DHS Asks an Icelandic Host to Remove Leaked ICE Staff Data by Letter, Not by Court Order

The Department of Homeland Security asked an Icelandic hosting company on Thursday 29 October to take down a leaked database of more than 40,000 of its personnel, and the request arrived as a letter from a contractor rather than as a court order. The host, FlokiNET, refused. The site went offline anyway when its domain was suspended, and the data reappeared at another address.

The database was released on Wednesday 28 October by Distributed Denial of Secrets, a non-profit data transparency group, together with a separate searchable tool called Icepick, at icepi.cx, the Guardian reported. A group calling itself the Department of Peace claimed responsibility for obtaining the data, saying that DHS employees “have our information, so it’s only fair that we have theirs.” The department said it “is aware of a potential breach and is actively working to address the situation swiftly and effectively,” CyberScoop reported. Outlets differ slightly on the size: the takedown letter gives “more than 40,000 identifiable individuals,” and CyberScoop gives “more than 41,000 employees.”

Who asked, and on what authority?

A private security firm, citing the host’s own rules. The request came from ZeroFox, which ICE has authorised to pursue content removal, according to the Guardian. FlokiNET published it. The letter says the database “places more than 40,000 identifiable individuals at risk of harassment, stalking and physical harm,” accuses FlokiNET of breaching its terms of service by hosting a “stolen” dataset, and asks it to “remove or disable” the material, Al Jazeera reported.

None of the three reports describes a subpoena, a court order, a copyright notice or a request under Icelandic law. The legal theory is contractual: a hosting company’s acceptable-use terms, which bind the host’s customer and which the host alone enforces. ZeroFox put the argument as a matter of two facts. “The request does not depend on who the listed individuals are or what their duties are,” it wrote. “It rests on two facts: the data was stolen, and it is personal data that identifies and locates real people.”

Why did the host say no?

Because it reads the data as work information about public employees. Kolja Weber, FlokiNET’s chief executive, told Reuters the company would not remove it because it contains government employees’ work addresses and work phone numbers, not personal ones, the Guardian reported. The company’s statement, as quoted by CyberScoop and Al Jazeera, draws the line explicitly: “Doxxing publishes private details about private people so that others can find them at home. Icepick publishes work identities of government employees.” And: “Federal officers carrying out an enforcement programme are not private individuals while they are carrying it out.”

The administration has often declined to identify DHS agents involved in particular operations, citing their safety, Al Jazeera noted. This publication has covered how the department’s own election field interviews and its $20 million advertising campaign ended up before federal judges. Here no judge is involved.

What does federal law actually protect?

A narrower list than either side describes. The closest federal statute, 18 U.S.C. § 119, makes it a crime, punishable by up to five years, to publish “restricted personal information” about a covered person with the intent to threaten, intimidate or incite violence, or with the knowledge that it will be used that way. Covered persons include, by cross-reference to § 1114, any “officer or employee of the United States.” The table sets the statute’s list beside what each side says the database holds. The comparison is this publication’s reading of the statute and of the reports; nobody outside the parties has published a field-by-field description of the data.

Two gaps follow. The statute turns on intent, which a takedown letter does not establish and a host cannot assess. And if FlokiNET’s description is accurate, most of what is published is not on the statute’s list at all; the mobile-number line is the one open question. That leaves the letter where it began, as an appeal to a contract between a host and its customer, governed by the host.

Why did the site go dark if the host refused?

Because the host is not the only company in the chain. “By mid-morning, icepi.cx no longer resolved,” FlokiNET wrote, as quoted by CyberScoop. “Its registrar, CentralNic, had placed the domain on serverHold.” A server hold stops a domain name resolving to any server, wherever the files sit. “Our refusal kept nothing online,” FlokiNET wrote. The archive later returned under a domain from a different registrar, CyberScoop reported. Bluesky separately blocked links to it for sharing contact information without permission, according to the same report.

None of the reports read for this piece says who asked CentralNic to act, or whether anyone did; ZeroFox did not immediately respond to CyberScoop. The Privacy Act, which this publication has examined before, is written for the agencies that hold records, not for the hosts that end up serving a copy. The request that was made in writing was refused, and the one that worked, if it was a request at all, has not been published.