Bluesky Blocks Links to DHS Employee Leak and Labels Archive 'Malicious'

Since Distributed Denial of Secrets (DDoSecrets) published the "Icepick" archive on Wednesday, Oct. 28, the fight has moved from the leak itself to who gets to link to it. Bluesky is now blocking users from opening links to the archive and labeling the pages "malicious," WIRED reported.

Bluesky told WIRED the files include email addresses and phone numbers "shared without their authorization," in violation of its community guidelines. The company said it chose to block the links rather than remove individual posts, "to avoid limiting public discussion or restricting broader access to reporting and commentary."

Users who click through on the Bluesky website or app land on a "Blocked Link" page saying the URL was flagged as malicious and blocked for their safety.

What Bluesky has and hasn't said

Bluesky did not answer WIRED's questions about whether the block was applied automatically or whether any government agency asked it to restrict access. DHS has made no public statement about Bluesky.

The block is narrow. The DDoSecrets homepage still loads from Bluesky, and at least one third-party app, Klearsky, opens the DHS archive links with no warning. Bluesky's open protocol lets outside developers build their own apps and choose which of the company's moderation labels to apply.

The company's own rules cut both ways. They bar sharing "home addresses, personal contact info, financial or medical data, or identification documents." They also explicitly protect "factual reporting" on matters of public interest related to "government transparency and public officials."

A preview of the leak that WIRED analyzed appeared to contain work contact information that one expert described as the kind of detail printed "on a business card."

A user posting as @micahflee.com wrote that Bluesky is "just blocking the Icepick dataset" and linked the WIRED story about it, calling the data "extremely newsworthy." DDoSecrets cofounder Emma Best said this is not the first time a social media platform has wrongly labeled the organization's website.

Bluesky says it counted 45 million registered accounts by August. Toni Schneider has been CEO since cofounder Jay Graber stepped down in March.

What's in the archive

The archive covers more than 41,000 DHS employees and contractors, roughly a fifth of a workforce of about 220,000. It lists names, emails, phone numbers and office locations. More than 21,000 records relate to Customs and Border Protection, and about 10,000 to Immigration and Customs Enforcement and Homeland Security Investigations.

It also contains more than 55,000 group names. Around 4,500 users, including ICE agents and deportation officers, appear in a group called "Headspace_users." Dozens of groups reference Penlink, a surveillance vendor whose technology can track mobile-device location data. More than 200 CBP users are tied to Mobile Fortify, a facial-recognition app used by CBP and ICE.

Other group names reference ChatGPT, Gemini, Copilot, Grok and Palantir. One reviewer count found 39 HSI employees in groups whose names include "CUC," which government court filings say stands for "certified undercover operation."

TechCrunch matched several known DHS employees against an offline copy of the database, and timestamps indicated the directory records were taken around mid-August. CyberScoop verified numerous current Cybersecurity and Infrastructure Security Agency employees in the data, along with former leaders who left years ago. Group names also reference COVID-19 planning and 2023 summits, so the data reaches back years.

Who says what

A hacktivist group calling itself the Department of Peace claimed the breach and said it took the data from an Okta single sign-on service used at DHS. Okta disputes that. "Okta is secure, and we have no evidence our data or systems were compromised," a company spokesperson said.

The group's note reads: "They have our information, so it's only fair that we have theirs." It added: "On July 17th, Markwayne Mullin said he was turning up the heat. This is what happens to ICE when you do that." Mullin is the DHS secretary.

DHS said it is "aware of a potential breach and is actively working to address the situation swiftly and effectively," and is taking steps to "ensure all are properly protected."

The people who published the data reject the doxxing label. Ryan Ottignon, a journalist who helped build the searchable database with Swiss hacker maia arson crimew, told NPR that federal agents "seek to hide who they are," often with masks and plain clothes. "We need oversight for useful government, if it exists at all," he said. Ottignon said crimew did all the technical work. Crimew has been indicted in the U.S. over past leaks.

Ryan Shapiro, executive director of Property of the People, said email addresses and phone numbers are "indispensable tools for FOIA researchers." Best said the leak identifies officials overseeing covert and undercover operations and "key personnel in DHS's ever-escalating rendition and deportation programs."

The undercover designation cuts the other way. The archive's group names point to personnel whose jobs depend on not being identified, and the data was taken from a federal system by people who say they did it to punish ICE.

What's next

DHS has not said how the records were taken, and Okta rejects the single sign-on explanation. Until one of them says more, the claimed source of the data rests on the hackers' own account. Bluesky has not said who, or what, triggered the "malicious" label.