Digital Footprint Audit

Purpose

This audit maps the publicly indexed digital footprint of the Cheyenne River Sioux Tribe across federal agency databases (BIA, IHS, EPA, FEMA, USDA, DOJ, Congress), state government portals (SD Tribal Relations, SD SOS), certificate transparency logs, the Wayback Machine, federal spending databases, court records, and the entity's own web properties.

What can anyone with a search engine learn about your organization in 30 minutes?

Tribal governments occupy a unique position in the digital landscape. As sovereign nations that interact extensively with federal agencies, tribes generate data across dozens of federal systems they do not control. Every grant application, disaster declaration, environmental permit, court filing, and Federal Register notice creates a data point that, when assembled, reveals operational capacity, funding dependencies, infrastructure vulnerabilities, and leadership identities. This audit shows what that assembled picture looks like for the Cheyenne River Sioux Tribe.

Methodology

The following data sources were queried:

• Google Advanced Search (Dorking): Targeted queries across bia.gov, ihs.gov, epa.gov, hhs.gov, doi.gov, doj.gov, house.gov, senate.gov, congress.gov, govinfo.gov, federalregister.gov, and entity domains.
• Wayback Machine CDX API: Historical archive queries on cheyenneriversioux.com, crstgfp.com, and crstepd.org.
• Certificate Transparency (crt.sh): SSL/TLS certificate analysis for all three domains.
• Federal Spending Databases: USASpending.gov, HHS TAGGS, GovTribe, HigherGov, FPDS, SAM.gov.
• Legal Databases: NARF/NILL Tribal Law Gateway, Justia, CourtListener, JudyRecords, Federal Register.
• DNS/Infrastructure Analysis: DNS record queries, security header analysis, hosting platform identification.
• Disaster/Environmental Databases: FEMA, USGS Water Resources, EPA ECHO, EPA Superfund.
• Media Sources: West River Eagle, Indian Country Today, Indianz.com, Native News Online, South Dakota Searchlight, Tribal Business News, congressional testimony transcripts.

Governance & Sensitive Documents

Queries used:

"Cheyenne River Sioux Tribe" filetype:pdf "confidential" OR "internal" OR "not for distribution"
"Cheyenne River Sioux Tribe" filetype:pdf "resolution" OR "compact" OR "charter" OR "MOU"
"Cheyenne River Sioux Tribe" filetype:pdf "agreement" OR "contract" OR "memorandum" site:gov
"Cheyenne River Sioux Tribe" site:bia.gov filetype:pdf
"Cheyenne River Sioux Tribe" site:ihs.gov filetype:pdf
"Cheyenne River Sioux Tribe" site:epa.gov filetype:pdf
"Cheyenne River Sioux Tribe" site:federalregister.gov

#	Document	Hosted On	Risk	Notes
1	CRST Constitution	sdtribalrelations.sd.gov	Low	Full tribal constitution on SD state site, not CRST's own domain
2	CRST/SD Gaming Compact (1993)	bia.gov	Medium	Full gaming compact with operational details on BIA OIG site
3	CRST Joint Powers Agreement	sdsos.gov	Low	UCC filing system agreement with SD SOS
4	CRST Hemp Plan	ams.usda.gov	Low	Full tribal hemp production plan including Resolution No. 113-2020-CR
5	CRST DOT TERO Agreement (signed)	sdtribalrelations.sd.gov	Medium	Signed intergovernmental agreement with officer signatures
6	ACHP Consultation Letter	achp.gov	Low	Historic Preservation correspondence
7	Alcoholic Beverages Control Law	federalregister.gov	Low	Published tribal law, effective June 2023
8	Equitable Compensation Act	congress.gov	Low	$290.7M trust fund for Oahe Dam land takings
9	BIA Seismic Data Basemap	bia.gov	Medium	Geological/seismic survey data — mineral resource intelligence
10	IHS FOIA Population Data	ihs.gov	Medium	FOIA-released population/user data including CRST service area
11	USDA Conservation Reserve Draft PEA	fsa.usda.gov	Medium	Environmental assessment with reservation land use details
12	BIA Self-Governance Compact (#54)	bia.gov	Medium	Self-governance compact document
13	LIHEAP Tribal Plan (2025)	liheapch.acf.gov	Medium	Current tribal plan with operational and financial details
14	BIA FOIA Log (2008)	bia.gov	Medium	FOIA request log — may reveal adversarial intelligence-gathering patterns

Assessment: Medium

Summary: Multiple governance documents are hosted on third-party government sites rather than CRST's own domain. The constitution lives on SD Tribal Relations, the gaming compact on BIA, and the TERO agreement on SD Tribal Relations. No documents marked "confidential" or "internal" were found. The BIA seismic basemap reveals mineral resource data, and the FOIA log could reveal adversarial intelligence-gathering patterns.

Personnel & PII Exposure

#	Document	Hosted On	Risk	Notes
1	BIA Tribal Leaders Directory (CSV)	bia.gov	Medium	Machine-readable CSV with CRST leadership names and contact info
2	ZoomInfo — CRST Employee Directory	zoominfo.com	Medium-High	Data broker aggregating employee names and contact details
3	ZoomInfo — CRST Telephone Authority	zoominfo.com	Medium	Data broker listing Telephone Authority employee details
4	ZoomInfo — CRST Legal Department	zoominfo.com	Medium	Data broker listing Legal Department staff
5	ContactOut — CRST Staff Directory	contactout.com	Medium-High	Second data broker compiling employee contact info
6	RocketReach — CRST Tel. Auth. Org Chart	rocketreach.co	Medium	Management structure and employee names

Assessment: Medium-High

Summary: Three commercial data brokers (ZoomInfo, ContactOut, RocketReach) maintain employee directories for CRST and its sub-entities without the Tribe's control. This enables targeted social engineering against tribal employees. No enrollment rosters or membership lists were found — the most important "clean" finding.

Financial Documents

#	Document	Hosted On	Risk	Notes
1	CRST Federal Award Profile	usaspending.gov	Medium	Complete federal funding history — all awards enumerated
2	GovTribe Vendor Profile	govtribe.com	Medium	Federal contracting profile aggregation
3	HigherGov Awardee Profile	highergov.com	Medium	Third-party award aggregation
4	LIHEAP Agreement (2024)	liheapch.acf.hhs.gov	Medium	Full LIHEAP tribal contract with budget details
5	Chairman LeBeau Congressional Testimony	congress.gov	Low	Testimony citing 85% winter unemployment

Assessment: Medium

Summary: No internal audits, CAFRs, or salary schedules were found exposed. The primary financial exposure is through USASpending.gov (standard for all federal recipients) and two third-party aggregators (GovTribe, HigherGov) that reconstruct the full award portfolio.

Wayback Machine Archive

Domains queried: cheyenneriversioux.com, crstgfp.com, crstepd.org

Metric	Value
Total unique pages archived	1,972
Total unique PDFs archived	561
Earliest snapshot	1998-12-06
Most recent snapshot	2026-02-17
Hosting platforms detected	Wix (primary), taoCMS/PHP (GFP), FrontPage/SHTML (EPD)

Notable archived paths

#	URL	Type	Notes
1	/constitution	Page	Tribal constitution page
2	/codes	Page	Tribal legal codes
3	/resolutions	Page	Council resolutions
4	/arpa-funds	Page	ARPA federal funding tracking
5	taoCMS login (GFP)	Admin	CMS admin login archived — reveals backend technology
6	510 Wix UGD PDFs (cheyenneriversioux.com) — hashed filenames; contents unknown without download
7	47 PDFs (crstgfp.com) — hunting/fishing season regulations, 2010–2022

Assessment: Medium-High

Summary: 561 archived PDFs represent a substantial document recovery corpus spanning 27 years. The primary site's PDFs are stored as Wix hash files, obscuring content but not preventing access. The GFP site's archived CMS admin login reveals backend technology. The EPD site appears dormant since the early 2000s.

Certificate Transparency

Domains analyzed: cheyenneriversioux.com, crstgfp.com, crstepd.org

Property	Value
Total certificates found	30
Issuers	Let's Encrypt, Sectigo, Google Trust Services
Earliest certificate	2023-04-27
Most recent certificate	2026-03-16
Wildcard certs?	No
Renewal pattern	90-day automated (Let's Encrypt)

Subdomains discovered: 4 total (only apex + www for each active domain). No mail, vpn, portal, intranet, dev, or staging subdomains visible.

Key finding: crstepd.org has zero certificates in CT logs — the domain has never served validated HTTPS.

Assessment: Low

Summary: Minimal subdomain surface area. The absence of any service-indicating subdomains means either internal services run on different domains or the tribe has very limited digital infrastructure. The hosting migration visible in certificate issuer changes confirms a platform change in mid-2024.

Funding & Contract Records

USASpending Recipient Profile: usaspending.gov/recipient/0cb2d045-d0b8-4d47-d72d-9d435a395f10-C/latest

Major Awards Identified

#	Record	Amount	Agency	Notes
1	IHS Health Center Construction (ARRA)	$84,500,000	HHS/IHS	New Cheyenne River Health Center
2	Mni Waste Water Treatment Plant	$65,871,293	USDA RD	Largest single award found
3	CRSTTA Telecom Infrastructure Loan	$37,900,000	USDA RUS	Fiber-to-premises buildout
4	Mni Waste North Highway 63 Water	$27,146,000	USDA RD + IHS	Loan + grant
5	CRSTTA ReConnect Broadband	$16,900,000	USDA ReConnect	Fiber to CRST + Standing Rock
6	Treatment Center Construction	$8,700,000	CRST	Substance abuse treatment center
7	CRHA Housing Block Grant	$3,800,000	HUD	IHBG Formula Grant FY2022
8	NTIA Tribal Broadband Connectivity	$2,300,000	Commerce	Subscriber discount program

Subsidiary Entities Discovered

#	Entity	Relationship	Notes
1	Cheyenne River Housing Authority	Housing authority	735 rental + 152 Mutual Help units
2	CRST Telephone Authority	Telecom utility	Est. 1958; $37.9M USDA loan, $16.9M ReConnect
3	Mni Waste Water Company	Water utility	$65.8M+ USDA funding; serves 14,000 members
4	CREDCO	Section 17 economic dev. corp	Operates Lakota Thrifty Mart
5	KIPI Radio (93.5 FM)	Radio station	100kW, FCC-licensed
6	Cheyenne River Casino & Hotel	Gaming enterprise	Major reservation employer
7	CRST Transit	Transit program	FTA Tribal Transit recipient
8	CRST Education Services	Education department	BIA 638 higher education contract

Assessment: High

Summary: $250M+ in identified federal awards across USDA, IHS, HUD, DOJ, DOT, Interior, Commerce, and FEMA. The portfolio is fully reconstructable through USASpending, GovTribe, and HigherGov. Eight subsidiary entities with independent contracting identities expand the public surface area substantially.

Legal & Regulatory Records

Legal Code Exposure

#	Resource	Source	Scope	Notes
1	Tribal Code Index	narf.org	14 titles, 74+ ordinances	Table of contents only — full text restricted (good posture)
2	Tribal Constitution	narf.org	Full constitution & bylaws	Also on SD Tribal Relations
3	Tribal Law Gateway	narf.org	Court opinions index	Appeals opinions from 2001 forward

Key Litigation

#	Case	Court	Significance
1	South Dakota v. Bourland (1993)	U.S. Supreme Court	7-2 against Tribe: Congress abrogated treaty right on 104,420 Oahe Dam acres
2	CRST v. United States (2003–present)	Court of Federal Claims	Moreau River flooding — 25+ year case, last filing Dec 2024
3	CRST v. Trump (COVID checkpoints)	D.C. District	Defended reservation border checkpoints during COVID-19
4	Standing Rock v. USACE (DAPL)	D.C. District	CRST joined as plaintiff-intervenor; NEPA violation found
5	Western Sky/CashCall payday lending	Multiple federal	CRST sovereignty exploited as shield for 90-343% APR loans. $134M judgment.

Assessment: Medium-High

Summary: The Tribe has a substantial legal footprint spanning 60+ years. Tribal code structure is indexed on NARF but full text is restricted — better posture than tribes whose codes are fully published. Litigation is dominated by Oahe Dam takings, sovereignty-era cases, and the Western Sky/CashCall controversy.

Infrastructure & Technical Surface

Domains analyzed: cheyenneriversioux.com, crstgfp.com, crstepd.org

Property	cheyenneriversioux.com	crstgfp.com	crstepd.org
Hosting	Wix	Microsoft Azure	GoDaddy
Domain type	.com	.com	.org
Email provider	None configured	ISP Services / Lakota Network	Microsoft 365
SSL/TLS	Valid (Wix-managed)	Valid	Self-signed (broken)
SPF	No	Yes (strict)	Yes (strict)
DMARC	No	No	No
DKIM	No	No	No
Security headers	HSTS + nosniff	None	None

Assessment: Medium-High

Summary: Infrastructure is fragmented across three entirely separate hosting stacks with no centralized IT governance. The primary tribal website runs on Wix — a consumer-grade site builder — notable for a sovereign government entity. No .gov domain. DMARC absent on all domains. Legacy FTP subdomains exposed on two of three domains.

Disaster & Environmental

FEMA Declarations

#	Declaration	Date	Type	Notes
1	FEMA-4842-DR	2024-11	Severe Storm/Flooding	IA, PA, Hazard Mitigation. SBA loans + IRS relief authorized.
2	EM-3536	2020-03	COVID-19	Tribal-specific emergency declaration.
3	FEMA-4440-DR (SD)	2019-06	Winter Storm/Flooding	State declaration; Dewey/Ziebach counties included.
4	No declaration	2022-12	Winter Storm Elliott	60+ mph winds, -55F wind chills, 1,000+ homes damaged. No federal disaster declaration issued.

Environmental Monitoring

#	Station	Agency	Notes
1	Cheyenne River Near Eagle Butte	USGS	24,235 sq mi drainage; cooperator: CRST
2	Cheyenne River at Cherry Creek	USGS	On-reservation; 23,568 sq mi drainage
3	Moreau River Near Faith	USGS	Federal Priority Streamgage; records since 1944

EPA Records

#	Record	Notes
1	Superfund Site (SDN000802901)	Landfill fire SE of Eagle Butte. Closed — No Further Action.
2	NPDES Permit SD-0020192	Eagle Butte wastewater. EPA directly administers NPDES on reservation.
3	Upstream Superfund Contamination	Elevated arsenic, zinc, mercury from Black Hills mining. Ongoing since 1997.
4	CWA Section 319 Allocation	$70,000 FY2025 nonpoint source funding

Assessment: Medium-High

Summary: Active FEMA disaster declaration with full federal assistance. The December 2022 blizzard (1,000+ homes damaged) received no federal aid — a significant gap. Chronic upstream contamination from Black Hills mining documented for 29 years. USGS operates cooperative streamgages on tribal lands.

Media & Public Narrative

Key Coverage

#	Article	Date	Publication	Key Points
1	CRST October 2025 Motions	2025-10	West River Eagle	FY2026 budget $27M; $8.7M treatment center; TTP reform
2	LeBeau Outlines Vision	2025-05	West River Eagle	Four pillars: renewable energy, healthcare, education, culture
3	CRST Purchases Foster Village	2024-04	SD Searchlight	Acquired 8-acre Children's Village in La Plant
4	Kristi Noem Banned from Reservation	2024-04	ICT News	12-0 council vote
5	Army Corps Recommends Continued DAPL	2025-12	ND Monitor	464-page EIS favors continued operation. CRST opposes.
6	Cannabis Corp Appoints Executive Director	2025	West River Eagle	Summer Rain Afraid Of Hawk appointed

Leadership Identified

#	Name	Role	Notes
1	Ryman LeBeau	Chairman	Elected Nov 2022; NCAI delegate through Nov 2026
2	Harold Frazier	Former Chairman (3 terms)	Lost 2022 election to LeBeau
3	Sharon Vogel	Exec. Director, Housing Authority	Senate Banking testimony
4	Summer Rain Afraid Of Hawk	Marijuana Executive Director	Cannabis Control Corp

Assessment: Low

Summary: Coverage reveals active governance under Chairman LeBeau — not crisis, not steady-state, but deliberate infrastructure buildout. Dominant concerns: land fractionation, federal funding vulnerability from budget cuts, DAPL opposition, and acute social service needs.

Risk Summary

The Cheyenne River Sioux Tribe has an extensive digital footprint driven primarily by its deep interaction with federal agencies. The funding portfolio alone — $250M+ across 8+ subsidiary entities — creates a detailed public picture of organizational structure, operational priorities, and financial dependencies. The legal record spans 60+ years of federal litigation. Infrastructure fragmentation across three hosting platforms with no .gov domain and no DMARC on any domain represents the most actionable near-term gap.

Recommendations

Immediate Actions

1. Request removal from data brokers. File opt-out requests with ZoomInfo, ContactOut, and RocketReach to remove CRST employee directories. These enable social engineering and phishing campaigns against tribal staff.
2. Enable DMARC on all three domains. No domain has DMARC configured, making all three vulnerable to email spoofing. Start with p=none monitoring, then move to p=quarantine.
3. Fix crstepd.org SSL certificate. The Environmental Protection Department domain serves a self-signed certificate. Either install a valid certificate or redirect to the primary domain.
4. Remove legacy FTP subdomains. Both crstgfp.com and crstepd.org have FTP subdomains pointing to live IPs. FTP is unencrypted and should be decommissioned.

Ongoing Monitoring

1. Set a Google Alert for "Cheyenne River Sioux Tribe" filetype:pdf to detect new document indexing on third-party servers.
2. Monitor USASpending recipient profile quarterly — it aggregates all new federal awards and is the primary source for anyone reconstructing the funding portfolio.
3. Review FOIA logs periodically on bia.gov and ihs.gov to detect patterns of adversarial information requests targeting CRST.

Strategic Considerations

1. Consider a .gov domain. The Tribe qualifies for a .gov domain under the Tribal Governments category. A .gov domain provides domain authority, inherent trust signaling, and eligibility for CISA .gov security programs.
2. Host authoritative governance documents on your own domain. The tribal constitution, ordinances, and key agreements should have canonical copies on cheyenneriversioux.com rather than relying on third-party government sites.
3. Consolidate web infrastructure. Three separate hosting stacks with three DNS providers means no single point of IT governance. A unified platform would reduce surface area and simplify security management.

What This Means

Data sovereignty is not only about what data you collect. It is about knowing where your data already lives, who else can find it, and what decisions it enables them to make.

The Cheyenne River Sioux Tribe's digital footprint is not unusual for a large, mature tribal government — but it is substantial. Federal agencies, commercial data brokers, court databases, and the Wayback Machine collectively hold a detailed picture of the Tribe's funding dependencies, leadership identities, infrastructure capabilities, legal history, and environmental vulnerabilities. None of this data was obtained through unauthorized access. All of it is available to anyone with a search engine and 30 minutes.

The question is not whether this data exists — it does, and much of it must exist as a consequence of the Tribe's relationship with the federal government. The question is whether the Tribe knows the full picture, controls the canonical copies, and has a strategy for managing what the assembled data reveals.