Bluesky blocks links to leaked DHS employee records, labels them malicious

What Bluesky blocked and why

Bluesky is preventing users from accessing links to a leaked archive of over 41,000 DHS employee records, redirecting them to a "Blocked Link" page that identifies the URLs as "malicious." The platform did not respond to questions about whether the block was automated or requested by a government agency.

The leaked files, published by the transparency nonprofit Distributed Denial of Secrets (DDoSecrets), include names, work-related contact information, and details about DHS operations, such as surveillance and undercover roles. Bluesky’s decision to block the links—but not individual posts discussing them—reflects its policy of avoiding outright suppression of public discourse while still enforcing rules against sharing personal data.

Bluesky’s community guidelines explicitly prohibit sharing "personal contact info, financial or medical data, or identification documents." However, the platform also protects "factual reporting" on matters of public interest, particularly those related to government transparency. A preview of the leak analyzed by WIRED showed work-related details akin to what might appear on a business card, complicating the moderation decision.

How third-party tools bypass the block

While Bluesky’s website and mobile app block access to the leaked DHS records, at least one third-party app, Klearsky, allows users to open the links without warnings. This gap highlights how Bluesky’s open-protocol model—where outside developers can build their own apps—creates inconsistencies in content moderation.

The leak itself, dubbed "Icepick," was provided to DDoSecrets and journalist maia arson crimew by a group calling itself the Department of Peace. Crimew also built a searchable website for the records, which Bluesky blocks in its official apps. Meanwhile, X’s Grok chatbot actively directed users to the Icepick website, describing it as a "cleaned searchable web tool."

DDoSecrets’ history of platform conflicts

This is not the first time DDoSecrets has faced restrictions on social media platforms. In 2020, Twitter suspended the organization’s account and blocked links to its website following the publication of BlueLeaks, a trove of law enforcement documents. Emma Best, cofounder of DDoSecrets, told WIRED that platforms frequently label their publications as malicious under government pressure, though they cannot ultimately prevent the information from spreading.

Bluesky’s handling of the DHS leak contrasts with its earlier product updates, such as beta support for iPad and profile links for creators, which focused on expanding functionality rather than moderation challenges. The platform’s decentralized nature, which allows external developers to build apps on its protocol, adds complexity to enforcing consistent policies across its ecosystem.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

Bluesky’s decision to block the DHS leak links while permitting discussion about them exposes the tightrope walk platforms face between enforcing privacy rules and enabling transparency. For founders and operators, this case underscores how decentralized networks—while offering flexibility—can create moderation inconsistencies that centralized platforms avoid. The discrepancy between Bluesky’s blocks and Grok’s promotion of the same data also signals how competitors may leverage such leaks for engagement, putting pressure on platforms to clarify their policies. Operators in the transparency or journalism space should note how quickly platforms label leaks as "malicious," even when the content aligns with public-interest reporting.

Related on Lazyfounder

• Bluesky
• X
• Bluesky launches iPad beta support and profile links for creators
• SpaceXAI’s Grok rolls out free tier with caps, reserves advanced features for paid plans