Contents
- Purpose
- Methodology
- Governance & Sensitive Documents
- Personnel & PII Exposure
- Financial Documents
- Wayback Machine Archive
- Certificate Transparency
- Funding & Contract Records
- Legal & Regulatory Records
- Infrastructure & Technical Surface
- Disaster & Environmental
- Media & Public Narrative
- Risk Summary
- Recommendations
- What This Means
Purpose
This audit maps the publicly indexed digital footprint of the Turtle Mountain Band of Chippewa Indians across federal agency databases (BIA, IHS, EPA, HHS, DOJ, USDA, HUD, NTIA, Treasury, FEMA), state records (North Dakota), certificate transparency logs, the Wayback Machine, and the entity's own web properties.
What can anyone with a search engine learn about your organization in 30 minutes?
For a sovereign tribal nation, the digital footprint extends far beyond the official website. Federal agencies, state governments, courts, and third-party databases publish governance documents, funding records, legal codes, environmental data, and disaster declarations — often without the tribe's awareness or control. This audit reveals the full scope of what is publicly discoverable.
Methodology
The following data sources were queried:
- Advanced search operators targeting BIA, IHS, EPA, HHS, DOJ, DOI, Congress, GovInfo, Federal Register, and tmchippewa.com
- Wayback Machine CDX API for historical archive analysis of tmchippewa.com
- Certificate Transparency logs (crt.sh) for subdomain discovery
- USASpending API, HHS TAGGS, GovTribe for federal funding records
- NARF/NILL, Justia, CourtListener, JudyRecords for legal records
- DNS interrogation (A, MX, NS, TXT, CNAME) and HTTP header analysis
- FEMA disaster declarations, USGS monitoring data, EPA facility records
- News search across general media, tribal media (Indianz, ICT News, Native News Online), and Federal Register
No authenticated or unauthorized access was performed or attempted.
Governance & Sensitive Documents
Queries used
"Turtle Mountain Band of Chippewa" filetype:pdf "confidential" OR "internal" OR "not for distribution"
"Turtle Mountain Band of Chippewa" filetype:pdf "resolution" OR "compact" OR "charter" OR "MOU"
"Turtle Mountain Band of Chippewa" site:bia.gov filetype:pdf
"Turtle Mountain Band of Chippewa" site:federalregister.gov OR site:govinfo.gov
site:tmchippewa.com filetype:pdf| # | Document | Hosted On | Risk | Notes |
|---|---|---|---|---|
| 1 | Tribal Constitution 2015 | tmchippewa.com | Low | Full tribal constitution on own domain |
| 2 | Title 32 TERO Ordinance | tmchippewa.com | Low | Employment rights ordinance on own domain |
| 3 | Council Resolution 1042-03-24 | law.tmchippewa.com | Low | Adopted resolution via tribal law library |
| 4 | Tribal-State Gaming Compact (2022) | bia.gov | Medium | Full Class III gaming compact with ND on BIA site |
| 5 | Gaming Compact (1999 Original) | bia.gov | Medium | Original compact; notes confidential gaming records |
| 6 | Constitution & Bylaws | indianaffairs.nd.gov | Medium | Full constitution on ND state domain |
| 7 | BJA COSSAP Narrative | bja.ojp.gov | Medium | DOJ grant narrative detailing substance abuse operations |
| 8 | Complete Tribal Code Index | narf.org | Low | Full 25+ title tribal legal code on NARF |
Assessment: Medium
Significant governance documents are indexed across multiple third-party domains (bia.gov, indianaffairs.nd.gov, narf.org, govinfo.gov). The full tribal constitution, gaming compacts, and grant narratives are hosted on federal and state sites outside the tribe's control. No documents marked "confidential" or "not for distribution" were found exposed.
Personnel & PII Exposure
Queries used
"Turtle Mountain Band of Chippewa" filetype:csv OR filetype:xlsx "member" OR "enrollment" OR "employee"
"Turtle Mountain Band of Chippewa" filetype:pdf "staff list" OR "phone directory" OR "org chart"| # | Document | Hosted On | Risk | Notes |
|---|---|---|---|---|
| 1 | WAU Landowner List (Feb 2020) | tmchippewa.com | HIGH | Names and account numbers of landowners |
| 2 | WAU Landowner List (Dec 2020) | tmchippewa.com | HIGH | Second WAU list with individual PII |
| 3 | ContactOut Company Profile | contactout.com | Medium | Third-party scraper exposing staff data |
| 4 | ContactOut Email Format | contactout.com | Medium | Reveals email format: {first_initial}{last}@tmchippewa.com |
| 5 | UserTimesheet.pdf | tmchippewa.com | Medium | Timesheet template on public uploads |
Assessment: HIGH
Two "Whereabouts Unknown" (WAU) landowner lists on the tribe's WordPress uploads directory contain individual names and account numbers. This is personally identifiable information exposed at publicly indexed, predictable URLs. The ContactOut scraper site has harvested the tribe's email naming convention, enabling targeted phishing.
Financial Documents
| # | Document | Hosted On | Risk | Notes |
|---|---|---|---|---|
| 1 | CRRSA 60-Day Report | acf.gov | Medium | COVID relief spending detail |
| 2 | FTA Transit Profile | transit.dot.gov | Medium | Operating expenditure: $242,324 |
| 3 | Treasury CRF Desk Review | oig.treasury.gov | Medium | $32.3M CRF expenditures; documentation questioned |
| 4 | DOI OIG Audit | oversight.gov | Medium | $216,878 questioned; 2 open recommendations |
Assessment: Medium
Financial exposure is primarily through federal spending reports and OIG reviews. No comprehensive tribal budget or CAFR documents were found.
Wayback Machine Archive
| Metric | Value |
|---|---|
| Total unique pages archived | 10,419 |
| Total unique PDFs archived | 190 |
| Earliest snapshot | 2018-06-30 |
| Most recent snapshot | 2026-02-02 |
| Hosting platform | WordPress (Divi theme, 22 plugins) |
The archive contains a near-complete set of the tribal code (Titles 1-58) as individual PDFs, plus constitutional documents, COVID-era emergency orders, ARPA subgrant forms, internal investigation statements, MOUs, and employment applications. Documents that may no longer be accessible on the live site remain permanently archived.
Assessment: Medium-High
Certificate Transparency
| Property | Value |
|---|---|
| Certificate issuer(s) | Let's Encrypt (E7), Amazon RSA 2048 M02 |
| Earliest certificate | 2018 |
| Most recent certificate | 2026-04-06 |
| Wildcard certs | Yes — *.law.tmchippewa.com + sub-environment wildcards |
Subdomains Discovered
| # | Subdomain | Purpose | Notes |
|---|---|---|---|
| 1 | www.tmchippewa.com | Main site | WordPress.com / Automattic |
| 2 | law.tmchippewa.com | Tribal court / legal system | AWS CloudFront, Open Law Library |
| 3 | analytics.law.tmchippewa.com | Legal platform analytics | GoatCounter (privacy-respecting) |
| 4 | *.beta.law.tmchippewa.com | Beta environment | SDLC environment for legal platform |
| 5 | *.development.law.tmchippewa.com | Development environment | SDLC environment for legal platform |
| 6 | *.preview.law.tmchippewa.com | Preview/QA environment | SDLC environment for legal platform |
Assessment: Low
Certificate data reveals a competent split-infrastructure approach with WordPress.com for the public site and a professionally engineered Open Law Library deployment on AWS. Self-hosted GoatCounter analytics indicates intentional data governance. The .com domain lacks the trust signal of .gov or .nsn.gov.
Funding & Contract Records
USASpending Recipient Profile
Parent: $63,773,482 across 277 transactions
Child: $45,758,180 across 162 transactions
HHS TAGGS: Dedicated recipient profile
Major Awards
| # | Program | Amount | Agency |
|---|---|---|---|
| 1 | Water Line Replacement | $12,789,040 | DOI/Bureau of Reclamation |
| 2 | Water Infrastructure (BIL) | $5,100,000 | USDA |
| 3 | Public Utilities Commission | $4,000,000 | USDA |
| 4 | Head Start | $3,256,259 | HHS/OHS |
| 5 | Tribal Broadband Connectivity | $2,713,979 | DOC/NTIA |
| 6 | Heritage Center | $1,550,000 | USDA/RD |
| 7 | EPA Brownfields (IIJA) | $1,000,000 | EPA |
| 8 | EPA Brownfields (Dunseith) | $500,000 | EPA |
| 9 | Proposed: Rural Water System | $98,000,000 | DOI/BOR |
Subsidiary Entities (12+)
| # | Entity | USASpending Total | Notes |
|---|---|---|---|
| 1 | Turtle Mountain College | $17,943,661 | Tribal land-grant institution |
| 2 | TM Housing Authority | $11,312,610 | IHBG + HUD-VASH |
| 3 | TM Public Utilities Commission | $1,474,776 | Water/wastewater |
| 4 | TM Recovery Center | $173,800 | Behavioral health |
| 5 | TM Manufacturing Company | — | 100-160 employees |
| 6 | Sky Dancer Casino & Resort | — | 700 slots, 300 employees |
Assessment: HIGH
The tribe's entire federal funding portfolio ($63.8M+ across 277 awards) is fully reconstructable via publicly available USASpending data. A network of 12+ subsidiary entities — each with independent UEIs — creates substantial additional surface area. Funding sources span 8+ federal agencies.
Legal & Regulatory Records
Legal Code Exposure
| # | Resource | Source | Scope |
|---|---|---|---|
| 1 | Complete Tribal Code | narf.org | 25+ titles: criminal, civil, evidence, elections, gaming, housing, etc. |
| 2 | Tribal Constitution (14 articles) | narf.org | Amended 2015; also on tmchippewa.com |
| 3 | Court of Appeals Opinions | narf.org | Spanning 1989-2012 |
Significant Litigation
| # | Case | Forum | Status | Notes |
|---|---|---|---|---|
| 1 | TMBCI v. Howe (VRA) | U.S. Supreme Court | Cert petition Sept 2025 | Landmark VRA private right of action |
| 2 | Peltier v. Haaland | D.D.C. | Resolved | $59M Pembina settlement; TMBCI share $6.85M |
| 3 | Brakebill v. Jaeger | D.N.D. | Settled 2020 | Consent decree for tribal ID acceptance |
Regulatory Filings
| # | Filing | Source | Notes |
|---|---|---|---|
| 1 | NIGC Enforcement (2023) | nigc.gov | Gaming licensing violations; settled June 2023 |
| 2 | USDA Hemp Plan | ams.usda.gov | Approved tribal hemp regulation |
| 3 | Gaming Compact | bia.gov | Class III compact with ND |
| 4 | NAGPRA Repatriation | federalregister.gov | Sacred objects from UND |
Assessment: Medium-High
One of the most complete publicly readable legal frameworks of any tribe. The tribe is lead plaintiff in a potentially landmark SCOTUS case on VRA enforcement. The 2023 NIGC enforcement action was resolved via settlement.
Infrastructure & Technical Surface
DNS Configuration
| Record | Value | Significance |
|---|---|---|
| A | 192.0.78.239, 192.0.78.163 | Automattic (WordPress.com) |
| MX | tmchippewa-com.mail.protection.outlook.com (pri 0), aspmx.l.google.com (pri 1-10) | Dual email: Microsoft 365 + Google |
| NS | ns1/ns2/ns3.wordpress.com | DNS delegated to WordPress.com |
| SPF | v=spf1 include:spf.protection.outlook.com include:_spf.wpcloud.com -all | Google not authorized in SPF |
| DMARC | v=DMARC1;p=none | Monitor-only, no enforcement |
| DKIM | Selectors CNAME to apex | Misconfigured — not functional |
Infrastructure Profile
| Property | Value |
|---|---|
| Hosting platform | WordPress.com (Automattic managed hosting) |
| Domain type | .com (not .gov or .nsn.gov) |
| Email provider | Microsoft 365 (primary) + Google Workspace (secondary) |
| Legal platform | Open Law Library on AWS CloudFront |
| Analytics | GoatCounter (privacy-respecting) |
| Security headers | Partial — HSTS present; no CSP, no X-Frame-Options |
Assessment: Medium
DKIM selectors are misconfigured, DMARC is unenforced (p=none), and dual MX records with an SPF that only authorizes Outlook create risk of the domain being spoofable.
Disaster & Environmental
FEMA Declarations
| # | Declaration | Date | Type | Assistance |
|---|---|---|---|---|
| 1 | FEMA-4323-DR | 2017-07-12 | Flooding | PA, HM |
| 2 | FEMA-4444-DR | 2019-06-12 | Flooding | IA, PA |
| 3 | FEMA-4475-DR | 2020-01-21 | Flooding | PA |
| 4 | FEMA-4686-DR | 2023-02-05 | Winter storm | PA |
| 5 | FEMA-4717-DR | 2023-07-05 | Flooding | IA, PA |
| 6 | FEMA-4760-DR | 2024-02-15 | Winter storm | IA, PA |
Additional: May 2025 wildfire complex (~4,200 acres, ND National Guard deployed).
Environmental
| # | Facility | Agency | Notes |
|---|---|---|---|
| 1 | Shell Valley Aquifer | USGS | Sole drinking water; ~50% exceed secondary MCLs |
| 2 | Gordon Lake monitoring | TM Environmental Office | Biological + nutrient data since 2001 |
| 3 | San Haven Brownfields | EPA | $2M+ cumulative cleanup; asbestos, lead, PCBs |
Assessment: Medium-High
Six FEMA declarations since 2017 demonstrate persistent hazard exposure. The Shell Valley aquifer — sole drinking water source — has elevated contaminant levels. San Haven brownfields remediation is ongoing.
Media & Public Narrative
| # | Coverage | Date | Significance |
|---|---|---|---|
| 1 | Emergency plan amid shutdown | 2025-10 | T-SNAP for 4,100+ SNAP recipients |
| 2 | $300M casino proposal | 2025-01 | 800 jobs; inter-tribal opposition from Spirit Lake |
| 3 | Leonard Peltier homecoming | 2025-02 | 500+ people; national media attention |
| 4 | SCOTUS VRA case | 2025-07 | Landmark voting rights — stay granted |
| 5 | Autonomy push at G2G | 2025-06 | Chairman Azure advocating for less federal dependency |
Leadership
| Name | Role | Source |
|---|---|---|
| Jamie Azure | Chairman (since Jan 2018) | Native Governance Center |
| Darryl LaCounte | Enrolled member; former BIA Director | ICT News |
Assessment: Low
Active growth-and-defense posture: $300M casino project, autonomous T-SNAP program, SCOTUS voting rights case. Chairman Jamie Azure is the visible decision-maker.
Risk Summary
Scorecard
| Category | Assessment |
|---|---|
| Governance & Documents | Medium |
| Personnel & PII Exposure | HIGH |
| Financial Documents | Medium |
| Wayback Archive | Medium-High |
| Certificate Transparency | Low |
| Funding & Contracts | HIGH |
| Legal & Regulatory | Medium-High |
| Infrastructure | Medium |
| Disaster & Environmental | Medium-High |
| Media & Narrative | Low |
The Turtle Mountain Band of Chippewa Indians has one of the most comprehensive publicly indexed digital footprints of any tribal entity in the Northern Plains. Across federal databases, the tribe's governance structure, legal code, funding portfolio, environmental history, and litigation posture are fully discoverable and largely reconstructable from public sources.
Recommendations
Immediate Actions
- Remove or restrict WAU landowner lists — Two PDFs on tmchippewa.com contain individual names and account numbers at publicly indexed URLs.
- Fix DKIM configuration — The selector CNAME records loop to the apex domain instead of Microsoft's DKIM infrastructure.
- Enforce DMARC policy — Move from p=none to p=quarantine or p=reject to prevent domain spoofing.
- Request removal from ContactOut — The scraped email format enables targeted phishing.
- Reconcile dual MX records — SPF only authorizes Outlook, but Google MX records are present.
Ongoing Monitoring
- Audit WordPress uploads directory — Review all files under /wp-content/uploads/ for sensitive documents.
- Monitor USASpending and TAGGS profiles — Understand what competitors can reconstruct from public funding records.
- Track Wayback Machine crawls — 190 PDFs are permanently archived including draft documents and internal statements.
Strategic Considerations
- Evaluate .gov or .nsn.gov domain — A government domain provides stronger identity assurance for a sovereign entity.
- Consolidate legal code publishing — The Open Law Library platform appears to be the strategic direction; consolidating away from NARF and raw PDF uploads would improve version control.
- Data sovereignty posture — The tribe already demonstrates strong choices (GoatCounter, Open Law Library). Extending this to email and document hosting would strengthen the position.
What This Means
Data sovereignty is not only about what data you collect. It is about knowing where your data already lives, who else can find it, and what decisions it enables them to make.
The Turtle Mountain Band of Chippewa Indians' digital footprint spans federal agency databases, state records, certificate transparency logs, historical web archives, and third-party data aggregators. Much of this is the expected result of a large, active tribal government participating in federal programs. But the aggregation of these records — funding portfolios, legal codes, environmental compliance, disaster history, personnel information — creates a composite picture that no single disclosure was intended to reveal.
Understanding this footprint is the first step toward managing it.