Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents
DHS and DOJ did not respond to WIRED’s request for comment. The FBI referred WIRED’s inquiry to DHS.
According to a WIRED analysis of the data, CBP staffers account for more than half of the records. ICE accounts for about 10,000, roughly a third of them in Homeland Security Investigations, ICE’s investigative wing. Another 6,200 belong to US Citizenship and Immigration Services, and nearly 1,000 are tied to the Cybersecurity and Infrastructure Security Agency, more than half of them contractors. Altogether, the files cover about a seventh of DHS’s workforce, revealing how DHS is structured, from senior leadership down to individual immigration agents and detention contractors.
Like most large organizations, DHS uses permission groups to control access to internal systems, according to the leaked records. Nearly everyone named in the leak has access to at least some of these systems. At HSI, 39 employees across more than a dozen field offices belong to groups whose names include “CUC,” which government court filings say stands for “certified undercover operation.” Another group, apparently based in HSI’s St. Paul, Minnesota area of operations, references “Keyhole,” which federal court filings describe as a certified undercover operation that recently funded HSI’s undercover surveillance of Minneapolis protest groups earlier this year. Others reference a “Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program” for wiretaps, and an “Illicit Sensor Intercept Program (ISIP).”
The names of the groups—there are over 55,000 in all—appear to reference tools for accessing immigration court records, pulling data from seized phones, and conducting surveillance. These include Palantir’s Falcon investigative platform and PenLink, which analyzes phone records and social media.
Two permission groups, named “Executive Leadership” and “AI Access,” appear to list people given exceptions to DHS’s web filter, which blocks some websites for employees. They contain the same 13 people, including former DHS head Kristi Noem; Antoine McCord, the recently departed DHS chief information officer who has returned to defense tech company Anduril; Philip Hegseth, listed as a senior advisor to the DHS secretary and the younger brother of defense secretary Pete Hegseth; and Jayce Krachenfels, listed as a policy adviser, who previously worked as a regional field director for Donald Trump’s 2024 presidential campaign, according to his LinkedIn profile.
