Joe Toomey

Head of Security Engineering @SolveCyberRisk. Former Carbon Black.
| Infosec | Algorithms wonk | Data at Scale | Volleyball | ENFP | My Opinions | He/him

[Joe Toomey @jptsetme]

Verifying myself on Mastodon; I'm
https://t.co/LweWhDqV2R

[katya schwenk @ktyschwnk]

After an obscure defense vendor won a $12 million no-bid contract w/ ICE, I noticed something odd on its website: The firm was using a (still watermarked!) stock photo for the chief of its “development team.”

Things only got more bizarre from there…

[Joe Toomey @jptsetme]

If you haven’t built a cooldown window into your package manager use in both CI and dev tooling, today is the second best time to do it!

[Brian Allen @allenanalysis]

JUST IN: A Trump judicial nominee was asked point blank: is Trump eligible to run for a third term?

Their answer: “I would have to review the actual wording…”

Sen. Chris Coons then asked every nominee in the room to confirm the Constitution bars a third term.

Silence.

Every single one of them refused to say it.

Trump is appointing judges who won’t affirm the 22nd Amendment to his face.

Never stop connecting the dots.

[Joe Toomey @jptsetme]

@HostGator Here's @watchtowrcyber 's blog
https://t.co/mVcwPcGmB5

And cPanel's release note: https://t.co/aVMJC2VaaL

[Joe Toomey @jptsetme]

@blaboratoryuehost, @hostgator We've identified thousands of vulnerable cPanel systems on your infrastructure 24+ hours after patch availability — are you aware and do you have a timeline?

[Joe Toomey @jptsetme]

@HostGator It's not abuse, it's (thousands of) vulnerable cPanel installations that you are hosting and are responsible for patching (as many/most of your competitors did already).

Context to share with your team if they are somehow unaware:

https://t.co/xFtoLOlRlI

[Joe Toomey @jptsetme]

@inmotionhosting @InMotion_cPanel We've identified thousands of vulnerable cPanel systems on your infrastructure 24+ hours after patch availability — are you aware and do you have a timeline?

[Joe Toomey @jptsetme]

@TheNotARubicon @robertgraham This is great but really needs some spinning back-fist. Run it all again in MAX mode.

[Joe Toomey @jptsetme]

@ssimonsen0202 @BertJanCyber No insurance. They chose not to purchase it.

https://t.co/M1x5bZKgLk

[Joe Toomey @jptsetme]

@bbaskin @facebook I haven’t updated the app lately and this confirms that I won’t be anytime soon.

[Mark Bland @markbland]

Ooh this is bad. A STAND DOWN ORDER on the investigation of Renee Good from FBI DIRECTOR Kash Patel!

Documented proof it happened. This Dept of Justice is not working in “good faith” for the American people. That is their job.

[Meredith Whittaker @mer__edith]

I read it. And I'll engage here in good faith. But before I get into substance, I implore you to open the window, touch grass, and let yourself connect with the reality of what’s happening right now. This is a world historical moment. Please recognize what ICE is at this time, what it’s doing, and what it really means for your company, Palantir, to be supporting them with targeting and surveillance technologies that aid their attacks on freedom, liberty, and the constitution.

Now to the substance of your post. I’ll address the three key claims you make in defense of your work with ICE:

1. The post spends a lot of time pushing back on the claim that Palantir is building a “master database.” But in my view this is a red herring. It’s an easy claim to rebut. For one, because there’s no technical definition of “master database” and whether you are building one or not is beside the point. Indeed, injecting multiple data sources from disparate databases that are then processed and synthesized by your system doesn’t require One Big Database. The effect—synthesizing data in service of creating target lists of people in the US—is the same, whether or not this is All of the Data. And that’s the problem, not the size and the scope of a given database.

2. On claims that ICE is using Palantir’s ELITE tool—which shows ICE a map with addresses and other information about people to deport or otherwise menace—you claim that this is not “the purpose of this tool.” I can only read this pushback as cringe ‘neutrality washing.’ Especially in the context of the current moment, it takes a lot of contorting to say this as if it exculpates you. There are hundreds of court orders being disobeyed by ICE; people are being summarily shot in the street and otherwise menaced and brutalized for exercising basic constitutional rights—the first amendment high on the list. Not to mention that whatever the tools’ ‘purpose’ as your engineers imagined it at a whiteboard in a clean office somewhere, 404 media reports ICE officers discussing their use of the tool in exactly the way you say it’s not meant to be used. It also seems clear that many at your company know this, and are upset about it, as recent whistleblowing revealing internal dissent about contracts with ICE shows.

3. Similarly, you point to your tool’s “indelible audit log” as a feature that makes it, implicitly, more safe and lawful. But, just like body cams, the question is not whether it has this audit capacity. The question is what mechanisms exist to ensure this capacity is used to discipline misuse? Whom, in particular, can access such a log? Who’s auditing? God? The referee? In the context of the evidenced lawlessness, and lack of accountability, this reads as an almost intellectually insulting claim.

Again, this is a grim and critical moment. I know you and a lot of people are probably scared, feeling some “am I the baddie?” tremors at the level of your core identity. I know this is hard! But as someone who claims to love privacy and liberty, I invite—implore!—you to find the courage of your convictions and at least sit quietly and consider what this work is really supporting.

[Jesus Freakin Congress @TheJFreakinC]

🚨BREAKING: ICE/Border Patrol are now pistol-whipping 16-year-olds and smashing their heads into the curb.

In the video, an agent illegally tries to detain an unaccompanied minor, in Long Beach, California.

The child has his hands in the air.

An agent runs up and hits him in the head with a pistol. Then two agents tackle him and force his head down against the curb.

After the child is already on the ground, pinned by two armed adults, another agent brings out a K9, for what reason exactly?

Then one agent puts his knee on the child’s neck while another handcuffs him, even though he’s not resisting at all.

Unaccompanied minors are supposed to be handled through child-welfare procedures, not slammed into concrete by armed agents.

Using a gun as a weapon is deadly force. You don’t get to use deadly force on a child who is standing still with his hands up. And putting a knee on someone’s neck while they’re restrained is a textbook violation of use-of-force rules and basic constitutional rights.

ICE/Border Patrol agents are brutalizing people for sport, they are executing people because they can, trafficking children, and if they aren’t stopped no one will be safe.

[Covie @covie_93]

Everyone in this photo was pardoned by trump except the unconscious cop who Republicans blame for the attack.

[Steve Peoples @sppeoples]

ICE agents initially claimed Mondragón had tried to flee while handcuffed and “purposefully ran headfirst into a brick wall.”

But staff members at Hennepin County Medical Center determined that could not possibly account for the fractures and bleeding throughout the man’s 31-year-old’s brain. ... A CT scan revealed at least eight skull fractures and life-threatening hemorrhages in at least five areas of his brain.

Mondragón entered the U.S. in 2022 with valid immigration documents. Minnesota incorporation filings show he founded a company called Castaneda Construction the following year with an address listed in St. Paul. He appears to have no criminal record.
https://t.co/IpO4pBmATe

[Jesus Freakin Congress @TheJFreakinC]

🚨BREAKING: ICE agents pulled guns on an unarmed U.S. citizen in a small Minnesota town… then had to be stopped by the local police chief.

This happened in St. Peter, Minnesota. A quiet southern Minnesota town

A local woman was alone in her car, observing and recording ICE activity in her community. She is doing something that is fully protected under the First Amendment… observing and documenting federal agents in public.

ICE notices her watching.

Three federal vehicles begin chasing her, and try to force her to pull over.

They eventually box her car in and three agents jump out of the vehicle in front of her… with their guns drawn… screaming at her to get out of the car.

She refuses, and states her rights.

The agents open her car door anyway, drag her out, force her to the ground, and handcuff her.

This is all happening while she is unarmed, and alone on a country road.

She suffers cuts, scrapes, and bruises as they pin her down.

Her husband then arrives and starts recording. He tells them they don’t have a warrant and cannot search her car. An ICE agent dismisses him outright and says, “I’m not getting into the legality of everything.”

Read that again.

A federal agent, pointing guns at civilians, openly says they are not concerned with legality.

ICE puts this woman into their vehicle and starts driving her toward the Twin Cities, toward a federal detention facility… even though she is a U.S. citizen.

About twenty minutes into the drive, they suddenly turn around after getting a call from a supervisor.

The St. Peter police chief stepped in.

After her husband contacted an attorney and spoke with the police chief, the chief identified the vehicle ICE was using, took custody of the woman, and personally drove her home.

ICE turned her over to local police because what they were doing was so clearly wrong.

This is what is happening in America.

A small-town police chief had to intervene to stop federal agents from disappearing an unarmed woman for observing them.

If ICE feels comfortable pulling guns on unarmed citizens in small towns, chasing them, throwing them to the ground, and ignoring the law entirely, then no town is too small and no one is safe from ICE brutality.

This is what it looks like when federal agents think they’re above the Constitution.

[JD Vance @JDVance]

Remember when we learned that our wealthiest and most powerful people were connected to a guy who ran a literal child sex trafficking ring? And then that guy died mysteriously in a jail? And now we just don't talk about it.

[Joe Toomey @jptsetme]

@4WhomJBellTolls IMO, similar, not identical play, ruled an interception in 2024: https://t.co/xfHTa3Zl8X

[Joe Toomey @jptsetme]

@pucksnplates @KDPomp @JRown32 It does matter. Two things can be true at the same time.

1. DK should be suspended. No question
2. The league should thoroughly investigate what the fan said and did, and the fan should be barred from future games if he did what DK said.