BlueLeaks: one small web host, hundreds of agencies’ files
BlueLeaks exposed years of law enforcement and fusion center documents through the compromise of one web development firm. Each agency had judged a small contract; nobody had judged the shared platform, its accumulated archive or its sprawling user base.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On June 19, 2020, the transparency group Distributed Denial of Secrets published a large collection of files from hundreds of US law enforcement agencies and fusion centers, which it called BlueLeaks. The data ran to hundreds of gigabytes and spanned many years. It included bulletins, reports, emails and personal information about officers and members of the public. In the following days, reporting and an internal analysis by the National Fusion Center Association traced the data to a breach of Netsential. The Texas web development firm built and hosted websites and portals for many fusion centers and law enforcement organizations. Agencies spent the week assessing what had been exposed, as protests over policing continued nationwide.
Fusion centers and law enforcement associations share information by design. Many used web portals built and hosted by small specialist firms, because those firms understood the community and were affordable. Each agency assessed its own modest contract. Nobody assessed the platform as a whole. BlueLeaks exposed three risks that existed only at that level. They were the concentration of many agencies’ data with one small vendor, the accumulation of years of sensitive material that nobody needed online, and an access model built for wide sharing. Each needs a different remedy and, critically, an owner who sees across agencies.
Concentration with one small vendor
A single compromised vendor exposed data from hundreds of organizations. Each agency, looking only at its own contract, saw a website or a portal at a modest price. The aggregate risk existed only across the vendor’s customer base, and no customer was positioned to see it.
Small vendors are not inherently less secure. They often lack dedicated security staff, independent assessments and the ability to detect and contain a capable intruder. The remedy is to set minimum security requirements for any vendor hosting sensitive information, scaled to the data rather than the contract value. Agencies can prefer hosting arrangements that have been independently assessed. Information-sharing networks can assess common vendors once on behalf of all members, which is more searching than each member sending the same questionnaire.
Contracts with shared-platform vendors should require prompt notice of any security incident affecting any customer, not only the contracting agency. On a shared platform, one customer’s breach is everyone’s. Agencies should also know where their data is hosted, which vendor staff can reach it, and whether backups and old copies exist elsewhere. Those questions are cheap to ask at renewal and very hard to answer after a leak.
Small vendors also need room to improve. A requirement for independent assessment or multi-factor authentication may cost a three-person firm more than a year’s contract value from any single agency. Members acting together can fund those improvements, phase them in, or move the platform to an assessed hosting environment while keeping the vendor’s domain expertise. Treating the vendor as a shared asset that members invest in tends to produce better security than treating it as a supplier each member pressures separately.
An archive nobody needed online
The leaked material spanned many years. Bulletins and reports that had long served their purpose remained online, with attachments containing personal information about suspects, victims, officers and people who had sent tips. Information-sharing portals accumulate because publishing is a routine task and deletion is nobody’s job.
Retention rules apply here as they do to any record. Agencies should define how long shared material stays available online, then archive or delete it on schedule. A bulletin with operational value for 90 days does not need to sit on an internet-facing server for ten years. Personal data should stay out of broad distribution products unless the purpose requires it. Where it is required, it can go in a restricted attachment with its own shorter retention. Data that is no longer online cannot leak from a web server, and a portal holding one year of material exposes far less than one holding a decade.
Someone has to do the work. Assigning each publishing unit responsibility for reviewing its own content annually, with a report to the platform owner, turns retention from a policy into a practice.
Access built for wide sharing
Information-sharing portals typically serve many users across many agencies. Accounts persist after people change roles or leave, because the portal operator cannot see personnel changes at member agencies. Authentication strength, account review and logging vary by portal. When sensitive material is shared broadly, the weakest account and the least monitored server set the exposure.
Where a portal carries criminal justice information as defined by the FBI’s CJIS Security Policy, that policy sets requirements for access control, authentication and auditing. Agencies should confirm with counsel and their CJIS systems officer whether a given portal is in scope. Not all fusion center material is CJIS information, but treating sensitive shared material to a comparable standard is sound practice. Regular account recertification, with each member agency confirming which of its staff still need access, is a simple control many portals lacked. Logging that records who downloaded what, retained long enough to investigate, is the other half. Without it, agencies cannot tell which documents an intruder actually took.
All three risks share a governance gap. Individual agencies owned their contracts, associations owned the community and vendors owned the infrastructure. Agencies should insist that each shared platform has an accountable owner with authority to set security standards, funding to check them, and a mandate written into the agreements among members. The same pattern exists well beyond law enforcement, in shared portals for emergency management, public health reporting and grant administration.
With hindsight
In early July 2020, German authorities seized a server used by Distributed Denial of Secrets, reportedly at the request of US authorities. Twitter had already suspended the group’s account under its policy on distributing hacked material. Neither step put the documents back; once published, a decade of bulletins stayed public.
The broader risk of shared tools serving many agencies recurred. In 2023, exploitation of the MOVEit Transfer file transfer software affected numerous federal, state and local agencies alongside private organizations. Shared security assessment programs, such as FedRAMP federally and similar programs for state and local governments, expanded. The FBI also modernized its CJIS Security Policy to align more closely with NIST controls, including stronger authentication requirements.