The Department of Homeland Security quietly updated the directive governing its internal use of artificial intelligence this month, and the revised policy gives the department's chief AI officer the power to waive any requirement it contains, including prohibitions on specific uses. The directive, which took effect in September, keeps a ban on using AI for "systemic or large-scale monitoring, surveillance, or tracking of individuals," along with predictions of emotional state or future behavior. But the same document lets a single official set that ban aside.
"A rule that comes with its own off switch is not a rule," Tom Bowman, policy counsel at the Center for Democracy and Technology, told FedScoop. The waiver carries no requirement for independent review by the department's privacy or civil-rights offices, no notice to Congress or the public, and no expiration date. The directive says any waiver must stay "consistent with law, regulation, and government-wide policy," but Rachel Levinson-Waldman of the Brennan Center called that "a loophole big enough to drive a truck through," arguing that a determined chief AI officer could justify setting aside almost any prohibition.
The timing sharpens the concern. In September, Immigration and Customs Enforcement awarded a $125 million contract to Thomson Reuters Special Services for services that would enable the monitoring of one million individuals and flag potentially criminal or fraudulent behavior before it happens. Asked how that squares with the surveillance ban, an ICE spokesperson said the agency would assess the contractor's use of what the administration now calls "super intelligence" for consistency with the directive, the same directive its chief AI officer can waive.
A separate analysis published this week by Just Security argues the transparency meant to check these systems is already failing. Federal agencies must publish annual inventories of their AI use cases, but DHS classifies tools such as the facial-recognition app Mobile Fortify and the ELITE address-finding app in ways that let it skip minimum safeguards like accuracy testing and appeal processes. The inventories appear only once a year, so a tool can run for months before the public learns of it: Mobile Fortify became operational in May 2025 but surfaced publicly only when 404 Media reported it in January 2026.
These two developments point the same way. The 2022 Advancing American AI Act leaves each administration to decide how much detail agencies must disclose, and the current one has read that latitude narrowly, dropping Biden-era questions on operational testing, privacy review and demographic performance gaps. A waiver power with no outside sign-off, layered on inventories that reveal little, means the formal prohibitions on surveillance can be switched off and the record of doing so may never appear.
What remains unclear is whether the chief AI officer has used the waiver, and for what. DHS has not said, and nothing in the directive requires it to. The open question is not only what the department is doing with AI at the border and in immigration enforcement, but whether its own rules are built to let anyone find out.