美国国土安全部记录的一次前所未有的泄露事件，暴露了该部门及其下属机构中超过41,000名员工或承包商的详细信息。这些记录包括电子邮件地址、电话号码和办公地址，还涉及内部系统以及关于卧底和监控计划的敏感信息。总体而言，这次泄露提供了一张国土安全部如何组织和运作的地图。
An unprecedented leak of Department of Homeland Security records has exposed details of more than 41,000 employees or contractors who work for the department and its constituent agencies. The records include email addresses, phone numbers, and office addresses, but also references to internal systems and sensitive information on undercover and surveillance programs. In all, the leak provides a map of how DHS is organized and how it operates.
这些记录涵盖国土安全部本身以及七个下属机构，包括移民与海关执法局和美国海关与边境保护局，最后更新时间为2026年8月19日。透明度非营利组织“分布式拒绝服务秘密组织”以及网络安全研究员兼记者Maia Arson Crimew向《连线》杂志预览了这些数据，他们称数据来自一个自称“和平部”的团体。
The records, which span DHS itself as well as seven component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection, were last updated on August 19, 2026. The transparency nonprofit Distributed Denial of Secrets and cybersecurity researcher and journalist maia arson crimew previewed the data for WIRED, which they say they obtained from a group calling itself the Department of Peace.
“分布式拒绝服务秘密组织”周三发布了名为“Icepick”的档案。在一份新闻稿中，该组织表示数据来自国土安全部的Okta系统。在随文件附带的备注中，黑客写道：“他们掌握我们的信息，所以我们掌握他们的信息也只公平。”Okta的一位发言人告诉《连线》杂志，其不知晓其系统遭到任何入侵。“我们了解这一报道。Okta是安全的，我们没有证据表明我们的数据或系统遭到破坏，”该发言人表示。
DDoSecrets published the archive, which it calls “Icepick,” on Wednesday. In a press release, DDoSecrets says the data is from DHS's Okta system. In a note with the files, the hackers wrote, “They have our information, so it’s only fair that we have theirs.”An Okta spokesperson tells WIRED that it is unaware of any breach of its systems. “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised,” the spokesperson says.
此次泄露发生之际，国土安全部正在积极追击其批评者，试图揭露匿名社交媒体用户的身份，获取抗议者的客户记录，并为针对记者的监控工具获取搜查令。自特朗普第二任期开始以来，国土安部和联邦政府已采取措施隐藏国土安部员工的姓名和面容。该机构还扩大了“曝光个人信息”的定义——该术语通常指出于恶意目的公布某人的家庭住址和其他个人细节——将其涵盖至公布公职人员的基本事实，例如他们的姓名和职务。
The leak comes as DHS has aggressively pursued its critics, seeking to unmask anonymous social media users, obtain customer records on protesters, and secure warrants for surveillance tools aimed at reporters. Since the start of the second Trump administration, DHS and the federal government have moved to hide DHS employees’ names and faces. The agency has also expanded its definition of “doxing”—a term that typically refers to publishing someone’s home address and other personal details for malicious purposes—to encompass the publication of basic facts about public employees, like their names and titles.
此次泄露发生在一起安全漏洞之后，一群名为ShinyHunters的黑客声称窃取了几乎所有FBI员工及其家属的个人信息。执法机构已逮捕多名嫌疑人，并拘留了另一名据称属于该团体的人员。
The leak follows a breach in which a group of hackers known as ShinyHunters claimed to have stolen personal information on nearly every FBI employee and their families. Law enforcement agencies have arrested several suspects and detained another who is alleged to be part of the group.
DHS的记录可在crimew建立的网站上搜索。“我不认为我们应该让他们吓住，从而不去调查它们，”她对《连线》杂志说。
The DHS records are searchable on a website crimew built. “I don't think we should let them scare us into not looking into them,” she tells WIRED.
DHS和司法部未回应《连线》杂志的置评请求。FBI将《连线》杂志的询问转交给了DHS。
The DHS and DOJ did not respond to WIRED’s request for comment. The FBI referred WIRED’s inquiry to DHS.
根据《连线》杂志对数据的分析，CBP员工占记录的一半以上。ICE约占1万条记录，其中约三分之一属于国土安全部调查局，即ICE的调查部门。另有6200条记录属于美国公民及移民服务局，近1000条记录与网络安全与基础设施安全局有关，其中一半以上为承包商。总体而言，这些文件涵盖了DHS约七分之一的员工，揭示了DHS的架构，从高层领导到个别移民特工和拘留承包商。
According to a WIRED analysis of the data, CBP staffers account for more than half of the records. ICE accounts for about 10,000, roughly a third of them in Homeland Security Investigations, ICE’s investigative wing. Another 6,200 belong to US Citizenship and Immigration Services, and nearly 1,000 are tied to the Cybersecurity and Infrastructure Security Agency, more than half of them contractors. Altogether, the files cover about a seventh of DHS’s workforce, revealing how DHS is structured, from senior leadership down to individual immigration agents and detention contractors.
根据泄露的记录，与大多数大型机构一样，国土安全部使用权限组来控制对内部系统的访问。泄露文件中提到的几乎每个人都能访问至少部分此类系统。在国土安全调查局，来自十几个以上外勤办公室的39名员工属于名称中包含“CUC”的群组，政府法庭文件称该缩写代表“认证卧底行动”。另一个群组显然以国土安全调查局明尼苏达州圣保罗行动区为基地，其名称提及“Keyhole”，联邦法庭文件将其描述为一项认证卧底行动，该行动今年早些时候资助了国土安全调查局对明尼阿波利斯抗议团体的卧底监视。
Like most large organizations, DHS uses permission groups to control access to internal systems, according to the leaked records. Nearly everyone named in the leak has access to at least some of these systems. At HSI, 39 employees across more than a dozen field offices belong to groups whose names include “CUC,” which government court filings say stands for “certified undercover operation.”Another group, apparently based in HSI's St. Paul, Minnesota, area of operations, references "Keyhole," which federal court filings describe as a certified undercover operation that recently funded HSI’s undercover surveillance of Minneapolis protest groups earlier this year.
其他群组则提及“通信拦截中心技术运营（CICTO）计划”、用于窃听的“第三编拦截计划”以及“非法传感器拦截计划（ISIP）”。这些群组的名称——总共有超过5.5万个——似乎指向用于访问移民法庭记录、从缴获手机中提取数据以及进行监视的工具。其中包括Palantir的Falcon调查平台和PenLink，后者用于分析电话记录和社交媒体。
Others reference a “Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program” for wiretaps, and an “Illicit Sensor Intercept Program (ISIP).”The names of the groups—there are over 55,000 in all—appear to reference tools for accessing immigration court records, pulling data from seized phones, and conducting surveillance. These include Palantir’s Falcon investigative platform and PenLink, which analyzes phone records and social media.
两个名为“行政领导层”和“AI访问”的权限组似乎列出了获得国土安全部网络过滤器例外权限的人员，该过滤器会为员工屏蔽部分网站。这两个组包含同样的13人，其中包括前国土安全部部长克里斯蒂·诺姆；最近离职、已回到国防科技公司安杜里尔的国土安全部首席信息官安托万·麦科德；被列为国土安全部部长高级顾问的菲利普·赫格塞思，他是国防部长皮特·赫格塞思的弟弟；以及被列为政策顾问的杰斯·克拉肯费尔斯，根据他的领英个人资料，他此前曾担任唐纳德·特朗普2024年总统竞选活动的地区现场主管。
Two permission groups, named “Executive Leadership” and “AI Access,” appear to list people given exceptions to DHS's web filter, which blocks some websites for employees. They contain the same 13 people, including former DHS head Kristi Noem; Antoine McCord, the recently departed DHS chief information officer who has returned to defense tech company Anduril; Philip Hegseth, listed as a senior adviser to the DHS secretary and the younger brother of defense secretary Pete Hegseth; and Jayce Krachenfels, listed as a policy adviser, who previously worked as a regional field director for Donald Trump’s 2024 presidential campaign, according to his LinkedIn profile.
诺姆、麦科德、赫格塞思和克拉肯费尔斯均未回应置评请求。泄露文件中提到的其他组涉及AI工具，包括OpenAI的ChatGPT、谷歌的Gemini和微软的Copilot。其中一个名为“Grok.com”的组包含八名国土安全部技术官员，包括该部门的前首席信息官和首席数据官。
Noem, McCord, Hegseth, and Krachenfels did not respond to a request for comment Other groups named in the leak reference AI tools, including OpenAI’s ChatGPT, Google’s Gemini, and Microsoft’s Copilot. One, called “Grok.com,” includes eight DHS technology officials, including the department’s former chief information officer and chief data officer.
威胁情报公司Recorded Future的国安专家亚历山大·莱斯利表示：“如果这些数据真实且为最新，那么对于试图渗透国土安全部的人来说，这是一份极具价值的情报资源。当这些数据与先前泄露的信息、商业数据及其他情报收集成果相互关联时，其价值会大幅提升。对手可能花费数月时间利用这些关联来锁定易受攻击的人员、策划令人信服的冒充尝试，或破坏正在进行的调查。”
“If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS,” says Alexander Leslie, a national security expert at the threat intelligence company Recorded Future. “This dataset becomes way more valuable when correlated with previously compromised information, commercial data, and other intelligence collections. An adversary could spend months exploiting these relationships to identify vulnerable personnel, develop convincing impersonation attempts, or compromise ongoing investigations.”
有700多个账户与一个显然指向加密通讯应用Signal的群组相关联，其中几乎所有账户都属于海关与边境保护局人员。200多个海关与边境保护局账户属于一个指向Mobile Fortify的群组，这是一款移民执法人员用来识别人员身份的面部识别应用。该群组包括现场主管、特别响应小组操作员以及战术和情报探员。其中约半数分布在得克萨斯州、加利福尼亚州和亚利桑那州。
More than 700 accounts are associated with a group apparently referencing Signal, the encrypted messaging app, nearly all belonging to CBP personnel. More than 200 CBP accounts belong to a group referencing Mobile Fortify, a face-recognition app that immigration agents use to identify people. The group includes field supervisors, special response team operators, and tactical and intelligence agents. About half are in Texas, California, and Arizona.
自2025年7月4日特朗普签署《一项大而美的法案》以来，已创建了约1300个移民与海关执法局执法账户。该法案拨款用于在2025年底前新聘1万名移民与海关执法局执法与遣返官员。
Roughly 1,300 ICE enforcement accounts have been created since July 4, 2025, when Trump signed the One Big Beautiful Bill Act, which funded the hiring of 10,000 new ICE Enforcement and Removal officers by the end of 2025.
近20个账户似乎属于国防部人员——本届政府将其改称为战争部；其中8个属于一个名为“ICE Tip Line DOW Surge”的群组。约170个账户被列为在移民与海关执法局设施提供“军事处理支持”，另有35个账户明确标明为国民警卫队成员。
Nearly 20 accounts appear to belong to personnel with the Department of Defense, which the administration styles as the Department of War; eight are in a group titled “ICE Tip Line DOW Surge.”About 170 accounts are listed as providing “military processing support” at ICE facilities, and 35 others explicitly identify National Guard members.
数十个账号的职务头衔为“指定移民官员”和“287(g)官员”，这些头衔标识的是获授权执行部分移民执法职责的地方执法人员。许多账号列出的工作单位是县治安官办公室和监狱。记录中还包括大约4400名“关联人员”，其工作范围从IT开发人员和数据科学家到护士和拘留官员。其中，145人被列为“承包商”或“高风险承包商”。
Dozens of accounts have job titles like “Designated Immigration Officer” and “287(g) Officer,” which mark local law enforcement personnel authorized to carry out some immigration enforcement duties. Many list county sheriff's offices and jails as their workplaces. The records also include roughly 4,400 “associates,” whose jobs range from IT developers and data scientists to nurses and detention officers. Of those, 145 are named as a “contractor” or “high risk contractor.”
超过300条记录提及与国土安全部总部相关的高级职务，从诺姆一直到副次长、助理部长和幕僚长，以及负责情报、技术、生物识别和隐私的官员。大多数记录还列出了主管，这可能让任何分析该数据集的人重建该部门的汇报关系。
More than 300 records reference senior titles associated with DHS headquarters, from Noem down through deputy undersecretaries, assistant secretaries, and chiefs of staff to officials overseeing intelligence, technology, biometrics, and privacy. Most records also name a supervisor, which could allow anyone analyzing the dataset to reconstruct reporting relationships across the department.
特朗普政府已起诉因发布个别ICE官员信息而受到指控的抗议者，并警告其他人不要这样做。六月，15名明尼苏达州居民因与跟踪和暴力威胁相关的法律被起诉，检察官将其与参与反对ICE活动联系起来。超过100名特别调查局特工，包括卧底特工，参与了一项行动，该行动包括广泛的监控和渗透群聊。
The Trump administration has prosecuted protesters for posting information about individual ICE officers and warned others for doing so. In June, 15 Minnesota residents were charged under laws related to stalking and threats of violence, which prosecutors linked to their participation in ICE-opposition activities. More than 100 HSI agents, including undercover operatives, took part in an operation that included widespread surveillance and infiltration of group chats.
非营利公民自由组织FIRE的资深律师亚当·斯坦鲍表示，特朗普政府对18 USC 119持宽泛看法，该法律禁止人们出于威胁联邦官员或其家人的意图，分享关于他们的“受限个人信息”。
Adam Steinbaugh, a senior attorney at the nonprofit civil liberties group FIRE, says that the Trump administration has taken an expansive view of 18 USC 119, a law that prohibits people from sharing “restricted personal information” about federal officers or their families with the intent to threaten them.
“这些信息会出现在名片上，”斯坦鲍谈到档案中包含的姓名和基本工作细节时说。“这不是政府可以将其定为犯罪的事情。”尽管泄露数据中其他记录可能具有潜在敏感性，但Icepick的创建者并不认为这是人肉搜索。他们将其视为一种问责工具。
“This is information that would be on a business card,” says Steinbaugh of the names and basic work details included in the archive. “That’s not something the government can criminalize." Despite the potential sensitivity of other records in the leaked data, the creators of Icepick do not consider it doxing. They see it as an accountability tool.
“国土安全部尤其如此，作为一个机构，它完全缺乏问责机制，尽管其许多部门极其不得人心。在那里工作的人也知道这一点；例如，他们有些人的领英简介只写着‘美国政府的一些事’，”crimew说。“如果他们不是在隐瞒自己参与美国政府镇压机构的事实，我们根本就没有必要曝光他们。”
“The DHS especially as an agency completely lacks accountability, despite many parts of it being incredibly unpopular. The people who work there know this too; for example, some of their LinkedIn bios simply say ‘stuff at US Government,’” says crimew. “If they weren't hiding their involvement in the repressive arm of the US government, there would be no need for us to expose them in the first place.”