美国国土安全部 4.1 万名员工数据泄露：ICE 卧底探员与内部监控、AI 权限曝光

美国国土安全部（DHS）与司法部（DOJ）均未回应《连线》（WIRED）的置评请求。美国联邦调查局（FBI）则将《连线》的问询转交给了国土安全部。

根据《连线》对数据的深入分析，海关及边境保卫局（CBP）人员占泄露记录的一半以上；移民及海关执法局（ICE）约占 10,000 条，其中约三分之一隶属于 ICE 的调查分支机构——国土安全调查局（HSI）。另有 6,200 条记录属于美国公民及移民服务局（USCIS），近 1,000 条与网络安全和基础设施安全局（CISA）相关（其中超过半数为合同工）。总体而言，这些文件覆盖了国土安全部约七分之一的员工编制，完整揭示了 DHS 从高级领导层到基层一线移民执法人员及拘留所外包人员的组织架构。

泄露的记录显示，与大多数大型组织一样，国土安全部使用权限组来控制对内部系统的访问权限。泄露名单中几乎所有人都能访问其中的部分系统。在 HSI，分布在十几个外地办事处的 39 名员工隶属于名称包含“CUC”的权限组，政府法院文件显示该缩写代表“认证卧底行动”（certified undercover operation）。另一个明显设在 HSI 明尼苏达州圣保罗行动区的权限组提及了“Keyhole”——联邦法院文件显示，这是一项经过认证的卧底行动，今年早些时候曾资助 HSI 对明尼阿波利斯抗议团体的卧底监视。其他群组名称还涉及“通信拦截中心技术行动（CICTO）计划”、用于窃听的“第三编（Title III）拦截计划”，以及“非法传感器拦截计划（ISIP）”。

这些权限组的总数超过 55,000 个，其命名似乎对应着用于访问移民法庭记录、提取被查扣手机数据以及开展监控的各类工具，其中包括 Palantir 的 Falcon 调查分析平台，以及用于分析通话记录和社交媒体数据的 PenLink。

名为“Executive Leadership”（行政领导层）和“AI Access”（AI 访问）的两个权限组，似乎列出了获得 DHS 网页过滤白名单豁免的人员名单（该过滤器通常会为员工拦截部分网站）。这两个组均包含相同的 13 人，其中包括前国土安全部部长克里斯蒂·诺姆（Kristi Noem）；近期离任并已重返国防科技公司 Anduril的前国土安全部首席信息官（CIO）安托万·麦考德（Antoine McCord）；被列为国土安全部部长高级顾问、现任国防部长皮特·海格塞斯（Pete Hegseth）之弟的菲利普·海格塞斯（Philip Hegseth）；以及根据其 LinkedIn 个人资料曾担任唐纳德·特朗普 2024 年总统竞选活动区域现场负责人的政策顾问杰斯·克拉兴费尔斯（Jayce Krachenfels）。诺姆、麦考德、海格塞斯和克拉兴费尔斯均未回应置评请求。

The DHS and DOJ did not respond to WIRED’s request for comment. The FBI referred WIRED’s inquiry to DHS.

According to a WIRED analysis of the data, CBP staffers account for more than half of the records. ICE accounts for about 10,000, roughly a third of them in Homeland Security Investigations, ICE’s investigative wing. Another 6,200 belong to US Citizenship and Immigration Services, and nearly 1,000 are tied to the Cybersecurity and Infrastructure Security Agency, more than half of them contractors. Altogether, the files cover about a seventh of DHS’s workforce, revealing how DHS is structured, from senior leadership down to individual immigration agents and detention contractors.

Like most large organizations, DHS uses permission groups to control access to internal systems, according to the leaked records. Nearly everyone named in the leak has access to at least some of these systems. At HSI, 39 employees across more than a dozen field offices belong to groups whose names include “CUC,” which government court filings say stands for “certified undercover operation.” Another group, apparently based in HSI's St. Paul, Minnesota, area of operations, references "Keyhole," which federal court filings describe as a certified undercover operation that recently funded HSI’s undercover surveillance of Minneapolis protest groups earlier this year. Others reference a “Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program” for wiretaps, and an “Illicit Sensor Intercept Program (ISIP).”

The names of the groups—there are over 55,000 in all—appear to reference tools for accessing immigration court records, pulling data from seized phones, and conducting surveillance. These include Palantir’s Falcon investigative platform and PenLink, which analyzes phone records and social media.

Two permission groups, named “Executive Leadership” and “AI Access,” appear to list people given exceptions to DHS's web filter, which blocks some websites for employees. They contain the same 13 people, including former DHS head Kristi Noem; Antoine McCord, the recently departed DHS chief information officer who has returned to defense tech company Anduril; Philip Hegseth, listed as a senior adviser to the DHS secretary and the younger brother of defense secretary Pete Hegseth; and Jayce Krachenfels, listed as a policy adviser, who previously worked as a regional field director for Donald Trump’s 2024 presidential campaign, according to his LinkedIn profile. Noem, McCord, Hegseth, and Krachenfels did not respond to a request for comment