defend them. Instead, the withdrawals function as a pressure-release valve that lets the agency avoid the adverse court ruling that would actually clarify the law and bind future conduct. EFF has since sued DHS and ICE in the U.S. District Court for the District of Columbia to force release of records on how the subpoena authority is being used, after a March 2026 records request went unanswered (Military.com, Apr. 22, 2026).
The fix here doesn't require new legislation restricting legitimate law enforcement access — it requires enforcing the limits Congress already wrote into § 1509 and holding agencies to the 2017 OIG findings they never fully implemented. Congress's Permanent Subcommittee on Investigations and Senate Finance Committee members have already sent DHS formal inquiries on customs-summons use; those should be paired with a hard requirement that any subpoena seeking to unmask an anonymous speaker get judicial sign-off before compliance, not after a company happens to object. Platforms, for their part, should follow Twitter's 2017 example rather than Meta's 2025 one: challenge first, comply only under court order, and publish the numbers. A subpoena process that only works because targets occasionally have the resources to sue is not a functioning check — it's a lottery, and the people it's failing are the ones speaking most directly against government power.