Homeland Security Investigations Increasing Use of Administrative Subpoenas
Homeland Security Investigations (HSI), a division of Immigration and Customs Enforcement (ICE) primarily tasked with addressing transnational crime, has reported issuing at least 185,000 administrative subpoenas since the inauguration of the Trump administration. This staggering figure, disclosed in a recent court filing by the Electronic Frontier Foundation (EFF), highlights HSI’s growing reliance on this warrantless authority to conduct various investigations.
To contextualize HSI’s figure, a prior WIRED analysis indicated that over a span of more than six years, from early 2016 to mid-August 2022, ICE agents had issued approximately 170,000 customs summons—specifically a type known as a 1509 administrative subpoena. This comparison underscores a significant increase in investigative activity by HSI through administrative means.
The revelations came as part of a Freedom of Information Act lawsuit aimed at obtaining clearer insights into HSI’s practices surrounding these subpoenas. Aaron Mackey, the EFF’s deputy legal director, stated that the organization seeks further clarification on the estimated 185,000 subpoenas. The initial request from the EFF aimed to uncover detailed information regarding the number of these subpoenas sent to technology firms and internet service providers since January 20, 2025. It remains unclear whether this request pertains exclusively to technology-related entities or if it encompasses a wider array of recipients.
Administrative subpoenas present a potent, albeit unchecked, tool for governmental investigation. Unlike traditional grand jury subpoenas, which require judicial approval and justification, these administrative requests allow the government to obtain documents without demonstrating to a court the necessity or relevance of the information sought. This lack of oversight raises concerns about potential overreach and misuse of power.
Since the Trump administration’s onset, there have been instances where the DHS utilized its administrative subpoena powers to identify anonymous online critics and to obtain extensive customer records related to public demonstrations. Notably, one such case involved requesting a list of individuals in the Twin Cities area who purchased a particular product, demonstrating the broad application of these subpoenas in contexts beyond traditional investigations.
Initially, Congress authorized the use of 1509 customs summons nearly a century ago, intending to enhance customs officers’ ability to audit business records pertinent to imports and assess customs duties. Following the establishment of the Department of Homeland Security in 2003, these powers were transferred to the new agency. Historically, DHS has insisted that customs summons are limited to specific, customs-related purposes. However, a 2017 reprimand from the DHS Inspector General criticized Customs and Border Protection for attempting to use a customs summons to reveal the identity of an anonymous Twitter user, highlighting an ongoing tension between the agency’s protocols and its operational practices.
As businesses increasingly find themselves in the crosshairs of such governmental actions, understanding the framework of HSI’s investigative methodologies becomes critical. Utilizing the MITRE ATT&CK framework, one can ascertain that tactics such as initial access and persistence may be relevant in these contexts, especially in facing potential repercussions stemming from investigative overreach. The implications for data security and privacy in light of this increasing usage of administrative subpoenas should be a focal point for business owners and cybersecurity professionals alike.