The Secret Terrorist Watchlist consisting of over 1.9 million records of people barred from flying is lying exposed on the internet. The list can be accessed by anyone who can use an Elastic Search Cluster as it does not contain any password.
What Did The Secret List Contain?
This important list was discovered by researcher Bob Diachenko who works for Security Discovery and recently discovered JSON records which he investigated further to reveal more shocking details. The recordset consisted of sensitive information on 1.9 million+ people providing information about the Name, Citizenship, Gender, Date of Birth, Passport Details, and the No-Fly Status.
This information was first shared to the Bleeping Computer website by Mr. Diachenko who devised that any list with personal records of people with an extra No-Fly-Indicator column could only mean that it was a terrorist watch list which indicates the status of people with no-fly-permission. Other fields that could not be deciphered as of now included Tag, Nomination Type, Selectee Indicator among others that required more research.
How was the identified information proved to be important?
Mr. Diachenko also found out that this list was indexed by two particular search engines in particular – Censys and ZoomEye. He also stated that there could have been others that would have accessed this list before him. One of the data fields in the list was labeled as TSC_ID which could mean Terrorist Screening Center (TSC). This list is maintained by the Federal Bureau of Investigation in the United States and is shared among the federal agencies for counter-terrorism purposes.
The FBI confirmed in an earlier press release that it does maintain a watchlist known as Terrorist Screening Database which is highly classified and often referred to as NO-Fly list in common terms. This database contains sensitive information that includes a person’s complete details and is maintained to help maintain National Security and aids other Law Enforcement agencies. Any designated terrorist or reasonable suspect nominated by the agency will be listed in such a secret watch list by the US government.
Who uses this No-Fly List?
The No-Fly list is used by multiple law enforcement agencies and airlines/airports to check if a person is allowed to fly or not. It also contains a list of people that are not allowed to enter the United States Soil. Hence this list is often referred to by Customs and Border Protection (CBP), Department of Defense, Transportation Security Authority (TSA), and Department of State.
What is the Current Status of this critical No-Fly List?
The first instance when this No-Fly list was discovered was on 19th July 2021 with an IP address of a country in the Middle East region, Bahrain. The data leak was immediately reported to the U.S. Department of Homeland Security (DHS) by Bob Diachenko. However, it was visible for quite some time after time as the exposed server was taken down only on 9th August 2021. This means that this list was exposed for three weeks after it had been reported.
The report completed by Diachenko stated, “It’s not clear why it took so long, and I don’t know for sure whether any unauthorized parties accessed it,”. He further stated that “In the wrong hands, this list could be used to oppress, harass, or persecute people on the list and their families.” And finally the Security Discovery researcher expressed his concern by stating that
“It could cause any number of personal and professional problems for innocent people whose names are included in the list”.
The Final Word on the No-Fly-List With 2 Million Records Exposed Online
This No-Fly list is not a new security measure and has been in place since the devastating attacks of 9/11 on US soil in 2001. Many people were considered suspects and landed on the No-Fly list. However, the data leak of such a list can bear negative effects on people on the list. The researcher, Bob Diachenko stated, “The TSC watchlist is highly controversial. The ACLU, for example, has for many years fought against the use of a secret government no-fly list without due process,”.
It is important to note that the owner of the server that exposed the list has not been confirmed yet and it is assumed that it belonged to a US government agency. This data leak of such lists is a dangerous activity as it lists people who are only suspects but not charged with any crime and as they say “ Innocent Until Proven Guilty”