Hundreds of database-abuse allegations at CBP, and the logs caught every one of them

A control has to do three things: notice the act, tie it to a person, and cost that person something. The files described by WIRED clear the first two comfortably. Queries were recorded, attached to named employees and contractors, and still retrievable years later when a reporter filed FOIA requests with CBP's Office of Professional Responsibility and the DHS Inspector General ^[1]. The audit trail functioned exactly as designed. What it produced was paperwork.

The volume is worth sitting with as arithmetic rather than adjective. Hundreds of allegations across a span of more than a decade ^[2][3] works out to something on the order of seventeen to twenty recorded allegations a year as a floor ^[15], and that floor counts only the ones a complainant raised, an investigator opened, and a records office kept. Nobody discovers a query rate this way. They discover a complaint rate.

The categories inside it are ordinary in the worst way. Officers looking up romantic interests and monitoring family members ^[4]. An officer accused of pulling information out of trusted-traveler applications to ask people out ^[7], which turns an expedited-screening program into a contact list. Border-crossing data handed to someone in the middle of a heated divorce ^[8]. One officer allegedly using government systems to reach a flight attendant ^[6]. The same access path also shows up carrying intelligence to suspected smugglers and drug-trafficking organisations ^[5], and the logging regime treats that query and the divorce query identically: it writes both down.

Then there is the outlier. A DHS employee is alleged to have used ad-tech-derived location data to track several coworkers' phones, described as the first known internal abuse case involving DHS use of commercially sourced mobile location data ^[9]. Read that as a boundary rather than a scandal. Query logs cover the systems an agency runs. Data an agency buys arrives with whatever handling the vendor contract specifies, and the files as described cannot tell us whether this is the first time it happened or the first time someone noticed.

On what happened to the people involved, the source is thinner than the source's own confidence suggests. Techdirt asserts that most officers are permitted to resign rather than face discipline or criminal charges ^[10], and that contractors who abuse access move to other jobs in the same industry because surveillance vendors are equally uninterested in punishing it ^[11]. That is characterisation, not a tabulation of dispositions, and the excerpt offers no case-by-case outcomes. But it is the load-bearing question, because a resignation ends the personnel record and leaves the log entry as the only artefact.

Meanwhile the current wave of coverage about tech-enabled stalking by police is aimed at Flock Safety, a comparatively recent arrival ^[13]. The federal database problem has a decade of internal documentation behind it ^[3] and produced, on this evidence, a well-maintained archive of things somebody already did.