By Matt Busel, who built the apps, crates and game he writes about · every number links to its source and every dataset is downloadable (methods) · corrections · featured in Kirino, gamebiz, This Week in Rust, New Mobile Life, By-Press
DHS leak: auditors flagged its logins 8 times. 27 fixes still open
On this page · 9 sections
Short answer: The "Icepick" leak of 41,000 Homeland Security records, which WIRED reported on Oct 28 2026 and which its publishers say came from DHS's Okta login system, did not come out of nowhere. DHS's own inspector general wrote 8 reports on who can get into DHS systems between September 2022 and September 2026, made 51 recommendations, and 27 of them are still listed as open. We also traced every DHS Okta order: $24.4M, bought through 9 different resellers, with no direct Okta contract at all.
TL;DR: The oldest open fix, telling DHS to cut off ex-employees' access, is 3 years and 9 months old (OIG-23-04). Eight weeks before the leak, the watchdog found that all 76,000 CBP network users could reach one highly privileged account, and 11 of its 12 fixes are still open (OIG-26-28). Meanwhile the number of people who need DHS logins is exploding: ICE's 287(g) list now holds 2,725 agreements deputizing local police, 2,015 of them signed since July 4 2025, and the summer of 2026 ran at a record 197 a month.
Key numbers
| What | Number | Source, checked Oct 29 2026 |
|---|---|---|
| DHS records in the Icepick leak | 41,000+ | WIRED, Oct 28 2026 |
| DHS OIG access-control reports, Sep 2022 to Sep 2026 | 8 | oversight.gov (OIG-24-11 and others) |
| Recommendations made / still open | 51 / 27 | oversight.gov report pages |
| ICE departed staff who kept system access (sample) | 84% (159 of 190) | OIG-23-33 |
| CBP users who could reach one privileged account | 76,000 (all of them) | OIG-26-28 |
| DHS Okta orders / total / resellers | 19 / $24.4M / 9 | USAspending |
| 287(g) agreements in force | 2,725 (2,367 agencies) | ICE 287(g) list, Oct 28 2026 |
| Signed since July 4 2025 | 2,015 | ICE participating agencies xlsx |
The watchdog wrote the warning eight times
Access control is boring until it is a leak. It means one thing: when someone leaves, their login dies; when someone is an admin, someone checks.
DHS's Office of Inspector General audited exactly that, component by component. USCIS in September 2022. Headquarters in January 2023. FEMA in February 2023, where 75% of departed staff accounts it checked were still live. ICE in July 2023, where it was 84%.
Then it wrote a summary report in January 2024 saying the same failure ran across components. Then CBP and TSA in September 2026. The pattern is not one bad office. It is the department.
| Report | Date | Finding | Open fixes | Source |
|---|---|---|---|---|
| OIG-22-65 USCIS | Sep 7 2022 | Access for staff, service and admin accounts not managed | 0 of 10 | oversight.gov |
| OIG-23-04 DHS | Jan 9 2023 | ID-card access and clearances not pulled from people who left | 6 of 6 | oversight.gov |
| OIG-23-16 FEMA | Feb 15 2023 | 75% of departed accounts sampled still active | 0 of 10 | oig.dhs.gov |
| OIG-23-33 ICE | Jul 20 2023 | 84% of departed staff sampled kept access | 4 of 7 | oversight.gov |
| OIG-24-11 summary | Jan 16 2024 | USCIS, FEMA, ICE all failed to restrict access | no recs | oversight.gov |
| OIG-25-28 FY2024 FISMA | Jul 1 2025 | Rated "effective" while noting identity weaknesses and MFA gaps | 1 of 1 | oversight.gov |
| OIG-26-28 CBP | Sep 4 2026 | All 76,000 users could reach one privileged account | 11 of 12 | oversight.gov |
| OIG-26-40 TSA | Sep 30 2026 | Service accounts made without approval, no admin reviews | 5 of 5 | oversight.gov |
The grade said "effective" anyway
Here is the part that should make any taxpayer laugh. The FY2024 security evaluation, OIG-25-28, rated DHS's program "effective." The same report says "selected components had identity and access weaknesses" and that multifactor login was "not enforced on all cloud accounts" at one component.
A passing grade with the failure written in the margin. That is how a department ends up with 27 open fixes and a clean report card at the same time.
The CBP report is the sharpest. Published September 4 2026, it says CBP never fully put in place its own May 2023 identity directive, could not list all its admin accounts, and left 20% of departed employee accounts and 15% of departed contractor accounts on past their deadline. It even mentions a June 2025 incident in which hackers stole CBP employee data across components. Eight weeks later, CBP staff were more than half of the leaked records, per WIRED.
One caution, because we do not referee what we cannot see: nobody has shown which system CBP's access control runs on, and Okta told WIRED its own systems were not breached. The record does not need the vendor's name. It needs the fixes done.
Follow the money: Okta, bought nine ways
The publishers say the data came from DHS's Okta login system. So we pulled every DHS award whose description names Okta from the USAspending API. A search by recipient for Okta returns zero DHS awards. Every dollar goes through a middleman.
Nineteen orders, $24.4M, through Carahsoft, V3 Gate, Anacapa Micro, Blue Tech, SNAP, DH Technologies, Alvarez, RedHawk and Pueo. TSA alone has renewed through five different resellers since 2019 ($10.8M). CBP spent $7.0M, headquarters $3.7M, FEMA $2.8M. ICE has no Okta-named order at all, so whatever ICE uses is bought inside a bundle you cannot see from the outside.
| Order | Buyer | Date | Amount | Source |
|---|---|---|---|---|
| Okta license renewal (Carahsoft BPA) | DHS HQ | Jul 31 2026 | $2,958,888 | USAspending |
| Okta software maintenance | CBP | Jul 1 2021 | $2,262,227 | USAspending |
| Okta software | CBP | Jul 1 2022 | $2,169,946 | USAspending |
| Okta identity cloud renewal | TSA | Sep 30 2026 | $2,019,410 | USAspending |
| Okta identity cloud renewal | TSA | Sep 30 2025 | $1,980,668 | USAspending |
| Okta subscription renewal | TSA | Sep 30 2024 | $1,783,755 | USAspending |
| Okta software and services | CBP | Jul 1 2020 | $1,768,688 | USAspending |
| Purchase of Okta software | FEMA | Jul 23 2026 | $1,635,609 | USAspending |
| Okta MFA server access, six months | FEMA | Jan 23 2026 | $67,627 | USAspending |
FY2026 is the biggest Okta year on record: $7.8M, 32% of the seven-year total. The headquarters renewal now runs under a Carahsoft blanket agreement that GovConWire reports as a sole-source deal, while USAspending codes it "full and open competition." Both cannot be the whole story.
The real money is around the login, not in it
Okta is the cheap part. The integrators who build DHS identity systems took $341.7M across 43 awards that name ICAM (identity, credential and access management), led by Dignari, with a $49.0M headquarters order in 2024 plus $40.5M and $33.1M at USCIS and $34.8M at TSA.
And the tools whose names show up in the leaked permission groups cost far more. DHS awards to Palantir total $554.0M, including $86.3M on May 5 2026 for ICE deportation operations modernization. Anduril, where the departed DHS CIO went back to work per WIRED, holds $929.9M in CBP awards, $424.7M of it in FY2026. PenLink holds $71.1M (we covered its no-bid Webloc renewal).
Put the two numbers side by side. DHS can find $1.5B for surveillance and analysis platforms. It has not closed 27 recommendations about turning off logins.
More logins, faster: 287(g) at record pace
Every new account is a new door. WIRED counted about 1,300 ICE enforcement accounts created since July 4 2025, and found local "287(g) Officer" accounts at county sheriffs and jails.
So we pulled ICE's own 287(g) participating agencies file, updated Oct 28 2026. 287(g) is the program that deputizes local police to do immigration work. The file lists 2,725 agreements with 2,367 agencies. 2,596 of them (95%) are dated on or after Jan 20 2025, and 2,015 on or after July 4 2025.
The pace is speeding up, not leveling off. June to September 2026 added 788 agreements, about 197 a month, the fastest stretch in the file. 2026 has 1,537 so far against 1,059 in all of 2025. Texas leads with 553, then Florida 354, Arkansas 182, Tennessee 166 and Missouri 163 (ICE).
A caveat on dates: the file shows when the current agreement was signed, so an agency that re-signed in 2025 shows the new date. Read it as "agreements dated since," not "brand new partners." The direction does not change.
What this means for you
If you are a journalist or a records nerd, the paper trail is now public and short. Ask DHS which of the 27 open recommendations it has closed since October 28. File a FOIA for CBP's corrective action plan on OIG-26-28 and for the account-review logs the TSA report says do not exist. Ask every sheriff on the 287(g) list how many deputies hold DHS logins and who switches them off when a deputy leaves.
If you build software, the lesson is cheaper than a breach: kill accounts on exit, review admin accounts on a schedule, and never let one service account be reachable by everyone. That is the whole fix DHS has been told to do since 2022. More of our federal-money work lives under AI industry, in the Flock Safety investigation and on the news desk.
Want this kind of contract and audit trail watched for you? Company Watch tracks any company's federal awards, SEC filings and lobbying for $99 a month, and we keep fixing it at no extra cost until it does what it promises.
How we got the data
- Audit record: DHS OIG report pages on oversight.gov, read Oct 29 2026. We counted every report from Sep 2022 to Sep 2026 whose subject is restricting system access, revoking access for departed staff, or the department-wide FISMA grade. Open status is what oversight.gov lists on Oct 29 2026; USCIS and FEMA list no open recommendations and count as 0 open. Download: data.csv.
- Money: USAspending API v2 spending_by_award, pulled Oct 28 to 29 2026, awarding agency Department of Homeland Security, period Oct 1 2019 to Sep 30 2026, contracts and IDVs, top 100 awards per search by amount. Searches: recipient (Palantir, Pen-Link, Anduril, OpenAI, Okta) and description keywords (Okta, ICAM, Falcon, Mobile Fortify, Grok, Copilot, Gemini, Signal). Amounts are lifetime obligations. Excluded: "Falcon" hits that are IBM and Goldbelt Falcon, not Palantir; Gemini hits for unrelated firms. No DHS awards name OpenAI, Grok, Mobile Fortify or Signal. Downloads: dhs_awards_leak_vendors.csv, dhs_okta_awards.csv.
- 287(g): ICE ParticipatingAgencies10282026pm.xlsx from ice.gov, pulled Oct 29 2026; counts by state, model and month signed. Downloads: 287g_agencies.csv, 287g_by_state.csv, 287g_by_month.csv.
- Not used: the leaked files themselves. Every leak number here is WIRED's.
Sources
- WIRED, Dhruv Mehrotra, Maddy Varner and Dell Cameron, "Massive Leak Exposes 41,000 Homeland Security Workers", Oct 28 2026
- DHS OIG, OIG-26-28 CBP access control, Sep 4 2026
- DHS OIG, OIG-26-40 TSA access control, Sep 30 2026
- DHS OIG, OIG-25-28 FY2024 information security, Jul 1 2025
- DHS OIG, OIG-23-33 ICE access control, Jul 20 2023
- DHS OIG, OIG-23-04 PIV and clearances, Jan 9 2023
- USAspending.gov award records, pulled Oct 29 2026
- GovConWire, Carahsoft DHS sole-source BPA, 2026
- ICE, 287(g) participating agencies, updated Oct 28 2026
First published here on tensorust.com on Oct 29, 2026. Related: .
Up next
More on AI industryH-1B and layoffs: Google doubled new H-1B hires in a layoff yearGoogle got 2,201 new-hire H-1B approvals in 9 months, double fiscal 2025. We matched 60,133 visa filings to 2026 layoff notices: 28 same-month overlaps.Read it next →Cite this
Free to cite and reuse under CC BY 4.0 with a link back. How it was collected: methods. Spotted an error? Corrections.
Did this answer your question?
Get the next one by email.
What my AI agents tried this week, with the real numbers: what worked, what flopped, what made money. One email when there is something worth reading.
No spam, never sold. Every email has a one-click unsubscribe.
What are people saying about this? Read and post on The Floor →
More: the author, related reading, share this, a free game
Try it yourself · Following AI?
Check what the models really cost
71 API prices, each copied from the provider page with the date, plus every change.
In The Manual: on this topic
Explainers answer one question, short answer first. Guides walk you through it step by step.
- Explainer · Money and the economyWhat is a no-bid contract, and how do you spot one?
- Guide · Shipping and sellingHow to turn off your phone's advertising ID (iPhone and Android)
- Explainer · AI, LLMs and agentsWhat is the KV cache in an LLM, in plain English?
- Guide · Money and the economyHow to search USAspending.gov for any company's federal contracts (and catch the resellers)
Read next
- Politics · Oct 29, 2026 · 9 min readH-1B and layoffs: Google doubled new H-1B hires in a layoff year
- Politics · Oct 28, 2026 · 25 min readFederal grants bought plate readers and cameras for polls in 12 places
- AI · Oct 28, 2026 · 5 min read447 AI chatbot trials on patients. 160 finished, 2 posted results
