The records are public. The path to them often isn't.
What's actually riding along when you check who's in custody, and how to check it for yourself.
Jail booking and custody-status information is public record. Who's in custody, when they're released, when they move facilities. In most states, this is information the public is entitled to see. The open question is how you're allowed to reach it, and what rides along on the path.
Increasingly, the convenient path is a phone app. A vendor builds that app as a product, and it carries what products carry: advertising components, location trackers, and a pipeline back toward a data broker.
This page documents what that path looks like today, shows that better-designed paths already exist in some states, and describes a method anyone can use to check the apps in their own jurisdiction.
The national victim-notification service (VINE / VINELink, the "register to be alerted when an offender's custody status changes" system used across most of the country) is a product of Appriss Insights, LLC. Appriss Insights is a subsidiary of Equifax, which acquired it in 2021 for $1.825 billion and folded it into Equifax Workforce Solutions. Both facts are stated plainly on the services' own pages and in Equifax's own announcements.
In practice, when someone registers to be notified about a person in custody, they're handing their name, contact details, and their connection to that person to the victim-services front end of a company whose core business is selling incarceration and criminal-justice data, and which is one of the three national credit bureaus.
The VINE terms promise that registration data is "used only for VINE services." That's a real, narrow, victim-protective commitment. It's also a policy promise rather than a technical guarantee, made by a corporate family with a documented regulatory record: a 2019 settlement with the FTC, CFPB, and states over the 2017 breach that exposed 147 million people, and a 2025 CFPB order ($15 million) over botched credit-report dispute investigations. None of that proves misuse of registration data. It's context for how much weight a "trust us" promise can bear.
Equifax–Appriss acquisition; VINE terms ("used only for VINE services"); FTC/CFPB 2019 settlement; CFPB 2025 orderMany county sheriffs don't build their own apps; they license a white-label app from a vendor. One of the larger vendors, OCV, LLC, publishes hundreds of these under brands like TheSheriffApp.com, each one custom-branded for an agency but built from a shared codebase. A core marketed feature is digitizing jail and inmate information.
We statically audited 20 of these county apps across five states (Alabama, Florida, Georgia, Nevada, Texas), every one a com.ocv.* package. The findings were consistent across jurisdictions. Alongside the custody/VINE data feed, the same app commonly bundled:
The embedded keys and identifiers are extractable from any published app by design. That's not a breach, and we don't call it one. What matters is the bundling: the convenient path to public custody data also carries advertising identifiers, third-party location components, and a pipeline back toward a consumer-data broker. A vendor chose that bundle, and a vendor can choose differently.
Every claim above comes from a tamper-evident audit: each finding is bound by a hash chain to the exact app file it was derived from, so anyone can reproduce or challenge it. (More on the method below.)
The service works without the surveillance wrap. Two existing models show how.
Open records, published in bulk. Vermont publishes broad incident and stop-level data through an open data portal, on top of a strong Public Records Act. No app stands between the public and the public's information, and no advertising identifier comes along for the ride. This is the control case: it demonstrates that the data can flow without the toll.
A state that built its own. In August 2025, Nevada moved off the vendor system entirely. The Attorney General's office replaced VINE with a state-run service, Nevada S.A.V.E. Notifications, offender-based rather than incident-based, with victim-controllable features like notification blackout windows. The shift crossed party lines: Nevada was the first state to launch the "enhanced" vendor version of VINE back in 2017 under one administration, and replaced it under another. Even the earliest adopter reversed course.
Nevada fixed the state notification contract. The county sheriff apps are a separate layer, and our own audit found Nevada county apps still carrying the same bundle. Fixing the state contract is real progress; the app layer is the same job, unfinished.
Vermont Open Data Portal (e.g. VSP traffic-stop data); Vermont Public Records Act (1 V.S.A. §§ 315–320); Nevada S.A.V.E. Notifications (launched late Aug 2025; Nevada AG announcement, June 28, 2025)Public-records access is also a safeguard. When federal detention data becomes incomplete, or wrong, local public information is often the only way to reconstruct what actually happened to a person.
The 287(g) program, which deputizes local officers for immigration enforcement, grew more than tenfold, from 135 signed agreements in January 2025 to 1,954 (across 39 states and two territories) by June 2026. ICE describes it as removing serious criminal offenders; independent analysis of ICE's own detention data finds that more than 70% of people in detention had no criminal conviction (70.8% as of April 2026). Both claims are on the record.
ICE 287(g) program (as of June 12, 2026); TRAC detention quick facts; American Immigration CouncilWhat makes the 287(g) list useful is that ICE publishes it. Its Jail Enforcement Model subset, 181 agencies across 30 states, names the jails processing people for removal, so it tells you where to look. Cross-referenced against public rosters and detainer holds, it can surface the pattern federal data hides: a person held a long time, no charges, whose status then changes without explanation. This is built entirely from public inputs.
Verifiable provenance matters here for a concrete reason: it happened to someone I know: held without charges, recorded as "moved to an undisclosed location" when he had in fact been deported. One roster snapshot can't prove a record was rewritten; a tamper-evident series of them, over time, can show exactly what the record said and when it changed. That is the entire reason this project treats chain of custody as something to prove, not trust.
The courts are part of this picture, unevenly. In a March 30, 2026 order, a Nevada federal court (Jacobo-Ramirez v. Noem) ruled DHS's mandatory-detention policy unlawful and restored bond hearings for a Nevada class, district-court relief specific to that state. The Fifth and Eighth Circuits have gone the other way, broadening mandatory detention, so the law is genuinely unsettled and on appeal.
ACLU of Nevada; Jacobo-Ramirez v. Noem order (Justia); CLINIC Court Watch (circuit splits)On method and ethics: the accountability target is the system and the agencies, not the individuals caught in it. Surface patterns, hand verifiable records to advocates, journalists, and counsel, connect people to help, and never publish a detained person's identity. The redaction discipline used elsewhere on this site applies here with more force.
And local action still has teeth. Several states have banned 287(g) participation, any agency can withdraw at any time, and litigation like Nevada's can restore due process locally even while the federal picture stays dark. People held under federal opacity still exist in a physical place, governed by laws that may protect them. Local transparency is what makes that protection actionable.
Detention has a financial engine, and the facts behind it are documented.
At the local level, detention is a revenue stream. County jails are paid per detainee, per day, through Intergovernmental Service Agreements. The per-diem varies by jurisdiction and often isn't public, against an ICE all-in average around $152 per adult per day (September 2025). Every additional day a person is held is a billable line item. That turns a county jail into a revenue center, which is a local financial incentive to participate in detention. It's the same incentive as the federal contracts, one rung down. You can compute your own county's take: pull its IGSA (FOIA the county or ICE; counties often attach the agreement to commission-meeting agendas), multiply the per-diem by days held.
In one case I can account for personally, a 40-day detention that should have taken under a week generated roughly $2,400–$4,800 to two counties for a single person, and the ~33 avoidable days were billable all the same.
At the national level, it's a record-revenue business on a steep upswing. In 2025 the two dominant private operators hit record revenue: GEO Group $2.63 billion, CoreCivic $2.2 billion, with CoreCivic's net income up about 70% to $116.5 million. Both guide higher for 2026: GEO expects roughly $3 billion in revenue, and CoreCivic projects net income of about $148–158 million. The engine is the 2025 budget law (enacted July 2025) that put about $45 billion over four years into immigrant detention, roughly tripling ICE's detention budget, to fund an expansion from about 56,000 people detained in mid-2025 toward 100,000 beds. On their own earnings calls, investors pressed these companies for more detention.
GEO Group FY2025 results; CoreCivic revenue (TIME); CoreCivic profit & 2026 guidance (The Appeal); $45B / bed expansion (Brennan Center); per-diem & average stayThe incentive is perverse: the public interest is due process and releasing low-risk people quickly, while the revenue is maximized by detaining more people for longer, in a population that is roughly 71% people with no conviction. The operators' answer is that they provide a service the government requests and don't set detention policy. That's fair as far as it goes. But the structure still rewards expanding detention regardless of need, and it stays invisible unless someone makes it visible.
As for who's behind the policy: the honest answer is a documented, circumstantial pattern. A clean exchange ("this payment bought that policy") is exactly what the decades-old ban on federal-contractor contributions exists to prevent, and exactly what structured giving (routing money through subsidiaries that hold no federal contracts) is built to obscure. The clearest case is GEO Group. In 2016, the day after the Justice Department announced it would phase out private-prison contracts (sending GEO's stock down), GEO's subsidiary GEO Corrections Holdings gave $100,000 to the pro-administration super PAC Rebuilding America Now ($225,000 by election day), plus $250,000 to the inaugural committee; the phase-out was reversed in early 2017, and new federal contracts followed. In 2024, a different non-contracting subsidiary, GEO Acquisition II, gave about $1 million to the super PAC MAGA Inc.; in 2025–26, GEO Reentry Services gave $1 million more on three separate occasions, and GEO's own 2025 political-activity report lists $4.4 million in total contributions. The Campaign Legal Center and CREW have formally alleged this amounts to pay-to-play; the FEC deadlocked and now lacks the quorum to investigate. GEO maintains its contributions are lawful and that it serves under both parties. We present the timeline (who gave, how much, through what vehicle, when, and what followed), and let readers weigh it.
Campaign Legal Center (GEO pay-to-play); POGO (2025–26 giving, $4.4M); FEC lacks quorum (CNN)The method we used is open and reproducible, and you don't need anything exotic to run it. The short version:
com.ocv.* package, so existing tracker databases often already have a report.This is something a curious resident, a journalist, or a public defender can do for their own jurisdiction in an afternoon.
Publishing responsibly. If you find embedded keys or backend identifiers, please don't publish a turnkey copy of them; even though they're extractable, aggregating and annotating them helps no one and can harm the agency. The tooling behind this page includes a redaction step that replaces such values with stable fingerprints (so "the same key appears across N apps" stays provable) while removing the live values and any exploitation detail. Document the finding; don't hand out a kit. And where keys are live, the responsible path is to notify the vendor so they can rotate them, ideally before publishing.
A purchasing standard solves this. A reasonable baseline for any publicly-funded victim-notification or public-information app:
Nevada is the existence proof that a state can meet this bar. The audit method on this page gives any office a reproducible way to check whether a vendor actually does.
This page is informational. It documents how public-records access is currently intermediated, points to better-designed alternatives that already exist, and describes a method you can run yourself. The better answer here is mostly a policy and procurement choice, one some states have already made.