ICE Spent $100 Million Watching You. Nobody Was Watching the Door.
One hacker, 41,191 records, and the org chart Washington never wanted you to see.
The Jack Hopkins Now Newsletter #1,072: Sunday, November 1st, 2026.
Here’s what happened while everybody was watching the Michigan Senate race.
On Wednesday, Oct. 28, a hacker group calling itself the Department of Peace dumped 41,191 Department of Homeland Security personnel records onto the open internet.
Distributed Denial of Secrets, the nonprofit that archives leaked datasets, published the lot. Names. Offices. Contact details. Job assignments. And 55,603 internal groups.
Customs and Border Protection took the biggest hit: 21,329 entries. ICE: 6,598. Homeland Security Investigations, the ICE division that is supposed to chase cartels, not grandmothers: 3,421.
Now pay attention, because this is the part most people miss.
A phone book tells you who works somewhere. These files tell you what they work WITH. That is a different animal entirely.
For the better part of two years, ICE agents did their business behind masks, in unmarked cars, with no name tags. The government’s position was simple: you don’t get to know who these people are. That position held right up until one hacker…decided otherwise.
The group’s spokesperson tied it to a July 17 remark by DHS Secretary Markwayne Mullin about turning up the heat on ICE’s critics. This, they said, is what happens when you do.
I’m not here to cheer for hackers. I’m here to tell you what the files show…why serious reporters are already mining them…and… what it means for anyone who thought secrecy was a strategy.
Keep reading.
The groups are the story
Every big organization runs on access lists.
You get added to a group, the group unlocks a tool. Nobody thinks about it. It’s plumbing.
The Icepick files, as the leak is called, are that plumbing laid bare.
Reporters digging through the group names found references to PenLink, the phone-records analysis vendor. Palantir’s FALCON platform. Mobile Fortify, the facial recognition app agents point at people on the sidewalk.
Groups labeled Undercover Operations and Covert Operations. Groups for HSI’s certified undercover agents. Groups built around named operations: Op White Tide, Operation Condor, Operation Money Flight.
And this one, which Emma Best of DDoSecrets flagged: an approval chain for nominating ICE agents for removal awards. There are more than 30 groups like it. Read that twice….even three times if you’re extra peppy today.
A Swiss hacker who goes by crimew built a search engine on top of the dump. Type in an office, a tool, an operation name, and out comes a list of people. She called it a game changer for anyone investigating DHS, and said it would feed Freedom of Information Act requests for years.
Now, the honest caveat, because I do NOT sell you things that aren’t true.
A group membership is not a confession. It doesn’t prove anyone pointed a camera at anyone. Some records are stale. Some belong to contractors. Reuters matched six employees to outside records and phoned three more to confirm details, which is how you verify a leak, by the way: one name at a time.
But here’s the thing about plumbing. Once you can see it…you can follow the pipes.
Follow the pipes to Tampa
Reason magazine followed them first.
On Thursday, one day after the dump, they published what the group lists say about ICE and the United States military.
Short version: ICE has people inside the war rooms.
The files show an HSI unit chief who appears to run the agency’s military liaison program. Under him: a Combatant Command Program Manager at Special Operations Command headquarters in Tampa.
An HSI liaison to Africa Command in Stuttgart, Germany. A senior liaison to Southern Command in Doral, Florida. And an HSI contractor tagged as a CENTCOM analyst, sitting at the National Targeting Center in Sterling, Virginia.
SOCOM runs the commandos. AFRICOM runs Africa. SOUTHCOM runs Latin America. CENTCOM runs the Middle East.
The liaisons at SOCOM, AFRICOM and SOUTHCOM share access to the same advanced surveillance software ICE uses at home. The CENTCOM contractor is the exception; he doesn’t have it.
None of this was exactly secret. ICE press releases have mentioned HSI joining an AFRICOM maritime exercise back in 2021.
An HSI executive has bragged in public that the agency’s global footprint lets it straddle law enforcement and foreign policy. But bragging in a speech is one thing. A roster, with names and duty stations…is another.
Stack that next to two more facts. Wired recently reported that HSI is running a large surveillance operation against left-wing protesters at home. And…last month ICE announced upcoming contracts for a $100 million…fast-tracked expansion of its domestic surveillance capacity.
A former military intelligence analyst told The American Prospect this is the imperial boomerang: the tools you build for the war zone come home.
You don’t have to agree with him. You do have to admit the org chart now says what he says.
Washington sent lawyers. Europe sent a search box.
Watch how each side responded, because the response tells you more than the leak.
Washington answered with takedown notices. A White House official condemned the breach and reminded everyone that ICE agents have families too. Which is true, and which is also exactly what the people on the other end of those raids have been saying for two years.
Meta, for its part…had already blocked links to an earlier agent list across Facebook, Instagram and Threads back in January. The playbook is: bury it.
Europe answered with a search engine. The files sit on servers outside U.S. reach. The search tool is hosted abroad. A takedown notice in that situation is a strongly worded letter to nobody.
This is the oldest lesson in my world…and the government just paid full tuition to learn it.
You cannot un-publish. You can only out-publish.
When the thing you were hiding…gets out…your two options are to explain it on your terms, fast…or…to let 55,603 group names explain it for you, slowly, one Freedom of Information request at a time. DHS picked door number two.
They sent lawyers at a dataset that had already been mirrored, indexed and cross-referenced by Reuters before the ink was dry.
Meanwhile, the agents whose names are in there? Reuters called one. His own department hadn’t told him he’d been exposed. He found out from a reporter.
That’s not a security failure. That’s a management failure. And management failures…yeah…they don’t get fixed by takedown notices.
The mask was never the point
Let me tell you what this leak actually proves. Not what the activists say it proves. Not what DHS says it proves. What it proves.
It proves that an agency with a $100 million surveillance budget, liaisons inside four military commands, facial recognition in every agent’s pocket and a two-year policy of hiding faces…could not protect its own personnel directory from one hacker in Switzerland.
Every dollar spent watching you. Not one dollar spent watching the door.
That is the tell. Organizations that are confident in what they do put their names on it. Organizations that are not confident wear masks and buy software. The mask isn’t security.
The mask is marketing, aimed at you…meant to make the thing feel bigger and more inevitable than it is.
And…marketing fails…the moment somebody prints the real brochure.
So here’s your takeaway, whichever side of this you’re on.
If you’re a reporter, a lawyer, an organizer or just a citizen with a grudge and a FOIA form: the files are indexed, the search box is up, and Reason showed you how to work it in 24 hours flat. There are 55,603 threads to pull. Pick one.
If you run anything, a company, an agency, a campaign: stop confusing secrecy with strength. Secrecy is a loan. The interest compounds. And…the bill arrives on a Wednesday, from someone you’ve never heard of…in a country where your lawyers can’t go.
The reporting has already started. It is not going to stop. It. Is. Not.
Not Your Data. Still Your Problem. Ten Questions on the ICE Leak.
1. Does this leak expose my personal data?
No. The Icepick files are DHS personnel records: names, offices, contact details and internal group memberships of about 41,000 employees and contractors. No citizen or immigrant case data has been reported in the dump. If you don’t work for DHS, you’re not in it.
2. Then why does it matter to me?
Because it’s the first detailed public map of what surveillance tools the government has pointed at the public.
Group names reference phone-records analysis (PenLink), Palantir’s FALCON platform, and Mobile Fortify, a facial recognition app used on people in the street. Until now, you had to guess at this…from contracts…and press releases. Now…there’s an org chart.
3. What’s the single most important thing the files show?
That ICE’s Homeland Security Investigations unit has liaisons embedded at Special Operations Command, Africa Command and Southern Command, and a contractor tied to Central Command, several with access to the same surveillance software used domestically. The wall between military intelligence tools and domestic law enforcement is thinner than most people assumed.
4. Can ICE use facial recognition on me, a U.S. citizen, on the street?
The tool exists and agents carry it. Whether and when it can legally be used on citizens is contested…and the files don’t settle that. What they do show is who has access. Expect lawsuits and FOIA requests built on these records to force the policy question into the open.
5. HSI is supposed to investigate cartels and smuggling. Why is that unit showing up in protest surveillance?
That’s the question reporters are asking. Wired reported HSI is running a large surveillance operation against left-wing protesters. Combine that with the military liaison roster…and the $100 million surveillance expansion ICE announced last month…and you have an investigative agency whose mission has visibly widened.
6. Is the leak itself a threat to my security?
Indirectly, possibly. Exposed agents could be targeted…which raises the risk of violence or retaliation…that spills into communities.
And…the leak may prompt DHS to tighten secrecy further…rather than loosen it. A breach that hardens an agency’s posture can leave citizens with less transparency, not more.
7. Should I be worried that the government couldn’t protect its own directory?
Yes, in a specific way. The same department that holds biometric data…immigration files…travel records and watchlists on millions of Americans…lost its own staff roster to a single hacker. That’s a competence signal about how well your data is guarded.
8. What can an ordinary citizen do with this information?
File Freedom of Information Act requests using the exact office and program names now visible. Ask your members of Congress what oversight exists for HSI’s military liaisons and domestic surveillance tools. Support or follow the journalists working the files. Doxxing individual agents is illegal, dangerous and counterproductive.
9. Is any of this new, or just newly visible?
Mostly newly visible. ICE’s cooperation with the military has been mentioned publicly for years…and the surveillance vendors are known from contracts. What’s new…is the ability to see who holds which access…in one searchable place…with names attached. That’s what makes it usable for reporting and litigation.
10. What should I watch for next?
Three things:
Whether courts or Congress act on the military liaison revelations.
Whether ICE’s $100 million surveillance contracts move forward unchanged.
And…whether DHS responds with reforms…or with more masks, more secrecy and more takedown notices.
The second path is the one that should concern every citizen, regardless of their politics.
Here’s the part nobody in Washington wants to say out loud. The masks were never there to protect the agents. They were there to protect the agency from a question it couldn’t answer: what exactly are you doing…and who gave you permission to do it?
For two years…the answer was “none of your business.” As of Wednesday…it’s a searchable database.
The government can keep sending lawyers at servers it can’t reach…or…it can do the one thing it never tried: tell the truth before somebody else prints it. I know which one I’d bet on. I also know which one works.
#HoldFast
Back soon.
-Jack
Jack Hopkins
P.S. Nobody got hurt by a name on a list. People got hurt…by what the people on the list were doing. Keep those two facts in order and you’ll read the next six months of news correctly.
Sources
Leaked Files Reveal ICE Liaisons to U.S. Military Commands With Access to Surveillance Tech — Reason, Oct. 29, 2026
ICE Agents Hid Behind Masks Under Trump. Europeans Published Their Names Online. — Pablo Manríquez, Migrant Insider, Oct. 31, 2026
Icepick — Distributed Denial of Secrets, dataset page with full press coverage list
Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents — Help Net Security, Oct. 29, 2026
‘Icepick’ Leak Exposes Thousands of Homeland Security Personnel, Groups and More — Unicorn Riot, Oct. 30, 2026
ICE Is Running One of the Largest Anti-Left Surveillance Operations in US History — Ali Winston, Wired, Oct. 28, 2026
Documents show how feds spied on protesters, left-wing organizations and unions during Metro Surge — Minnesota Reformer, Aug. 13, 2026
The American Prospect — interview with former military intelligence analyst Michael Wriston on the “imperial boomerang,” as cited by Reason.
Great post, Jack, and your explanations, as always are even better. Thank you.
WOW, just WOW! Thanks for putting this in such a clear and concise manner.