We obtain takedown notices regularly. They arrive from individuals, lawyers, companies, and governments. This article is part of a sequence anywhere we document how we grip them, the two the regular cases and those that disclose item value discussing publicly.
This request, to obtain downward icepi.cx (now online again at http://icepicx.is/ ) arrived from a business we have no association with, acting for a authorities agency in a nation anywhere we do not operate.
We declined the request.
What happened
The notice describes a doxxing campaign. That is not what the location is.
Doxxing publishes personal particulars concerning personal group so that others can discover them at home. Icepick publishes activity identities of authorities employees. Who they activity for. What their function is. How they can be reached in that role. The data describes group in the exercise of community authority, not in their personal lives. Federal officers carrying out an implementation program are not personal individuals during they are carrying it out. The community has a lawful involvement in knowing who is doing that work, under whose authority, and in which office. Journalists cannot study on an agency whose personnel are structurally unknowable.
We are not pretending the base of the data is comfortable. It came from a breach, and nobody in the dataset chose to be in it. The inquiry we had to answer was narrower: does publishing it assist a intent that a hosting provider should protect? We concluded that it does. The location functions as a citation tool for accountability reporting by journalists and citizens, and that is a use we be to keep online. This is why we declined the take-down request.
Why this matters
An automated takedown notice does not eliminate the activity of checking whether an allegation is true. It moves that activity to the recipient. We made that item concerning a false allegation from a German constabulary authority, and it holds current alongside a distinct agency, a distinct country, and a distinct benevolent of claim.
ZeroFox finds applicant matter through AI-driven detection. Whether a stated location is accountability reporting or a harassment run is exactly the judgement that finding cannot make. Someone has to peruse the site, appearance at the dataset, and measure community involvement against individual hazard and this dawn that person was us.
This case adds item to that. The gathering accusing us and the gathering contacting us are no longer the same. We cannot see who inner ICE decided this location should go, whether anyone did, or what they were shown before deciding. We are being asked to validate a assertion whose author we cannot identify.
As a endeavor model, none of this is new. Copyright has worked this way for decades. A personal business sells monitoring to entitlements holders, scrapes for matches, sends petition alphabet automatically, and takes a portion of any recipients pay to create the alphabet stop. Volume is the product. Checking is a disbursal against it. Plenty has been written concerning what that does to lawful speech, and most of it transfers to what arrived in our inbox this morning.
What has changed is the client. In this case its a governmental institution, not a personal company. DHS signed a $15 myriad agreement alongside ZeroFox in July 2026 covering ICE and Homeland Security Investigations, and the business can document on the department’s behalf until 2028. The Intercept reported on a leaked memo describing the program internally as a “Doxing Mitigation Initiative,” and quoted an ICE authoritative who concerned it could be turned on whistleblowers and critics inner the agency fairly than on threats from exterior it. ZeroFox additionally has form. In 2015 it classified peaceful Black Lives Matter organisers in Baltimore as “threat actors” warranting uninterrupted monitoring, partially on the power of their follower counts. The FBI hired the business anyway in 2021.
Validation by the recipient is no longer a flank consequence of a seriously built process. It is part of what the assistance sells. Finding politically and journalistically applicable data is the product, removing it is the deliverable, and the figure of notices submitted is the measure of success.
What happened to the site?
By mid-morning, icepi.cx no longer resolved. Its registrar, CentralNic, had placed the domain on serverHold.
Our refusal kept nothing online. The petition that decided the outcome to obtain the location downward was not the one sent to us. A registrar reached the contrary decision the identical morning, published nothing, and a earth spectators misplaced admission to the site. In the meantime the location is online again under a domain from a distinct registrar (http://icepicx.is/)
What have to be done concerning this
As we depict in our former article, law akin the DSA loads obligations onto hosting providers and asks nothing of the group who document notices.
This case demonstrates what can happen formerly filing becomes a business assistance accessible to governmental organisations.
Anyone filing a takedown notice on another party’s behalf should have to province who they act for, under what lawful basis, and who is accountable if the assertion is wrong. Where a notice was produced by automated detection, that have to be declared on its face. A provider cannot measure a assertion correctly without knowing whether a individual always looked at it.
Removals at the register and registrar flat need the the identical scrutiny.
Enforcement against genuinely harmful satisfied is a lawful goal, and protecting individuals from harassment is a genuine one. But a scheme anywhere an agency can buy removals through a contractor, anywhere the contractor is perchance paid by volume, and anywhere the quickest path runs through infrastructure nobody is watching, akin the registrar in this case is not a scheme for stopping harassment. It is a scheme for making inconvenient data disappear.
What others compose concerning this case
https://subscriber.politicopro.com/article/2026/10/ice-dhs-leak-takedown-request-01140645
