Icelandic hosting company refuses to remove data on 40,000 US officials

An Icelandic web-hosting company, FlokiNET, will not remove or restrict access to a database containing information on tens of thousands of employees of the US Department of Homeland Security and its agencies, mbl.is reports. The department says the publication puts more than 40,000 identifiable people at risk.

FlokiNET published online a removal request sent to the company the previous day. The request said the database could expose people to harassment, persecution and physical harm.

Cybersecurity firm ZeroFox sent the request on behalf of US Immigration and Customs Enforcement, which authorised it to seek the removal of online material. FlokiNET chief executive Kolja Weber told Reuters the company would not take down the data. He said it contained employees’ work addresses and work phone numbers, but not their home addresses or personal phone numbers.

FlokiNET has also defended its decision on public-interest grounds. The company told Al Jazeera that the public has a legitimate interest in knowing who carries out immigration enforcement, on whose authority and from which workplaces.

The Department of Homeland Security said it was aware of a possible security breach and was working to respond quickly and effectively. A spokesperson said the department took threats to the safety of its employees and officials seriously and would work to ensure they received appropriate protection.

The nonprofit transparency group DDoSecrets published data on more than 40,000 department and agency employees on Wednesday. It also made available a separate searchable database developed by hacker and journalist maia arson crimew.

The database was briefly inaccessible the following day but soon reappeared under a different domain. FlokiNET told Al Jazeera that the domain registrar had disabled the domain even though the hosting company had rejected the request to remove the material. The information was then made available under another domain.

A group calling itself the Department of Peace claimed responsibility for obtaining the data. In a statement, it said department employees had information about the group and that it was therefore fair for the group to have information about them. It said it hoped the data could help limit further harm caused by the department.

FlokiNET was founded in Iceland in 2012. The company says it was established to provide protection for freedom of expression, independent media and whistleblower projects. Privacy advocates have criticised the department’s use of personal information from other agencies to enforce immigration laws, including data from Medicaid.