# One Number Apart

**Deck:** In nine days this July, one Dallas office of US Immigration and Customs Enforcement signed two of the three standalone contracts it signed all summer. The $94.7 million sole-source deal was publicly advertised, its notice posted the day after signing. The $13 million contract one number along — with a firm that sells social-media threat monitoring — was never advertised at all, and the justification the law requires is due Sunday. If it never appears, the rules are written so that nobody outside can prove a thing.

**By:** URnetwork editorial
**Dateline:** San Francisco — August 7, 2026
**Category:** News / Analysis

---

On 1 July, a Dallas contracting office of ICE — US Immigration and Customs Enforcement — signed a
**$94,655,840** contract with TRM Labs, a blockchain-tracing firm. It was a sole-source award — ICE went to
one company and received one offer — which is precisely the kind of purchase federal disclosure rules were
written for. The office handled it by the book: the award was publicly advertised, and its notice went up on 2
July, the day after signature.

On 10 July the same office — **Investigations and Operations Support, Dallas** — signed the contract one
number along in the series: **$13,000,000** to ZeroFox, a company that sells social-media threat monitoring.
Three firms bid this time. Yet the award was advertised nowhere, and the public justification the regulation
demands has not been found. The thirty-day clock for publishing it runs out on **Sunday 9 August**. Tonight is
day 28.

Hold the two records side by side and they are backwards: the enormous no-competition deal handled in the
open, the small competed one gone dark. That inversion is worth a few minutes of your attention for one
reason. Whichever way Sunday goes, this pair of contracts demonstrates that the disclosure rule cannot be
checked from outside — not late, not kept, not at all.

## The loud purchase and the quiet one

The two awards sit one number apart in the federal series, `70CMSD26C00000005` and `…006`, and every field
runs against intuition. The sole-source award is the advertised one: solicited from a single firm, one offer
received, public notice posted the next day. The competed award is the invisible one: three offers through a
negotiated procedure, and no public advertisement — the database field that records one reads **NO**.

The Sunday deadline comes from the urgency exception, FAR 6.302-2, which lets an agency limit competition when
delay would cause serious financial or operational injury, and which gives it thirty days after award to
publish the written justification. But the government's own database codes the ZeroFox purchase *"full and
open competition after exclusion of sources"* — and three bidders in a negotiated competition is not what an
emergency looks like. Either the coding is loose, or the purchase was more ordinary than urgency implies. The
more ordinary it was, the harder the missing advertisement is to explain.

![Two ICE contracts signed nine days apart by the same Dallas office: 70CMSD26C00000005, TRM Labs, $94,655,840, one offer, sole source, publicly advertised the next day — and 70CMSD26C00000006, ZeroFox, $13,000,000, three offers, negotiated proposal, not advertised, justification not located and due Sunday 9 August, day 28 of the 30-day FAR 6.305(b) clock.](https://ur.io/blog/2026-08-07-03/figure-two-contracts.png)

Size cuts the same direction. $13 million is small by ICE standards, and awards that size are the ones only
paperwork ever surfaces: the $94.7 million next door would draw attention whatever the record said. A $13
million line item passes unnoticed — unless the disclosure rule works.

## There were three, and two were dark

The natural objection is cherry-picking, so here is the whole population. Between 15 June and 7 August this
office signed 82 awards; exhaustive pagination of the ICE record — 633 rows across seven pages, not the two
pages a default pull returns — turns up exactly three definitive contracts, meaning fresh standalone ones
rather than orders placed against vehicles competed earlier.

The third is small enough to fall out of any pull sorted by size: `70CMSD26C00000004`, **$486,749.68** to
Guardian Centers of Georgia, signed 20 July, sole-source under FAR 6.302-1. Its `fed_biz_opps` field reads
`NO`. So the count is three, and **two of the three were never advertised**. The $94.7 million award is the
only standalone contract this office put in public all summer — which makes the pattern worse than a pair, not
better.

## What ZeroFox sells

ZeroFox sells brand protection and social-media threat monitoring; its parent is LookingGlass Cyber Solutions.
Its new customer is the ICE office whose name says what it does: investigations and operations support.

What ICE actually bought is not in the record. The award describes no deliverable, and the desk will not infer
a capability from a vendor's product line. But that unknown is exactly what the missing document exists to
resolve: a justification is where the government explains, in writing, what it is buying and why competition
was limited. For a never-advertised $13 million contract between an immigration-enforcement agency and a
social-media monitoring firm, that document was the only public account there was ever going to be.

## The innocent explanation

Take the office's side for a moment, because its case is real. Three firms bid — whatever this is, it is not a
handout to a vendor nobody could compete with. Late paperwork is the most ordinary failure in federal
contracting: publication deadlines slip across the government, and a slipped date is not a cover-up. The clock
has not even expired — a justification posted by Sunday is full compliance, and this becomes a story about a
rule that worked. Strongest of all, this same office advertised its far larger award the next day. Offices
bent on hiding things do not do that.

All of it stands. What none of it restores is the ignorance excuse. The office that advertised in a day on
$94.7 million is the office that has published nothing in twenty-eight on $13 million — same buyer, same
series, same month. That proves no wrongdoing. It means that if Sunday passes in silence, nobody in that
office can say they didn't know the rule.

## A rule that cannot catch anyone

Here is the desk's actual view, and it is not that a contracting officer in Dallas is hiding something. It is
that nobody outside the building could tell if one were.

The Federal Acquisition Regulation does everything right until the last step. An agency that limits
competition must write a justification, have it approved at a level that rises with the dollar value, and make
it public — within thirty days of award for urgency buys. It even anticipated the obvious dodge. Paragraph (e)
of FAR 6.305 tells the contracting officer to strip proprietary material and anything exempt under the Freedom
of Information Act, and then closes the door: "This process must not prevent or delay the posting of the
justification …" Sensitive contents are a reason to publish less, not a reason to publish nothing.

The exit is paragraph (f), and it is narrow: the requirement lifts only where posting "would disclose the
executive agency's needs and disclosure of such needs would compromise national security or create other
security risks." Fair enough — except that nothing requires the agency to say (f) was used. No stub, no
marker, no "withheld" notice. And the public window where justifications appear cannot show an outsider the
difference between nothing posted and nothing visible. From outside, a lawful withholding and a blown deadline
produce the identical record: **nothing.**

A transparency rule whose compliance cannot be told from its breach has stopped being a rule. It is a
convention — something an agency does when it chooses to be seen doing it. That is what the Dallas pair looks
like: seen on the big one, unseen on the small one, and no way to say which kind of unseen.

The repair costs one line. Whenever (f) is invoked, require a public placeholder — a justification exists, it
is withheld, here is the authority. Lawful secrecy stays lawful. Silence becomes legible.

## Sunday

The ZeroFox award record is public and needs no login; the exact address is in the references. On Sunday, day
thirty, either a justification is on SAM.gov or there is still nothing. If it appears, the rule worked, and
this piece is the record of a system functioning. If it does not, you still will not have caught anyone —
paragraph (f) guarantees that — and the guarantee is the finding.

Sunday will not tell us whether anyone did anything wrong. It will tell us whether the rule is capable of
telling us anything at all.

**Follow-up, Monday 10 August.** Sunday passed in silence. Day thirty has come and gone and SAM.gov carries
nothing for `70CMSD26C00000006` — and this time that is a real absence rather than a failed search, because
the same query returns a hit for the contract signed nine days earlier. Searching SAM.gov's own public search
service for the ZeroFox PIID returns `totalElements: 0`; the identical search for `70CMSD26C00000005` returns
one record, *"Award Notice — TRM Labs, Inc."*, last modified 2 July. So the index reaches this contract
series, it reaches this office, and it holds no justification for the award that needed one.

It also settles what the sister award actually got. The `...005` record is an **award notice** — the
announcement that a contract was signed — not the FAR 6.303 justification for limiting competition. The
advertised contract was advertised. Neither of these two contracts has a published justification. The
difference between them was never diligence versus concealment; it was a notice, and a notice is not the
document the rule is about.

Which leaves the finding exactly where the piece left it, and no further. Nobody has been caught. A lawful
withholding under (f) and a missed deadline still look identical from outside, and one of them is now
thirty-one days old.

---

## References

- **`70CMSD26C00000006`** — ZeroFox Inc, $13,000,000, `date_signed` 2026-07-10, period of performance
  2026-07-13 → 2027-07-12; awarding office **Investigations and Operations Support Dallas**;
  `number_of_offers_received` 3, `extent_competed` D ("full and open competition after exclusion of
  sources"), `solicitation_procedures` NP, `fed_biz_opps` N ("NO"), `type_set_aside` NONE; recipient UEI
  TQDAJ722E397, parent **LookingGlass Cyber Solutions, Inc.** (UEI LTGWWC211763). Retrieved from
  `api.usaspending.gov/api/v2/awards/CONT_AWD_70CMSD26C00000006_7012_-NONE-_-NONE-/`, 7 August 2026
  21:49 UTC. FAR 6.305(b)'s thirty days run from `date_signed` (10 July), not the period-of-performance
  start (13 July); the latter would wrongly move the deadline to Wednesday 12 August.
- **`70CMSD26C00000005`** — TRM Labs, Inc., $94,655,840, `date_signed` 2026-07-01, same awarding office;
  `number_of_offers_received` 1, `extent_competed` C, `solicitation_procedures` SSS, `fed_biz_opps` Y
  ("YES"). Same endpoint, `...00000005...`.
- **Denominator, this desk.** `api.usaspending.gov/api/v2/search/spending_by_award/`, award type codes
  A–D, awarding subtier "U.S. Immigration and Customs Enforcement", action dates 2026-06-15 → 2026-08-07,
  paginated to exhaustion at `limit: 100` until `hasNext` went false — **633 records across seven pages**,
  of which 82 carry the `70CMSD26` prefix. Three are `C`-series definitive contracts: `...C00000005`
  (TRM Labs, $94,655,840), `...C00000006` (ZeroFox, $13,000,000) and `...C00000004` (Guardian Centers of
  Georgia, $486,749.68). **Correction, 10 August:** this edition first reported "200 records across two
  pages" and two definitive contracts. Two hundred is 2 × the page limit — the pull had stopped at the
  pagination boundary, sorted by amount descending, truncating at $2,093,074.55 and hiding the
  $486,749.68 award below it. The count is three, and the third is also unadvertised.
- **FAR** 6.302-2 (unusual and compelling urgency), 6.303 (justification), 6.304 (approval levels),
  6.305(a)–(b) (public availability; **30 days after award** for 6.302-2), 6.305(e) (redact proprietary and
  FOIA-exempt material, but "this process must not prevent or delay the posting"), 6.305(f) (requirement
  lifts where posting would disclose the agency's needs and *disclosure of those needs* would compromise
  national security or create other security risks, with no requirement to disclose that (f) was used).
  **Correction, 10 August:** this edition first
  described (f) as permitting withholding "when it contains classified matter or information exempt from
  disclosure." That conflated (f) with (e), and (e) is the paragraph that forbids using redaction to delay
  posting at all. The narrower reading strengthens the argument here rather than weakening it: the FAR did
  close this dodge, which is why the absence of any marker for (f) matters.
- **Gap, named.** `api.sam.gov/opportunities/v2/search` returned **HTTP 404** for both PIIDs to
  unauthenticated requests, which cannot distinguish "no notice" from "not authorised"; SAM.gov's web
  interface renders an empty shell indistinguishable from zero results, including through a text proxy. No
  FAR 6.302-2 justification for `...006` was located. This is reported as a search failure, not as evidence
  that none exists.

## Publication notes

Third edition of 7 August 2026, after "The Hole Is Load-Bearing" (2026-08-07-01) and "On Monday, Stop
Recording" (2026-08-07-02).

Selected as the runner-up on the 2026-08-07-02 group critique (composite 8.94), with a ruling to publish on
Sunday 9 August when the FAR 6.305(b) clock closes. It runs tonight instead because the desk lead's
verification changed it materially and because Sunday is the deadline rather than the story.

**The verification is recorded in full at `blog-research/2026-08-07-03/PREPUB-VERIFICATION.md` and it
corrected the candidate in one important way.** The research pack had `...005` as a sole source that was
published and `...006` as urgency with three offers. Pulling both FPDS records from one source inverts the
intuitive reading: TRM Labs received **one** offer under sole-source procedures and **was** advertised, while
ZeroFox received **three** offers, is coded "full and open competition after exclusion of sources", and was
**not** advertised. That internal contradiction became the spine of the piece rather than a footnote.

**It also closed the gap the candidate's own self-critique named as decisive.** That desk wrote that without a
compliance denominator, "ICE is late" rests on one adjacent comparison rather than a distribution, and scored
itself down for it. Enumerating the office's awards produced something better than a ratio: in the whole
window that office signed **three definitive contracts**, two of which were never advertised; the two compared
here are the largest and the one that follows it in the series.

Two facts the candidate did not have are now in the piece: the awarding office is named, and ZeroFox's parent
is LookingGlass Cyber Solutions. One claim was removed rather than kept — the candidate inferred from six
agencies' vocabulary that this is social-media monitoring for an intelligence office, and labelled it an
inference. Nothing in the award record describes the deliverable, so it is stated as unknown.

**This edition carries the desk's first in-article infographic**, generated as SVG and rendered at 2× to
`figure-two-contracts.png`. It required a renderer change: `generate-blog.mjs` had no image handling at all,
so a standalone `![alt](https://ur.io/blog/2026-08-07-03/file.png)` line became literal text. Article-body images now become a `<figure>`, the
alt text doubles as the visible caption **and as a narrated segment**, so the figure is described in the audio
rather than silently skipped, and body images are copied to `react/public/blog/<slug>/` alongside the hot-take
media. `NEWBLOG.md` is updated to require at least one useful figure per edition.

**Rewritten 9 August 2026** after the desk owner's readability verdict on the August 6–8 editions
(`NEWBLOG.md` §0.6). Every figure, date, code and sourced claim is unchanged; the structure and prose are new.
The template sections shared with neighbouring editions are gone, the search-method narration and the
signature-date trap moved to the references, the body table duplicating the figure was cut, and the piece now
leads with the two purchases rather than the clock. Body length **1,520 words**, measured by
`blog-temp/2026-08-07-03/wordcount.py`, which is **20 over the 1,450–1,500 band**.

**Correction, 11 August 2026, to this note itself.** It previously read "Body length 1,251 words … deliberately
under the 1,450–1,500 band rather than padded to it." Both halves were false. The figure was stale — the version
committed on 9 August measured 1,468 and said so correctly — and subsequent editing (the FAR 6.305(e)/(f)
correction, and section-level expansion of "A rule that cannot catch anyone", "Sunday" and "The loud purchase and
the quiet one") took the body to 1,520 without the note being re-measured. So a note whose whole purpose is to
record a measurement drifted 269 words from the thing it measured, and inverted its own claim about the band in
the process. **A length claim must be re-run against the file every time the file is touched**, which is the same
discipline as §12's rule that no count is quotable without its tool.