Digital Footprint Audit

Purpose

This audit maps the publicly indexed digital footprint of the Crow Creek Sioux Tribe across federal agency databases (BIA, IHS, EPA, HHS, DOJ, DOI, FEMA, USDA), certificate transparency logs, the Wayback Machine, federal court records, USASpending, and the entity's own web properties.

What can anyone with a search engine learn about your organization in 30 minutes?

For a federally recognized tribe, the digital footprint extends far beyond the tribal website. Every federal grant, disaster declaration, gaming compact, court filing, and NAGPRA consultation creates a public record on a server the tribe does not control. This audit maps those records so the tribe can understand what picture they create when assembled.

Methodology

Data sources queried across 8 parallel research vectors:

Governance & Sensitive Documents

Assessment: MEDIUM

Summary: The most critical finding is the apparent compromise of hunkpatioyate.org. Governance documents are distributed across servers the tribe does not control. No internal or confidential documents were found exposed.

Personnel & PII Exposure

Assessment: MEDIUM

Summary: No member enrollment data or salary schedules found. ContactOut scraping is the primary PII concern.

Financial Documents

Assessment: MEDIUM

Summary: No internal budgets or salary schedules found. Federal funding portfolio is substantially reconstructable through public databases.

Wayback Machine Archive

Assessment: LOW

Summary: Modest archived footprint with only 1 PDF. Community directory and phonebook remain accessible in archive.

Certificate Transparency

Subdomains Discovered

Assessment: MEDIUM

Summary: Four domains across four hosting providers and three CAs. Exposed cPanel subdomains represent a notable attack surface.

Infrastructure & Technical Surface

Key findings:

• No .gov or .nsn.gov domain despite federal recognition eligibility
• No DKIM records on any domain
• Primary site stale since December 2025
• crowcreekenrollment.com appears to be a personal WordPress.com account
• 13 subdomains discovered across all domains

Assessment: MEDIUM-HIGH

Summary: Fragmented web presence across four hosting platforms with no centralized IT governance. Consistent with ad-hoc IT managed by multiple individuals.

Funding & Contract Records

USASpending Recipient Profile: CROW CREEK SIOUX TRIBE (UEI: W83DYN8U2A21 | CAGE: 1QN83)

Subsidiary entities: Crow Creek Housing Authority, Lode Star Casino, Native American Telecom LLC, Big Bend Farm Corp, Hunkpati Processors, Hunkpati Investments (CDFI), Harvest Initiative, CCST Environmental Programs, Guided Hunting

Assessment: MEDIUM-HIGH

Summary: Federal funding portfolio reconstructable. Annual federal inflow likely $5-10M from formula programs alone, plus episodic discretionary awards. Nine subsidiary entities expand the footprint.

Legal & Regulatory Records

Legal Code

Key Litigation

Assessment: LOW

Summary: Tribal code withheld by choice — a deliberate exercise of data sovereignty. Litigation is typical of a Missouri River tribe. No adverse regulatory findings.

Disaster & Environmental

FEMA Declarations (Tribal-Specific)

County-level: 15+ additional declarations for Buffalo County (1969–2024), including 2024 1,000-year flood (FEMA-4807-DR).

Tribal environmental monitoring: 2 water quality stations (STORET), 10 real-time air quality sensors, active brownfield program with EPA Region 8.

Assessment: MEDIUM-HIGH

Summary: Substantial disaster history dominated by flooding and storms. Nearly all declarations provide only PA (not IA). Tribe operates own environmental monitoring, more sophisticated than many comparable tribes.

Media & Public Narrative

Leadership: Chairman Peter Lengkeek (since 2020; DV/SA Prevention Specialist, NIWRC speaker)

Assessment: MEDIUM

Summary: Public safety crisis plus economic diversification. Chairman Lengkeek is the sole consistent public voice. No council minutes published online.

Risk Summary

Recommendations

Immediate Actions

1. Investigate hunkpatioyate.org — The domain appears compromised. Audit the WordPress database for exposed enrollment data and community directory records. Secure or reclaim immediately.
2. Request removal from ContactOut — Tribal employee data is being scraped and resold. Submit a removal request and harden DMARC/SPF.
3. Add DKIM records — No domain currently has DKIM. This enables email spoofing.
4. Secure cPanel subdomains — cpanel., webmail., and webdisk. on hunkpatioyate.org are publicly exposed.

Ongoing Monitoring

1. Set up Google Alerts for "Crow Creek Sioux Tribe" to track new third-party documents
2. Monitor crt.sh for unexpected certificate issuance
3. Periodically check Wayback Machine for newly archived sensitive content

Strategic Considerations

1. Apply for a .gov domain — Eligible as a federally recognized tribe; significantly higher trust authority
2. Consolidate web infrastructure — Four domains on four platforms creates unnecessary attack surface
3. Understand USASpending exposure — The entire federal funding portfolio is publicly reconstructable

What This Means

Data sovereignty is not only about what data you collect. It is about knowing where your data already lives, who else can find it, and what decisions it enables them to make.

The Crow Creek Sioux Tribe's digital footprint is primarily written by federal agencies — BIA, HUD, FEMA, EPA, USDA, DOJ — on servers the tribe does not control. Every grant award, disaster declaration, gaming compact, and court filing adds to a publicly readable profile that reveals the tribe's budget, infrastructure vulnerabilities, legal framework, and organizational structure.

Understanding this footprint is the first step toward managing it.