Personal information of civilians who were on an outdated version of the US Government's No Fly List and Terrorist Screening Database was found on an open server by a 23-year-old Swiss hacker.
On January 12, Maia Arson Crimew, an influential hacker noted by the Department of Justice in a separate indictment, discovered the highly sensitive documents while browsing through a search engine full of unsecured servers.
The text file "NoFly.csv," which refers to the subset of people in the Terrorist Screening Database who have been prohibited from flying because of suspected or known ties to terrorist organizations, was found after server analysis.
According to crimew, there were reportedly more than 1.5 million entries on the list overall. The data includes names and birthdates. The number of distinct people was significantly fewer than 1.5 million because it also contained many aliases.
According to the hacker, CommuteAir, an Ohio-based minor airline, maintained the insecure Amazon Web Services cloud server that contained the No Fly List as well as confidential data on roughly 1,000 of the airline's employees. Their passport numbers, addresses, and phone numbers were apparently included in this data.
Many of the names on the list appeared to be of Arabic or Middle Eastern ancestry, however, there were also Hispanic and Anglican-sounding names. The uncovered No-Fly list had several well-known names, including Viktor Bout, a Russian arms dealer who was recently released from a US prison in exchange for US basketball player Brittney Griner. Also included on the list were alleged IRA members, an Irish paramilitary group. Another person was listed as being 8 years old by crimew based on their birth year.
While those on the smaller No-fly list are known or suspected terrorists who are prohibited from traveling to or inside the US, those on the Terrorist Screening Database may be subject to enhanced security checks and inspections when traveling.
According to the FBI, a list of people shared among government agencies is the Terrorism Screening Database, which is intended to prevent the kind of intelligence failures that took place before 9/11. The more constrained, smaller No Fly List is contained within it. People who have been screened for terrorism may be subject to further security checks and limitations. No one from the No Fly List is allowed to board an airplane in the United States.
