Hackers leak "Icepick" - a big dataset of internal records about ICE and other DHS agents

Hackers, calling themselves the Department of Peace, have obtained and leaked an incredible set of US Department of Homeland Security data, now, given its focus on the justly infamous “Immigration and Customs Enforcement”, or ICE, branch of the administration, known as Icepick. Get it here.

What is it? To quote that site:

An internal database identifying more than 41,000 employees for the U.S. Department of Homeland Security (DHS). The database, from an Okta single sign-on service used by the DHS, reveals employee names, offices, contact information, and assignments. The data was obtained by a hacktivist group known as the Department of Peace who provided copies to Distributed Denial of Secrets and maia arson crimew.

…

This dataset is massive in terms of both size and impact. It provides an unprecedented look into the Department of Homeland Security’s organizational structure, highlighting which people do what work across multiple DHS agencies, including ICE," said journalist and cyber security researcher maia arson crimew.

The quoted hacktivist “crimew” above has kindly enriched the data and created a tool to make it easy to explore here.

Wired has more information, including a few early analyses of the data:

According to a WIRED analysis of the data, CBP staffers account for more than half of the records. ICE accounts for about 10,000, roughly a third of them in Homeland Security Investigations, ICE’s investigative wing. Another 6,200 belong to US Citizenship and Immigration Services, and nearly 1,000 are tied to the Cybersecurity and Infrastructure Security Agency, more than half of them contractors. Altogether, the files cover about a seventh of DHS’s workforce, revealing how DHS is structured, from senior leadership down to individual immigration agents and detention contractors.

…

At HSI, 39 employees across more than a dozen field offices belong to groups whose names include “CUC,” which government court filings say stands for “certified undercover operation.” Another group, apparently based in HSI’s St. Paul, Minnesota, area of operations, references “Keyhole,” which federal court filings describe as a certified undercover operation that recently funded HSI’s undercover surveillance of Minneapolis protest groups earlier this year. Others reference a “Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program” for wiretaps, and an “Illicit Sensor Intercept Program (ISIP).”

The names of the groups—there are over 55,000 in all—appear to reference tools for accessing immigration court records, pulling data from seized phones, and conducting surveillance. These include Palantir’s Falcon investigative platform and PenLink, which analyzes phone records and social media.

This is likely an especially important dataset given the Trump administration’s hugely inappropriate attempts to keep ICE’s often-brutal staff hidden and unaccountable. ICE agents conceal their identities, literally hiding their faces. They physically track down their critics. They demand big tech hand over data from folk who criticised their cruel and unusual actions, even from other countries. They demand to know your personal details if you happened to buy the wrong kind of hat within the last two years. They abuse people. They kill people.

In short, ICE is, as ProPublica says “Unfettered and Unaccountable: How Trump Is Building a Violent, Shadowy Federal Police Force”.

Perhaps this dataset will be a step in the direction of the accountability these often-violent thugs and their masters so desperately need.

I guess it’s time for us all to put into practice what we learned about The Art of Analyzing Hacked and Leaked Data.