LeRoyNellis.blog Hacks | Criminals Behind The Badge
After articles on jail conditions and detention practices began changing without his input, LeRoy Nellis traced the edits to a compromised identity layer.
LeRoy Nellis says his site, LeRoyNellis.blog, began changing itself. He knew something was wrong the moment his own article stopped matching the version he had written. Entire sections of his investigative articles were disappearing, and he was not the one making the edits.
The pattern:
At first it looked like a glitch — a missing sentence here, a broken paragraph there. Anyone who runs a website has seen strange things happen after updates. But this was not a formatting problem. The edits were not random; they were targeted. The only articles that kept changing were the ones about Williamson County — posts discussing jail conditions, posts describing detention practices, posts referencing law enforcement systems. Other articles on the blog remained untouched. Technology posts, personal essays, and research pieces unrelated to Williamson County stayed exactly the same. Only the investigative material kept changing.
The emails:
The website edits were disturbing, but what happened next was worse. Emails Nellis had already read began vanishing from inbox threads. Some appeared to have been opened before he accessed them. Attachments went missing. Entire conversations disappeared from email history. Not spam. Not junk mail. Messages related to his reporting — messages connected to Williamson County investigations — were the ones disappearing. That is when he realized the problem might not be his website. The problem might be identity access.
Single sign-on:
Like most modern publishers, Nellis relied on Single Sign-On authentication. One login can connect multiple systems: email, website administration, analytics dashboards, social media publishing, cloud storage, and API integrations. Convenience has a cost. If someone gains access to that authentication layer, they do not need to hack each system individually. They can simply impersonate the identity. Once they do, everything connected to that identity becomes accessible — including email, including website publishing tools, including article editing permissions. What Nellis had first dismissed as glitches were hacks, and they were aimed at a specific subject: Williamson County.
Federal detention networks:
Across the United States, federal detainees are frequently housed in county jails through Intergovernmental Service Agreements, or IGSAs. These contracts allow federal agencies to place detainees in local facilities and pay counties per-day housing rates. These detention agreements are widely documented and represent a major revenue source for many local jail systems. Researchers and policy analysts have noted that these agreements create complex financial relationships between federal agencies and local governments. Nellis's reporting examined how those systems operate locally. Those were the exact articles that kept changing.
Quiet censorship:
People imagine censorship as something obvious — books being banned, articles being taken down. Modern censorship is quieter. A sentence disappears. A paragraph gets softened. A name is removed. An article slowly becomes something different than the one originally published. The internet creates the illusion that information is permanent. But digital information is easier to rewrite than printed ink ever was. And if nobody preserves the original record, the public may never realize the change happened.
Documentation:
Once Nellis realized what was happening, he began preserving everything. Local copies of every article. Archived drafts. Screenshots of website changes. Email logs. Backup archives. Because when records start changing, documentation becomes the only defense. The only way to protect the truth is to preserve it in multiple places. History disappears when nobody archives it. But when records are preserved, the story always finds its way back into the light.
The site lists three related investigations alongside this post.
2. Digital Retaliation Surveillance: Federal Legal Packet:
Listed as a related investigation on the same site.
3. Digital Evidence Admissibility: Constitutional Risks:
Listed as a related investigation on the same site.
What I had first dismissed as glitches were hacks, and they were aimed at a specific subject: Williamson County.
What the Record Shows:
The record Nellis describes is specific and testable. Website edits targeted only Williamson County investigations, while unrelated posts stayed the same. Emails tied to that reporting disappeared after being read. Both systems were reachable through one shared sign-on identity. Federal detention contracts — IGSAs paying counties per-day housing rates — formed the subject matter under examination. Nellis preserved local copies, archived drafts, screenshots, email logs, and backup archives. The open question is who gained that identity access, and whether the rewritten articles can be restored to their original text from the preserved record.