America's immigration cops have pushed back against an official probe that concluded their lax mobile device security potentially put sensitive government information at risk of being stolen by foreign snoops.

Between April 27 and August 17, the US Department of Homeland Security Office of the Inspector General conducted an audit of equipment managed by Immigration and Customs Enforcement (ICE) and the agency's IT policies.

In an October 30 write-up, the inspector general came down hard on the Feds' device management practices, highlighting "urgent issues" on ICE-managed handhelds - including concerns about devices running apps that could be hijacked by foreign adversaries. Think: software linked to or developed within reach of China or Russia, which could be altered or compromised to spy on Uncle Sam.

"Specifically, we found mobile device management issues that put ICE mobile devices - and potentially other [Homeland Security] mobile devices demonstrating similar issues - and sensitive data at greater risk of potential espionage, leaks, and attacks from viruses," wrote Inspector General Joseph Cuffari in a redacted report [PDF].

The investigation found "thousands" of applications installed on ICE-managed devices that had been installed by employees, contractors, and other DHS staff. This included third-party file sharing services and virtual private networks (VPN), outdated messaging platforms, and apps developed by companies banned from US government IT systems.

While we don't know which of these naughty-list apps auditors found on ICE employees phones, it's probably safe to assume one of the offenders was TikTok - banned from US federal government staff and contractors' devices because of espionage concerns, due to the influence the Chinese government can exert over Beijing-based parent ByteDance.

The DHS OIG report added the software it found on the handhelds included "applications associated with [redacted] and [redacted]." We're guessing the redacted names are China and Russia. According to the inspector general, these user-installed apps potentially put ICE's operations, employees, and all of DHS at risk.

"These applications introduce the potential for collecting and monitoring user and device information through device sensors such as a camera, microphone, and Global Positioning System," the report stated. "The applications may also collect and distribute information stored on the device (eg, photos, videos, and documents), including potentially sensitive information outside the secure containers." 

Because ICE considered these downloads to be "personal applications," it didn't monitor them, we're told, despite their presence on the federal agency's devices. To be fair, some of the ICE-approved apps sound equally concerning, such as "one ICE-owned application allows ICE personnel to capture and search biometric information of people they encounter in real-time."

An ICE spokesperson declined to comment on this scanning app, and also did not answer The Register's questions about its last personal-use policy update, which happened in 2014, and if it planned to review the policy more frequently from here on out. 

In a lengthy statement emailed to The Register, an ICE spokesperson said:

The report acknowledged that ICE has implemented some of the auditors' recommendations already to boost device security, such as blocking and disabling prohibited apps, vulnerable messaging applications, and VPN applications. 

"ICE also stated it has taken steps to implement application vetting and is in the process of updating its mobile device use policy," the report says.

Additionally, DHS, in its response to the audit, disagreed that ICE security controls did not reduce the risk to federal mobile devices and their sensitive information. Homeland Security also claimed the percentage of ICE-managed devices that did not have mobile threat defense capability installed is significantly lower than the inspector general's audit number.

While ICE's actions "demonstrate progress," the report concludes that ICE still hasn't fully addressed "risks associated with user-installed applications communicated in this alert." ®

https://www.theregister.com//2023/11/06/ice_device_security/