Bluesky Is Blocking Links to a Major Leak of DHS Employee Records

Bluesky is blocking users from opening links to a newly leaked archive of records on more than 41,000 Department of Homeland Security employees and contractors, and labels the pages "malicious."

The files include people's email addresses and phone numbers, "shared without their authorization," Bluesky tells WIRED, in violation of its community guidelines. The company says it chose to block the links, rather than remove individual posts, "to avoid limiting public discussion or restricting broader access to reporting and commentary."

The DHS records, published Wednesday by the transparency nonprofit Distributed Denial of Secrets, list employees' and contractors' names, contact information, and membership in internal groups, tied in some cases to surveillance and undercover operations. A WIRED investigation found that the files lay out in detail how DHS is organized, from senior leadership to individual immigration agents, and in some cases appear to show who has access to certain technologies.

Users who try to open the archive through Bluesky's website or app land on a page labeled "Blocked Link," which says the URL has been identified as "malicious" and blocked for their safety. Bluesky did not respond to questions about whether the block was imposed automatically or whether any government agency had asked the company to restrict access to the data.

The DDoSecrets homepage loads normally from Bluesky. At least one third-party app, Klearsky, opens links to the DHS archive with no warning.

Bluesky promotes a decentralized approach to content moderation that lets users pick independent services that label or filter posts. Its current community guidelines bar sharing "home addresses, personal contact info, financial or medical data, or identification documents." (A preview of the DHS leak analyzed by WIRED apparently contained work-related contact information one expert described as details that would be printed "on a business card.") The same guidelines explicitly protect "factual reporting" on matters of public interest that are "related to government transparency and public officials."

Bluesky started in 2019 as a Twitter research project, later became independent, and opened to the public in February 2024. By August of this year, it counted 45 million registered accounts, and an estimated 10.4 million people used its mobile app in June. Toni Schneider, the founding CEO of Automattic, has run the company since cofounder Jay Graber stepped down in March. Because the network runs on an open protocol, outside developers can build their own Bluesky apps and decide which of the company's moderation labels to apply.

Emma Best, cofounder of DDoSecrets, says this is not the first time a social media platform has wrongly labeled the organization's website malicious or tried to restrict access to its publications. Twitter suspended DDoSecrets' account in 2020, prior to the Elon Musk acquisition and X rebrand, and blocked links to its website after the group published BlueLeaks, a 269-gigabyte trove of internal records from hundreds of police agencies and fusion centers. Best says tech platforms often give in to government pressure but insists they cannot prevent the information from spreading. "They can't stop the signal," they say.

A group calling itself the Department of Peace gave the archive, dubbed "Icepick," to DDoSecrets and journalist maia arson crimew. crimew also built a website for searching the records, and Bluesky blocks that site in its website and app as well.

At least one of Bluesky's competitors has taken a different tack. On X, the Grok chatbot built by X's parent company pointed curious users to the Icepick website, describing it as a "cleaned searchable web tool" and saying that the complete dataset can be downloaded via DDoSecrets' website or by torrent. X did not immediately respond to a request for comment.