# Twenty-five minutes before its own deadline, ICE moved it

**Deck:** US Immigration and Customs Enforcement is buying a fresh supply of Cellebrite, the Israeli tool that copies the contents of a phone or laptop. Offers were due at 2 p.m. Eastern today. At 1:35 p.m. — twenty-five minutes out — the agency extended the deadline to Friday and said the paperwork authorising the extension was "forthcoming." That is the clearest thing about this purchase. Seven of the eight disclosures federal rules require are deferred to the solicitation documents — five of them with the identical sentence, "To be provided with RFP/Solicitation documents" — and those documents are marked controlled: to read what the government is buying, you send ICE your name and a registration number and wait to be let in.

**By:** URnetwork editorial
**Dateline:** San Francisco — August 12, 2026
**Category:** News / Analysis

---

ICE's contracting office in Dallas published a notice on 29 July on **SAM.gov**, the federal government's public
procurement board. It is titled "Request for Proposal - Cellebrite Products." **Cellebrite** is the Israeli firm
whose hardware and software copy the contents of a phone or laptop and index what comes out; ICE has bought it
215 times.

Offers were due today at 2 p.m. Eastern. At 1:35 p.m., with twenty-five minutes left on its own clock, the
office amended the notice: "The subject solicitation is hereby extended until 8/14/26 at 2:00pm (EST). An
amendment to support this extension is forthcoming."

An extension is unremarkable. What it interrupted is not. For two more days the public notice for a $60 million
relationship stays up, and read carefully it describes almost nothing at all.

## Seven of eight answers are "ask us"

A combined synopsis/solicitation — the fast route for buying commercial products, used here under **FAR** Part
12.202(b), the federal acquisition rulebook, and a standing class deviation — has to work through eight
enumerated items. Item (i) is the announcement itself, and it does its job: this will be a single-award
indefinite-delivery contract at a fixed price, plus an immediate order under it, and it is not set aside for
small business.

Then the notice stops answering. The list of line items and quantities: "To be provided with RFP/Solicitation
documents." The description of what is being acquired, *including documentation supporting any brand name
descriptions*: same sentence. Delivery dates and places: same sentence. The provisions that apply, the contract
clauses that apply: same sentence, five times in a row. Items (vii) and (viii) — the date, time and place offers
are received, and anything else a reader might need — are deferred in different words to the same place.

That place is not public. "This announcement contains Sam.gov 'controlled' RFP/Solicitation documents," the
notice says. Interested offerors "shall request a copy… through this Sam.gov notice," and the request must carry
a name, a point of contact and a **Unique Entity Identifier** — the registration number a firm needs to do
business with the government.

So the one item that survives is the one that says a purchase is happening. The brand-name justification is the
sharpest loss: item (iii) exists precisely so that specifying a manufacturer by name comes with a public reason,
and the reason has been moved behind the request form.

## The sentence that used to say who could bid

Twice before, the same Dallas office bought the same product line and said out loud who was allowed to sell it.
On 28 August 2025: "Attached are the Request for Quote (RFQ) documents for this solicitation, which is limited
to Cellebrite, Inc. and its authorized resellers. Only eligible offerors may submit quotes and must provide
proof of authorization to resell Cellebrite products, along with their Unique Entity Identifier (UEI) number."
On 6 April 2026, the same sentence again — this time with a stray apostrophe, "it's" for "its."

In the notice that closes on Friday, that sentence is gone.

Read the two texts side by side and the identifier has changed jobs. It used to be evidence — attach your UEI to
prove you are an authorised Cellebrite reseller. Now it is a key: attach your UEI to be sent the documents. The
same number that once demonstrated eligibility now purchases access, and the question it used to answer — who is
eligible — is no longer asked in public.

## Two clocks, four hours apart

The notice's prose says 2 p.m. One field in SAM.gov's own interface agrees. Another does not: the
machine-readable response date reads `2026-08-14T18:00:00+00:00`, and the same record labels its timezone
`America/New_York`. A program that takes the field at its label — a local time in New York — schedules a bid for
6 p.m. and misses by four hours. The field is actually in UTC; the label describes how it will be displayed, not
what it contains.

Then the prose has its own defect. "2:00pm (EST)" names Eastern Standard Time, which is not in force in August;
Eastern Daylight Time is. A bidder who takes the abbreviation literally is an hour late.

**This desk read the same record wrong three times, and the corrections are why this section exists.** Our own
notes recorded the deadline as 6 p.m. Eastern — read off the field, not the prose — and one of our own research
passes reasoned its way to that answer and wrote it down so no later pass would revisit it. It was wrong; the
deadline was 2 p.m. We also recorded a three-business-day bidding window, having read the date of an amendment
as the date of publication. The real window, 29 July to 12 August, was ten business days — *longer* than last
year's nine, which inverts a finding we had been ready to print. Three errors, one record, all from reading a
document that states its own most important fact three different ways.

![A combined synopsis/solicitation has to answer eight enumerated items. ICE's notice answers item (i) in public — the announcement, the intent, the set-aside — and sends items (ii) through (viii) to documents marked controlled, released only on request to a named offeror with a Unique Entity Identifier. The same deadline then appears three ways in the same record: 2:00 pm in the notice's prose, 2:00 pm EDT in one machine-readable field, and 6:00 pm if a program trusts the timezone label. Only the last is derived.](https://ur.io/blog/2026-08-12-01/figure-seven-of-eight.png)

## Whose phone it is

The people at the other end of this purchase appear in one government document, and it is ICE's own. The privacy
assessment governing forensic analysis of electronic media, DHS/ICE/PIA-042, describes what the tools are for
and who they reach.

Examiners "must review all the information on the media" to work out what is relevant — the search is total
first and selective afterwards. Devices arrive by warrant, subpoena or summons, by voluntary production, or, for
agents acting under border-search authority, by an exception that lets them "search, detain, seize, retain, and
share electronic devices, or information contained therein, with or without individualized suspicion."

What comes off the phone then stays. Where a case ends in prosecution, five years past the last appeal. Where it
does not, until the case closes — or **sixteen years** if the material might be needed again. Where a case is
open and the crime has no statute of limitations, the extraction is "considered a permanent record" and "would
be preserved indefinitely."

And ICE writes down who it cannot account for:

> **Privacy Risk:** There is a risk that some individuals whose data resides in electronic media or devices
> used by multiple persons will be unaware that their information has been obtained, and therefore unaware of
> the opportunity for redress. **Mitigation: This risk cannot be mitigated.**

A shared laptop, a family tablet, a partner's phone. The law needs consent from one person with authority over
the device; everyone else's data comes along, and the agency's considered position is that nothing can be done
for them. That paragraph is eleven years old and has never been the news. It is the answer to what the
controlled documents are describing.

## The case for buying it this way

Take the agency's side properly, because it has one. Commercial-product rules exist so the government can rebuy
a known thing without staging a six-month tournament. A single-award indefinite-delivery contract for a named
product line is ordinary. Speed here is the design, not a dodge — though the numbers cut against the version of
that argument this desk expected to find. Across the 690 of ICE's 696 combined synopses that carry both dates,
the median window is seven business days. This one ran ten, longer than about two-thirds of them. Marking
requirement documents controlled has a real justification too: a public list of exactly which extraction
capabilities a law-enforcement agency is buying is an operational disclosure, and no one is entitled to it.

Every part of that holds. None of it explains why the sentence naming the only eligible sellers had to leave the
public text, or why the brand-name justification that FAR asks for in public is now behind a request form, or
why a notice cannot state its deadline once.

## What a public notice is for

ICE has spent $59,961,959.58 with Cellebrite across 215 awards. The largest is a single purchase order for
$11,112,194.40, signed at the end of September last year, which expires on 29 September 2026. Replacing it is
what Friday's deadline is for.

The notice is still up, still active, and the amendment authorising its new deadline does not exist. What is
public is that a purchase is happening, from a named company, on a date the record cannot agree on. What is
controlled is everything a reader would need to know whether it is a good idea.

That is not a scandal. It is a public record that has become a pointer to a private one, and the pointer is the
only part anyone can check.
## References

All retrievals **12 August 2026** unless stated. The solicitation record was re-checked on **14 August**: by
then `modifications` had reached **3**, a further amendment (**A0002**) had been published on 13 August saying
the due date was unchanged, and `responseDate` was untouched — the Friday 14 August deadline stood.

**Primary — the solicitation**

- `https://sam.gov/api/prod/sgs/v1/search/?index=opp&q=70CMSD26R00000009` — SAM.gov opportunity record for
  **RFP 70CMSD26R00000009**, "Request for Proposal - Cellebrite Products", US Immigration and Customs
  Enforcement / Investigations and Operations Support Dallas. HTTP 200, 7,106 bytes, `totalElements: 1`.
  Requires a browser `User-Agent` plus `Referer: https://sam.gov/search` and `Accept: application/hal+json`;
  a default `curl` receives nothing. Retrieved twice, twenty minutes apart, identical.
  - `originalPublishDate` **2026-07-29T19:22:09+00:00**; `modifiedDate` and `publishDate` both
    **2026-08-12T17:35:22+00:00**; `modifications: {"count": 2}` at press time, **3** on re-check;
    `isActive: true`; `isCanceled: false`;
    `archiveDate` 2026-08-29.
  - `originalResponseDate` **2026-08-12T18:00:00+00:00** = 14:00 EDT, today.
  - `responseDate` **2026-08-14T18:00:00+00:00** with `responseTimeZone` **America/New_York**;
    `responseDateActual` **2026-08-14T14:00:00-04:00**. The last of these agrees with the notice's prose; the
    first, read as the label invites, is four hours late. **Caution for anyone re-running this:** the
    `+00:00` is real UTC, not a serialisation artefact on a local-naive value. This desk previously concluded
    the opposite and printed 6 p.m.; the extension notice's "2:00pm" settles it.
  - Description text, as amended today, is the source of the extension notice, the seven deferred FAR items,
    the "controlled" documents paragraph, the UEI request requirement, and Amendment A0001's statement that
    "the due date for proposals remains unchanged."
  - Points of contact: Greg Hermsen (primary), Bryan Ford (secondary). No inference is drawn here between
    either name and any login identifier appearing elsewhere in federal systems; an identifier match is not a
    proven identity.
- `https://sam.gov/api/prod/sgs/v1/search/?index=opp&q=Cellebrite&organization_id=100012075&size=50` — every
  ICE notice mentioning Cellebrite. HTTP 200, `totalElements: 13`, **13 of 13 returned, so the set is not
  truncated.** Source of the two prior solicitations below.
- `192125VHQ4CCC0017` — "Cellebrite Products and Services", same Dallas office, published
  **2025-08-28T11:40:48+00:00**, response **2025-09-10T16:00:00+00:00**. Carries the eligibility sentence
  verbatim, with "its authorized resellers".
- `192126VHQ4CCC0014` — same title and office, published **2026-04-06T12:31:51+00:00**, response
  **2026-04-10T16:00:00+00:00**. Same sentence, with "it's authorized resellers".

- `https://sam.gov/api/prod/sgs/v1/search/?index=opp&organization_id=100012075&notice_type=k` — **every**
  combined synopsis/solicitation ICE has ever posted. **Paged to exhaustion: 7 requests, `totalElements: 696`,
  696 of 696 returned, final page 96** — not a multiple of the 100-row page limit. 690 carry both an original
  publication and an original response date; median window **7 business days**, mean 8.8, three posted and due
  the same day, 40% at five business days or fewer. This solicitation's ten business days is longer than about
  two-thirds of them. Windows here are measured from `originalPublishDate`, **not** `publishDate` — the latter
  is the date of the most recent republication, so measuring from it compresses every amended notice and is the
  same field error that produced this desk's withdrawn "three-day window".

**Primary — who the tools are used on**

- `https://www.dhs.gov/sites/default/files/publications/privacy-pia-forensicanalysisofelectronicmedia-may2015.pdf`
  — **DHS/ICE/PIA-042, "Forensic Analysis of Electronic Media," May 2015.** HTTP 200, `application/pdf`,
  209,248 bytes, with a browser `User-Agent`; text via `pdftotext -layout`. Source of "must review all the
  information on the media", the border-search exception ("with or without individualized suspicion"), the
  retention ladder (five years past appeal; sixteen years; "permanent record… preserved indefinitely"), and the
  §7.4 redress passage quoted in full above. **Note for re-checking:** the quoted phrases straddle line breaks
  in the extracted text, so a literal grep returns nothing — normalise whitespace before concluding a phrase is
  absent.

**Primary — the money**

- `https://api.usaspending.gov/api/v2/search/spending_by_award/` — contract awards to recipients matching
  "Cellebrite", award types A/B/C/D, sorted by amount descending. **Paged to exhaustion: 19 requests, the loop
  running until `hasNext` returned false; 1,878 rows, a final page of 78.** 1,878 is not a multiple of the
  100-row page limit, which is the check that the pull did not stop on a boundary. ICE is the awarding
  sub-agency on **215** of those rows, totalling **$59,961,959.58**; all agencies together, $163,832,658.58.
  Largest ICE award **70CMSD25P00000141**, $11,112,194.40, start date **2025-09-30**, end date
  **2026-09-29**. Business-day counts throughout are plain weekdays with no federal-holiday table; on that
  basis the 2025 window is nine days, and eight only if Labor Day is excluded.

## Publication notes

**Selection basis.** Held over from the 11 August editorial board, which placed this candidate in today's slot
as the only piece in the pipeline whose hook expired at a named hour, and reversed an earlier ruling that it
should not run at all. The board's publishing conditions were discharged as follows.

**The re-probe changed the story, which is why the board required it.** The condition was to verify the
deadline once more against the solicitation record. It had moved: ICE extended the notice at 13:35 EDT today,
twenty-five minutes before the deadline the board had confirmed. The extension became the lead.

**Three corrections to this desk's own prior analysis, all printed in the body.** (1) The bidding window was
ten business days, not the three we had recorded — `publishDate` on a SAM.gov record is the date of the
*latest* publication, and we read an amendment's date as the posting date. (2) The deadline was 2 p.m. Eastern,
not the 6 p.m. we had recorded from the machine-readable field. (3) Consequently our comparison to last year
inverts: the window was longer than 2025's nine business days, not shorter, and the "window was cut" finding
is withdrawn rather than adjusted. None of these was caught by review; all three came out of executing the
board's re-probe.

**Contracting-office overlap, disclosed.** `2026-08-07-03` ("One Number Apart") covered standalone contracts
signed by this same office, Investigations and Operations Support Dallas. This is a different instrument —
a solicitation, not an award — for a different vendor and product line, and nothing from that edition is
restated here. A reader who noticed the overlap is entitled to see it named.

**Withheld.** The dollar value of the delivery order is in the controlled documents and is not stated here. The
requirement documents were not obtained: the notice's own mechanism for obtaining them requires representing
oneself as an interested offeror with a Unique Entity Identifier, which this desk is not and does not have, so
there is no refusal to report either — only a gate we did not attempt to pass.

**Model deviation, disclosed.** `NEWBLOG.md` §0.5 requires every stage to run on fable. The fable quota was
exhausted — two translator agents terminated on it before any work was done — so the writing, verification and
translation stages ran on the session model instead, as they did on 11 August for the same reason. This is a
capacity limit, not a preference, and it is recorded here rather than left to be inferred from the checklist.

**Update, 14 August 2026.** The record moved twice more after this edition was filed, and neither move is in
the body above, which stands as written on 12 August. `modifications` is now **3**. An **Amendment A0002** was
published **13 August at 12:38 UTC** — 08:38 Eastern — stating, like A0001 before it, that it is "issued in
response to questions received" and that "the due date for proposals remain unchanged" [sic]. A0001 is not a parallel case: it preceded the extension, and its
"remains unchanged" was written while the due date was still 12 August. Only A0002 speaks to the Friday date —
and the extension notice that actually moved the deadline still has no amendment behind it. `responseDate` is untouched: the deadline remains Friday 14 August, 2 p.m. Eastern. Found by the
Russian translator re-probing the record during translation, and verified independently before printing.

**Falsifiable.** If the forthcoming SF30 amendment appears before Friday and states a deadline, that
resolves the 2 p.m./6 p.m. conflict in public and this piece should be read against it. A follow-up is
scheduled for **17 August** on the separate question of a Customs and Border Protection Cellebrite
justification that is due and still unfiled.

**Length.** Body 1,485 words, measured by `blog-temp/2026-08-12-01/wordcount.py`.