DOGE May Have Misused Social Security Data, DOJ Admits
Law enforcement authorities in the United States have for years circumvented the Fourth Amendment to the U.S. Constitution by purchasing data on U.S. residents that would otherwise have had to be obtained through a warrant. Now Immigration and Customs Enforcement apparently thinks it can ignore a longstanding constitutional protection by breaking down doors without a warrant to arrest people, according to a recent whistleblower complaint — despite recent federal rulings that doing so violates the Fourth Amendment.
That’s the news coming to us from Minneapolis this week, where protesters and the federal government continue their confrontation, even as ICE plans to build a deportation network spanning Minnesota and four other states. And despite the Department of Homeland Security’s claims that simply publicly naming an ICE agent amounts to “doxing,” a WIRED LinkedIn study found that agents frequently doxx themselves. Of course, having access to a person’s personal information can have consequences: A report released this week found that people are less likely to seek medical attention due to ad tech surveillance and ICE enforcement activities.
Immigration authorities don’t just search people’s homes without a warrant signed by a judge: they also search for drugs. Customs and Border Protection this week launched tests for a “quantum sensor” that can detect fentanyl linked to an “AI database.”
In non-immigration news, a researcher recently discovered an insecure database containing 149 million login credentials. Usernames and passwords appear to be tied to accounts for everything from Gmail, Facebook, and Apple to government systems around the world. The researcher who found the database, Jeremiah Fowler, believes the stolen credentials were collected by information-stealing malware. The database, accessible to anyone on the Internet, has since been taken offline.
TikTok, meanwhile, began collecting even more data on its users, including precise location data, after the social video app was sold to US investors.
But that’s not all. Every week, we round up security and privacy news that we haven’t covered in depth ourselves. Click on the headlines to read the full stories. And stay safe out there.
The Trump administration admitted in court documents this week that agents of the so-called Department of Government Efficiency (DOGE) may have shared Social Security Administration (SSA) data with an outside group seeking to “overturn election results in certain states,” according to a Jan. 16 Justice Department court filing. However, it is unclear to the DOJ whether the anonymous “DOGE team members” actually shared the data with the group, which was not identified in court records.
The filing, which seeks to “correct” previous testimony, also states that DOGE agents “used links to share data through the third-party server ‘Cloudflare,'” which is “not approved for SSA data storage and, when used in this manner, is outside of SSA security protocols.” The filing further states that Steve Davis, a high-ranking advisor to Elon Musk, was copied in a March 3, 2025 email containing a password-protected file attachment containing the names and addresses of approximately 1,000 individuals, which was extracted from the SSA’s records systems. The SSA, however, was unable to determine whether Davis accessed the record, which remained inaccessible to current SSA employees as of the date the case was filed with the court.
The Federal Aviation Administration has taken the unusual step of including “Department of Homeland Security facilities as mobile assets” in a “no-fly zone” announcement, 404 Media reports. The advisory prohibits the use of “unmanned aircraft,” which includes commercial drones used to capture aerial imagery, below 3,000 feet horizontally and up to 1,000 feet in altitude above DHS assets. According to 404 Media, people caught violating the restrictions could face criminal charges, civil penalties or even lose their authority to fly drones in the future.
If you’re breaking out your thermals in preparation for this weekend’s giant winter storm, you might want to check if you bought it from Under Armour. TechCrunch reports that the clothing and fitness app company is investigating a potential data breach after a hacker posted millions of customer records online. Data breach notification site Have I Been Pwned notified 72 million people via email about the leak and says the dataset included names, email address, gender, date of birth, approximate location and purchasing information. An Under Armor spokesperson told TechCrunch that the company was aware of the allegations about the breach, had hired “external cybersecurity experts” for help and had no evidence that the issue affected customers’ payment processing or password storage systems.
When you encrypt your laptop’s hard drive, you probably expect that only you, the computer’s owner, will be able to decrypt it at will and access your data. If you follow Microsoft’s recommendation to store your decryption key in the cloud to make it easier to recover your data if you lose the key or forget your password to unlock it, then you’ll need to update your security expectations: Microsoft has confirmed that it often distributes these decryption keys to law enforcement at the request of an agency, giving them full access to the machine’s secrets. Forbes found an instance where Microsoft complied with an FBI request for decryption keys from a computer in Guam, as part of a fraud investigation. Microsoft later confirmed to Forbes that it receives about 20 requests for Bitlocker keys a year from law enforcement and often complies. The company added that it can’t comply, however, when the key is only stored locally by the user – an instructive note for cypherpunks everywhere.
The Iranian government shut down the internet for weeks amid protests that swept the country. But anti-regime voices this week found another way to reach the country’s population: a hacking operation appears to have hijacked the country’s state television satellite to broadcast a message of support for protesters, thousands of whom died in the recent uprising. The clip, which featured the former Iranian leader’s son Reza Pahlavi, called on the military and security forces to join protesters and fight the regime. “Don’t point your guns at people,” a graphic from the show read. “Join the nation for the freedom of Iran.” According to reports, the unauthorized message lasted for up to 10 minutes before the state television station resumed normal programming.
