Over the last decade, a growing number of American cities and states have restricted the information local law enforcement departments can exchange with immigration authorities.

But new documents reveal that US Immigration and Customs Enforcement (Ice) has tapped a network of private technology companies to skirt such sanctuary policies, facilitating access to “real time” information about incarcerations and jail bookings, which enables them to pick up immigrants targeted for deportation.

The documents, which were obtained by a group of immigrant advocacy groups including Mijente, Colorado Immigrant Rights Coalition, and American Friends Services Committee and reviewed by the Guardian, show that in lieu of law enforcement cooperation in jurisdictions with sanctuary policies, Ice has turned to LexisNexis and Equifax, data brokers that collect, access and then sell personal and criminal justice information.

The report focuses on Colorado, where a sanctuary policy has limited cooperation between local agencies and Ice since 2019. But many of the databases Ice has acquired access to are national in scope, the documents show.

Several US jurisdictions with sanctuary policies have started to ask questions about Ice’s use of tech solutions and loopholes. In Chicago, members of the Cook county board of commissioners in April requested an investigation into whether Ice’s use of data brokers violated sanctuary policies.

A trove of personal and court information

Before Colorado passed its version of a sanctuary law in 2019, local law enforcement regularly shared information like probation schedules with Ice, or granted requests to hold migrants the federal agency was interested in.

Getting picked up by Ice in the middle of probation appointments, for example, was not uncommon. Maria, an immigrant from Honduras who said she traveled to the US to escape the dangers of a local gang, said she was detained by Ice during her first appointment with her probation officer. Maria, whose name the Guardian has changed as to not jeopardize her immigration prospects, had arrived in the US in 2011. She was arrested in 2014 after police found drugs belonging to her roommate in their house, she said.

After the arrest, she had hoped to quickly clear her record and start fresh. But instead, she was detained by Ice. She spent eight months in a detention center, she said, during which she applied for asylum. Her case was ultimately rejected and she was deported back to Honduras in 2016.

Maria does not know how Ice obtained her probation information. But in 2019, three years after her deportation, Colorado explicitly prohibited local law enforcement agencies from sharing probation information with Ice. Although the state still allowed law enforcement to share jail booking and release information with the agency, it barred local departments from complying with Ice’s detainer requests.

After the law was passed, the share of detainer requests that were refused by Colorado agencies went from 19% in 2019 to more than 29% by 2020, according to Ice data.

But Ice found new sources of information. In addition to issuing subpoenas and legal requests to tech companies known for storing vast swaths of user data such as Google and Facebook, the agency contracted with data brokers that collect and sell personal consumer and criminal justice data from a variety of sources.

In February 2021, Ice agreed to pay LexisNexis, the company that offers database services to law librarians, journalists and others, more than $17m to access its real-time “virtual crime” platform Accurint, the documents show.

Accurint, according to the company’s website, “brings together disconnected data from over 10,000 different sources, including police agencies nationwide and public records” to give law enforcement a “comprehensive view of people’s identities”. Police agencies, for instance, contribute crime data, dispatch records, offender data, crash data and license plate reader data, according to the Colorado report. The program allows law enforcement officers to receive jail booking alerts on individuals, paired with their personal information including phone records, vehicle registration and court and property records.

Four months later, Ice paid for access to Justice Intelligence, a database offered as an add-on service by several platforms including LexisNexis and run by Appriss, a company owned by credit bureau Equifax.

Justice Intelligence provides real-time jail booking and release information from more than 2,800 jails across the US, according to Appriss, as well as information pulled from tens of millions of court records, probation and parole records and offender data. The database updates “as frequently as every 15 minutes”, according to the company. The Justice Intelligence deal would cost Ice an additional $4.8m .

Ice argued in the documents it needs Appriss’s data because law enforcement agencies around the country won’t give it to them. “Due to policy or legislative changes, [Ice Enforcement and Removals Office] has experienced an increase in the number of law enforcement agencies and state or local governments that do not share information about real time incarceration of foreign-born nationals with ICE.

“Therefore, it is critical to have access to Justice Intelligence. There would be a major operational impact on public safety without these screening tools.”

In Colorado, booking and release information included in the Justice Intelligence database is provided to Appriss by many Colorado sheriffs departments through a direct connection to local jail management systems, according to the report. That information is intended to be used to notify victims of crimes who sign up for a statewide alert system called Vine. Though anyone can sign up for Vine, sharing that information with Appriss means that Colorado law enforcement may also be sharing it with the company’s other clients, including Ice.

Conor Cahill, the press secretary for Colorado’s governor, Jared Polis, said the governor has worked to balance “the need to protect individuals’ privacy from unnecessary intrusion with the state’s need to ensure public safety and support with law enforcement”.

“Colorado’s jails are under local – not state – jurisdiction,” Cahill said in a statement. “At the state level, Governor Polis has developed and implemented safeguards to ensure data privacy for all Coloradans, regardless of immigration status.”

Ice referred questions about its contract with LexisNexis to LexisNexis.

LexisNexis referred to an FAQ about its work with Ice.

An Equifax spokesperson, Kate Walker, said the company does not directly contract with Ice. “Appriss Insights (‘Insights’), an Equifax company, aggregates publicly available incarceration and other law enforcement data,” Walker said in a statement. “Insights does not contract directly with US Immigration and Customs Enforcement. Its contracts permit its channel partners to deliver solutions that may be used for law enforcement purposes in accordance with state and federal regulations,” she continued.

Bill Ray, a spokesperson for the county sheriffs of Colorado (CSOC), which manages Vine, said there was no way of knowing how Ice used Appriss. “We have no way of knowing what Ice does in any aspect of its operations and how it might use this or any other system,” Ray said. “At the same time, CSOC cannot speak to Appriss’s operations.”

How Ice evades protections against searches

Data brokers are part of a broader ecosystem of companies hoovering up consumer data from a variety of sources and selling or sharing it with clients, including law enforcement.

That ecosystem has privatized the mechanisms law enforcement typically use to obtain information on individuals, allowing agencies like Ice to circumvent traditional avenues of information gathering for which it typically would have to show probable cause.

There are few federal laws on the books that regulate how data brokers buy and sell consumer data. And many sanctuary policies, including Colorado’s, do not specify regulations around these alternate sources of information, said Siena Mann, the organizing and campaigns manager at the Colorado Immigrant Rights Coalition (Circ).

“Ice is evolving really rapidly,” Mann said. “So we as a state need to evolve as well, so our policies actually do what they say they’re supposed to do. The spirit of them is to protect our communities and they need to evolve to address the ways that enforcement is evolving.

“These contracts with data brokers completely erode any sort of protections you can have against search and seizure,” said Jacinta Gonzalez, the field director for the Latinx advocacy group Mijente. “The idea that there would have to be an investigation and probable cause that would lead to getting a warrant is just totally thrown out the window when Ice can use private companies to come up with information just for investigative purposes, and then arrest and deport someone.”

Companies like LexisNexis should “stop pretending to be just research companies or publications or whatever it is that they kind of pretend to be,” said Gonzalez. “If they know that the consequence of them selling information to Ice is some of the stories that you’re hearing then they should reconsider their practices and those contracts,” Gonzalez said.

Colorado’s state sanctuary policies don’t prohibit companies from sharing incarceration information with Ice, but the sanctuary ordinance of Denver, Colorado’s state capitol, prohibits the city from entering into “any contractual agreement that would commit or require any city officer or employee to directly or indirectly assist in the enforcement of federal immigration laws.” Still, Denver is a part of the state’s Vine system run by Appriss.

The Denver district attorney’s office and the sheriff’s office did not respond to a request for comment in time for publication.

In Cook county, Illinois, where in 2015 the governor instructed state agencies not to cooperate with Ice the contract for Appriss prompted county commissioner Alma E Anayaa to propose a resolution earlier this month to investigate Ice’s relationship with data brokers. “Ice has published documents that explicitly confirm that they use data brokers to get around sanctuary policies and law,” the resolution reads. “The previous year, Cook county law enforcement agencies had to reject more than 1,000 detainer requests because of local sanctuary policies. Even when localities refuse to execute detainers, LexisNexis’s program, Justice Intelligence, allows Ice to obtain the necessary data to bypass local policies,” it continues.