# ICEPIC Successor Stack: Distributed Case Management, Analytics, and Information Sharing ## Core Finding The successor to [[wiki/ICEPIC|ICEPIC]] is not one database. DHS decomposed the older combination of repository, pattern analysis, and external sharing into interacting systems of record, analytical platforms, exchange services, enrichment products, and collection or exploitation tools. The documented historical branch is **ICEPIC → [[wiki/DHS Pattern and Information Collaboration Sharing System|DPICS2]] → standalone [[wiki/DHS Law Enforcement Information Sharing Service|LEIS/LEISS]]** for information exchange. The wider analytical branch moved through [[wiki/FALCON Search and Analysis|FALCON-SA]], [[wiki/Palantir Gotham|Palantir Gotham]], and [[wiki/Investigative Case Management|ICM]] toward the 2026 [[wiki/Case Management and Analytics Platform|Case Management and Analytics Platform (CMAP)]] and its [[wiki/Enterprise Lakehouse|Enterprise Lakehouse]].[^1][^2][^3][^4] This is best described as functional and architectural continuity rather than a claim that every ICEPIC rule, record, or analytic persisted unchanged. Direct lineage is established where DHS privacy assessments or procurement records say so; elsewhere, continuity means that the same mission functions—entity resolution, relationship analysis, lead development, search, sharing, deconfliction, and case workflow—reappear in newer systems. ## The Historical Split ICEPIC contained repository and analytical functions and supported the LEIS external-sharing interface. ICE retired ICEPIC in 2012 and replaced it with DPICS2; DPICS2 was retired in 2014. LEIS survived as a non-public backend service that DHS called a data-sharing “super highway.” After DPICS2 disappeared, LEIS retrieved selected information directly from authoritative systems rather than querying copies held in the intermediate repository.[^1] LEIS is therefore the successor to ICEPIC's **exchange plane**, not a complete analytical successor. Its continuation records the architectural shift from repository-centered sharing to federated access through services and authoritative sources. ## Five-Plane Modern Architecture ### 1. System-of-record plane [[wiki/Investigative Case Management|ICM]], deployed in 2016 on [[wiki/Palantir Gotham|Palantir Gotham]], became HSI's official investigative system of record for cases, subjects, organizations, reports, seizures, media, workflows, and relationships. Its surrounding architecture includes the [[wiki/PRIME Interface Hub|PRIME Interface Hub]], [[wiki/HSI Data Warehouse|HSI Data Warehouse]], [[wiki/Telecommunications Linking System|Telecommunications Linking System (TLS)]], and [[wiki/PenLink|PenLink]].[^3] The 2026 procurement record points toward [[wiki/Case Management and Analytics Platform|CMAP]], a unified case-management and investigative-analytics environment designed to reduce duplicate operational and analytical stores, enforce role- and case-level security, and produce near-real-time insight. ### 2. Data and graph-analytics plane [[wiki/FALCON Search and Analysis|FALCON-SA]] provides large-scale search, visualization, link analysis, and intelligence development across ICE and outside data. It discovers relationships among people, organizations, events, locations, and investigations.[^2] The CMAP design adds an [[wiki/Enterprise Lakehouse|Enterprise Lakehouse]], entity resolution, graph and network analytics, geospatial and temporal analysis, anomaly detection, and machine-learning-assisted workflows. Public records reviewed in 2026 do not establish that FALCON-SA has formally retired. ### 3. Federation and exchange plane [[wiki/DHS Law Enforcement Information Sharing Service|LEIS/LEISS]], [[wiki/PRIME Interface Hub|PRIME]], [[wiki/Nlets|Nlets]], [[wiki/Criminal Justice Information Services Division|FBI CJIS]], [[wiki/Office of Biometric Identity Management|OBIM]], CBP systems, and APIs or web services let authorized systems exchange or retrieve information without cloning every upstream source. The important distinction is **authoritative record versus queryable representation**. ### 4. Commercial and open-source enrichment plane HSI procurements expose a specialized ecosystem for screening and vetting, lead development, pattern and relationship detection, anomaly detection, cyber-threat intelligence, social and dark-web research, and network visualization. The [[wiki/HSI Cyber Crimes Center|HSI Cyber Crimes Center]] is procuring [[wiki/H2O.ai|H2O.ai]]; other named products and organizations include [[wiki/Searchlight Cyber|Searchlight Cyber]], [[wiki/Team Cymru Advanced Recon|Team Cymru Advanced Recon]], and [[wiki/PenLink Tangles and Webloc|Tangles + Webloc]].[^5] ### 5. Collection and exploitation plane Digital-forensic, telecommunications, open-source, cyber, image, and device evidence enters cases and graphs through systems including [[wiki/Cellebrite|Cellebrite]], [[wiki/Magnet Griffeye|Magnet Griffeye]], [[wiki/Magnet AXIOM|Magnet AXIOM]], and [[wiki/LACE Carver|LACE Carver]]. This plane produces evidence and extracted artifacts; the system-of-record and analytics planes organize, correlate, and act on them.[^6] ## CMAP as the 2026 Convergence Point ICE's stated CMAP objective is a single integrated platform joining case management and analytics at [[wiki/FedRAMP High|FedRAMP High]]. Requirements describe an Enterprise Lakehouse capable of serving as an authoritative data source, integration with CBP seizure information and [[wiki/Enforcement Integrated Database|EID]]/[[wiki/EAGLE|EAGLE]] arrest data, interoperability with FBI CJIS, Nlets, OBIM, CBP and other partners, and role-based plus individual-case security. The explicit objective is to eliminate duplicate datasets and synchronization delays while supporting real-time analytical insight.[^4] In June 2026 ICE awarded Palantir work for HSI investigative case management and analytics on CMAP; a separate ERO modernization award uses the broader CMAP architecture. Those awards show platform convergence across ICE components while preserving component missions and access boundaries. ## Vocabulary Shift The current vocabulary is **case management and analytics platform, Enterprise Lakehouse, investigative analytics, entity and relationship analysis, interoperability, data integration, screening and vetting, lead development, targeting, anomaly detection, OSINT, cyber-threat intelligence, digital forensics, link analysis, network analysis, real-time analytics, role-based access control, case-level security, FedRAMP High, authoritative data source, COTS/SaaS, API, and web-service information sharing**. The architectural shift is from “put copied records in one repository and search them” toward **maintain authoritative distributed sources; integrate relevant information into a governed lakehouse and graph; resolve entities across domains; enrich them through specialized sources; expose relationships to models and analysts; and return intelligence to operational case workflows.** ## Relationships - **historical system:** [[wiki/ICEPIC|ICEPIC]] and [[wiki/DHS Pattern and Information Collaboration Sharing System|DPICS2]]. - **exchange continuity:** [[wiki/DHS Law Enforcement Information Sharing Service|LEIS/LEISS]]. - **analytical continuity:** [[wiki/FALCON Search and Analysis|FALCON-SA]], [[wiki/Palantir Gotham|Gotham]], and [[wiki/Investigative Case Management|ICM]]. - **2026 convergence:** [[wiki/Case Management and Analytics Platform|CMAP]] and [[wiki/Enterprise Lakehouse|Enterprise Lakehouse]]. - **mission organizations:** [[wiki/Homeland Security Investigations|HSI]], [[wiki/Enforcement and Removal Operations|ICE Enforcement and Removal Operations]], [[wiki/United States Customs and Border Protection|CBP]], [[wiki/Office of Biometric Identity Management|OBIM]], and [[wiki/Criminal Justice Information Services Division|FBI CJIS]]. ## References [^1]: DHS, [*Privacy Impact Assessment for the Law Enforcement Information Sharing Service*, 2019](https://www.dhs.gov/sites/default/files/publications/privacy-pia-ice-leiss-july2019_0.pdf). [^2]: DHS, [*Privacy Impact Assessment Update for FALCON Search & Analysis*, 2021](https://www.dhs.gov/sites/default/files/publications/privacy-pia-ice032b-falconsa-appendixbupdate-march2021.pdf). [^3]: DHS, [*Privacy Impact Assessment for Investigative Case Management*, 2016](https://www.dhs.gov/sites/default/files/publications/privacy-pia-ice-icm-june2016.pdf). [^4]: ICE procurement record, [CMAP investigative case management and analytics requirements, 2026](https://govtribe.com/file/government-file/1-dot-5-dot-1-ice-lsj-icm-palantir-final-signed-redacted-1-dot-8-dot-26-dot-pdf). [^5]: DHS Acquisition Planning Forecast System, [HSI Data and Analytical Support Services](https://apfs-cloud.dhs.gov/record/73278/public-print/). [^6]: DHS Acquisition Planning Forecast System, [Cellebrite IDIQ forecast](https://apfs-cloud.dhs.gov/record/73738/public-print/).