BlueLeaks

BlueLeaks, sometimes referred to by the Twitter hashtag #BlueLeaks, refers to 269.21 gibibytes of internal U.S. law enforcement data obtained by the hacker collective Anonymous and released on June 19, 2020, by the activist group Distributed Denial of Secrets, which called it the "largest published hack of American law enforcement agencies".^[1]

Hackvist w/ Guy Fawkes mask

The data — internal intelligence, bulletins, emails, and reports — was produced between August 1996 and June 2020^[2] by more than 200 law enforcement agencies, which provided it to fusion centers. It was obtained through a security breach of Netsential, a web developer that works with fusion centers and law enforcement.

The leaks were released at hunter.ddosecrets.com and announced on the @DDoSecrets Twitter account. The account was banned shortly after for "dissemination of hacked materials" and "information that could have put individuals at risk of real-world harm."^[3] Wired reported that Distributed Denial of Secrets attempted to remove sensitive information from the data before publication. National Fusion Center Association (NFCA) officials confirmed the authenticity of the data, according to documents obtained by security journalist Brian Krebs; the organization warned its members that hackers may use the leaked information to target them.^[4]

Background

The Blue Leaks data comes largely from the intelligence gathered by fusion centers. After the September 11 attacks, the United States government sought to improve communication between different levels of law enforcement to better discover and prevent terrorist attacks. They encouraged state and local governments to create fusion centers: physical locations where representatives of different law enforcement agencies share and collectively analyze intelligence before distributing reports back to their respective agencies. Fusion centers have since begun working with private data brokers with little public oversight.^[5]

Fusion centers have been criticized as privacy-invading, ineffective, and targeted at political groups. In 2012, the Senate Permanent Subcommittee on Investigations found that over the 13 months of review, fusion centers did not contribute to the identification or prevention of a terrorist plot,^[6]: 2 and that of the 386 unclassified fusion center reports it reviewed, three-quarters had no connection to terrorism at all.^[6]: 32 In 2008, the Department of Homeland Security identified a number of privacy-related concerns created by fusion centers. The department noted that the excessive secrecy of fusion centers led to comparisons with COINTELPRO, and that fusion center reports sometimes distribute inaccurate or incomplete information.^{[7]: 28–9} The 2012 Senate report points to a report issued by an Illinois fusion center in 2011. The report wrongly claimed that Russian hackers were to blame for a broken water pump, and despite the Department of Homeland Security publicly stating the report was false, its Office of Intelligence and Analysis included the claims in its report to Congress.^[8]

After the murder of George Floyd and other instances of police violence in 2020, law enforcement in the United States came under renewed scrutiny. In early June, the hacker collective Anonymous announced its intent to expose police misconduct.^[9] The collective did high-profile hacks in the 2000s and early 2010s. In 2011, Antisec, a subgroup of Anonymous, released law enforcement information in support of Occupy Wall Street protestors, but the collective had few significant operations within the United States since then.^[4]

Findings

The BlueLeaks collection includes internal memos, financial records, and more from over 200 state, local, and federal agencies.^[4] More than one million documents were leaked from law enforcement fusion centers.^[1] In leaked documents, officers track individual, group, and event pages with protest or anti-law enforcement rhetoric.^[10] Some of the documents contain material related to the attitudes of law enforcement and their response to the Black Lives Matter movement, George Floyd protests, and COVID-19 pandemic.

During the George Floyd protests, law enforcement agencies monitored protesters' communications over social media and messaging apps. Reports leaked found that the police were aware of the potential for their surveillance to violate the Constitution. They distributed documents to police filled with rumors and warnings that the protests would become violent, sparking fear among police officers.^[11]

The documents also show a much broader trend of surveillance. They show details about the data that police can obtain from social media sites including Facebook, Twitter, TikTok, Reddit and Tumblr, among others. Fusion centers also collect and distribute detailed data from automatic license plate readers.^[12]

Surveys from law enforcement training programs reveal that some instructors were prejudiced and unprofessional. Classes taught biased, outdated, and incorrect content. Some contain sexual content unrelated to the class, and there was one report of an instructor admitting to lying in court frequently.^[13]

In Maine, legislators took interest in BlueLeaks thanks to details about the Maine Information and Analysis Center, which is under investigation. The leaks showed the fusion center was spying on and keeping records on people who had been legally protesting or had been "suspicious" but committed no crime.^[14]

Documents also contain reports about other countries from the Department of Homeland Security, U.S. Department of State and other agencies. Officials discussed cyber attacks from Iran and concerns about further attacks in early 2020.^[15] Another report discusses possible Chinese espionage at natural gas facilities.^[16] Homeland Security also discussed Russian interference with American elections, attempts to hack the 2020 census, and manipulation of social media discussion.^[17]

Google's CyberCrime Investigation Group

On August 21, The Guardian revealed, based on the leaked documents, the existence of Google's "CyberCrime Investigation Group" (CIG). The group focused on voluntarily forwarding detailed information of Google, YouTube, and Gmail users, among other products, to members of the Northern California Regional Intelligence, a counter-terrorist fusion center, for content threatening violence or otherwise expressing extremist views, often associated with the far right. The company has also been said to report users who appeared to be in mental distress, indicating suicidal thoughts or intent to commit self-harm.^[18]

One way Google identified its users in order to report them to law enforcement was by cross-referencing different Gmail accounts, which eventually led them to a single Android phone. In some cases, the company did not ban the users they reported to the authorities, and some were said to still have accounts on YouTube, Gmail, and other services.^[18][19]

Response

Shortly after the leaks were released, on June 23, Twitter permanently banned DDoSecrets's Twitter account for distributing hacked materials. Twitter also censored all links to the DDoSecrets website.^[20]

German authorities seized a server used by DDoSecrets at the request of U.S. authorities. The server had hosted the BlueLeaks files, but the documents remained available for download through BitTorrent and other websites.^[21]

Reddit banned r/BlueLeaks, a community created to discuss BlueLeaks, claiming they had posted personal information.^[22]

There is a federal investigation relating to BlueLeaks. Various Freedom of Information Act requests filed about BlueLeaks and DDoSecrets were rejected due to an ongoing federal investigation. Homeland Security Investigations has questioned at least one person, seeking information about BlueLeaks, DDoSecrets, and one of its founders, Emma Best.^[23]

The editor for The Intercept described BlueLeaks as the law enforcement equivalent to the Pentagon Papers.^[24]

See also

• Afghan War documents leak – 2010 disclosure of a collection of internal U.S. military logs of the War in AfghanistanPages displaying short descriptions of redirect targets
• Cyberwarfare – Use of digital attacks against a nation
• Electronic civil disobedience – A form of nonviolent online protest
• Hacktivism – Computer-based activities as a means of protest
• Jeremy Hammond – American political activist and hacker
• Iraq War documents leak – Largest disclosure in United States military history
• Panama Papers – 2016 document leak scandal
• Paradise Papers – 2017 documents leak related to offshore investment

References

1. Karlis, Nicole (June 22, 2020). "Inside "Blue Leaks," a trove of hacked police documents released by Anonymous". Salon. from the original on June 23, 2020. Retrieved June 24, 2020.
2. "'BlueLeaks' Exposes Files from Hundreds of Police Departments — Krebs on Security". Krebs on Security. June 22, 2020. from the original on June 22, 2020. Retrieved June 22, 2020.
3. Cimpanu, Catalin (June 23, 2020). "Twitter bans DDoSecrets account over 'BlueLeaks' police data dump". ZDNet. from the original on June 24, 2020. Retrieved June 24, 2020.
4. Greenberg, Andy (June 22, 2020). "Anonymous Stole and Leaked a Megatrove of Police Documents". Wired. ISSN 1059-1028. from the original on June 23, 2020. Retrieved June 24, 2020.
5. Monahan, T. (2009). "The Murky World of 'Fusion Centres'" (PDF). Criminal Justice Matters. 75 (1): 20–21. doi:10.1080/09627250802699715. (PDF) from the original on July 11, 2019. Retrieved June 24, 2020.
6. "Senate report" (PDF). (PDF) from the original on November 12, 2019. Retrieved June 24, 2020.
7. "DHS report" (PDF). (PDF) from the original on March 29, 2020. Retrieved June 24, 2020.
8. Zetter, Kim (October 3, 2012). "DHS Issued False 'Water Pump Hack' Report; Called It a 'Success'". Wired. ISSN 1059-1028. from the original on June 24, 2020. Retrieved June 24, 2020.
9. Molloy, David; Tidy, Joe (June 1, 2020). "The return of the Anonymous hacker collective". BBC News. from the original on June 4, 2020. Retrieved June 24, 2020.
10. "Yes, the police are watching what you post on Facebook about protests". The Daily Dot. June 29, 2020. from the original on July 13, 2020. Retrieved July 9, 2020.
11. Hvistendahl, Mara; Brown, Alleen (June 26, 2020). "Law Enforcement Scoured Protester Communications and Exaggerated Threats to Minneapolis Cops, Leaked Documents Show". The Intercept. from the original on June 27, 2020. Retrieved June 28, 2020.
12. Maharrey, Mike (June 27, 2020). "Document Unmasks Fusion Center's Participation in License Plate Surveillance". Tenth Amendment Center. from the original on July 6, 2020. Retrieved July 11, 2020.
13. Hagerty, Colleen (July 10, 2020). "'This is a time bomb'—Leaked docs reveal homophobic, racist police instructors". The Daily Dot. from the original on July 10, 2020. Retrieved July 11, 2020.
14. Neumann, Dan (June 30, 2020). "Lawmakers call to defund Maine's secretive police intelligence agency". Beacon. Retrieved July 11, 2020.
15. Slapinski, Mark (July 1, 2020). "BlueLeaks: US Law Enforcement feared Iranian hackers". Toronto Today. from the original on July 9, 2020. Retrieved July 11, 2020.
16. Petti, Matthew (July 7, 2020). "Exclusive: Did Chinese Agents Try To Stake Out American Natural Gas Plants With Drones?". The National Interest. Retrieved July 11, 2020.
17. Slapinski, Mark (July 6, 2020). "Homeland Security prepared for Russian interference in 2020 Census". Toronto Today. from the original on July 11, 2020. Retrieved July 11, 2020.
18. Wilson, Jason (August 17, 2020). "Google giving far-right users' data to law enforcement, documents reveal". the Guardian. Retrieved September 6, 2020.
19. Low, Cherlynn (August 17, 2020). "Google reportedly sent identifying info of extremist users to law enforcement". Engadget. Retrieved September 6, 2020.
20. "Twitter has permanently banned the group that published the 'BlueLeaks' police files obtained by hackers". Business Insider Nederland (in Dutch). June 24, 2020. from the original on July 9, 2020. Retrieved July 9, 2020.
21. Bajak, Frank (July 9, 2020). "Germany seizes server hosting pilfered US police files". Associated Press. from the original on July 9, 2020. Retrieved July 11, 2020.
22. Lee, Micah (July 15, 2020). "Hack of 251 Law Enforcement Websites Exposes Personal Data of 700,000 Cops". The Intercept. Retrieved October 13, 2021.
23. Franceschi-Bicchierai, Lorenzo (July 20, 2020). "ICE Questions an Admin of The-Eye Archive Site That Hosted 'Blue Leaks'". Vice. from the original on July 20, 2020. Retrieved July 20, 2020.
24. Elder, Jeff. "How 'Keyser Söze' leaked a secret trove of police documents that exposed cops tracking George Floyd protesters". Business Insider. Retrieved February 19, 2021.