JEDI-SEC | Security Research & Digital Defense

Tag: Department of Homeland Security (DHS)

  • CISA director pick already drawing concern from Hill Dems over Palantir connection

    The two expected incoming leaders of the Senate and House homeland security panels expressed reservations Tuesday about the Trump administration’s pick to lead the Cybersecurity and Infrastructure Security Agency because he currently works for the oft-controversial tech company Palantir.

    The Trump administration on Monday announced its intent to nominate Michael LoSapio, chief information security officer for Palantir, to fill the long-vacant Senate-confirmed position of CISA director.

    The Senate Homeland Security and Governmental Affairs Committee has authority over approving CISA director nominees. A spokesperson for its current chairman, Rand Paul, R-Ky., didn’t respond to a request for comment, but he won’t hold the gavel much longer with Sen. Maggie Hassan, D-N.H., in line to take over as chair in 2027.

    Hassan and her counterpart on the House side, prospective Homeland Security Committee Chairman Bennie Thompson, D-Miss., both voiced concerns about Palantir’s work at the Department of Homeland Security and with its subagency, Immigration and Customs Enforcement.

    “CISA plays a critical role in protecting our nation’s cybersecurity infrastructure, and the Trump-Vance administration has undermined CISA by cutting its funding, reducing agency staff, and making us vulnerable to cyberattacks from our adversaries,” Hassan said in a statement to CyberScoop. “I will carefully review Mr. LoSapio’s nomination to lead CISA, as I do with any nominee. But given his senior role at Palantir, which has provided tools that helped enable ICE’s lawless behavior under this administration, I have serious questions about whether he has the independence and judgement needed for this position.” 

    Thompson expressed apprehensions for similar reasons.

    “CISA is at a critical juncture, rebuilding after a year of reckless efforts to hack up the agency. I don’t know much about Mr. LoSapio, but certainly his relationship with Palantir raises very serious concerns given its role in DHS surveillance programs,” he said in a statement to CyberScoop. “I’m concerned that baggage will be an unnecessary distraction from the urgent rebuilding efforts at CISA. I urge my Senate colleagues to thoroughly vet Mr. LoSapio before proceeding with his nomination.”

    The current top Democrat on the Senate panel, the retiring Gary Peters of Michigan, also cited the threats CISA is facing amid cutbacks: “Mr. LoSapio must demonstrate that he possesses the independent judgment and qualifications to decisively place national security and the national interest above political pressure.”

    The current chairman of the House panel, Andrew Garbarino, R-N.Y., said he appreciated Trump putting forward a nominee given the need for a Senate-confirmed director, something CISA has lacked for his second term, even as he praised the leadership of acting director Nick Andersen.

    “I look forward to reviewing the qualifications of Michael LoSapio and urge the Senate to do so with urgency,” he said in a statement.

    Unlike another of the top cybersecurity officials in the Trump administration prior to his nomination, National Cyber Director Sean Cairncross, LoSapio comes with technical credentials.

    A former Trump administration official said that LoSapio’s name was first floated months ago, and said his cybersecurity certifications and experience managing cyber risk for a major public company would make him a good fit for the role.

    A cybersecurity executive who knows and has worked with LoSapio said he was an “exceptional choice” for the job.

    “Mike LoSapio is an extremely competent and talented cybersecurity leader. He knows his stuff,” the executive said. “He defends one of the most targeted organizations on the planet” because of Palantir’s sensitive government work.

    CISA is primarily a technical agency, so “that work is best done by someone who knows how to do it,” the executive said. LoSapio is also a “high-integrity” person who isn’t “dogmatic or political” or “the kind of person that would be cowed by political pressure.”

    But his role at Palantir is drawing criticism, something the executive said he understood given concerns about surveillance in the United States, even as the executive noted LoSapio has proven capable of navigating those “thorny issues.”

    Patrick Eddington, a senior fellow at the libertarian Cato Institute think tank, acknowledged LoSapio’s technical background but said his lack of a government background and no public record of weighing in on the subject matter CISA works on adds up to a “thin resume.” More worrisome, he said, is that CISA is a Palantir customer.

    “The nominee would come from the vendor whose software is already being bought, without competition, by the office he’d run,” Eddington said. “And the agency responsible for judging the security of federal civilian systems would be led by the former security chief of a vendor whose platforms now run across DHS. That’s where ethics rules would normally help, yet this administration has weakened them.”

    Before confirming LoSapio, senators should find out what kind of Palantir stock or other holdings LoSapio has and whether he’ll divest it, whether he’ll recuse himself from Palantir matters for longer than the Trump administration would require, whether he has made bargains to return to Palantir after CISA service and other answers about potential conflicts of interest.

    “Bottom line: Palantir’s business is fusing government data at scale, and DHS has made it the default analytics vendor across the department,” Eddington said. “Putting the company’s security chief in charge of the agency that sets the security bar for those systems, with a one-year recusal as the main safeguard, risks making CISA one vendor’s customer, regulator and alumni network all at once. Even if LoSapio is entirely well-intentioned, that’s the wrong setup.”

    A Palantir spokesperson didn’t respond to requests for comment.

    Even in optimal circumstances for a nominee, it can take some time to work through the Senate confirmation process and then begin shaping an agency as its leader, said Joshua Corman, a former CISA adviser and now executive in residence for public safety and resilience at the Institute for Security and Technology.

    Andersen and his team, even amid budget cutbacks, “never gave up” on the agency, Corman said, and set important priorities for “the most life-safety of our critical functions.”

    With two years left in Trump’s term, “it may be hard to have much of a dent, no matter who gets the nod, and as such, I really hope they lean on the current steward” in Andersen, Corman said. 

    Madison Alder contributed reporting to this story.

    Source: CyberScoop · 2026-11-10

  • Trump picks Palantir’s LoSapio to head CISA

    The Cybersecurity and Infrastructure Security Agency finally got a new nominee for director, with President Donald Trump on Monday nominating Michael LoSapio, chief information security officer at Palantir.

    CISA has been without a Senate-confirmed director for the entirety of Trump’s second term, after his first pick, Sean Plankey, languished in the Senate before withdrawing in April.

    LoSapio could face some obstacles of his own, with Palantir far from a popular company with the Democrats set to take over Congress. Democrats have scrutinized the company over its work with the Department of Homeland Security, even as Palantir has denied aiding mass surveillance of immigrants.

    As of late last month, Sen. Ron Wyden, D-Ore., was also still waiting for CISA to release a public version of a report on telecommunications cybersecurity, and he had placed one of several Senate holds on Plankey pending the receipt of that report.

    Republicans will still control the Senate until January, however, and a lame-duck session began Monday.

    Some CISA watchers were convinced that the agency’s acting director, Nick Andersen, was likely to continue holding the role. He was running out of days to hold the “acting” position under the law, but putting forward a nominee could pause the clock on that deadline.

    The administration was thought to be looking for someone from a high-profile tech company to fill the CISA director position, a bill LoSapio fits.

    Source: CyberScoop · 2026-11-10

  • California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment

    The Trump administration is taking direct aim at California state election officials, issuing grand jury subpoenas to election offices statewide ahead of the final day of voting on Nov. 3.

    The investigations, first reported by Bloomberg, center on alleged administration of illegal voting. They are ostensibly tied to demands by the U.S. Justice Department that California and other states use federal voter lists to determine whether a voter is a “potential noncitizen” and should be removed.

    The Los Angeles County Registrar of Voters told CyberScoop it received multiple grand jury subpoenas last week related to the investigation. The office called the federal efforts an attempt to intimidate California election officials into accepting federal supremacy over state voter registration authority.

    “At every step, the U.S. Department of Justice has taken a confrontational, adversarial approach,” said Los Angeles County Registrar Dean Logan in a statement. “Election officials are acting in accordance with state and federal law. Clear court rulings at both the U.S. District Court level and the Court of Appeals have confirmed that. Threats and intimidation have no place in elections. We will take whatever steps necessary to ensure the safety of our employees and to remain focused on serving the voters of Los Angeles County so they can exercise their voting franchise.”

    California Secretary of State Shirley Weber, also reportedly a target of the federal probe, did not respond to a request for comment from CyberScoop.

    One California election official, Clint Curtis, the outgoing registrar of voters in Shasta County, endorsed the federal government’s efforts to remove 20,000 voters from California voter rolls. Curtis, whose term ends in January, was previously part of a failed effort to hire Tina Peters, a felon and former Mesa County, Colorado, election clerk to help with the upcoming midterms. Curtis has long believed in widespread election fraud.

    He told CyberScoop earlier this year that he believed Shasta County elections in 2024 were plagued by suspicious mail-in ballots, saying they looked, felt and “smelled” different from normal mail ballots.

    The U.S. Constitution gives states the authority to administer elections and Congress the power to make election laws, something courts have repeatedly upheld in dozens of legal challenges by the Trump administration.

    The Department of Justice has claimed there are at least 20,000 such potential noncitizens on California’s voter lists, while the Department of Homeland Security told CyberScoop the figure could be as many as 190,000. The administration’s data, drawn from public voter lists, federal databases and commercially purchased personal information, has been repeatedly criticized by election officials, voting experts and federal courts as inaccurate and unreliable for determining voter eligibility.

    Most people identified as “potential noncitizens” turn out to be naturalized citizens who have since gained voting rights, or the result of state administrative errors that mistakenly registered a small number of ineligible voters. Many of those mistakenly registered never cast a ballot.

    State officials have had to defend against attempts at federal coercion as well as third-party activists who are constantly testing and probing election procedures nationwide, sometimes without understanding the laws election officials must follow to verify voters.

    On Wednesday, the Hennepin County Attorney’s Office in Minnesota announced felony charges against a pair of right-wing provocateurs, James O’Keefe and Cam Higby, for unlawful voting and identity theft. According to a statement from Hennepin County Attorney Mary Moriarty, the two showed up at various election offices, provided false identities of real voters to election judges, violating state laws against misrepresenting their identity in applying for a ballot.

    “Elections are the bedrock of democracy and their protection is one of our highest priorities. Individuals engaging in unlawful conduct related to our elections will be held accountable,” said Moriarty. “Our office has had regular meetings with Hennepin County Elections staff in preparation for both the primary and the general elections this year and we are fully prepared.”

    Voting rights and civil society groups are also executing short- and long-term plans to combat potential voter disenfranchisement ahead of Tuesday.

    Jessica Ayoub, deputy political director for the Michigan American Civil Liberties Union, said her organization has “never been more prepared” for any expected fights with the federal government or local officials seeking to disenfranchise voters, saying they first began planning for different scenarios 18 months ago, cultivating relationships with hundreds of clerks and election staff across Michigan.

    “We’ve gamed out 25 potential scenarios and have rapid response strategies that we’ll deploy to ensure our elections are protected and that our democracy remains intact,” said Ayoub, who cited a desire not to publicize further details ahead of next month.

    On Friday, voting rights groups filed a new lawsuit against the Department of Justice and Department of Homeland Security in California, seeking to block the federal government’s efforts against state election officials.

    The groups are asking a judge to declare that the federal government has exceeded its constitutional authority and that state officials are legally carrying out their duties. They also want the court to force the departments to contact all California election officials who received subpoenas and tell them the investigation has halted due to a court order.

    Source: CyberScoop · 2026-10-30

  • Leaked DHS employee archive, Icepick, faces challenges to stay online

    A company working on behalf of the Department of Homeland Security sought to cut off online access to information on more than 41,000 employees that hacktivists said they obtained from a database breached at DHS.

    A search tool for the database, named Icepick, went offline for a spell before coming online again Thursday under a different registrar.

    Icelandic hosting company FlokiNET said Thursday that it received a request from DHS contractor ZeroFox to remove the data, which it refused.

    “By mid-morning, icepi.cx no longer resolved. Its registrar, CentralNic, had placed the domain on serverHold,” FlokiNET said in a blog post. “Our refusal kept nothing online. The request that decided the outcome to take the site down was not the one sent to us. A registrar reached the opposite conclusion the same morning, published nothing, and a global audience lost access to the site. In the meantime the site is online again under a domain from a different registrar.”

    CentralNic and ZeroFox did not immediately respond to requests for comment Thursday.

    DHS said late Wednesday that it was working to protect its employees against any breach.

    “DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a spokesperson said. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”

    The social media site Bluesky was also blocking links to the archive because it shared people’s contact information without their permission, although a company official said changes were coming because the wording had identified it as a malicious link.

    FlokiNET said it refused the ZeroFox request that mislabeled the archive as part of a doxxing campaign.

    “Doxxing publishes private details about private people so that others can find them at home. Icepick publishes work identities of government employees,” it wrote. “Who they work for. What their role is. How they can be reached in that role. The information describes people in the exercise of public authority, not in their private lives. Federal officers carrying out an enforcement programme are not private individuals while they are carrying it out.”

    “The public has a legitimate interest in knowing who is doing that work, under whose authority, and in which office,” it continued. “Journalists cannot report on an agency whose personnel are structurally unknowable.”

    ZeroFox said that regardless of that, the data made it possible to locate people whose information was in the database.

    “The request does not depend on who the listed individuals are or what their duties are,” ZeroFox wrote to FlokiNET. “It rests on two facts: the data was stolen, and it is personal data that identifies and locates real people.”

    Source: CyberScoop · 2026-10-29

  • Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists

    A leak website was published Wednesday, showcasing internal data on more than 41,000 Department of Homeland Security employees and contractors after it was obtained by hackers who claimed to have breached an identity service used by the agency.  

    The transparency nonprofit Distributed Denial of Secrets and the hacker maia arson crimew got the data from a hacktivist outfit known as the Department of Peace.

    ”The leak is extraordinary but deceptive in [its] simplicity as it identifies the officials responsible for overseeing covert and undercover operations, the government’s hunt for leakers and the failed BlueLeaks investigation — along with key personnel in DHS’s ever-escalating rendition and deportation programs,” said Emma Best, founder of DDoSecrets.

    CyberScoop was able to verify numerous current Cybersecurity and Infrastructure Agency employees are listed in the data, along with some former leadership members who left the agency years ago.

    The data goes back years, with various group names listed in the database making reference to COVID-19 planning and internal summits in 2023.

    As of Thursday morning, the website hosting a searchable form of the data has been taken offline.

    The hacktivists said the breach was a response to the promise of stepped-up operations from Immigrations and Customs Enforcement by DHS Secretary Markwayne Mullin.

    ”On July 17th, Markwayne Mullin said he was ’turning up the heat.’ This is what happens to ICE when you do that,” said a spokesperson for the Department of Peace.

    The spokesperson said they obtained the database from an Okta single sign-on service used at DHS. Okta said it was aware of the report.

    “Okta is secure, and we have no evidence our data or systems were compromised,” an Okta spokesperson said.

    DHS did not immediately respond to a request for comment.

    ”This dataset is massive in terms of both size and impact,” said crimew, a Swiss hacker and journalist who has been indicted in the United States over past leaks and who created a search tool for the DHS data. “It provides an unprecedented look into the Department of Homeland Security’s organizational structure, highlighting which people do what work across multiple DHS agencies, including ICE.”

    One researcher said the leak could prove valuable for Freedom of Information Act requests.

    “Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results,” Ryan Shapiro, executive director of Property of the People, said. “Given the Trump administration’s contempt for even basic transparency, the need for such tools is urgent.”

    DHS has suffered notable breaches before, dating back to a 2014 breach that may have exposed the data of 390,000 then-current and former Homeland Security Department employees, job applicants and contractors. In 2018, DHS notified nearly 250,000 people of a breach at the department.

    Earlier this year, Security firm GitGuardian said it discovered a public GitHub repository that exposed credentials for privileged AWS GovCloud accounts and internal CISA systems dating back to November 2025.

    Greg Otto contributed to this story.

    UPDATE: 10/29/2026, 9:30 a.m.: This story has been updated with details about the web-based database being taken offline.

    Source: CyberScoop · 2026-10-28