The United States government’s rapid expansion of biometric data infrastructure for immigration enforcement has created a critical national security liability, according to a new analysis from the Center for Strategic and International Studies. The CSIS report argues that by consolidating fingerprints, facial images, travel histories, and employment records into centralized systems, federal agencies have assembled exactly the kind of high-value target that nation-state adversaries most want to penetrate.
The core concern is what CSIS calls an “aggregation hazard”: previously siloed data streams have been merged into unified repositories that offer adversaries a single access point to an extraordinary depth of personal intelligence. Fueled by $75 billion in new funding through the 2025 “One Big Beautiful Bill” Act, ICE’s surveillance pipeline now includes driver’s license photos covering roughly one in three US adults and utility records reaching three in four. The primary platform consolidating this data, ImmigrationOS, was built by Palantir.
The warning follows CBP’s recent Clearview AI deal for tactical targeting, one of a series of contracts expanding the biometric infrastructure CSIS identifies as a counterintelligence risk. The report’s concerns are further illustrated by tools already deployed in the field, including NEC’s Mobile Fortify app, which draws from a 1.2 billion image database for DHS agents.
CSIS identifies the immutability of biometric data as the defining risk factor that distinguishes this threat from conventional data breaches. Unlike passwords or account credentials, compromised biometric records cannot be changed or reissued. A nation-state adversary that successfully penetrates these repositories would gain a permanent intelligence advantage for identifying, profiling, and targeting individuals. The report cites the 2015 OPM breach and the 2024 Salt Typhoon campaign, in which Chinese state-sponsored actors infiltrated US telecommunications networks, as precedents demonstrating both the appetite and capability of foreign intelligence services to conduct exactly this kind of long-horizon data collection.
The CSIS report also points to ICE’s $9.2 million Clearview AI facial recognition contract as one of several investments contributing to the aggregation risk the report describes.
“Much like the power grid or banking systems, if these massive biometric and location databases are to be used foundationally by federal agencies, they should be governed with the same rigor as our most sensitive national assets,” the CSIS Strategic Technologies Blog stated in the report.
The analysis stops short of calling for a halt to biometric data collection, instead arguing for governance frameworks commensurate with the sensitivity of the data. CSIS positions these repositories as critical national infrastructure requiring protective standards comparable to those applied to financial systems or the energy grid.
Sources: CSIS
–
By Cass Kennedy
