Transparency Toolkit created ICWatch after the 2013 surveillance disclosures exposed code names such as MARINA and MAINWAY. The project automated searches of public LinkedIn profiles for those terms and related intelligence-community language, then launched on May 6, 2015, with more than 27,000 profiles. By February 2017, it reportedly tracked over 100,000 profiles drawn from LinkedIn, Indeed, and other public sources, most belonging to intelligence contractors rather than NSA employees.
The database made identifiable workers searchable by employer, location, industry, and other attributes, turning scattered professional information into a concentrated intelligence-community directory. Individuals began requesting removal in mid-May 2015; the project also received death threats and suffered distributed-denial-of-service attacks. WikiLeaks began hosting ICWatch by the end of that month. In August 2016, TechCrunch reported that LinkedIn was suing 100 unnamed individuals over scraping, identifying ICWatch as a possible target, but the source does not establish that ICWatch itself was sued. ICWatch and related datasets became unavailable on WikiLeaks in November 2022.