DHS Orders FlokiNET To Remove Icepick Leak Exposing ICE And CBP Staff Data

Icepick leak targets agents

The United States Department of Homeland Security asked an Icelandic web hosting company, FlokiNET, to take down a site with information about tens of thousands of its employees, after FlokiNET posted a letter it received from ZeroFox on behalf of DHS. The DHS letter accused FlokiNET of violating its terms of service by publishing a “stolen” employee dataset and asked it to “remove or disable” the information, saying the content is live and places more than 40,000 identifiable individuals at risk of harassment, stalking, and physical harm. Details of more than 41,000 DHS personnel were leaked to the public, including names, work addresses and phone numbers of staff working with Immigration and Customs Enforcement (ICE) and Customs and Border Protection.

DHS asks FlokiNET1 of 9 outlets reported it · not in BBC and 7 more▾

The information was put in a database named Icepick, and it identified that more than 21,000 of the agents work for CBP and nearly 6,600 work for ICE. The group called the Department of Peace accessed the information through a single sign-on service called Okta, while an Okta spokeswoman said: "Okta is secure, and we have no evidence our data or systems were compromised."

Okta access claim6 of 12 outlets reported it · not in Al Jazeera and 5 more▾

Reporting for this sectionAl JazeeraBBC

Okta, tools, and competing claims

DDoSecrets co-founder Emma Best said the leak was extraordinary and deceptive in its simplicity because it identifies the officials responsible for overseeing covert and undercover operations, the government's hunt for leakers and the failed BlueLeaks investigation.

The leaked information included some of the technology the agents used in their work, including tech provided by Cellbrite and Palantir.

The Icepick files were published October 28 by Distributed Denial of Secrets and Reuters was unable to verify that the records originated from a DHS-associated Okta identity-management environment.

Okta has no evidence its systems or data were compromised, and it described the searchable database as indexing 55,603 Active Directory and Okta groups covering 41,191 people.

A Department of Peace spokesperson pointed to actions by ICE agents and wrote: "On July 17th, Markwayne Mullin said he was 'turning up the heat'. This is what happens to ICE when you do that," while DHS said it was aware of a potential breach and actively working to address the situation swiftly and effectively.

Reporting for this sectionBBCBiometric Update

Security stakes and oversight

DHS said it was aware of a potential breach and was actively working to address the situation swiftly and effectively, while the agency said it would update the public when more information became available. DW reported that the leaked data included names, phone numbers and email addresses of personnel from ICE, CBP, USCIS, HSI, and CISA, and it said the data transparency group provided a link to an online search tool. Nextgov/FCW said the Icepick release exposed contact details and sensitive job information for more than 41,000 employees and contractors, and it said some entries described roles involving surveillance, computer forensics and undercover work.

+3DHS response9 of 11 outlets reported it · not in Al Jazeera and 1 more▾

The exposure of employees’ assignments and professional connections could help malicious actors identify sensitive targets and craft convincing impersonation attempts. Al Jazeera said the Trump administration has taken an aggressive approach to online platforms purporting to contain information about ICE employees and other agents involved in immigration operations, and it cited a Democratic Representative Jamie Raskin letter warning that blocking access raises the distinct possibility that Apple is working with government to violate its customers’ First Amendment right to record and report on the activities of their government.

Reporting for this sectionDWNextgov/FCW