9 ms·

US Soldiers Expose Nuclear Weapons Secrets via Flashcard Apps

309 points by cyberlurker 5y ago

arbitrage 5y ago
> Some flashcards uncovered during the course of this investigation had been publicly visible online as far back as 2013. Other sets detailed processes that were being learned by users until at least April 2021. It is not known whether secret phrases, protocols or other security practices have been altered since then. Just gobsmacked by this, honestly.
tiagod 5y ago
This is crazy. How are intelligence agencies, with the amount of money and free reign they have, not monitoring the whole Internet for this kind of stuff?
- salawat 5y ago
  Because even within intelligence agencies, knowledge is strictly controlled. To monitor actively, you have to ask for related content. Asking about related content in a context where you have something to keep secret is an implicit acknowledgement there is something there. It's a trick I've seen used in intelligence gathering contexts quite often. You get close to a researcher and technical expert on classified matters, then ask questions and gauge responses. Sometimes you don't need an answer, you just need to know you're asking the right questions. Knowledge of this practice and regular experience doing it will not make you many friends in either the intel or counter-intel dept. t. Apparently a professional insider threat given all the DoD documentation that describes how I fix places by actually communicating with people and ensuring effective information dissemination through an organization. Makes interviews awkward. All the periodicals in the waiting room basically explain what I do better than I can.
  - deleted 5y ago
    [deleted]
  - 1MachineElf 5y ago
    Many family members have been pressuring me to steer my IT/InfoSec career towards obtaining a security clearance because it is a big salary and job security booster. While I know many US Gov employees have these and do not have to work day-to-day in/on controlled security stuff, they must have had to do it for one point during their career, and I fear that I could not last through such an ordeal. The concept of not being able to collaborate with coworkers due to arbitrary security rules sounds like a disaster.
    - leephillips 5y ago
      If you are already a civil servant without a clearance, getting a clearance decreases job security. It effectively nullifies your civil service protections, and allows you to be fired at will on a security pretext, with absolutely zero recourse. I worked at a navy lab for 21 years and saw this happen to colleagues who displeased their bosses.
    - sneak 5y ago
      Aside from the whole grossness of working for the military-industrial complex, there is another issue for those of us who care about rigor: the whole system of clearances in the US relies heavily on the inaccurate and pseudoscientific polygraph test, which does not test or prove any measurable thing. The interpretations of this pseudoscience can have devastating effects on your career, and not being based on facts or anything truly measurable, you have effectively zero recourse against such destruction, whether willful or otherwise, because it's elevated to the status of "evidence", simply because "the machine said it!" https://antipolygraph.org/pubs.shtml https://antipolygraph.org/pubs.shtml What's worse is that the failings of this pseudoscientific nonsense are well known to the USG, and yet this continues for decades to be central to the system of ostensible "trust" in those who keep government secrets. It's abusive. (Imagine if your government health insurance only covered crystal healers.)
  - asdff 5y ago
    It would be easy to crawl for this stuff imo. The technical language used for this stuff is finite and limited. Just grep the internet for phrases from their training materials, and I bet you can catch all of this.
- tablespoon 5y ago
  > This is crazy. How are intelligence agencies, with the amount of money and free reign they have, not monitoring the whole Internet for this kind of stuff? How do you know they aren't? They're probably focused on adversary nations, though.
- savoytruffle 5y ago
  Isn't free rein for a horse, not a king?
cyberlurker 5y ago
The flash cards are much worse, but it reminds me of the Strava data leak from military staff: https://www.bbc.com/news/technology-42853072 https://www.bbc.com/news/technology-42853072
- joelrunyon 5y ago
  Fun story - this data leak actually launched me into the middle of a reddit Antarctica conspiracy theory - https://impossiblehq.com/the-antarctica-conspiracy-theory/ https://impossiblehq.com/the-antarctica-conspiracy-theory/ Unfortunately, it was just a really long run :)
  - atatatat 5y ago
    Where'd you give up//feel disproven?
    - re 5y ago
      Joel "started"/was part of the conspiracy theory by running a marathon in Antarctica; he wasn't a conspiracy theorist himself.
      - atatatat 5y ago
        Ah, got it. That's actually hilarious. Joel, btw, dead/typo'd link top of this list: https://joelrunyon.com/impossible/ https://joelrunyon.com/impossible/ Have a good day, everyone!
        joelrunyon 5y ago
        Got it - will fix!
      - ilugaslifk 5y ago
        > Joel run yon Nominative determinism
david_allison 5y ago
What makes this more egregious is that the Air Force seems to have internal educational apps which can handle sensitive information: https://www.reddit.com/r/AirForce/comments/nmyu7n/us_soldiers_should_say_airmen_expose_nuclear/gzrnfgo/ https://www.reddit.com/r/AirForce/comments/nmyu7n/us_soldier...
- Someone1234 5y ago
  Your link says that the AF does not have an app for this but could because they have a similar one for "aircrew MQF study." Sounds like a post promoting the idea of having a more general purpose but secure app using the stuff they already built within the AF, rather than saying it is already widely available.
  - atatatat 5y ago
    They seem to know that. I didn't, though. Thanks!
- dmd 5y ago
  But they're probably terrible. Kind of like how at many places they'll tell you "don't use 1password, use cyberark" - leaving out the fact that what takes 0.25 seconds to do in 1password takes over a minute in cyberark.
- angry_octet 5y ago
  Systems like AKO (Army Knowledge Online) are notoriously terrible. US compliance systems often favour rote learning over knowledge, hence memorising vast numbers of irrelevant details as a false proxy for competency.
seanieb 5y ago
Still a lot of these in Google cache... Passwords etc. can be changed, but the protocols and the information about readiness.. oh boy... absolutely classified. Somewhere in Europe there's a number of junior officers having a very bad day.
adolph 5y ago
[Dr Jeffrey Lewis] added that “secrecy about US nuclear weapons deployments in Europe does not exist to protect the weapons from terrorists, but only to protect politicians and military leaders from having to answer tough questions about whether NATO’s nuclear-sharing arrangements still make sense today. This is yet one more warning that these weapons are not secure.” *[Hans Kristenssen, director of the Nuclear Information Project at the Federation of American Scientists] added: “There are so many fingerprints that give away where the nuclear weapons are that it serves no military or safety purpose to try to keep it secret. Safety is accomplished by effective security, not secrecy. Granted, there may be specific operational and security details that need to be kept secret, but the presence of nuclear weapons does not. The real purpose of secrecy is to avoid a contentious public debate in countries where nuclear weapons are not popular.”
- SkyMarshal 5y ago
  >Safety is accomplished by effective security, not secrecy. This seems to depend on your threat model. Two threat models were explicitly mentioned here - terrorists, and contentious public debate. But it seems a third threat model, and the most important one given that nukes are anti-nation-state weapons, is to prevent nation state adversaries from knowing with certainty the location of those nukes. In which case, secrecy is still a necessary component of nuclear safety, or more specifically, deterrent effectiveness.
  - pests 5y ago
    But they already know, per the quote above. >"There are so many fingerprints that give away where the nuclear weapons are that it serves no military or safety purpose to try to keep it secret."
    - pseudo0 5y ago
      I'd imagine it's more of a defense in depth approach. Why do your adversary's work for them? Unsophisticated adversaries (ie. random anti-nuclear agitators) might be dissuaded entirely due to the lack of information, and even sophisticated adversaries would have to take time and effort to verify those fingerprints and make sure they have the right spot. Unless there's a compelling reason to make the information public, I don't see why they would.
baybal2 5y ago
A piece of data more interesting than anything in the article are service numbers of soldiers there. USSR spooks been for decades deducing troop numbers, and rotation schedules on NATO bases based on patterns in service numbers. Not much changed since it seems. Though, same was done for Russian troops in Crimea.
titzer 5y ago
> It is not entirely clear why or how this information became publicly searchable. Quizlet’s website states that all flashcards are set to public visibility by default — users can then change privacy if they choose. Just a sign of how deeply flawed the base of our thinking about information is these days. Everything is public by default, in part because of the warped Google/Facebook worldview has been drilled into us by the likes of Schmidt and Zuckerberg.
- svachalek 5y ago
  Venmo is still the worst example of this I've seen. Putting every financial transaction you make out into a newsfeed, by default.
  - the_local_host 5y ago
    Holy shit. I've never used Venmo, but thanks for the warning.
    - moftz 5y ago
      In your first transaction, you just set it to private so only you and the recipient (and Venmo and whatever gov't agency) can only see the memo line. The amount is always private. The setting sticks after that so you don't ever need to change it again.
      - ta988 5y ago
        why would anybody want that to be public?
        moftz 5y ago
        No fucking clue. Some people like to leave jokey memo lines but I'm glad none of my friends have done something like that outside of the "friends only" option. I just say what it's for or give it a generic name like "money" or "here you go".
wearywanderer 5y ago
I wonder if schools still teach kids that they can make flashcards with a marker and some cardstock, without using any software at all. Or have schools all gone 'paperless' with ipads and chromebooks?
- Mediterraneo10 5y ago
  The reason people like flashcard apps is not simply because they don't want to write with pen and paper, it is 1) they like spaced-repetition algorithms and 2) if you have a set consisting of many hundreds of cards (common in language learning) it much more convenient to carry one phone around than that pocket-bursting stack of cardstock.
  - wearywanderer 5y ago
    The act of writing the cards is part of the learning process. Every time I make a stack, I end up knowing half of it before I even start 'using' it. With software cards, this doesn't work so well. And you can always put the stack into your purse or backpack if your pockets are small. I'm sure soldiers have somewhere they can put a stack of cards.
    - sigstoat 5y ago
      i use electronic SRS flashcard stuff, and i hand write the material onto scrap paper when i first encounter it. i don't have to worry about keeping it neat/legible, i still get the physical connection, and it doesn't take up any space after i've written it.
    - Mediterraneo10 5y ago
      Again, you don’t understand the value some people find in spaced-repetition algorithms. For example, in language-learning decks involving hundreds of cards, writing the cards may lead you to remember the word on a short-term basis, but you are likely to soon forget it. A flashcard app using spaced repetition will ensure that you see that card at the right intervals so that you can retain it until you definitively internalize the word from seeing it used in context in texts.
supernova87a 5y ago
"Your rockstar name is your bunker entry codeword + authentication key + base commander's name, send to all your friends!"
- biofox 5y ago
  Gold-dust 23-kappa-99 Colonel Thompson. Seems a bit long... not sure I like it.
tyho 5y ago
It took me less than 5m to un-redact the information in this post. I found much more than this post details. Wild.
- devit 5y ago
  Yeah, they are redacting in the middle of text in a variable-sized font!
morpheuskafka 5y ago
I have long noticed that Quizlet is a repository for a lot of information that shouldn't be online... from test answers to proprietary line-of-business stuff (ex. retail training materials) to security related stuff (security trainings, emergency response codes). But I would have thought the military would be smart enough not to use it (at all--private or public, it is not in any way designed to handle classified or FOUO data). For example, this one appears to list a number of installations that hold various critical networking infrastructure as well as the names of various admins. https://quizlet.com/414907821/eiws-study-guide-here-it-is-bois-and-gals-flash-cards/ https://quizlet.com/414907821/eiws-study-guide-here-it-is-bo...
- tablespoon 5y ago
  I doubt these were official DoD flashcard decks. They were probably created individually by different soldiers/airmen to help them study for some test they had to take.
  - morpheuskafka 5y ago
    Yeah, I understand that. But I mean as members of the military who are trained and indoctrinated into OPSEC and information handling practices, I would expect them to have made a better decision.
    - jrockway 5y ago
      Hey, at least we didn't find the flashcards for their OPSEC test!
      - nraynaud 5y ago
        Shit, I was thinking along the same line: for any question regarding the OPSec of those people, please search the relevant flash cards.
- tgsovlerkhgsel 5y ago
  One of the flash cards is "Define opsec". I wish I could add an annotation "not uploading your flashcards to a publicly accessible site".
lowbloodsugar 5y ago
Once had a conversation with a soldier who handled IT on base. He told me that officers could and did demand that he bypass security, VPNs, etc and install software of their choice to use it on their computers. They outrank him, and "that's against policy" was not an argument. This was maybe ten years ago. Sounds like things have only got worse.
- matheusmoreira 5y ago
  I wonder who would be held responsible in case of security breaches. The IT soldier? The soldier who outranked him? Both?
- throwaway3neu94 5y ago
  Sad that it works like this. As an engineer, I got some training by legal, followed up by a high level exec explaining to us that in this context, we report only to legal and are required to say "no" to engineering leadership when something would go against legal's policies. Also I think the military has something similar with medical officers. So it could be done right.
sneak 5y ago
This speaks to a wider trend where tons of local software, especially mobile, is now assuming always-on network and syncing, transmitting data, demanding account creation/PII, and spying on your usage and memory contents (uploading crash dumps, system information, et c). Very little software these days simply just runs locally and does the thing it's supposed to do on your own device without transmitting your private information to a datacenter (usually owned by a giant US corporation). This is a problem for all of society (especially those companies and users outside of the US), not just runners on secret bases or students in missile sites.
vmception 5y ago
This is actually hilarious, alongside shocking and scary. But the hilarious part is the cool info you can get by launching benign apps. Hey our flashcard app got popular check out these nuclear weapons secrets people posted on it! When I was dabbling in apps and mobile apps, I encountered several unintended benefits of the data I collected which had nothing to do with my original purpose or vision. This reminds me of that.
jessaustin 5y ago
I'm as suspicious of USA military as any other thinking human, but let's consider TFA's source. "bellingcat" is a CIA-sponsored limited-hangout sock puppet, run by video-game enthusiasts, and that's all it has ever been. There is no reason to assume that any particular point in TFA, or TFA taken as a whole, is particularly true.
- sangnoir 5y ago
  If you don't have clearance, you could verify this yourself. The info is still in search engine caches. If you do have clearance, then don't go about searching for classified info.
  - jessaustin 5y ago
    Occasionally salting in some verifiable bits is the "limited hangout" part. As TFA concedes, everyone who cared knew where these were already. Perhaps such people had mistakenly assumed that security was effective. At this time, there's no telling why the choice was made to disabuse the public of that notion, but that choice was not made within the bellingcat organization.
- JBlue42 5y ago
  >"bellingcat" is a CIA-sponsored limited-hangout sock puppet, run by video-game enthusiasts, and that's all it has ever been. Any links or sources for this?
  - cbHXBY1D 5y ago
    They are very open about being funded by CIA cut outs like the National Endowment for Democracy [1]. If you're not familiar with the NED then you should read William Blum's description of them [2]. Radio War Nerd recently did an excellent two part series on the NED and spent a good amount of time talking about Bellingat, too. [3] And as to them being a "limited hangout sock puppet" you're of course not going to find any source on this - because it's not known for certain - but in my opinion they are most likely something akin to that. They frequently get leaked information from US/UK intelligence organizations and they launder stories for CIA/MI6s. They might not know they are a limited hangout sock puppet for western intelligence but they certainly function as such. A good example is their actions around the OPCW leaks and claims of chemical weapons in Douma, Syria [4]. A lot of these stories unfold on Twitter so you'll have to search around You can also search on HN - there's comments from many years past calling out Bellingcat as a front for western intelligence. [1] https://twitter.com/search?q=from%3AEliotHiggins%20ned https://twitter.com/search?q=from%3AEliotHiggins%20ned [2] https://williamblum.org/chapters/rogue-state/trojan-horse-the-national-endowment-for-democracy https://williamblum.org/chapters/rogue-state/trojan-horse-th... [3] https://podcastaddict.com/episode/121232504 https://podcastaddict.com/episode/121232504 [4] https://thegrayzone.com/2021/03/24/author-bellingcat-opcw-whistleblower/ https://thegrayzone.com/2021/03/24/author-bellingcat-opcw-wh...
hilbert42 5y ago
Fuck some people are dumb! And they have access to nukes too. Heaven help us.
londons_explore 5y ago
Bellingcat has pretty thoroughly censored this information they found on a public website. Yet they don't do the same when investigating Russia - tables of private data were revealed there, together with details of military vehicles. Makes you think about bellingcat motives.
siraben 5y ago
Some of these still seem available via Google's cache[0] (both now deleted). [0] https://webcache.googleusercontent.com/search?q=cache:85ved4CR-WkJ:https://quizlet.com/153545519/nuke-test-flash-cards/ https://webcache.googleusercontent.com/search?q=cache:85ved4... [1] https://webcache.googleusercontent.com/search?q=cache:fNJwlH9o5U0J:https://quizlet.com/509824069/nukes-flash-cards/ https://webcache.googleusercontent.com/search?q=cache:fNJwlH...
londons_explore 5y ago
Is it difficult knowing which buildings are 'hot'? Surely a gamma ray detector pointed at the building long enough will detect signs of radioactive substances inside, even if well shielded.
throw-flash324 5y ago
Conspiracy theory time: Maybe a bad US actor deliberately leaked the information, but in a way that make it look accidental. Or maybe the ex-President already leaked it in a private meeting, so it doesn't matter.
relix 5y ago
> Two flashcards from the same set contain the squadron name “701 MUNSS”, and a phrase to make someone surrender weapons in Flemish, revealing that the security details in it apply to Kleine Brogel air base, Belgium. The phrase is "Halt politie, leg uw wapens neer! Handen op." There is no part of this sentence that would be unique to Flanders. In fact, "Handen op" is something I would expect to hear from Dutch people and never from Belgians, in Belgium it would be "Handen omhoog", but both ways the sentence is correct and would be be perfectly understood in both countries. I'd also expect that the small inconsequential and intricate differences between the way Dutch is spoken in Belgium compared to the Netherlands are not taken into account in this context - they probably use the same for both countries, which would make sense considering it's already difficult enough. I think Bellingcat is emBellishing.
- hebrox 5y ago
  Dutch person here: it’s also “handen omhoog” in Dutch. This is probably a word for word translation of “hands up”.
bofh23 5y ago
Do soldiers get regular training in IT security? I assume there’s more rigorous security training for those who handle more sensitive information. Were soldiers sharing flash cards or were they unknowingly posted online? The selling point for some flash card apps is lots of preexisting cards to study with and presumably app users are the ones creating them. That should hint that they’re stored online. It would be great if app stores noted network access requirements. Does an app operate standalone? Is Internet access required just for ads or also for functionality? Where is app data stored? On your phone, in personal cloud storage, in a shared storage service just for users of this app or shared to the general public? While Apple’s app store mentions none of this, there is a link to the privacy policy for each app. I’m not familiar with Google’s app store. I wish browser extension repositories also provided network access requirements for each add-on.
stunt 5y ago
It sounds like a bad idea to keep nuclear bombs in the Netherlands. A small country that produces and exports a lot of food without much usable land.
herewulf 5y ago
Nit-pick: It's the US Air Force that guards nuclear weapons, not the Army. So, it's not "soldiers" involved but rather "airmen". These service members are clearly real chuckleheads though.

309 points by cyberlurker 5y ago

> Some flashcards uncovered during the course of this investigation had been publicly visible online as far back as 2013. Other sets detailed processes that were being learned by users until at least April 2021. It is not known whether secret phrases, protocols or other security practices have been altered since then. Just gobsmacked by this, honestly.

tiagod 5y ago

This is crazy. How are intelligence agencies, with the amount of money and free reign they have, not monitoring the whole Internet for this kind of stuff?

salawat 5y ago
Because even within intelligence agencies, knowledge is strictly controlled. To monitor actively, you have to ask for related content. Asking about related content in a context where you have something to keep secret is an implicit acknowledgement there is something there. It's a trick I've seen used in intelligence gathering contexts quite often. You get close to a researcher and technical expert on classified matters, then ask questions and gauge responses. Sometimes you don't need an answer, you just need to know you're asking the right questions. Knowledge of this practice and regular experience doing it will not make you many friends in either the intel or counter-intel dept. t. Apparently a professional insider threat given all the DoD documentation that describes how I fix places by actually communicating with people and ensuring effective information dissemination through an organization. Makes interviews awkward. All the periodicals in the waiting room basically explain what I do better than I can.
- deleted 5y ago
  [deleted]
- 1MachineElf 5y ago
  Many family members have been pressuring me to steer my IT/InfoSec career towards obtaining a security clearance because it is a big salary and job security booster. While I know many US Gov employees have these and do not have to work day-to-day in/on controlled security stuff, they must have had to do it for one point during their career, and I fear that I could not last through such an ordeal. The concept of not being able to collaborate with coworkers due to arbitrary security rules sounds like a disaster.
  - leephillips 5y ago
    If you are already a civil servant without a clearance, getting a clearance decreases job security. It effectively nullifies your civil service protections, and allows you to be fired at will on a security pretext, with absolutely zero recourse. I worked at a navy lab for 21 years and saw this happen to colleagues who displeased their bosses.
  - sneak 5y ago
    Aside from the whole grossness of working for the military-industrial complex, there is another issue for those of us who care about rigor: the whole system of clearances in the US relies heavily on the inaccurate and pseudoscientific polygraph test, which does not test or prove any measurable thing. The interpretations of this pseudoscience can have devastating effects on your career, and not being based on facts or anything truly measurable, you have effectively zero recourse against such destruction, whether willful or otherwise, because it's elevated to the status of "evidence", simply because "the machine said it!" https://antipolygraph.org/pubs.shtml https://antipolygraph.org/pubs.shtml What's worse is that the failings of this pseudoscientific nonsense are well known to the USG, and yet this continues for decades to be central to the system of ostensible "trust" in those who keep government secrets. It's abusive. (Imagine if your government health insurance only covered crystal healers.)
- asdff 5y ago
  It would be easy to crawl for this stuff imo. The technical language used for this stuff is finite and limited. Just grep the internet for phrases from their training materials, and I bet you can catch all of this.
tablespoon 5y ago
> This is crazy. How are intelligence agencies, with the amount of money and free reign they have, not monitoring the whole Internet for this kind of stuff? How do you know they aren't? They're probably focused on adversary nations, though.
savoytruffle 5y ago
Isn't free rein for a horse, not a king?

cyberlurker 5y ago

The flash cards are much worse, but it reminds me of the Strava data leak from military staff: https://www.bbc.com/news/technology-42853072 https://www.bbc.com/news/technology-42853072

joelrunyon 5y ago
Fun story - this data leak actually launched me into the middle of a reddit Antarctica conspiracy theory - https://impossiblehq.com/the-antarctica-conspiracy-theory/ https://impossiblehq.com/the-antarctica-conspiracy-theory/ Unfortunately, it was just a really long run :)
- atatatat 5y ago
  Where'd you give up//feel disproven?
  - re 5y ago
    Joel "started"/was part of the conspiracy theory by running a marathon in Antarctica; he wasn't a conspiracy theorist himself.
    - atatatat 5y ago
      Ah, got it. That's actually hilarious. Joel, btw, dead/typo'd link top of this list: https://joelrunyon.com/impossible/ https://joelrunyon.com/impossible/ Have a good day, everyone!
      - joelrunyon 5y ago
        Got it - will fix!
    - ilugaslifk 5y ago
      > Joel run yon Nominative determinism

david_allison 5y ago

What makes this more egregious is that the Air Force seems to have internal educational apps which can handle sensitive information: https://www.reddit.com/r/AirForce/comments/nmyu7n/us_soldiers_should_say_airmen_expose_nuclear/gzrnfgo/ https://www.reddit.com/r/AirForce/comments/nmyu7n/us_soldier...

Someone1234 5y ago
Your link says that the AF does not have an app for this but could because they have a similar one for "aircrew MQF study." Sounds like a post promoting the idea of having a more general purpose but secure app using the stuff they already built within the AF, rather than saying it is already widely available.
- atatatat 5y ago
  They seem to know that. I didn't, though. Thanks!
dmd 5y ago
But they're probably terrible. Kind of like how at many places they'll tell you "don't use 1password, use cyberark" - leaving out the fact that what takes 0.25 seconds to do in 1password takes over a minute in cyberark.
angry_octet 5y ago
Systems like AKO (Army Knowledge Online) are notoriously terrible. US compliance systems often favour rote learning over knowledge, hence memorising vast numbers of irrelevant details as a false proxy for competency.

seanieb 5y ago

Still a lot of these in Google cache... Passwords etc. can be changed, but the protocols and the information about readiness.. oh boy... absolutely classified. Somewhere in Europe there's a number of junior officers having a very bad day.

adolph 5y ago

[Dr Jeffrey Lewis] added that “secrecy about US nuclear weapons deployments in Europe does not exist to protect the weapons from terrorists, but only to protect politicians and military leaders from having to answer tough questions about whether NATO’s nuclear-sharing arrangements still make sense today. This is yet one more warning that these weapons are not secure.” *[Hans Kristenssen, director of the Nuclear Information Project at the Federation of American Scientists] added: “There are so many fingerprints that give away where the nuclear weapons are that it serves no military or safety purpose to try to keep it secret. Safety is accomplished by effective security, not secrecy. Granted, there may be specific operational and security details that need to be kept secret, but the presence of nuclear weapons does not. The real purpose of secrecy is to avoid a contentious public debate in countries where nuclear weapons are not popular.”

SkyMarshal 5y ago
>Safety is accomplished by effective security, not secrecy. This seems to depend on your threat model. Two threat models were explicitly mentioned here - terrorists, and contentious public debate. But it seems a third threat model, and the most important one given that nukes are anti-nation-state weapons, is to prevent nation state adversaries from knowing with certainty the location of those nukes. In which case, secrecy is still a necessary component of nuclear safety, or more specifically, deterrent effectiveness.
- pests 5y ago
  But they already know, per the quote above. >"There are so many fingerprints that give away where the nuclear weapons are that it serves no military or safety purpose to try to keep it secret."
  - pseudo0 5y ago
    I'd imagine it's more of a defense in depth approach. Why do your adversary's work for them? Unsophisticated adversaries (ie. random anti-nuclear agitators) might be dissuaded entirely due to the lack of information, and even sophisticated adversaries would have to take time and effort to verify those fingerprints and make sure they have the right spot. Unless there's a compelling reason to make the information public, I don't see why they would.

baybal2 5y ago

A piece of data more interesting than anything in the article are service numbers of soldiers there. USSR spooks been for decades deducing troop numbers, and rotation schedules on NATO bases based on patterns in service numbers. Not much changed since it seems. Though, same was done for Russian troops in Crimea.

titzer 5y ago

> It is not entirely clear why or how this information became publicly searchable. Quizlet’s website states that all flashcards are set to public visibility by default — users can then change privacy if they choose. Just a sign of how deeply flawed the base of our thinking about information is these days. Everything is public by default, in part because of the warped Google/Facebook worldview has been drilled into us by the likes of Schmidt and Zuckerberg.

svachalek 5y ago
Venmo is still the worst example of this I've seen. Putting every financial transaction you make out into a newsfeed, by default.
- the_local_host 5y ago
  Holy shit. I've never used Venmo, but thanks for the warning.
  - moftz 5y ago
    In your first transaction, you just set it to private so only you and the recipient (and Venmo and whatever gov't agency) can only see the memo line. The amount is always private. The setting sticks after that so you don't ever need to change it again.
    - ta988 5y ago
      why would anybody want that to be public?
      - moftz 5y ago
        No fucking clue. Some people like to leave jokey memo lines but I'm glad none of my friends have done something like that outside of the "friends only" option. I just say what it's for or give it a generic name like "money" or "here you go".

wearywanderer 5y ago

I wonder if schools still teach kids that they can make flashcards with a marker and some cardstock, without using any software at all. Or have schools all gone 'paperless' with ipads and chromebooks?

Mediterraneo10 5y ago
The reason people like flashcard apps is not simply because they don't want to write with pen and paper, it is 1) they like spaced-repetition algorithms and 2) if you have a set consisting of many hundreds of cards (common in language learning) it much more convenient to carry one phone around than that pocket-bursting stack of cardstock.
- wearywanderer 5y ago
  The act of writing the cards is part of the learning process. Every time I make a stack, I end up knowing half of it before I even start 'using' it. With software cards, this doesn't work so well. And you can always put the stack into your purse or backpack if your pockets are small. I'm sure soldiers have somewhere they can put a stack of cards.
  - sigstoat 5y ago
    i use electronic SRS flashcard stuff, and i hand write the material onto scrap paper when i first encounter it. i don't have to worry about keeping it neat/legible, i still get the physical connection, and it doesn't take up any space after i've written it.
  - Mediterraneo10 5y ago
    Again, you don’t understand the value some people find in spaced-repetition algorithms. For example, in language-learning decks involving hundreds of cards, writing the cards may lead you to remember the word on a short-term basis, but you are likely to soon forget it. A flashcard app using spaced repetition will ensure that you see that card at the right intervals so that you can retain it until you definitively internalize the word from seeing it used in context in texts.

supernova87a 5y ago

"Your rockstar name is your bunker entry codeword + authentication key + base commander's name, send to all your friends!"

biofox 5y ago
Gold-dust 23-kappa-99 Colonel Thompson. Seems a bit long... not sure I like it.

tyho 5y ago

It took me less than 5m to un-redact the information in this post. I found much more than this post details. Wild.

devit 5y ago
Yeah, they are redacting in the middle of text in a variable-sized font!

morpheuskafka 5y ago

I have long noticed that Quizlet is a repository for a lot of information that shouldn't be online... from test answers to proprietary line-of-business stuff (ex. retail training materials) to security related stuff (security trainings, emergency response codes). But I would have thought the military would be smart enough not to use it (at all--private or public, it is not in any way designed to handle classified or FOUO data). For example, this one appears to list a number of installations that hold various critical networking infrastructure as well as the names of various admins. https://quizlet.com/414907821/eiws-study-guide-here-it-is-bois-and-gals-flash-cards/ https://quizlet.com/414907821/eiws-study-guide-here-it-is-bo...

tablespoon 5y ago
I doubt these were official DoD flashcard decks. They were probably created individually by different soldiers/airmen to help them study for some test they had to take.
- morpheuskafka 5y ago
  Yeah, I understand that. But I mean as members of the military who are trained and indoctrinated into OPSEC and information handling practices, I would expect them to have made a better decision.
  - jrockway 5y ago
    Hey, at least we didn't find the flashcards for their OPSEC test!
    - nraynaud 5y ago
      Shit, I was thinking along the same line: for any question regarding the OPSec of those people, please search the relevant flash cards.
tgsovlerkhgsel 5y ago
One of the flash cards is "Define opsec". I wish I could add an annotation "not uploading your flashcards to a publicly accessible site".

lowbloodsugar 5y ago

Once had a conversation with a soldier who handled IT on base. He told me that officers could and did demand that he bypass security, VPNs, etc and install software of their choice to use it on their computers. They outrank him, and "that's against policy" was not an argument. This was maybe ten years ago. Sounds like things have only got worse.

matheusmoreira 5y ago
I wonder who would be held responsible in case of security breaches. The IT soldier? The soldier who outranked him? Both?
throwaway3neu94 5y ago
Sad that it works like this. As an engineer, I got some training by legal, followed up by a high level exec explaining to us that in this context, we report only to legal and are required to say "no" to engineering leadership when something would go against legal's policies. Also I think the military has something similar with medical officers. So it could be done right.

sneak 5y ago

This speaks to a wider trend where tons of local software, especially mobile, is now assuming always-on network and syncing, transmitting data, demanding account creation/PII, and spying on your usage and memory contents (uploading crash dumps, system information, et c). Very little software these days simply just runs locally and does the thing it's supposed to do on your own device without transmitting your private information to a datacenter (usually owned by a giant US corporation). This is a problem for all of society (especially those companies and users outside of the US), not just runners on secret bases or students in missile sites.

vmception 5y ago

This is actually hilarious, alongside shocking and scary. But the hilarious part is the cool info you can get by launching benign apps. Hey our flashcard app got popular check out these nuclear weapons secrets people posted on it! When I was dabbling in apps and mobile apps, I encountered several unintended benefits of the data I collected which had nothing to do with my original purpose or vision. This reminds me of that.

jessaustin 5y ago

I'm as suspicious of USA military as any other thinking human, but let's consider TFA's source. "bellingcat" is a CIA-sponsored limited-hangout sock puppet, run by video-game enthusiasts, and that's all it has ever been. There is no reason to assume that any particular point in TFA, or TFA taken as a whole, is particularly true.

sangnoir 5y ago
If you don't have clearance, you could verify this yourself. The info is still in search engine caches. If you do have clearance, then don't go about searching for classified info.
- jessaustin 5y ago
  Occasionally salting in some verifiable bits is the "limited hangout" part. As TFA concedes, everyone who cared knew where these were already. Perhaps such people had mistakenly assumed that security was effective. At this time, there's no telling why the choice was made to disabuse the public of that notion, but that choice was not made within the bellingcat organization.
JBlue42 5y ago
>"bellingcat" is a CIA-sponsored limited-hangout sock puppet, run by video-game enthusiasts, and that's all it has ever been. Any links or sources for this?
- cbHXBY1D 5y ago
  They are very open about being funded by CIA cut outs like the National Endowment for Democracy [1]. If you're not familiar with the NED then you should read William Blum's description of them [2]. Radio War Nerd recently did an excellent two part series on the NED and spent a good amount of time talking about Bellingat, too. [3] And as to them being a "limited hangout sock puppet" you're of course not going to find any source on this - because it's not known for certain - but in my opinion they are most likely something akin to that. They frequently get leaked information from US/UK intelligence organizations and they launder stories for CIA/MI6s. They might not know they are a limited hangout sock puppet for western intelligence but they certainly function as such. A good example is their actions around the OPCW leaks and claims of chemical weapons in Douma, Syria [4]. A lot of these stories unfold on Twitter so you'll have to search around You can also search on HN - there's comments from many years past calling out Bellingcat as a front for western intelligence. [1] https://twitter.com/search?q=from%3AEliotHiggins%20ned https://twitter.com/search?q=from%3AEliotHiggins%20ned [2] https://williamblum.org/chapters/rogue-state/trojan-horse-the-national-endowment-for-democracy https://williamblum.org/chapters/rogue-state/trojan-horse-th... [3] https://podcastaddict.com/episode/121232504 https://podcastaddict.com/episode/121232504 [4] https://thegrayzone.com/2021/03/24/author-bellingcat-opcw-whistleblower/ https://thegrayzone.com/2021/03/24/author-bellingcat-opcw-wh...

hilbert42 5y ago

Fuck some people are dumb! And they have access to nukes too. Heaven help us.

londons_explore 5y ago

Bellingcat has pretty thoroughly censored this information they found on a public website. Yet they don't do the same when investigating Russia - tables of private data were revealed there, together with details of military vehicles. Makes you think about bellingcat motives.

siraben 5y ago

Some of these still seem available via Google's cache[0] (both now deleted). [0] https://webcache.googleusercontent.com/search?q=cache:85ved4CR-WkJ:https://quizlet.com/153545519/nuke-test-flash-cards/ https://webcache.googleusercontent.com/search?q=cache:85ved4... [1] https://webcache.googleusercontent.com/search?q=cache:fNJwlH9o5U0J:https://quizlet.com/509824069/nukes-flash-cards/ https://webcache.googleusercontent.com/search?q=cache:fNJwlH...

londons_explore 5y ago

Is it difficult knowing which buildings are 'hot'? Surely a gamma ray detector pointed at the building long enough will detect signs of radioactive substances inside, even if well shielded.

throw-flash324 5y ago

Conspiracy theory time: Maybe a bad US actor deliberately leaked the information, but in a way that make it look accidental. Or maybe the ex-President already leaked it in a private meeting, so it doesn't matter.

relix 5y ago

> Two flashcards from the same set contain the squadron name “701 MUNSS”, and a phrase to make someone surrender weapons in Flemish, revealing that the security details in it apply to Kleine Brogel air base, Belgium. The phrase is "Halt politie, leg uw wapens neer! Handen op." There is no part of this sentence that would be unique to Flanders. In fact, "Handen op" is something I would expect to hear from Dutch people and never from Belgians, in Belgium it would be "Handen omhoog", but both ways the sentence is correct and would be be perfectly understood in both countries. I'd also expect that the small inconsequential and intricate differences between the way Dutch is spoken in Belgium compared to the Netherlands are not taken into account in this context - they probably use the same for both countries, which would make sense considering it's already difficult enough. I think Bellingcat is emBellishing.

hebrox 5y ago
Dutch person here: it’s also “handen omhoog” in Dutch. This is probably a word for word translation of “hands up”.

bofh23 5y ago

Do soldiers get regular training in IT security? I assume there’s more rigorous security training for those who handle more sensitive information. Were soldiers sharing flash cards or were they unknowingly posted online? The selling point for some flash card apps is lots of preexisting cards to study with and presumably app users are the ones creating them. That should hint that they’re stored online. It would be great if app stores noted network access requirements. Does an app operate standalone? Is Internet access required just for ads or also for functionality? Where is app data stored? On your phone, in personal cloud storage, in a shared storage service just for users of this app or shared to the general public? While Apple’s app store mentions none of this, there is a link to the privacy policy for each app. I’m not familiar with Google’s app store. I wish browser extension repositories also provided network access requirements for each add-on.

stunt 5y ago

It sounds like a bad idea to keep nuclear bombs in the Netherlands. A small country that produces and exports a lot of food without much usable land.

herewulf 5y ago

Nit-pick: It's the US Air Force that guards nuclear weapons, not the Army. So, it's not "soldiers" involved but rather "airmen". These service members are clearly real chuckleheads though.