U.S. No Fly list publicly shared on a hacking forum, government investigating

https://www.bleepingcomputer.com/news/security/us-no-fly-list-shared-on-a-hacking-forum-government-investigating/

by dotty- • 3 years ago

208 252 3 years ago

List like these must be publicly available to anyone, like credit history/score. Also, there must some justice process for getting in and out of this list.

I still don't understand how societies accepted no-fly list, civil forfeiture, de-banking, de-platforming people and other clearly totalitarian practices in or "democratic" and "free" countries.

giantg22• 3 years ago

They accept them because they think it will never happen to them (most people would be right), and think it only happens to "people who deserve it".

anonporridge2• 3 years ago

The trick for these kinds of anti civil rights programs is to keep its application limited enough that not enough people are directly or indirectly affected to raise hell over it.

Keep the affected individuals at <1% (I don't know the real number) and it's a small enough set of people that they'll silently fall through the cracks. Be careful to not accidentally use it against people who are part of rich and powerful families, because they'll make a stink. Use it only against the poor, immigrants, or otherwise socially disconnected and you can keep doing it in perpetuity.

dsfyu404ed2• 3 years ago

I still don't understand how societies accepted no-fly list, civil forfeiture, de-banking, de-platforming people and other clearly totalitarian practices in or "democratic" and "free" countries.

Look at all the disgusting and "inconsistent with your values" behavior you, or if not yourself then the other people who support your causes, will turn a blind eye to, minimize or at the very least object less to when it benefits your cause(s). Now scale that behavior up to all the diverse groups and causes that exist across a nation of 330+mil. That's how.

Swenrekcah2• 3 years ago

None of the things you mention are incompatible with a free democracy, just so long as the process by which people get on (and off!) these lists are transparent.

But unfortunately that is often where things break down.

tinus_hn• 3 years ago

In theory the process of getting off the list is transparent. In practice you can’t be told if you are on the list in the first place.

Lev1a• 3 years ago

Civil (asset) forfeiture is literally license for the executive branch to rob people for practically anything they can think of with almost no recourse [0] and pad their department/agency's pockets.

[0]: "the accused is/are the asset/s not the person/entity robbed by the police/TLA"

matt3210• 3 years ago

People criticize China for doing this but the USA did it first but just kept it secret

vkou• 3 years ago

It's different here, only bad people end up on it.

godelski• 3 years ago

Americans also criticize America for this. I mean just look at this thread. Why would it then be surprising that they criticize China for it? That seems like consistent beliefs. Even before we bring in the reality that there's nuances and the two systems aren't identical and would be absurdly naive to believe they are.

lm284693• 3 years ago

These things are mostly abused in shady countries and the US (aka the freer of free countries). For example in France:

- having a bank account is a right

- civil forfeiture exists but is heavily regulated, nothing even close to the US style abuse

- there is no no fly list

- there is no credit score

Deplatforming is a private business thing, I though freedom advocates loved the right of business to serve whoever they please ?

JumpCrisscross2• 3 years ago

there is no credit score

The French consumer credit system resembles the U.S. no-fly list. Bankers have discretion on making loans and sharing consumer records, which are absolutely maintained. But consumers don’t get to look into the black box.

anonporridge2• 3 years ago

there is no credit score

This isn't good.

The alternative to credit scores is that some banker, most of whom grew up upper middle class or upper class, meets you in person, nods at your firm, masculine handshake, and decides they like the cut of your jib, complexion of your skin, and accent of your voice well enough to give you a loan and/or a reasonable rate. The inherent discrimination of this process is a huge part of the reason we shifted to credit scores in the 80s.

Credit scores are objective, algorithmic measures of credit worthiness that anyone can game upwards by following the rules. The alternative is subjective measures that are applied erratically by different human minds that will always be riddled with bias.

jhawk28• 3 years ago

The eighth amendment should make the no-fly list illegal.

shadowgovt7• 3 years ago

"Cruel and unusual" has always been a very conceptually-flexible term.

Regarding flight: nobody is assumed to have a right to fly, so the privilege of access to flight is easily revoked.

A "no crossing state lines" list, in contrast, is heavily mediated by the judicial system and the burden generally only placed upon those intimately and immediately entangled in a legal action.

shadowgovt7• 3 years ago

At least for the no-fly list (because I'm old enough to have watched the change happen):

9/11 caused an existential panic in the US public that made them willing to accept several new things in the name of safety against a threat model they did not understand. Once those things were in place, (a) burden of proof that removing them doesn't jeopardize our safety rests on those calling for their removal and (b) the average citizen can see the list doesn't impact them so they have little opinion on keeping or removing it.

In short, it was a sticky-bit that once stuck, is hard to un-stick because people don't, generally, feel less free (day-to-day) with it in existence.

slackfan2• 3 years ago

existential panic in the US public that made them willing to accept several new things in the name of safety against a threat model they did not understand

I'm old enough to have watched the change happen. There was no existential panic, but a straight up propaganda campaign waged by a collaborative media and government to ensure that this would be accepted, and that dissenters would be seen as "the other" to be feared and reviled, and potentially targeted for law enforcement action.

Seems very familiar, but history rhymes.

LatteLazy• 3 years ago

I generally agree but...

Remember: the alternative of (non-government required) deplatforming is that anyone can do anything they want on any platform. Want to flood knitting forums with porn? Well they cannot refuse you! And that just makes it impossible for anyone to actually organise anything without constant trolling...

mrguyorama5• 3 years ago

That knitting forum won't exist because if you upload child porn the website owner goes to jail, so they don't let you upload anything.

pc862• 3 years ago

Some of these are perpetrated by a government or agent of a government and shouldn't be tolerated at all.

Some of these are perpetrated by private companies and it's a much more gray area whether or not it's ok. "De-platforming" gets a lot of press but Twitter, Facebook, et al are under no obligation to let any particular person or group use their platform, nor should they be.

thepasswordis4• 3 years ago

There are two opposing groups:

1) Power comes from the people. It is centered in churches, families, and limited local city governments.

2) Power comes from the government. The federal government has the most power and the power decreases all the way down to the local level, which has the least power.

The second group, obviously, has become richer and more powerful. It has also done a good job of capturing the minds of the richest and smartest people in the country, who have been convinced that problems require government solutions.

There are a lot of people who don't accept these sorts of things, but they're called racists, white nationalists, nazis, and all other sorts of horrible (and usually illogical) things. To people who aren't politically active or don't have a good understanding of political philosophy, these accusations are very effective.

"What you oppose a national list of people who are standing in the way of our great society? What are you a nazi?" etc.

PentelicoMarble• 3 years ago

I’d love an example of a person from the first group who was called a white nationalist because they think power comes from the people and not the government.

jnovek3• 3 years ago

The problem I have with #1 is always “churches”. They are very powerful institutions and have disproportionate leverage wherever the government doesn’t step in. E.g. Catholic hospitals that won’t prescribe birth control.

Government, for better or worse, is secular. I don’t have to be concerned that I am subject to the rules of someone else’s faith when I need help from an organization larger than myself.

azov• 3 years ago

I honestly don’t understand the use case. Let’s imagine the list is public and the process is transparent. Who would you put on it and for what purpose?

Who are those people dangerous enough to never be allowed on a plane (despite being searched, xrayed, water bottles and corkscrews taken away from them), yet not dangerous enough to roam free everywhere else?

morpheuskafka2• 3 years ago

Here's what I don't get:

1) At some point, if you are on the list, they will have to tell you. If you were on the Selectee list, they could try to pretend that the additional screening was random/risk-based, but if they don't let you fly at all, they have to tell you that.

2) Aren't most of the people on the KST (know/suspected terrorist) list non-US citizens? If so, they have no chance of legally entering the US, so if they are flying here, they must be using a false identity. I'm not sure what the point of even having them on the list.

spuz2• 3 years ago

Aren't most of the people on the KST (know/suspected terrorist) list non-US citizens? If so, they have no chance of legally entering the US.

I'm not following here. Why would being a non-US citizen give you no chance to enter the US?

breadbreadbread3• 3 years ago

de-platforming isn't a state operation. it is a community moderation and liability management tool among private entities in a shared space. I think its a false equivalency to say that "not being allowed to spew hate speech on twitter" is the same as "having your house stolen by the government". Also twitter has an appeal process and most of the time they just ask you to delete a tweet.

imwillofficial2• 3 years ago

This was shown to be false in the twitter files

exabrial2• 3 years ago

Also, there must some justice process for getting in and out of this list.

This is backwards: there should be a justice process _for getting onto_ said list in the first place. The US Government has 0 authority to remove a right from a US citizen without a trial.

The US Constitution is silent on whether or not this applies to non-citizens unfortunately, but my recommendation is handcuff the government's power whenever possible.

Hamuko3• 3 years ago

Is flying a right?

Animats• 3 years ago

In one area, they don't, at least in the US. It was proposed at one point that the "no fly" list also be used as a "no gun" list. The gun nuts screamed.

mrguyorama5• 3 years ago

The gun nuts scream at everything, anything, and sometimes when it's nothing.

The no fly list still shouldn't be used for gun control. If we want gun control, we should look to do it in a way that doesn't further entrench the horse shit the USA implemented after 9/11

com2kid• 3 years ago

List like these must be publicly available to anyone, like credit history/score.

Devil's advocate, but the point of the no fly list is to stop someone carrying a flagged ID->person mapping from getting onboard an airplane. (Because fake IDs exist, IDs are not 1:1 to people!)

If the no fly list was public, then people who wanted to get on an airplane and cause devastation would see if their current ID is blacklisted, and if so, go get a new ID under a different name. Hard but not impossible, especially with RealID constantly being delayed.

If America had verified identifying documents that couldn't be easily forged, this wouldn't be a problem, but that isn't the infrastructure we have right now, and it really wasn't the infrastructure we had when the no fly list was implemented.

Without biometric IDs, the no fly list is essentially a blacklist of IDs.

How the list is used in practice is a separate discussion from the threat modeling exercise of should the list be public.

lamontcg2• 3 years ago

Animal Farm was Orwell's critique of communism. 1984 was Orwell's critique of liberal democratic capitalism.

photonbucket2• 3 years ago

How does the no-fly list work in practice? Are they just told 'no, go away' when they try to board a plane, or are they arrested?

carrja99• 3 years ago

I have always imagine walking through airport security like a normal person, then out of the blue you are tackled, arrested and charged with “illegal attempt to board a plane” and sentenced to twenty years in a federal prison.

An over-reaction to be sure… I expect no less from modern US laws enforcement.

PM_me_your_math• 3 years ago

That's quite the imagination. You get denied a boarding pass if you are on a no fly list, asked to leave the airport, and told to contact DHS. If you are on the terror watch list, or have active arrest warrants from a court, you will be arrested. If you attempt to evade and resist arrest, then yes, you will probably get tackled and tuned up.

People usually confuse the terrorist watch list with the no-fly list. The former being a list of persons known to having some involvement in terror activities in groups designated as terrorist groups by the US State Department.

The No-Fly list is generally full of criminals, unruly passengers, and people who have gotten violent on flights with crew or other passengers. It is also imperfect, with false positives occurring with people who have the same name as another listee.

It should be noted that the US government may not use the No Fly List to prevent U.S. citizens or permanent residents from returning home to U.S. territory, since doing so is a violation of the 14th amendment.

westmeal• 3 years ago

I think you get detained and sent to the shadow realm. OK the shadow realm part I made up but I'm sure there aren't good things that can happen to you once the government detains you.

jrockway• 3 years ago

good things that can happen to you once the government detains you

I think they have to charge you with a crime within 24 hours. All of the corner cases that you read about in the media are things like "but what if they're fighting in Afghanistan and they magically end up in Cuba on a military base, do we still have to arraign them?" That's apparently a tougher question (even though the answer is obviously yes), but if you end up in central booking in some random US city, some judge will have to spend 10 seconds looking at your case and decide whether or not you can get bail.

So you're not going to get disappeared to a shadow realm if you buy a plane ticket and you're on this list. You might still have an extremely shitty day, though. The criminal justice system is not fun.

notch898a7• 3 years ago

It's a civil limitation AFAIK. Those on the no-fly can still buy a gun lol. Probably can charter your own flight as well or fly your own private plane.

Spooky23• 3 years ago

It depends on your name. These lists are literally a name match.

If you're "John Smith", it's likely you're on multiple lists and will get separately hassled by multiple entities. A guy I grew up with had an FFL and would get flagged for followup when buying guns at retail because of his common name.

the_only_law• 3 years ago

Probably can charter your own flight as well or fly your own private plane.

If I’m that rich, I’m sure I could rub elbows and get my name removed.

rwmj2• 3 years ago

For those not in the US you wouldn't get as far as the plane because your ESTA would be denied first. Then your visa would be stuck in "Administrative Processing" forever.

notch898a7• 3 years ago

Don't need ESTA for guam / saipan. Wonder what happens if they board foreign carrier. Probably just get booted when they reach customs.

Also as fucked up as it is US citizens end up on the TSC and no-fly as well. No ESTA needed for them.

yabones• 3 years ago

The airline probably lets you buy a ticket but "technical errors" prevent them from printing a boarding pass when you go to check in. Then a circus of head scratching ensues while the desk staff stall for time until your flight leaves without you. Then, weeks later when your refund case is handled they tell you in cryptic terms that they are unable to process your reimbursement transaction but not why.

alistairSH• 3 years ago

On the US side, you get "turned away" (or at least taken for additional questions) at security screening. It happened to Ted Kennedy years ago (apparently, some criminal/terrorist once used "T Kennedy" as an alias, so Sen Kennedy, along with ~7000 other Americans, would have been flagged).

On the international side, I assume you get stopped somewhere between check-in and boarding (but not sure if it's up to local security or the airline agents). If not that, you'd be stopped at immigration once on US soil.

samstave2• 3 years ago

If you are on a no-fly, one should be notified that at the time they attempt to purchase a ticket, and before payment is taken for said ticket. No exceptions.

barbazoo3• 3 years ago

Surely they must do something more sophisticated than just simple string comparison of the name /s

MuffinFlavored• 3 years ago

Are they even able to book a ticket online or in person if they give their first + last name?

dotty-• 3 years ago

Discussion for original blog post detailing how the leak occurred: https://news.ycombinator.com/item?id=34446673

aestetix• 3 years ago

I hope the list is made public soon. The TSA needs to be abolished.

dsfyu404ed2• 3 years ago

The politicians will never abolish a multi-billion dollar jobs program because having such a program to control gives them power. Being able to appoint someone somewhere, make rule changes in favor of this or that group, those are political currency and get exchanged as such in DC.

pg5• 3 years ago

What would be the alternative?

ChickenNugger4• 3 years ago

Why do we need an alternative? Air travel existed for decades without it. Here's a more in-depth article on it: https://www.forbes.com/sites/ellistalton/2019/01/28/is-the-t...

mikecoles• 3 years ago

The previous solution.

somebody78978• 3 years ago

We don't need an alternative. I've never understood why we need to go through security to board an airplane, but not to board a train.

hadlock• 3 years ago

Same as the rest of the world, metal detector and possibly luggage scan of larger luggage. US airline security is a ridiculous jobs program for the most part. People have been using the phrase "security theater" since the TSA was invented, and with good reason. Taking your shoes off at security is outrageous, no other country requires this on a regular basis.

htag3• 3 years ago

It's strange that every commercial airplane passenger has an interaction with a federal employee. This isn't true for busses, trains, ferries, cabs, or any other mass transit system. It feels like something more appropriate for an airport employee, with local PD on premises.

johngladtj• 3 years ago

Not having it.

chucksta• 3 years ago

Nope, they're getting more power https://www.tsa.gov/news/press/releases/2022/10/18/tsa-issue...

hackeraccount• 3 years ago

That's not what you want. If that happened whatever the TSA is doing will be done by the FBI or some other agency.

I don't know what you want; maybe a less intrusive trip to the airport? If that's the case fine - but what you want is for TSA to be more respectful of civil liberties. The way you're saying it sounds like you just want the country to be more dangerous. There's no audience for that.

lamontcg2• 3 years ago

If anyone wants to kill a lot of people, disrupt air travel, disrupt the economy and spread fear they can just set off a suicide vest in the middle of a TSA screening line. We're not any safer by having a planeload of people all standing in line to be screened.

ifyoubuildit• 3 years ago

The way you're saying it sounds like you just want the country to be more dangerous

It's hard to know what dangers they're actually alleviating.

And on the flip side, they create other dangers, like having things in your luggage stolen, causing you to miss the occasional flight, normalizing intrusive government begavior, and in general just adding unnecessary friction and indignity to travel (ok maybe that last one is a stretch to call a danger).

Maybe you value these things less than the feeling of comfort that TSA may provide, but I think I'd count myself a part of gp's audience.

Edit: not to mention the opportunity cost of all of that tax money. Though there is something to be said for providing jobs... but you can probably think of plenty of jobs programs with a better ROI.

bsder2• 3 years ago

I don't know what you want; maybe a less intrusive trip to the airport?

I want security turned back over to the airports/airlines like before the TSA.

The way you're saying it sounds like you just want the country to be more dangerous. There's no audience for that.

You have no evidence that TSA has made anything safer while we all have lots of evidence that TSA has made the experience much worse.

scohesc• 3 years ago

Too bad there isn't a "reason" column showing even a summary of why they ended up on the no-fly list - probably because the reason is too sensitive for the people who regularly access the list to see.

"Matters of National Security" and all that jazz.

boomboomsubban2• 3 years ago

Isn't there a bullshit reason for that? Something like if they say why they're put on the list, it becomes an accusation of a crime and then punishment without a trial, but maintaining a list of people who can't fly is somehow OK.

anigbrowl• 3 years ago

A bunch of information like that (along with citizenship and so on is redacted), probably before the TSA gives it to the airlines. that way they can truthfully say they don't know why their computer said no. The ID fields for the entries start at 1 and run upwards chronologically thought not monotonically because people get removed from the list.

encryptluks2• 3 years ago

Wonder how many people would be on there out of retaliation for something personal, like their wife leaving them.

yawboakye• 3 years ago

i was contacted on twitter by the journalist at dailydot who broke the news (https://twitter.com/davidcovucci) because i have java code on github from ~10 years ago that reads a certain ‘nofly.csv’ file (https://gist.github.com/yawboakye/3888617). the interaction was short and i wondered what he was looking for exactly. well, it was joke code, written as part of introduction to java. all this makes me wonder where ‘super-secret-nuclear-codes.csv’ could get me

nebula8804• 3 years ago

wow so some journalists have found the search bar on github. I knew it wasn't going to last but I wish it remained a hush hush thing longer.

pphysch6• 3 years ago

Given the revelations about massive fraud in "Russian bot" detection (e.g. Hamilton 68) I'm inclined to believe the mainstream media is still wholly incompetent at anything of this sort. Probably because the laymen don't know any better.

croes• 3 years ago

Maybe just google search

metalcrow• 3 years ago

Link to the actual forum, since it's not provided for some reason: https://breached.vc/Thread-TSA-NoFly-List-Database-Leaked-Do...

zoklet-enjoyer• 3 years ago

I can't register because my email isn't whitelisted. Does anyone here have the file?

gruez• 3 years ago

Even if you register you have to pay "credits" (which you get by paying for a subscription) to actually get the file.

TheCaptain4815• 3 years ago

Site seems to be down.

gggggg54• 3 years ago

It's not.

bioemerl• 3 years ago

Now that's a file download I will not be clicking.

justsomehnguy• 3 years ago

Just get a VPN in Russia. And I'm only half joking.

triyambakam2• 3 years ago

I'm disappointed in how immature many of the users there seem. Why did I expect different?

capableweb4• 3 years ago

Keep in mind that many people purposefully change writing style drastically if they are assuming different identities online, as it becomes harder to link together profiles that way. Doesn't mean they are like that in real life. Doesn't mean they aren't like that in real life either, as well.

from5• 3 years ago

Human psychology. Refer to: https://www.imdb.com/title/tt0103671/characters/nm0351225#qu...

patientplatypus• 3 years ago

I registered - you can only unlock the link for "8 credits".

Yeah...anyone willing to just post a google drive link on an anonymous account or something?

boomboomsubban2• 3 years ago

I wonder if they got the list from crimew or if they followed the directions on her blog. You'd hope the offending airline would have fixed the issue over the past few weeks but who knows.

rozab• 3 years ago

She said the data would be shared with journos, researchers or human rights organizations with a legitimate interest.

https://ddosecrets.com/wiki/No_Fly_List

If she really didn't do any pre-disclosure then it seems inevitable other people managed to grab it directly. I doubt she had much desire to share it after the long uncomfortable phone call she must have had with the FBI right after the post went live.

duskwuff• 3 years ago

the long uncomfortable phone call she must have had with the FBI

Maia is Swiss. She doesn't have to answer when the FBI calls.

openasocket3• 3 years ago

What are the ethics of publishing such a list? The act of doing so exposes people and damages their reputations, and because there isn't a just procedure for adding people to that list that damage is likely unfair. It's not like this is the registry of sex offenders, where at least there was an actual court case to determine their registry and there are well-defined procedures for removal in case of mistakes or issues. Shouldn't we advocate for there to be a fair, just procedure for adding and removing people from the no-fly list before making it public?

rwmj2• 3 years ago

Since every airline has a copy of this list you can be pretty sure that anyone who wants access sufficiently already has access. Every government, including enemies of the USA, every security agency, any airline IT employee. I would say distributing it in public is fairly neutral.

Shouldn't we advocate for there to be a fair, just procedure for adding and removing people from the no-fly list before making it public?

Absolutely there should be this advocacy, but I don't see how that's connected to whether it is public or not.

kristofferR2• 3 years ago

Most innocent people on this list wouldn't have standing to get removed from this list because they wouldn't have been able to prove they were on it before it was leaked.

openasocket3• 3 years ago

I did some googling and couldn't find any examples of that, or any legal commentary suggesting that is the case. According to this ACLU page there is a standard process for you to determine whether or not you are on the list: https://www.aclu.org/know-your-rights/what-do-if-you-think-y... . At least if you're a U.S. citizen or lawful permanent resident that provides you official recognition of whether or not you are on the list. And even if you aren't a US citizen or lawful permanent resident, would a leaked list actually hold up in court?

banannaise• 3 years ago

The entire point of leaking the list is that the ways people are added to the list are unsupervised and unjust. Being on the list isn't a sign you've done anything wrong.

2OEH8eoCRo02• 3 years ago

If you're on the list and are harmed why not sue? Has anyone sued?

openasocket3• 3 years ago

Yeah, but is the average person going to interpret it that way? I think the average person is going to think "you're on the no-fly list, you must be suspicious in some way". They shouldn't, but that's going to happen.

2OEH8eoCRo02• 3 years ago

It's unethical to poke around on computer systems that aren't yours, unethical to steal from them, and unethical to give away what you stole.

At least he supposedly gave the information to legitimate journalists.

shadowgovt7• 3 years ago

Our industry is still not, in general, an industry that employs licensed professionals. Subsets of it, to be sure, but there is no such thing as a "computer engineering license" in the same sense as a "civil engineering license," for example.

If there were, using production PII in the test infrastructure would be grounds for license revocation.

xwdv2• 3 years ago

Let me tell you about the No-Rent list. Oh yes, if you fuck up a rental car or boat or do any kind of chargebacks for the rental, you will be immediately and automatically added to the No-Rent list for that company. Sometimes these lists can be distributed to central repositories where other rental companies can choose to follow the suggestions and not rent a car to you due to your status as high risk. One of my earliest jobs involved working on a system with such a list. I’ve had quite a bit of experience in engineering solutions to keep people in check.

I suspect there might be something for real estate, but more fragmented. You could end up on a no-rental list and be banned from renting property. I am certain Airbnb has such a list as well.

Cyph0n• 3 years ago

Great, as if dealing with car rental companies wasn’t already a nightmare.

xwdv2• 3 years ago

You have nothing to worry about if you’re a regular well mannered citizen. Otherwise why rent to someone with a history of making a company lose money each time they rent? Some customers aren’t worth the hassle.

BXLE_1-1-BitIs1• 3 years ago

Including the birthdate would be an improvement. Here in Canada, there's babies that get put through enhanced screening for having a flagged name, but there's an IT contract out there for many millions to provide something like redress numbers.

ChatGpt could likely generate the SQL for well under a million.

mabbo• 3 years ago

One time I went on a work trip and brought my intern along- we were meeting the people his intern project would be used by in person. Fun trip all around.

When our flight landed back in Toronto I said something like "Grab a coffee after customs and then head home?" and he's like "You go ahead. I have one of those names and I'm going to be here for a while."

"Come again?"

"There's someone out there who has the same name as me and because of whatever he did I now have to spend an hour in customs every time I come back to Canada."

Sure enough, he texted me later saying "Alright, I'm through- you still at the airport?". I was at home, getting ready for bed.

shwoopdiwoop• 3 years ago

Is this not what re-dress numbers are supposed to solve? Once you get one assigned, you can enter them at the time of booking to prevent problems that might occur by sharing the same name with a known no-fly individual.

jeffwask• 3 years ago

This is one of those terrifying security and operational scenarios. Sure the TSA can say nothing on our end was compromised but if the data is readily accessible to download and accessed by every mom and pop carrier with a 3 person IT staff that can barely keep the lights on is anything actually secure?

mrguyorama5• 3 years ago

It's a weird concept that doesn't make sense: "Nobody can see it but every single company that interfaces with airline booking NEEDS to see it".

The only way around this would be for DHS to host a web endpoint that took a name and answered whether they were on the list. This still has some problems like being able to enumerate over time.

thewebcount• 3 years ago

I mean, it's even more absurd than that. The data itself is rife with errors. Senator Ted Kennedy had to have himself removed from the list several times[0].

[0]https://www.cnn.com/2015/12/07/politics/no-fly-mistakes-cat-...

eddsh1994• 3 years ago

You could detect that enumeration and would require a list of everyones name - maybe add a DOB and a price per API call and it'd go down.

htag3• 3 years ago

This still has some problems like being able to enumerate over time.

1. There are eight billion people. Even if you had everyone's first name, last name and DOB you couldn't ask for more names (or more foreign names) then the size and location of your airline would allow without raising red flags with the wrong type of people. You would never get the complete list this way.

2. If you ask a DHS server if someone is allowed on an airplane, and they say no, there's a good chance that eventually someone at DHS will start to investigate. It's going to look a little bad if you don't have a reason for looking up the name. It's going to look very bad if this happens many times.

3. I wonder if an end user of an airline webportal could try to purchase tickets in someone else's and then see if it's denied to check if someone is on the no fly list.

ar_lan• 3 years ago

This is basically how public housing records work, right?

You basically cannot buy a house and keep your address private unless you route it through a trust or LLC. Even though the county won't up and tell you "Oh, Mr. ar_lan lives at 1234 Hacker Way", you can certainly just scrape all the data you want and construct a DB that then becomes searchable by name.

Seriously - unless the government steps in and has some sort of tunnel just between the user buying the ticket, and preventing them, without an airline employee somewhere in-between, this will just basically never be secure. I guess there could be some super severe auditing on the employeees w/ access - but that means these employees are now the ticketing agents, as well.

Scoundreller3• 3 years ago

The US already has that for non-citizens and non-Canadians:

ESTA and visas.

I guess lack of those doesn’t stop them from flying out.

Maybe codeshares are supposed to enforce the US no-fly list even if you’re not flying to/from US. Dunno.

freitzkriesler• 3 years ago

If a politician ran on eliminating the nudie TSA scanners and this silly list, I'd vote for him in a heart beat

gala8y• 3 years ago

OT: You could write a PhD not leaving their (bleepingcomputer) cookie consent pop-up.

LinuxBender• 3 years ago

I'm honestly surprised it's taken this long for one of these lists to be leaked. Many businesses are required to pull this and many other lists into their applications to approve/deny people and this is not just airlines. For the longest time these lists were on an unencrypted FTP server with a simple username/pw. I only had to deal with this because one of our firewalls did not play well with FTP. I tried to convince them to use HTTPS or SFTP. Hopefully they have at least done that by now.

O__________O• 3 years ago

Assuming this list doesn’t include anyone who’s on the Secondary Security Screening Selection (SSSS) list by default:

- https://wikipedia.org/wiki/Secondary_Security_Screening_Sele...

advisedwang• 3 years ago

The article mentions a separate SELECTEE.csv presumed to be SSSS list.

kristofferR2• 3 years ago

Interestringly the spreadsheet includes the columns SID,CLEARED,LASTNAME FIRSTNAME,MIDDLENAME,TYPE,DOB,POB,CITIZENSHIP,PASSPORT/IDNUMBER,MISC, but only LASTNAME, FIRSTNAME, DOB is populated.

And there are some guys from 1911 and 1912 there.

ding_dang• 3 years ago

Breached is the new site of the RAID Forum that was taken down a few months ago.

bastardoperator• 3 years ago

The names are almost exclusively middle eastern.

willmadden• 3 years ago

The OFAC/Sanctions list is also overwhelmingly middle eastern.

The OFAC list is public. The "nofly" list should be too.

sschueller2• 3 years ago

What security benefit is there for this list being secret? Sure privacy may be an issue but I should have the right to know if I am on it as I see absolutely not benefit if this list being secret other than the government having another reason to put people in jail.

Also if you know you are on it you can save the airlines and everyone else a lot of trouble by not trying to fly in the first place.

Does the list even state why you are on it?

capableweb4• 3 years ago

I'm guessing the official position is something like "If a suspected terrorist know they are a suspected terrorist, their behavior might change in order to hide easier, and sometimes we put suspected terrorists on the no-fly list, so if they could see that, they could figure out we now suspect them of something.". But that's just a guess, maybe there are better reasons out there.

skywhopper2• 3 years ago

And yet, if they are on the selectee list and get pulled for SSSS screening every time they fly, they'll probably know.

sschueller2• 3 years ago

So airlines actually make the effort to contact the authorities when someone on the list tries to book a flight? Are we sure they do this?

Spivak• 3 years ago

Good Faith: Bad guys would know to find someone different if they knew who could and couldn't fly.

Bad Faith: Fear. You better stay in line or one day you'll be trying to get on a flight and suddenly can't. It's your "permanent record" for adults.

Bad Faith: Accountability. Not having it exposed means the gov't can pretty much put anyone on there for any reason without having to worry about silly "public pressure" and "questions about why so many middle-eastern people are on it." You know the ACLU would be all up on that list researching every single person on it and calling them on their bullshit.

skywhopper2• 3 years ago

I'm very curious about this list and whether I'm on it. I have an extremely common Anglo-American first+last name and there was a period of years when I would regularly get my boarding pass stamped "SSSS" and pulled aside for the secondary screening almost every time I flew, which at the time was 5-6 times a year or more.

Now, my name is truly so common that I have convinced myself there was something more than just that name triggering the SSSS designation. Otherwise, most major airports would have been patting down someone with my name multiple times a day. I suppose that's possible, but if so it would really damn the value of this sort of list. The extra screening did seem to depend on which airline and which airports I was using, so maybe there was something else going on. Or maybe some dude with my name just crossed some line he shouldn't have and me and everyone else with that name paid the price for a few years.

lalopalota• 3 years ago

If you made it on to the plane, you weren't on the "no-fly" list. maybe some other list, but not this one.

omgomgomgomg• 3 years ago

Oh dear, yes we understand this is the world post 911, but many, many criminals will simply use entirelly fake identities.

And the data hygiene and itegrity are horrible,there are dead people on it.

capableweb4• 3 years ago

Seems there is a blog post authored by the same person credited in the dump ("maia arson crimew") describing how the data was acquired here: https://maia.crimew.gay/posts/how-to-hack-an-airline/ ("how to completely own an airline in 3 easy steps and grab the TSA nofly list along the way")

Discussed 10 days ago on HN (1024 points | 642 comments): https://news.ycombinator.com/item?id=34446673

hn_throwaway_99• 3 years ago

The way the no fly list was shared, it was absolutely inevitable that this would happen. A much more secure way to handle this:

1. Airlines are each given a no fly list that only includes tokens, e.g. each person's name hashed with a secret key that is specific to the airline, on a periodic basis.

2. When the airline wants to check if a user is on the list, they hit a government-owned service that returns the user's token (again, the token will be unique for each airline because each airline gets their own secret key).

3. The airline would then check the token against their revoked token list.

The benefit of this is:

1. The full token list by itself is useless

2. Even if the airlines API credentials are stolen, the response from the government-owned service is useless on its own.

3. So a bad guy would need to steal the token list AND the API creds to get any value, and even then it would be easy for the government to detect unusual access patterns to their service.

Remember back in the late 90s when we all used to store passwords in plain text? Yeah, we know how that turned out, and in this case, storing the list not only in plain text but sharing it to tons of different companies willy nilly is a million times worse if you expect it to stay secret.

mitthrowaway23• 3 years ago

Maybe the government could also make this service available to parents, who can query it to find out if they should pick a different name for their baby?

Seriously, using names for a no-fly-list is falsehood 21.

https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...

Scoundreller3• 3 years ago

Happens in Canada too. A 6 year old ended up on the list. Four years later; they were still on it with the government promising a fix the next year…

https://www.cbc.ca/news/politics/canada-no-fly-list-kids-mee...

https://www.cbc.ca/news/canada/toronto/no-fly-list-canada-1....

dosethree• 3 years ago

Sounds similar to how do not call lists are handled

KyeRussell• 3 years ago

Momentarily ignoring the myriad complexities of name matching, unfortunately you get no points for coming up with potentially technologically superior solutions for these sorts of problems.

The people involved in maintaining this system certainly knew that there were better ways to do it.

It’s an organisational / people problem. The real skill is making anyone listen to you, and pulling airlines away from a legacy system, and dealing with the inevitable claims that the government owes them $100mil a pop for “having to comply with increased compliance requirements”.

philsnow• 3 years ago

dealing with the inevitable claims that the government owes them $100mil a pop for “having to comply with increased compliance requirements”.

It would be amusing to announce "hey the incumbent airlines each seem to think this change is going to cost them $100M to implement, so instead we're offering $80M to newcomer airlines who know damn well they can do the integration for $100k".

(not that I would want the government to do this, necessarily, I just have a mindset that is contemptuous towards the inefficiencies of ancient/giant companies)

chii• 3 years ago

so if you need to hit a gov't owned api for a response, then why do all the tokenization at all? Just return a boolean from that service directly to deny. It might even work better if it was off a passport number, rather than a name.

The problem is that the online service is needed, and thus ties airline boarding to the service availability. Airlines wanted an offline list, so that even without internet connectivity, they can board.

quazar• 3 years ago

https://breached.vc/Thread-TSA-NoFly-List-Database-Leaked-Do...

gggggg54• 3 years ago

My comment linking to the file seems to have been quietly censored by dang or some other moderator. Not [flagged], just [dead].

https://news.ycombinator.com/item?id=34583299

Linking to this file does not seem to violate any documented HN rules, and download links charging money for the file were allowed to stay up.

Denatonium• 3 years ago

The Wayback Machine has it archived!

U.S. No Fly list publicly shared on a hacking forum, government investigating

Related Stories