A lawsuit filed in May 2026 has placed a sharp light on what legal advocates are calling an unprecedented expansion of government surveillance power: the U.S. Department of Homeland Security used a century-old customs law to demand that Google hand over the personal data, location history, and communications records of a Canadian citizen who had never set foot on American soil in more than a decade — and whose only apparent offense was criticizing the Trump administration online.

The case, Doe v. Mullin, brought by the ACLU of the District of Columbia and the ACLU of Northern California, offers a rare public window into what appears to be a much broader, quietly expanding infrastructure of digital surveillance that experts warn has few meaningful legal checks and even fewer geographic limits.

The Mechanics of a Customs Summons

On February 14, 2026, DHS issued an administrative summons to Google demanding extensive personal information about a Canadian man identified in court filings only as John Doe. The summons sought his name, residential address, detailed records of his physical movements, records of websites he visited, and information about people he communicated with online. According to the ACLU, Mr. Doe has not entered the United States since 2015.

What distinguishes this demand from a conventional law enforcement request is the legal instrument used to issue it. A customs summons — authorized under the Tariff Act of 1930 — functions as an administrative subpoena that does not require prior approval from a judge or a grand jury. DHS issued the summons on its own authority, citing customs enforcement powers despite the fact that Mr. Doe was not accused of importing goods, evading duties, or engaging in any activity traditionally governed by customs law.

The complaint filed by the ACLU describes the summons as “a transparent gambit to chill speech the government doesn’t like.” DHS issued the demand shortly after Mr. Doe posted online criticism related to the deaths of Renee Good and Alex Pretti during immigration enforcement actions in Minneapolis. His posts had collectively received more than 100,000 views on X.

“Not satisfied with trying to suppress speech at home, the Trump administration is now targeting dissenters abroad,” said Michael Perloff, senior staff attorney at the ACLU of the District of Columbia. “A law designed to enforce customs does not give the government authority to target its critics around the world.”

A Pattern, Not an Isolated Incident

The Doe case is not unique. According to the ACLU, reporting from The New York Times and other outlets shows that since the beginning of President Trump’s second term, social media platforms have received hundreds of similar government demands for user information. The ACLU of Northern California, the ACLU of Pennsylvania, and the national ACLU have each filed separate legal challenges against comparable administrative subpoenas — though DHS withdrew those subpoenas before a judge could rule on their legality, leaving the underlying legal questions unresolved.

The Doe v. Mullin lawsuit is specifically designed to go further than previous challenges. It asks the court not only to invalidate the specific summons against Mr. Doe but also to issue a ruling making clear that DHS may not use its customs enforcement authority as a mechanism to identify and intimidate critics of the government.

The Surveillance Infrastructure Behind the Summons

The legal battle over Mr. Doe’s data is taking place against the backdrop of a dramatically expanded DHS surveillance architecture. The Brennan Center for Justice, which tracks government technology contracts, has catalogued the full scope of tools DHS has acquired and deployed since January 2021.

According to the Brennan Center, DHS’s surveillance capabilities now span six major categories: video surveillance, biometrics, location tracking, access to phone content, data purchases from commercial brokers, and AI-driven data analytics. The total contract obligations across these categories since January 2021 are staggering — over $1.1 billion committed to biometrics alone, $793 million to video surveillance, $622 million to data analytics, $228 million to data purchases, $130 million to access phone content, and $44 million to location tracking tools.

These tools include facial recognition systems, social media monitoring platforms, license plate readers, drone surveillance, phone extraction technology capable of accessing messages, contacts, and photos, and AI-driven software that generates leads, dossiers, and enforcement targets from aggregated data. The Wall Street Journal has reported that DHS and ICE significantly expanded their use of these systems for immigration enforcement purposes following the start of the current administration.

The Brennan Center notes that while DHS policies formally prohibit taking enforcement action solely on the basis of constitutionally protected activities like speech, association, or dissent, DHS leadership’s statements to Congress have left significant ambiguity about how those protections are applied in practice — and reporting strongly indicates the department has expanded its targeting of protesters and online critics.

Why Technology Platforms Are the Gateway

The legal theory underlying cases like Doe v. Mullin rests on a foundational feature of the modern information economy: the vast majority of global digital activity flows through American technology companies. Smartphones continuously generate behavioral data through GPS, cellular networks, Bluetooth signals, Wi-Fi connections, application tracking, advertising identifiers, and cloud synchronization. Companies like Google, Meta, Amazon, and Microsoft — along with a sprawling ecosystem of commercial data brokers — hold detailed records tied to billions of people worldwide, most of whom are not American citizens.

Because these companies operate under U.S. jurisdiction, American agencies have increasingly argued that they possess legal grounds to access records held by those companies regardless of where the subjects of their inquiries actually reside. As the Activist Post analysis noted, this means that if your information passes through American technology infrastructure, authorities may now assert a legal claim to portions of that data without regard to your nationality or physical location.

Legislative Response: The DHS Surveillance Technology Moratorium Act

In direct response to the documented expansion of DHS surveillance capabilities, Representative Daniel Goldman of New York introduced H.R. 9314, the DHS Surveillance Technology Moratorium Act of 2026, on June 15, 2026. The bill was referred to the House Committees on the Judiciary and Homeland Security, and as of July 2026 had been sent to the Subcommittee on Oversight, Investigations, and Accountability.

The proposed legislation would place a moratorium on certain DHS contracts related to surveillance and data analytics technologies pending public audits and new reporting requirements. The bill’s definition of covered surveillance technology is broad, encompassing any tool used by DHS that collects, aggregates, analyzes, retains, maps, predicts, or operationalizes personal information in connection with immigration enforcement — including facial recognition, social media monitoring, cellphone location tracking, geolocation analytics, and predictive analytics platforms.

The bill was co-sponsored by Representatives Velázquez, Clarke of New York, Thanedar, Grijalva, García of Illinois, and Williams of Georgia. As of this writing, the bill remains in committee with no scheduled vote.

The Broader Precedent at Stake

Legal scholars and civil liberties organizations have noted that what makes the current moment particularly consequential is not any single case or technology, but the combination of factors now present simultaneously: administrative subpoena powers that bypass judicial oversight, a private technology sector that holds unprecedented quantities of behavioral data on billions of people, AI tools capable of synthesizing that data into detailed individual profiles, and a demonstrated willingness to deploy those capabilities against individuals engaged in constitutionally protected speech.

Authorities rarely announce broad monitoring programs openly. Historically, expanded surveillance powers tend to originate in politically sensitive cases — terrorism, organized crime, immigration enforcement — before the scope quietly broadens to encompass wider categories of speech, behavior, and political activity. The question now before the courts, and before Congress, is whether existing law provides any meaningful limit on that expansion when the surveillance target is a foreign national posting criticism on a social media platform hosted by an American company.

Mr. Doe, speaking through court filings, put the concern plainly: “I have long admired the United States for its commitment to free speech. Never in a million years did I think that, after criticizing the U.S. government, I would be targeted with a summons seeking to find out who I am, where I live, where I go, and what I read online.”

That statement, from a Canadian citizen who has not entered the United States in eleven years, may prove to be one of the more precise summaries of what digital surveillance as a governance tool actually means in practice.

This article draws on reporting from WIRED, the ACLU of the District of Columbia, the Brennan Center for Justice, Congress.gov, and Activist Post.

Want to go deeper? Ask NEX, the Decrypted Matrix research assistant, about the documents behind this story. It indexes every article here the day it is published and cites its sources.