Hackers have exposed login records belonging to more than 41,000 employees and contractors at the US Department of Homeland Security (DHS), revealing sensitive details about agency personnel, their access privileges and the surveillance and investigative technologies they are authorized to use.
The leaked records provide an unusual glimpse into the department's internal operations, investigative capabilities and management structure. The disclosure has also raised concerns about the balance between government transparency and the security risks of identifying individuals involved in federal immigration enforcement.
The transparency nonprofit Distributed Denial of Secrets (DDoSecrets) published the archive, named "Icepick," on Wednesday. The dataset covers DHS and seven of its agencies, including Immigration and Customs Enforcement (ICE) and US Customs and Border Protection (CBP).
The leaked material contains employees' email addresses, phone numbers and office locations, as well as more than 55,000 permission groups governing access to internal systems. Several group names reference investigative technologies, including Palantir's Falcon platform and PenLink, a tool used to analyze phone records and social media activity. Others point to software for extracting information from seized mobile phones, accessing immigration court records and conducting electronic surveillance.
Among the identified groups are a "Title III Intercept Program," a "Communications Intercept Center TechOps (CICTO) Program" and an "Illicit Sensor Intercept Program (ISIP)."
The records were last updated in August. DDoSecrets said the information originated from DHS' Okta login system, a claim the identity-management company disputes. "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised," an Okta spokesperson told Wired.
Almost every individual listed in the archive belongs to at least one permission group, allowing the records to reveal which employees have access to particular investigative capabilities.
At Homeland Security Investigations (HSI), ICE's investigative division, 39 employees across more than a dozen field offices belong to groups identified as "CUC." Government court documents indicate that the abbreviation stands for "certified undercover operation."
Another group, apparently associated with HSI's St. Paul, Minnesota, area of operations, references "Keyhole." Federal court filings describe Keyhole as a certified undercover operation that financed HSI surveillance of protest groups in Minneapolis earlier this year.
The records also identify more than 200 CBP accounts associated with a group referencing Mobile Fortify, a facial-recognition application used by immigration officers to identify individuals. Those listed include field supervisors, special response team operators, and tactical and intelligence personnel.
Additionally, more than 700 accounts, most of them belonging to CBP employees, are connected to a group that appears to reference Signal, the encrypted messaging application.