ICE's contracting office in Dallas published a notice on 29 July on SAM.gov, the federal government's public procurement board. It is titled "Request for Proposal - Cellebrite Products." Cellebrite is the Israeli firm whose hardware and software copy the contents of a phone or laptop and index what comes out; ICE has bought it 215 times.
Offers were due today at 2 p.m. Eastern. At 1:35 p.m., with twenty-five minutes left on its own clock, the office amended the notice: "The subject solicitation is hereby extended until 8/14/26 at 2:00pm (EST). An amendment to support this extension is forthcoming."
An extension is unremarkable. What it interrupted is not. For two more days the public notice for a $60 million relationship stays up, and read carefully it describes almost nothing at all.
Seven of eight answers are "ask us"
A combined synopsis/solicitation — the fast route for buying commercial products, used here under FAR Part 12.202(b), the federal acquisition rulebook, and a standing class deviation — has to work through eight enumerated items. Item (i) is the announcement itself, and it does its job: this will be a single-award indefinite-delivery contract at a fixed price, plus an immediate order under it, and it is not set aside for small business.
Then the notice stops answering. The list of line items and quantities: "To be provided with RFP/Solicitation documents." The description of what is being acquired, including documentation supporting any brand name descriptions: same sentence. Delivery dates and places: same sentence. The provisions that apply, the contract clauses that apply: same sentence, five times in a row. Items (vii) and (viii) — the date, time and place offers are received, and anything else a reader might need — are deferred in different words to the same place.
That place is not public. "This announcement contains Sam.gov 'controlled' RFP/Solicitation documents," the notice says. Interested offerors "shall request a copy… through this Sam.gov notice," and the request must carry a name, a point of contact and a Unique Entity Identifier — the registration number a firm needs to do business with the government.
So the one item that survives is the one that says a purchase is happening. The brand-name justification is the sharpest loss: item (iii) exists precisely so that specifying a manufacturer by name comes with a public reason, and the reason has been moved behind the request form.
The sentence that used to say who could bid
Twice before, the same Dallas office bought the same product line and said out loud who was allowed to sell it. On 28 August 2025: "Attached are the Request for Quote (RFQ) documents for this solicitation, which is limited to Cellebrite, Inc. and its authorized resellers. Only eligible offerors may submit quotes and must provide proof of authorization to resell Cellebrite products, along with their Unique Entity Identifier (UEI) number." On 6 April 2026, the same sentence again — this time with a stray apostrophe, "it's" for "its."
In the notice that closes on Friday, that sentence is gone.
Read the two texts side by side and the identifier has changed jobs. It used to be evidence — attach your UEI to prove you are an authorised Cellebrite reseller. Now it is a key: attach your UEI to be sent the documents. The same number that once demonstrated eligibility now purchases access, and the question it used to answer — who is eligible — is no longer asked in public.
Two clocks, four hours apart
The notice's prose says 2 p.m. One field in SAM.gov's own interface agrees. Another does not: the machine-readable response date reads 2026-08-14T18:00:00+00:00, and the same record labels its timezone America/New_York. A program that takes the field at its label — a local time in New York — schedules a bid for 6 p.m. and misses by four hours. The field is actually in UTC; the label describes how it will be displayed, not what it contains.
Then the prose has its own defect. "2:00pm (EST)" names Eastern Standard Time, which is not in force in August; Eastern Daylight Time is. A bidder who takes the abbreviation literally is an hour late.
This desk read the same record wrong three times, and the corrections are why this section exists. Our own notes recorded the deadline as 6 p.m. Eastern — read off the field, not the prose — and one of our own research passes reasoned its way to that answer and wrote it down so no later pass would revisit it. It was wrong; the deadline was 2 p.m. We also recorded a three-business-day bidding window, having read the date of an amendment as the date of publication. The real window, 29 July to 12 August, was ten business days — longer than last year's nine, which inverts a finding we had been ready to print. Three errors, one record, all from reading a document that states its own most important fact three different ways.
Whose phone it is
The people at the other end of this purchase appear in one government document, and it is ICE's own. The privacy assessment governing forensic analysis of electronic media, DHS/ICE/PIA-042, describes what the tools are for and who they reach.
Examiners "must review all the information on the media" to work out what is relevant — the search is total first and selective afterwards. Devices arrive by warrant, subpoena or summons, by voluntary production, or, for agents acting under border-search authority, by an exception that lets them "search, detain, seize, retain, and share electronic devices, or information contained therein, with or without individualized suspicion."
What comes off the phone then stays. Where a case ends in prosecution, five years past the last appeal. Where it does not, until the case closes — or sixteen years if the material might be needed again. Where a case is open and the crime has no statute of limitations, the extraction is "considered a permanent record" and "would be preserved indefinitely."
And ICE writes down who it cannot account for:
Privacy Risk: There is a risk that some individuals whose data resides in electronic media or devices used by multiple persons will be unaware that their information has been obtained, and therefore unaware of the opportunity for redress. Mitigation: This risk cannot be mitigated.
A shared laptop, a family tablet, a partner's phone. The law needs consent from one person with authority over the device; everyone else's data comes along, and the agency's considered position is that nothing can be done for them. That paragraph is eleven years old and has never been the news. It is the answer to what the controlled documents are describing.
The case for buying it this way
Take the agency's side properly, because it has one. Commercial-product rules exist so the government can rebuy a known thing without staging a six-month tournament. A single-award indefinite-delivery contract for a named product line is ordinary. Speed here is the design, not a dodge — though the numbers cut against the version of that argument this desk expected to find. Across the 690 of ICE's 696 combined synopses that carry both dates, the median window is seven business days. This one ran ten, longer than about two-thirds of them. Marking requirement documents controlled has a real justification too: a public list of exactly which extraction capabilities a law-enforcement agency is buying is an operational disclosure, and no one is entitled to it.
Every part of that holds. None of it explains why the sentence naming the only eligible sellers had to leave the public text, or why the brand-name justification that FAR asks for in public is now behind a request form, or why a notice cannot state its deadline once.
What a public notice is for
ICE has spent $59,961,959.58 with Cellebrite across 215 awards. The largest is a single purchase order for $11,112,194.40, signed at the end of September last year, which expires on 29 September 2026. Replacing it is what Friday's deadline is for.
The notice is still up, still active, and the amendment authorising its new deadline does not exist. What is public is that a purchase is happening, from a named company, on a date the record cannot agree on. What is controlled is everything a reader would need to know whether it is a good idea.
That is not a scandal. It is a public record that has become a pointer to a private one, and the pointer is the only part anyone can check.
References (1 sources)
References
All retrievals 12 August 2026 unless stated. The solicitation record was re-checked on 14 August: by then modifications had reached 3, a further amendment (A0002) had been published on 13 August saying the due date was unchanged, and responseDate was untouched — the Friday 14 August deadline stood.
Primary — the solicitation
https://sam.gov/api/prod/sgs/v1/search/?index=opp&q=70CMSD26R00000009— SAM.gov opportunity record for
RFP 70CMSD26R00000009, "Request for Proposal - Cellebrite Products", US Immigration and Customs Enforcement / Investigations and Operations Support Dallas. HTTP 200, 7,106 bytes, totalElements: 1. Requires a browser User-Agent plus Referer: https://sam.gov/search and Accept: application/hal+json; a default curl receives nothing. Retrieved twice, twenty minutes apart, identical. - originalPublishDate 2026-07-29T19:22:09+00:00; modifiedDate and publishDate both 2026-08-12T17:35:22+00:00; modifications: {"count": 2} at press time, 3 on re-check; isActive: true; isCanceled: false; archiveDate 2026-08-29. - originalResponseDate 2026-08-12T18:00:00+00:00 = 14:00 EDT, today. - responseDate 2026-08-14T18:00:00+00:00 with responseTimeZone America/New_York; responseDateActual 2026-08-14T14:00:00-04:00. The last of these agrees with the notice's prose; the first, read as the label invites, is four hours late. Caution for anyone re-running this: the +00:00 is real UTC, not a serialisation artefact on a local-naive value. This desk previously concluded the opposite and printed 6 p.m.; the extension notice's "2:00pm" settles it. - Description text, as amended today, is the source of the extension notice, the seven deferred FAR items, the "controlled" documents paragraph, the UEI request requirement, and Amendment A0001's statement that "the due date for proposals remains unchanged." - Points of contact: Greg Hermsen (primary), Bryan Ford (secondary). No inference is drawn here between either name and any login identifier appearing elsewhere in federal systems; an identifier match is not a proven identity.
https://sam.gov/api/prod/sgs/v1/search/?index=opp&q=Cellebrite&organization_id=100012075&size=50— every
ICE notice mentioning Cellebrite. HTTP 200, totalElements: 13, 13 of 13 returned, so the set is not truncated. Source of the two prior solicitations below.
192125VHQ4CCC0017— "Cellebrite Products and Services", same Dallas office, published
2025-08-28T11:40:48+00:00, response 2025-09-10T16:00:00+00:00. Carries the eligibility sentence verbatim, with "its authorized resellers".
192126VHQ4CCC0014— same title and office, published 2026-04-06T12:31:51+00:00, response
2026-04-10T16:00:00+00:00. Same sentence, with "it's authorized resellers".
https://sam.gov/api/prod/sgs/v1/search/?index=opp&organization_id=100012075¬ice_type=k— every
combined synopsis/solicitation ICE has ever posted. Paged to exhaustion: 7 requests, totalElements: 696, 696 of 696 returned, final page 96 — not a multiple of the 100-row page limit. 690 carry both an original publication and an original response date; median window 7 business days, mean 8.8, three posted and due the same day, 40% at five business days or fewer. This solicitation's ten business days is longer than about two-thirds of them. Windows here are measured from originalPublishDate, not publishDate — the latter is the date of the most recent republication, so measuring from it compresses every amended notice and is the same field error that produced this desk's withdrawn "three-day window".
Primary — who the tools are used on
https://www.dhs.gov/sites/default/files/publications/privacy-pia-forensicanalysisofelectronicmedia-may2015.pdf
— DHS/ICE/PIA-042, "Forensic Analysis of Electronic Media," May 2015. HTTP 200, application/pdf, 209,248 bytes, with a browser User-Agent; text via pdftotext -layout. Source of "must review all the information on the media", the border-search exception ("with or without individualized suspicion"), the retention ladder (five years past appeal; sixteen years; "permanent record… preserved indefinitely"), and the §7.4 redress passage quoted in full above. Note for re-checking: the quoted phrases straddle line breaks in the extracted text, so a literal grep returns nothing — normalise whitespace before concluding a phrase is absent.
Primary — the money
https://api.usaspending.gov/api/v2/search/spending_by_award/— contract awards to recipients matching
"Cellebrite", award types A/B/C/D, sorted by amount descending. Paged to exhaustion: 19 requests, the loop running until hasNext returned false; 1,878 rows, a final page of 78. 1,878 is not a multiple of the 100-row page limit, which is the check that the pull did not stop on a boundary. ICE is the awarding sub-agency on 215 of those rows, totalling $59,961,959.58; all agencies together, $163,832,658.58. Largest ICE award 70CMSD25P00000141, $11,112,194.40, start date 2025-09-30, end date 2026-09-29. Business-day counts throughout are plain weekdays with no federal-holiday table; on that basis the 2025 window is nine days, and eight only if Labor Day is excluded.