Don’t worry! We are the government! We know how to securely store data! You can trust US!
A secret terrorist watchlist with 1.9 million records, including classified “no-fly” records was exposed on the internet.
The list was left accessible on an Elasticsearch cluster that had no password on it.
July this year, Security Discovery researcher Bob Diachenko came across a plethora of JSON records in an exposed Elasticsearch cluster that piqued his interest.
The 1.9 million-strong recordset contained sensitive information on people, including their names, country citizenship, gender, date of birth, passport details, and no-fly status.
The exposed server was indexed by search engines Censys and ZoomEye, indicating Diachenko may not have been the only person to come across the list:
Additionally, the researcher noticed some elusive fields such as “tag,” “nomination type,” and “selectee indicator,” that weren’t immediately understood by him.
“That was the only valid guess given the nature of data plus there was a specific field named ‘TSC_ID’,” said Diachenko, which hinted to him the source of the recordset could be the Terrorist Screening Center (TSC).
Apparently, this is the TSC (Terrorist Screening Centre) dataset publicly exposed (tsc_id is the only clue), with 1.9M+ records. In any case, any thoughts as of where to responsibly report? pic.twitter.com/e31pSrHnoM
— Bob Diachenko (@MayhemDayOne) July 19, 2021
FBI’s TSC is used by multiple federal agencies to manage and share consolidated information for counterterrorism purposes.
The agency maintains the classified watchlist called the Terrorist Screening Database, sometimes also referred to as the “no-fly list.”
Such databases are regarded as highly sensitive in nature, considering the vital role they play in aiding national security and law enforcement tasks.
Terrorists or reasonable suspects who pose a national security risk are “nominated” for placement on the secret watchlist at the government’s discretion.
The list is referenced by airlines and multiple agencies such as the Department of State, Department of Defense, Transportation Security Authority (TSA), and Customs and Border Protection (CBP) to check if a passenger is allowed to fly, inadmissible to the U.S. or assess their risk for various other activities.
Server taken offline 3 weeks after DHS notified
The researcher discovered the exposed database on July 19th, interestingly, on a server with a Bahrain IP address, not a US one.
However, the same day, he rushed to report the data leak to the U.S. Department of Homeland Security (DHS).
“I discovered the exposed data on the same day and reported it to the DHS.”
“The exposed server was taken down about three weeks later, on August 9, 2021.”
“It’s not clear why it took so long, and I don’t know for sure whether any unauthorized parties accessed it,” writes Diachenko in his report.
The researcher considers this data leak to be serious, considering watchlists can list people who are suspected of an illicit activity but not necessarily charged with any crime.
“In the wrong hands, this list could be used to oppress, harass, or persecute people on the list and their families.”
“It could cause any number of personal and professional problems for innocent people whose names are included in the list,” says the researcher.
Cases, where people landed on the no-fly list for refusing to become an informant, aren’t unheard of.
Diachenko believes this leak could therefore have negative repercussions for such people and suspects.
“The TSC watchlist is highly controversial. The ACLU, for example, has for many years fought against the use of a secret government no-fly list without due process,” continued the researcher.
Note, it is not confirmed if the server leaking the list belonged to a U.S. government agency or a third-party entity.
Now think about that: The government doesn’t know how to securely store (your) data! They are constantly spying on us with cameras and trojans everywhere. And now, they will start digitalizing our health data… But don’t worry! All these data are completely safe and will never surfaced anywhere! Stop this! [LinkedIn, Bleeping Computer]
Now subscribe to this blog to get more amazing news curated just for you right in your inbox on a daily basis (here an example of our new newsletter).
You should really subscribe to QFiles. You will get very interesting information about strange events around the world.