CBP's database misuse files are a control problem, not a training problem

Internal Customs and Border Protection and Department of Homeland Security records obtained by WIRED under the Freedom of Information Act document hundreds of allegations that agency employees and contractors queried sensitive law-enforcement databases for reasons unrelated to their jobs, including looking up romantic interests, monitoring family members, exposing personal information, and in some cases providing intelligence to suspected smugglers or drug-trafficking organizations ^[1][2]. The entries run from 2009 through 2022, fourteen calendar years, which puts this in the category of a system property rather than an incident ^[3][4].

WIRED identified almost 300 data-related entries in the intake system ^[5]. Of those, 138 were referred to CBP management for review, 78 were assigned to Office of Professional Responsibility criminal investigators, 43 were logged as "Information Only" with no OPR investigation opened, 12 went to supervisors for management review, three were logged as criminally investigated "Law Enforcement Records" cases, two as "Immediate Management Actions" for minor misconduct resolved without a formal case, and one as a formal administrative inquiry ^{[6][7][8][9][10][11][12]}. CBP withheld 21 more, citing the exemption for active law-enforcement proceedings ^[13]. That is 277 categorized entries plus 21 withheld ^[14]. Roughly 54 percent of the categorized entries were handled by the employee's own management chain; about 28 percent reached criminal investigators ^[15][16].

The mechanism is the part operators should read closely. Complaints went through what was then the Joint Intake Center and the Joint Intake Case Management System, still used by CBP and ICE for case tracking, where analysts decided whether each allegation was retained for information, referred to a manager, or assigned to OPR as potentially serious misconduct ^[17][18]. Every one of those decisions happens after the query has already returned data. Ninety-nine entries involved alleged breaches or unauthorized disclosures and 48 explicitly involved improper database queries, about 53 percent of the categorized total ^[19][20].

The individual cases show what unrestricted query scope buys. One officer allegedly used government databases to contact a flight attendant ^[21]. Another was accused of pulling information from trusted-traveler applications to ask people out ^[22]. Others allegedly supplied border-crossing data to someone in a "heated divorce" ^[23]. A DHS employee allegedly used ad-tech-derived location data to track several coworkers' phones, which WIRED reports appears to be the first known internal abuse case involving DHS use of commercially sourced mobile location data ^[24]. None of these require sophistication. They require a search box with no enforced purpose binding and no automated flag when an employee queries a person connected to them.

CBP's stated position is that digital surveillance tools help officers screen travelers and investigate crimes more efficiently ^[25]. The same records cover a period in which immigration and border authorities were expanding into facial recognition, license plate readers, mobile-device searches, and commercially purchased app location data ^[26]. Laura Rivera, an attorney with Just Futures Law, told WIRED that accountability for CBP wrongdoing "has been elusive" and that data abuse is another aspect of that history ^[27]. WIRED also notes that many cases cluster around 2020, when the shift to remote work led employees to start moving work files off government systems ^[28].

What to watch: whether the 21 withheld cases produce charges, and whether any new capability arrives with a query-time justification field and self-association alerting before it arrives with its first abuse case ^[13][24].