18 ms·

U.S. No Fly list publicly shared on a hacking forum, government investigating

208 points by dotty- 4y ago

quazar 4y ago
https://breached.vc/Thread-TSA-NoFly-List-Database-Leaked-Download https://breached.vc/Thread-TSA-NoFly-List-Database-Leaked-Do...
stackedinserter 4y ago
List like these must be publicly available to anyone, like credit history/score. Also, there must some justice process for getting in and out of this list. I still don't understand how societies accepted no-fly list, civil forfeiture, de-banking, de-platforming people and other clearly totalitarian practices in or "democratic" and "free" countries.
- giantg2 4y ago
  They accept them because they think it will never happen to them (most people would be right), and think it only happens to "people who deserve it".
  - anonporridge 4y ago
    The trick for these kinds of anti civil rights programs is to keep its application limited enough that not enough people are directly or indirectly affected to raise hell over it. Keep the affected individuals at <1% (I don't know the real number) and it's a small enough set of people that they'll silently fall through the cracks. Be careful to not accidentally use it against people who are part of rich and powerful families, because they'll make a stink. Use it only against the poor, immigrants, or otherwise socially disconnected and you can keep doing it in perpetuity.
    - pc86 4y ago
      Honestly even if it was "accidentally" used against someone rich and connected, they would just make a phone call and have it fixed. For something like the no fly list it would probably get corrected in time for them to make the flight.
      - Teever 4y ago
        https://www.usatoday.com/story/news/politics/elections/2015/12/09/fact-check-ted-kennedy-and-no-fly-list-myth/77030278/ https://www.usatoday.com/story/news/politics/elections/2015/...
    - giantg2 4y ago
      The funny thing is, they are expanding it. It's still probably below the 1%, but it seems society has an appetite for expanding civil law to circumvent the (limited) protections dound in criminal law, like proof beyond a reasonable doubt or access to an attorney. Red flag laws and the TX abortion law are some recent evidence of this.
- dsfyu404ed 4y ago
  >I still don't understand how societies accepted no-fly list, civil forfeiture, de-banking, de-platforming people and other clearly totalitarian practices in or "democratic" and "free" countries. Look at all the disgusting and "inconsistent with your values" behavior you, or if not yourself then the other people who support your causes, will turn a blind eye to, minimize or at the very least object less to when it benefits your cause(s). Now scale that behavior up to all the diverse groups and causes that exist across a nation of 330+mil. That's how.
- Swenrekcah 4y ago
  None of the things you mention are incompatible with a free democracy, just so long as the process by which people get on (and off!) these lists are transparent. But unfortunately that is often where things break down.
  - tinus_hn 4y ago
    In theory the process of getting off the list is transparent. In practice you can’t be told if you are on the list in the first place.
    - jkaplowitz 4y ago
      What's the theoretically transparent process for getting off the list? DHS TRIP isn't very transparent.
      - brewdad 4y ago
        Apply for a redress number. If it's granted, you are all set. If it's denied, well you have your answer as to whether you were really on the list or not.
        jkaplowitz 4y ago
        That may help determine if you are on the list if they reliably grant or deny redress requests based on being off or on the list (I'm not sure), but it doesn't help getting off the list if they've actually but wrongly chosen to list you, or if they aren't adequately convinced you're not the person they meant to list.
  - Lev1a 4y ago
    Civil (asset) forfeiture is literally license for the executive branch to rob people for practically anything they can think of with almost no recourse [0] and pad their department/agency's pockets. [0]: "the accused is/are the asset/s not the person/entity robbed by the police/TLA"
- matt3210 4y ago
  People criticize China for doing this but the USA did it first but just kept it secret
  - vkou 4y ago
    It's different here, only bad people end up on it.
    - shiftpgdn 4y ago
      Bad according to who?
      - tremon 4y ago
        According to the list, obviously.
  - godelski 4y ago
    Americans also criticize America for this. I mean just look at this thread. Why would it then be surprising that they criticize China for it? That seems like consistent beliefs. Even before we bring in the reality that there's nuances and the two systems aren't identical and would be absurdly naive to believe they are.
- lm28469 4y ago
  These things are mostly abused in shady countries and the US (aka the freer of free countries). For example in France: - having a bank account is a right - civil forfeiture exists but is heavily regulated, nothing even close to the US style abuse - there is no no fly list - there is no credit score Deplatforming is a private business thing, I though freedom advocates loved the right of business to serve whoever they please ?
  - JumpCrisscross 4y ago
    > there is no credit score The French consumer credit system resembles the U.S. no-fly list. Bankers have discretion on making loans and sharing consumer records, which are absolutely maintained. But consumers don’t get to look into the black box.
    - lm28469 4y ago
      > But consumers don’t get to look into the black box. Nor your landlord, nor the shop in which you'll go buy a new bicycle, &c. Also, it's much harder to get a credit in France, you don't get on the list randomly. So all in all it's completely different thing since it won't impact your day to day life for simple things such as renting a flat. Ah, and you can still fly, you just can't get into more debt.
      - JumpCrisscross 4y ago
        > shop in which you'll go buy a new bicycle I’ve bought bicycles in America. Nobody checks credit. > much harder to get a credit in France If you aren’t rich, yes. If you have a personal banker, credit flows. > you don't get on the list randomly You do if you’re my friend and a SocGen clown mis-reports your mortgage as in default to the BdF. Both systems, the U.S. no-fly and French consumer credit, share common impetuses. They’re necessary, particularly for the elites. But they’re ideologically distasteful. So a system is maintained, shrouded in secrecy and, ideally, kept clear of the hoi polloi.
  - anonporridge 4y ago
- jhawk28 4y ago
  The eighth amendment should make the no-fly list illegal.
  - shadowgovt 4y ago
    "Cruel and unusual" has always been a very conceptually-flexible term. Regarding flight: nobody is assumed to have a right to fly, so the privilege of access to flight is easily revoked. A "no crossing state lines" list, in contrast, is heavily mediated by the judicial system and the burden generally only placed upon those intimately and immediately entangled in a legal action.
- shadowgovt 4y ago
  At least for the no-fly list (because I'm old enough to have watched the change happen): 9/11 caused an existential panic in the US public that made them willing to accept several new things in the name of safety against a threat model they did not understand. Once those things were in place, (a) burden of proof that removing them doesn't jeopardize our safety rests on those calling for their removal and (b) the average citizen can see the list doesn't impact them so they have little opinion on keeping or removing it. In short, it was a sticky-bit that once stuck, is hard to un-stick because people don't, generally, feel less free (day-to-day) with it in existence.
  - slackfan 4y ago
    >existential panic in the US public that made them willing to accept several new things in the name of safety against a threat model they did not understand I'm old enough to have watched the change happen. There was no existential panic, but a straight up propaganda campaign waged by a collaborative media and government to ensure that this would be accepted, and that dissenters would be seen as "the other" to be feared and reviled, and potentially targeted for law enforcement action. Seems very familiar, but history rhymes.
    - shadowgovt 4y ago
      It's both. There's no doubt the ruling party invested time and effort selling their solutions to the public, but the public was also buying because all of a sudden, men armed with automatic rifles standing in the airport security lines was a comforting sight, not a terrifying one, for many, many Americans. ETA: Regarding effects on the American psyche, https://www.webmd.com/balance/features/american-psyche-post-911 https://www.webmd.com/balance/features/american-psyche-post-... summarizes some of the post-9/11 research. Probably most of interest is that 21% of Americans studied by a researcher at Carnegie Mellon believed they would be the victim of a terrorist attack within a year. That number proved to be a way-outsized overestimate, but I think it's easy to see how people accept new curtailments to freedoms (especially someone else's freedoms) if 1-in-5 of them believe they'll be personally attacked.
- LatteLazy 4y ago
  I generally agree but... Remember: the alternative of (non-government required) deplatforming is that anyone can do anything they want on any platform. Want to flood knitting forums with porn? Well they cannot refuse you! And that just makes it impossible for anyone to actually organise anything without constant trolling...
  - mrguyorama 4y ago
    That knitting forum won't exist because if you upload child porn the website owner goes to jail, so they don't let you upload anything.
- pc86 4y ago
  Some of these are perpetrated by a government or agent of a government and shouldn't be tolerated at all. Some of these are perpetrated by private companies and it's a much more gray area whether or not it's ok. "De-platforming" gets a lot of press but Twitter, Facebook, et al are under no obligation to let any particular person or group use their platform, nor should they be.
- thepasswordis 4y ago
  There are two opposing groups: 1) Power comes from the people. It is centered in churches, families, and limited local city governments. 2) Power comes from the government. The federal government has the most power and the power decreases all the way down to the local level, which has the least power. The second group, obviously, has become richer and more powerful. It has also done a good job of capturing the minds of the richest and smartest people in the country, who have been convinced that problems require government solutions. There are a lot of people who don't accept these sorts of things, but they're called racists, white nationalists, nazis, and all other sorts of horrible (and usually illogical) things. To people who aren't politically active or don't have a good understanding of political philosophy, these accusations are very effective. "What you oppose a national list of people who are standing in the way of our great society? What are you a nazi?" etc.
  - PentelicoMarble 4y ago
    I’d love an example of a person from the first group who was called a white nationalist because they think power comes from the people and not the government.
    - thepasswordis 4y ago
      Every single person who participated in the truckers rally in Canada.
      - mrguyorama 4y ago
        Ah, so the Nazi flag had nothing to do with it?
        thepasswordis 4y ago
        The Nazi flag was there because somebody was calling Trudeau a nazi. As in: the thing they were there protesting they thought was similar to Nazism, and they think that is a bad thing which is why they are there protesting. There was as far as I can tell one instance of somebody doing this, and they were immediately denounced and told to stop. I agree, btw. Trudeau is an authoritarian, but he isn't a Nazi.
- azov 4y ago
  I honestly don’t understand the use case. Let’s imagine the list is public and the process is transparent. Who would you put on it and for what purpose? Who are those people dangerous enough to never be allowed on a plane (despite being searched, xrayed, water bottles and corkscrews taken away from them), yet not dangerous enough to roam free everywhere else?
- morpheuskafka 4y ago
  Here's what I don't get: 1) At some point, if you are on the list, they will have to tell you. If you were on the Selectee list, they could try to pretend that the additional screening was random/risk-based, but if they don't let you fly at all, they have to tell you that. 2) Aren't most of the people on the KST (know/suspected terrorist) list non-US citizens? If so, they have no chance of legally entering the US, so if they are flying here, they must be using a false identity. I'm not sure what the point of even having them on the list.
  - spuz 4y ago
    > Aren't most of the people on the KST (know/suspected terrorist) list non-US citizens? If so, they have no chance of legally entering the US. I'm not following here. Why would being a non-US citizen give you no chance to enter the US?
    - post-it 4y ago
      They can just get turned away at customs when their passport is scanned.
    - morpheuskafka 4y ago
      Because if the government even thinks you might be a terrorist, they are not going to give you a visa/allow you to enter. And those checks are far more thorough than the checks to board a plane. The only exceptions I could see would be some of those people might be allowed in as representatives of a foreign government, and there might be a few people who already have green cards and the US doesn't have enough evidence to remove them.
      - spuz 4y ago
        This is assuming anyone you might want to add to the no-fly list is not already a US citizen.
- breadbreadbread 4y ago
  de-platforming isn't a state operation. it is a community moderation and liability management tool among private entities in a shared space. I think its a false equivalency to say that "not being allowed to spew hate speech on twitter" is the same as "having your house stolen by the government". Also twitter has an appeal process and most of the time they just ask you to delete a tweet.
  - imwillofficial 4y ago
    This was shown to be false in the twitter files
    - greenhorn360 4y ago
      You're going to need to be more specific than that. I read them and you're making this up.
      - ChickenNugger 4y ago
        I guess you missed this one: https://twitter.com/mtaibbi/status/1613932017716195329 https://twitter.com/mtaibbi/status/1613932017716195329
        darkarmani 4y ago
        Didn't that tweet say that twitter refused to take it down?
        greenhorn360 4y ago
        A staffer of one politician asked Twitter to take content down and they refused. That sure doesn't look like a state level operation to me.
        ChickenNugger 4y ago
        >6.Even when Twitter didn’t suspend an account, that didn’t mean they didn’t act. Schiff’s office repeatedly complained about “QAnon related activity” that were often tweets about other matters, like the identity of the Ukraine “whistleblower” or the Steele dossier: https://twitter.com/mtaibbi/status/1613932028784742400 https://twitter.com/mtaibbi/status/1613932028784742400 >7.Twitter policy at the time didn’t ban QAnon, but “deamplified” such accounts. About the batch of tweets that included those above, Twitter execs wrote: “We can internally confirm that a number of the accounts flagged are already included in this deamplification.” https://twitter.com/mtaibbi/status/1613932028784742400 https://twitter.com/mtaibbi/status/1613932028784742400
- exabrial 4y ago
  > Also, there must some justice process for getting in and out of this list. This is backwards: there should be a justice process _for getting onto_ said list in the first place. The US Government has 0 authority to remove a right from a US citizen without a trial. The US Constitution is silent on whether or not this applies to non-citizens unfortunately, but my recommendation is handcuff the government's power whenever possible.
  - Hamuko 4y ago
    Is flying a right?
    - exabrial 4y ago
      I mean, breathing or eating isn't listed in the constitution... are those rights?
      - Hamuko 4y ago
        Would the "right to eat" also mean the "right to food"?
        notch898a 4y ago
        Positive right to be given food is different than negative right to not be stopped from obtaining food. Blocking someone from riding in a common carrier ordinarily open to the public falls under the "negative right" which is the variety of rights usually ascribed.
    - simple-thoughts 4y ago
      Yes, freedom of movement is a human right.
      - Hamuko 4y ago
        I feel like people have tried to use this as justification for operating a motor vehicle without a government-mandated license without much success.
- Animats 4y ago
  In one area, they don't, at least in the US. It was proposed at one point that the "no fly" list also be used as a "no gun" list. The gun nuts screamed.
  - mrguyorama 4y ago
    The gun nuts scream at everything, anything, and sometimes when it's nothing. The no fly list still shouldn't be used for gun control. If we want gun control, we should look to do it in a way that doesn't further entrench the horse shit the USA implemented after 9/11
- com2kid 4y ago
  > List like these must be publicly available to anyone, like credit history/score. Devil's advocate, but the point of the no fly list is to stop someone carrying a flagged ID->person mapping from getting onboard an airplane. (Because fake IDs exist, IDs are not 1:1 to people!) If the no fly list was public, then people who wanted to get on an airplane and cause devastation would see if their current ID is blacklisted, and if so, go get a new ID under a different name. Hard but not impossible, especially with RealID constantly being delayed. If America had verified identifying documents that couldn't be easily forged, this wouldn't be a problem, but that isn't the infrastructure we have right now, and it really wasn't the infrastructure we had when the no fly list was implemented. Without biometric IDs, the no fly list is essentially a blacklist of IDs. How the list is used in practice is a separate discussion from the threat modeling exercise of should the list be public.
- lamontcg 4y ago
  Animal Farm was Orwell's critique of communism. 1984 was Orwell's critique of liberal democratic capitalism.
photonbucket 4y ago
How does the no-fly list work in practice? Are they just told 'no, go away' when they try to board a plane, or are they arrested?
- carrja99 4y ago
  I have always imagine walking through airport security like a normal person, then out of the blue you are tackled, arrested and charged with “illegal attempt to board a plane” and sentenced to twenty years in a federal prison. An over-reaction to be sure… I expect no less from modern US laws enforcement.
  - PM_me_your_math 4y ago
    That's quite the imagination. You get denied a boarding pass if you are on a no fly list, asked to leave the airport, and told to contact DHS. If you are on the terror watch list, or have active arrest warrants from a court, you will be arrested. If you attempt to evade and resist arrest, then yes, you will probably get tackled and tuned up. People usually confuse the terrorist watch list with the no-fly list. The former being a list of persons known to having some involvement in terror activities in groups designated as terrorist groups by the US State Department. The No-Fly list is generally full of criminals, unruly passengers, and people who have gotten violent on flights with crew or other passengers. It is also imperfect, with false positives occurring with people who have the same name as another listee. It should be noted that the US government may not use the No Fly List to prevent U.S. citizens or permanent residents from returning home to U.S. territory, since doing so is a violation of the 14th amendment.
    - notch898a 4y ago
      What's the basis for arresting someone for just being on a watch list? That sounds unconstitutional. I was added to a watch list long ago that results in me being tossed in a cell and "detained" for up to 24 hours every time I go through customs but they always make it exceedingly clear I'm not under arrest (granted while sitting in immigration holding cell it doesn't feel much different). It really gets annoying just being told by CBP "you know what's next" while never being able to find out what list you've been put on. I hope more of these lists become public.
dotty- 4y ago
Discussion for original blog post detailing how the leak occurred: https://news.ycombinator.com/item?id=34446673 https://news.ycombinator.com/item?id=34446673
aestetix 4y ago
I hope the list is made public soon. The TSA needs to be abolished.
- dsfyu404ed 4y ago
  The politicians will never abolish a multi-billion dollar jobs program because having such a program to control gives them power. Being able to appoint someone somewhere, make rule changes in favor of this or that group, those are political currency and get exchanged as such in DC.
- pg5 4y ago
  What would be the alternative?
  - ChickenNugger 4y ago
    Why do we need an alternative? Air travel existed for decades without it. Here's a more in-depth article on it: https://www.forbes.com/sites/ellistalton/2019/01/28/is-the-tsa-really-necessary/?sh=303c5b3025e0 https://www.forbes.com/sites/ellistalton/2019/01/28/is-the-t...
  - mikecoles 4y ago
    The previous solution.
  - somebody78978 4y ago
    We don't need an alternative. I've never understood why we need to go through security to board an airplane, but not to board a train.
    - jxramos 4y ago
      probably the likely outcomes of terrorism. On a plane the whole thing is demolished in a crash because of the kinetic energy involved in colliding with the earth. For a train probably not the same degree of destruction is attainable unless you like bomb a bridge or something of the sort.
scohesc 4y ago
Too bad there isn't a "reason" column showing even a summary of why they ended up on the no-fly list - probably because the reason is too sensitive for the people who regularly access the list to see. "Matters of National Security" and all that jazz.
- boomboomsubban 4y ago
  Isn't there a bullshit reason for that? Something like if they say why they're put on the list, it becomes an accusation of a crime and then punishment without a trial, but maintaining a list of people who can't fly is somehow OK.
- anigbrowl 4y ago
  A bunch of information like that (along with citizenship and so on is redacted), probably before the TSA gives it to the airlines. that way they can truthfully say they don't know why their computer said no. The ID fields for the entries start at 1 and run upwards chronologically thought not monotonically because people get removed from the list.
- encryptluks2 4y ago
  Wonder how many people would be on there out of retaliation for something personal, like their wife leaving them.
yawboakye 4y ago
i was contacted on twitter by the journalist at dailydot who broke the news (https://twitter.com/davidcovucci https://twitter.com/davidcovucci) because i have java code on github from ~10 years ago that reads a certain ‘nofly.csv’ file (https://gist.github.com/yawboakye/3888617 https://gist.github.com/yawboakye/3888617). the interaction was short and i wondered what he was looking for exactly. well, it was joke code, written as part of introduction to java. all this makes me wonder where ‘super-secret-nuclear-codes.csv’ could get me
- nebula8804 4y ago
  wow so some journalists have found the search bar on github. I knew it wasn't going to last but I wish it remained a hush hush thing longer.
  - pphysch 4y ago
    Given the revelations about massive fraud in "Russian bot" detection (e.g. Hamilton 68) I'm inclined to believe the mainstream media is still wholly incompetent at anything of this sort. Probably because the laymen don't know any better.
    - milsorgen 4y ago
      Knoll's Law is a heck of a thing: https://effectiviology.com/knolls-law/ https://effectiviology.com/knolls-law/ Even though I'm aware of this phenomenon I constantly catch myself believing what I read until I remind myself to double check. Of course that leaves huge swaths of things I don't deem important enough to double check. I really wish there was a way to bring about, maybe not more accountability in media, but more faith that a news org or journalist is putting forth their best efforts to communicate correct information. It really is a tough nut to crack in terms resources available.
      - FredPret 4y ago
        You need multiple experts in a given topic to give a briefing to know what is going on. But now we need multiple experts in every single field, and layers of other people to verify that the former are, in fact, experts. The problem of accurate news is unsolvable.
metalcrow 4y ago
Link to the actual forum, since it's not provided for some reason: https://breached.vc/Thread-TSA-NoFly-List-Database-Leaked-Download https://breached.vc/Thread-TSA-NoFly-List-Database-Leaked-Do...
- zoklet-enjoyer 4y ago
  I can't register because my email isn't whitelisted. Does anyone here have the file?
  - gruez 4y ago
    Even if you register you have to pay "credits" (which you get by paying for a subscription) to actually get the file.
    - bojangleslover 4y ago
      Which can only be paid with crypto...
      - from 4y ago
        Were you expecting participants in a criminal conspiracy to take Amex?
        notch898a 4y ago
        I'm no lawyer but is this even a criminal conspiracy? I thought the 1A covered third party distribution of most stolen secret government information. The media does it and profits and apparently legally.
        from 4y ago
        I guess criminal conspiracy might be the wrong word. There is no prohibition on sharing hacked data as far as I can tell. There is “unauthorized access device” like having CC or SSN numbers but that’s only if you have an intent to defraud. Maybe they could argue stolen property? There is potentially copyright infringement in some cases but this is a government database so that doesn’t apply here.
boomboomsubban 4y ago
I wonder if they got the list from crimew or if they followed the directions on her blog. You'd hope the offending airline would have fixed the issue over the past few weeks but who knows.
- rozab 4y ago
  She said the data would be shared with journos, researchers or human rights organizations with a legitimate interest. https://ddosecrets.com/wiki/No_Fly_List https://ddosecrets.com/wiki/No_Fly_List If she really didn't do any pre-disclosure then it seems inevitable other people managed to grab it directly. I doubt she had much desire to share it after the long uncomfortable phone call she must have had with the FBI right after the post went live.
  - duskwuff 4y ago
    > the long uncomfortable phone call she must have had with the FBI Maia is Swiss. She doesn't have to answer when the FBI calls.
    - super256 4y ago
      > Maia is Swiss. She doesn't have to answer when the FBI calls. According to her Wikipage “her parents' home were raided by the Swiss police at the request of United States authorities” a while ago. https://en.wikipedia.org/wiki/Maia_arson_crimew https://en.wikipedia.org/wiki/Maia_arson_crimew
openasocket 4y ago
What are the ethics of publishing such a list? The act of doing so exposes people and damages their reputations, and because there isn't a just procedure for adding people to that list that damage is likely unfair. It's not like this is the registry of sex offenders, where at least there was an actual court case to determine their registry and there are well-defined procedures for removal in case of mistakes or issues. Shouldn't we advocate for there to be a fair, just procedure for adding and removing people from the no-fly list before making it public?
- rwmj 4y ago
  Since every airline has a copy of this list you can be pretty sure that anyone who wants access sufficiently already has access. Every government, including enemies of the USA, every security agency, any airline IT employee. I would say distributing it in public is fairly neutral. > Shouldn't we advocate for there to be a fair, just procedure for adding and removing people from the no-fly list before making it public? Absolutely there should be this advocacy, but I don't see how that's connected to whether it is public or not.
- kristofferR 4y ago
  Most innocent people on this list wouldn't have standing to get removed from this list because they wouldn't have been able to prove they were on it before it was leaked.
  - openasocket 4y ago
    I did some googling and couldn't find any examples of that, or any legal commentary suggesting that is the case. According to this ACLU page there is a standard process for you to determine whether or not you are on the list: https://www.aclu.org/know-your-rights/what-do-if-you-think-youre-no-fly-list https://www.aclu.org/know-your-rights/what-do-if-you-think-y... . At least if you're a U.S. citizen or lawful permanent resident that provides you official recognition of whether or not you are on the list. And even if you aren't a US citizen or lawful permanent resident, would a leaked list actually hold up in court?
freitzkriesler 4y ago
If a politician ran on eliminating the nudie TSA scanners and this silly list, I'd vote for him in a heart beat
shadowgovt 4y ago
Our industry is still not, in general, an industry that employs licensed professionals. Subsets of it, to be sure, but there is no such thing as a "computer engineering license" in the same sense as a "civil engineering license," for example. If there were, using production PII in the test infrastructure would be grounds for license revocation.
xwdv 4y ago
Let me tell you about the No-Rent list. Oh yes, if you fuck up a rental car or boat or do any kind of chargebacks for the rental, you will be immediately and automatically added to the No-Rent list for that company. Sometimes these lists can be distributed to central repositories where other rental companies can choose to follow the suggestions and not rent a car to you due to your status as high risk. One of my earliest jobs involved working on a system with such a list. I’ve had quite a bit of experience in engineering solutions to keep people in check. I suspect there might be something for real estate, but more fragmented. You could end up on a no-rental list and be banned from renting property. I am certain Airbnb has such a list as well.
- Cyph0n 4y ago
  Great, as if dealing with car rental companies wasn’t already a nightmare.
  - xwdv 4y ago
    You have nothing to worry about if you’re a regular well mannered citizen. Otherwise why rent to someone with a history of making a company lose money each time they rent? Some customers aren’t worth the hassle.
BXLE_1-1-BitIs1 4y ago
Including the birthdate would be an improvement. Here in Canada, there's babies that get put through enhanced screening for having a flagged name, but there's an IT contract out there for many millions to provide something like redress numbers. ChatGpt could likely generate the SQL for well under a million.
- mabbo 4y ago
  One time I went on a work trip and brought my intern along- we were meeting the people his intern project would be used by in person. Fun trip all around. When our flight landed back in Toronto I said something like "Grab a coffee after customs and then head home?" and he's like "You go ahead. I have one of those names and I'm going to be here for a while." "Come again?" "There's someone out there who has the same name as me and because of whatever he did I now have to spend an hour in customs every time I come back to Canada." Sure enough, he texted me later saying "Alright, I'm through- you still at the airport?". I was at home, getting ready for bed.
  - shwoopdiwoop 4y ago
    Is this not what re-dress numbers are supposed to solve? Once you get one assigned, you can enter them at the time of booking to prevent problems that might occur by sharing the same name with a known no-fly individual.
deleted 4y ago
[deleted]
jeffwask 4y ago
This is one of those terrifying security and operational scenarios. Sure the TSA can say nothing on our end was compromised but if the data is readily accessible to download and accessed by every mom and pop carrier with a 3 person IT staff that can barely keep the lights on is anything actually secure?
- mrguyorama 4y ago
  It's a weird concept that doesn't make sense: "Nobody can see it but every single company that interfaces with airline booking NEEDS to see it". The only way around this would be for DHS to host a web endpoint that took a name and answered whether they were on the list. This still has some problems like being able to enumerate over time.
  - thewebcount 4y ago
    I mean, it's even more absurd than that. The data itself is rife with errors. Senator Ted Kennedy had to have himself removed from the list several times[0]. [0]https://www.cnn.com/2015/12/07/politics/no-fly-mistakes-cat-stevens-ted-kennedy-john-lewis/index.html https://www.cnn.com/2015/12/07/politics/no-fly-mistakes-cat-...
  - eddsh1994 4y ago
    You could detect that enumeration and would require a list of everyones name - maybe add a DOB and a price per API call and it'd go down.
    - orev 4y ago
      Enumeration doesn’t have to mean using a brute force search. One could simply make the api call and then update a local database with the result. That local database would then become the potentially exposed data.
  - htag 4y ago
    > This still has some problems like being able to enumerate over time. 1. There are eight billion people. Even if you had everyone's first name, last name and DOB you couldn't ask for more names (or more foreign names) then the size and location of your airline would allow without raising red flags with the wrong type of people. You would never get the complete list this way. 2. If you ask a DHS server if someone is allowed on an airplane, and they say no, there's a good chance that eventually someone at DHS will start to investigate. It's going to look a little bad if you don't have a reason for looking up the name. It's going to look very bad if this happens many times. 3. I wonder if an end user of an airline webportal could try to purchase tickets in someone else's and then see if it's denied to check if someone is on the no fly list.
gala8y 4y ago
OT: You could write a PhD not leaving their (bleepingcomputer) cookie consent pop-up.
LinuxBender 4y ago
I'm honestly surprised it's taken this long for one of these lists to be leaked. Many businesses are required to pull this and many other lists into their applications to approve/deny people and this is not just airlines. For the longest time these lists were on an unencrypted FTP server with a simple username/pw. I only had to deal with this because one of our firewalls did not play well with FTP. I tried to convince them to use HTTPS or SFTP. Hopefully they have at least done that by now.
baybal2 4y ago
[dead]
O__________O 4y ago
Assuming this list doesn’t include anyone who’s on the Secondary Security Screening Selection (SSSS) list by default: - https://wikipedia.org/wiki/Secondary_Security_Screening_Selection https://wikipedia.org/wiki/Secondary_Security_Screening_Sele...
- advisedwang 4y ago
  The article mentions a separate SELECTEE.csv presumed to be SSSS list.
kristofferR 4y ago
Interestringly the spreadsheet includes the columns SID,CLEARED,LASTNAME FIRSTNAME,MIDDLENAME,TYPE,DOB,POB,CITIZENSHIP,PASSPORT/IDNUMBER,MISC, but only LASTNAME, FIRSTNAME, DOB is populated. And there are some guys from 1911 and 1912 there.
ding_dang 4y ago
Breached is the new site of the RAID Forum that was taken down a few months ago.
bastardoperator 4y ago
The names are almost exclusively middle eastern.
- willmadden 4y ago
  The OFAC/Sanctions list is also overwhelmingly middle eastern. The OFAC list is public. The "nofly" list should be too.
sschueller 4y ago
What security benefit is there for this list being secret? Sure privacy may be an issue but I should have the right to know if I am on it as I see absolutely not benefit if this list being secret other than the government having another reason to put people in jail. Also if you know you are on it you can save the airlines and everyone else a lot of trouble by not trying to fly in the first place. Does the list even state why you are on it?
- capableweb 4y ago
  I'm guessing the official position is something like "If a suspected terrorist know they are a suspected terrorist, their behavior might change in order to hide easier, and sometimes we put suspected terrorists on the no-fly list, so if they could see that, they could figure out we now suspect them of something.". But that's just a guess, maybe there are better reasons out there.
  - skywhopper 4y ago
    And yet, if they are on the selectee list and get pulled for SSSS screening every time they fly, they'll probably know.
    - naasking 4y ago
      If the list were public they could know this in advance though, and send someone who hasn't yet been flagged and so attacks would be harder to thwart. This is only hypothetical though, and given the size of the list I'm skeptical it's all that reliable to begin with.
    - capableweb 4y ago
      Maybe they handle it the same as if you trigger the anti-fraud system for the various IT companies ie they don't tell you anything but "I'm sorry but we cannot accept payments from you and I can't tell you why". To be honest, the whole thing sounds like a farce, just trying to get some understanding from perspective I don't myself hold.
  - 4y ago
skywhopper 4y ago
I'm very curious about this list and whether I'm on it. I have an extremely common Anglo-American first+last name and there was a period of years when I would regularly get my boarding pass stamped "SSSS" and pulled aside for the secondary screening almost every time I flew, which at the time was 5-6 times a year or more. Now, my name is truly so common that I have convinced myself there was something more than just that name triggering the SSSS designation. Otherwise, most major airports would have been patting down someone with my name multiple times a day. I suppose that's possible, but if so it would really damn the value of this sort of list. The extra screening did seem to depend on which airline and which airports I was using, so maybe there was something else going on. Or maybe some dude with my name just crossed some line he shouldn't have and me and everyone else with that name paid the price for a few years.
- lalopalota 4y ago
  If you made it on to the plane, you weren't on the "no-fly" list. maybe some other list, but not this one.
omgomgomgomg 4y ago
Oh dear, yes we understand this is the world post 911, but many, many criminals will simply use entirelly fake identities. And the data hygiene and itegrity are horrible,there are dead people on it.
capableweb 4y ago
Seems there is a blog post authored by the same person credited in the dump ("maia arson crimew") describing how the data was acquired here: https://maia.crimew.gay/posts/how-to-hack-an-airline/ https://maia.crimew.gay/posts/how-to-hack-an-airline/ ("how to completely own an airline in 3 easy steps and grab the TSA nofly list along the way") Discussed 10 days ago on HN (1024 points | 642 comments): https://news.ycombinator.com/item?id=34446673 https://news.ycombinator.com/item?id=34446673
hn_throwaway_99 4y ago
The way the no fly list was shared, it was absolutely inevitable that this would happen. A much more secure way to handle this: 1. Airlines are each given a no fly list that only includes tokens, e.g. each person's name hashed with a secret key that is specific to the airline, on a periodic basis. 2. When the airline wants to check if a user is on the list, they hit a government-owned service that returns the user's token (again, the token will be unique for each airline because each airline gets their own secret key). 3. The airline would then check the token against their revoked token list. The benefit of this is: 1. The full token list by itself is useless 2. Even if the airlines API credentials are stolen, the response from the government-owned service is useless on its own. 3. So a bad guy would need to steal the token list AND the API creds to get any value, and even then it would be easy for the government to detect unusual access patterns to their service. Remember back in the late 90s when we all used to store passwords in plain text? Yeah, we know how that turned out, and in this case, storing the list not only in plain text but sharing it to tons of different companies willy nilly is a million times worse if you expect it to stay secret.
- mitthrowaway2 4y ago
  Maybe the government could also make this service available to parents, who can query it to find out if they should pick a different name for their baby? Seriously, using names for a no-fly-list is falsehood 21. https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...
  - Scoundreller 4y ago
    Happens in Canada too. A 6 year old ended up on the list. Four years later; they were still on it with the government promising a fix the next year… https://www.cbc.ca/news/politics/canada-no-fly-list-kids-meeting-public-safety-minister-1.5403518 https://www.cbc.ca/news/politics/canada-no-fly-list-kids-mee... https://www.cbc.ca/news/canada/toronto/no-fly-list-canada-1.5396974 https://www.cbc.ca/news/canada/toronto/no-fly-list-canada-1....
- dosethree 4y ago
gggggg5 4y ago
My comment linking to the file seems to have been quietly censored by dang or some other moderator. Not [flagged], just [dead]. https://news.ycombinator.com/item?id=34583299 https://news.ycombinator.com/item?id=34583299 Linking to this file does not seem to violate any documented HN rules, and download links charging money for the file were allowed to stay up.
- Denatonium 4y ago
  The Wayback Machine has it archived!

208 points by dotty- 4y ago

https://breached.vc/Thread-TSA-NoFly-List-Database-Leaked-Download https://breached.vc/Thread-TSA-NoFly-List-Database-Leaked-Do...

stackedinserter 4y ago

List like these must be publicly available to anyone, like credit history/score. Also, there must some justice process for getting in and out of this list. I still don't understand how societies accepted no-fly list, civil forfeiture, de-banking, de-platforming people and other clearly totalitarian practices in or "democratic" and "free" countries.

giantg2 4y ago
They accept them because they think it will never happen to them (most people would be right), and think it only happens to "people who deserve it".
- anonporridge 4y ago
  The trick for these kinds of anti civil rights programs is to keep its application limited enough that not enough people are directly or indirectly affected to raise hell over it. Keep the affected individuals at <1% (I don't know the real number) and it's a small enough set of people that they'll silently fall through the cracks. Be careful to not accidentally use it against people who are part of rich and powerful families, because they'll make a stink. Use it only against the poor, immigrants, or otherwise socially disconnected and you can keep doing it in perpetuity.
  - pc86 4y ago
    Honestly even if it was "accidentally" used against someone rich and connected, they would just make a phone call and have it fixed. For something like the no fly list it would probably get corrected in time for them to make the flight.
    - Teever 4y ago
      https://www.usatoday.com/story/news/politics/elections/2015/12/09/fact-check-ted-kennedy-and-no-fly-list-myth/77030278/ https://www.usatoday.com/story/news/politics/elections/2015/...
  - giantg2 4y ago
    The funny thing is, they are expanding it. It's still probably below the 1%, but it seems society has an appetite for expanding civil law to circumvent the (limited) protections dound in criminal law, like proof beyond a reasonable doubt or access to an attorney. Red flag laws and the TX abortion law are some recent evidence of this.
dsfyu404ed 4y ago
>I still don't understand how societies accepted no-fly list, civil forfeiture, de-banking, de-platforming people and other clearly totalitarian practices in or "democratic" and "free" countries. Look at all the disgusting and "inconsistent with your values" behavior you, or if not yourself then the other people who support your causes, will turn a blind eye to, minimize or at the very least object less to when it benefits your cause(s). Now scale that behavior up to all the diverse groups and causes that exist across a nation of 330+mil. That's how.
Swenrekcah 4y ago
None of the things you mention are incompatible with a free democracy, just so long as the process by which people get on (and off!) these lists are transparent. But unfortunately that is often where things break down.
- tinus_hn 4y ago
  In theory the process of getting off the list is transparent. In practice you can’t be told if you are on the list in the first place.
  - jkaplowitz 4y ago
    What's the theoretically transparent process for getting off the list? DHS TRIP isn't very transparent.
    - brewdad 4y ago
      Apply for a redress number. If it's granted, you are all set. If it's denied, well you have your answer as to whether you were really on the list or not.
      - jkaplowitz 4y ago
        That may help determine if you are on the list if they reliably grant or deny redress requests based on being off or on the list (I'm not sure), but it doesn't help getting off the list if they've actually but wrongly chosen to list you, or if they aren't adequately convinced you're not the person they meant to list.
- Lev1a 4y ago
  Civil (asset) forfeiture is literally license for the executive branch to rob people for practically anything they can think of with almost no recourse [0] and pad their department/agency's pockets. [0]: "the accused is/are the asset/s not the person/entity robbed by the police/TLA"
matt3210 4y ago
People criticize China for doing this but the USA did it first but just kept it secret
- vkou 4y ago
  It's different here, only bad people end up on it.
  - shiftpgdn 4y ago
    Bad according to who?
    - tremon 4y ago
      According to the list, obviously.
- godelski 4y ago
  Americans also criticize America for this. I mean just look at this thread. Why would it then be surprising that they criticize China for it? That seems like consistent beliefs. Even before we bring in the reality that there's nuances and the two systems aren't identical and would be absurdly naive to believe they are.
lm28469 4y ago
These things are mostly abused in shady countries and the US (aka the freer of free countries). For example in France: - having a bank account is a right - civil forfeiture exists but is heavily regulated, nothing even close to the US style abuse - there is no no fly list - there is no credit score Deplatforming is a private business thing, I though freedom advocates loved the right of business to serve whoever they please ?
- JumpCrisscross 4y ago
  > there is no credit score The French consumer credit system resembles the U.S. no-fly list. Bankers have discretion on making loans and sharing consumer records, which are absolutely maintained. But consumers don’t get to look into the black box.
  - lm28469 4y ago
    > But consumers don’t get to look into the black box. Nor your landlord, nor the shop in which you'll go buy a new bicycle, &c. Also, it's much harder to get a credit in France, you don't get on the list randomly. So all in all it's completely different thing since it won't impact your day to day life for simple things such as renting a flat. Ah, and you can still fly, you just can't get into more debt.
    - JumpCrisscross 4y ago
      > shop in which you'll go buy a new bicycle I’ve bought bicycles in America. Nobody checks credit. > much harder to get a credit in France If you aren’t rich, yes. If you have a personal banker, credit flows. > you don't get on the list randomly You do if you’re my friend and a SocGen clown mis-reports your mortgage as in default to the BdF. Both systems, the U.S. no-fly and French consumer credit, share common impetuses. They’re necessary, particularly for the elites. But they’re ideologically distasteful. So a system is maintained, shrouded in secrecy and, ideally, kept clear of the hoi polloi.
- anonporridge 4y ago
jhawk28 4y ago
The eighth amendment should make the no-fly list illegal.
- shadowgovt 4y ago
  "Cruel and unusual" has always been a very conceptually-flexible term. Regarding flight: nobody is assumed to have a right to fly, so the privilege of access to flight is easily revoked. A "no crossing state lines" list, in contrast, is heavily mediated by the judicial system and the burden generally only placed upon those intimately and immediately entangled in a legal action.
shadowgovt 4y ago
At least for the no-fly list (because I'm old enough to have watched the change happen): 9/11 caused an existential panic in the US public that made them willing to accept several new things in the name of safety against a threat model they did not understand. Once those things were in place, (a) burden of proof that removing them doesn't jeopardize our safety rests on those calling for their removal and (b) the average citizen can see the list doesn't impact them so they have little opinion on keeping or removing it. In short, it was a sticky-bit that once stuck, is hard to un-stick because people don't, generally, feel less free (day-to-day) with it in existence.
- slackfan 4y ago
  >existential panic in the US public that made them willing to accept several new things in the name of safety against a threat model they did not understand I'm old enough to have watched the change happen. There was no existential panic, but a straight up propaganda campaign waged by a collaborative media and government to ensure that this would be accepted, and that dissenters would be seen as "the other" to be feared and reviled, and potentially targeted for law enforcement action. Seems very familiar, but history rhymes.
  - shadowgovt 4y ago
    It's both. There's no doubt the ruling party invested time and effort selling their solutions to the public, but the public was also buying because all of a sudden, men armed with automatic rifles standing in the airport security lines was a comforting sight, not a terrifying one, for many, many Americans. ETA: Regarding effects on the American psyche, https://www.webmd.com/balance/features/american-psyche-post-911 https://www.webmd.com/balance/features/american-psyche-post-... summarizes some of the post-9/11 research. Probably most of interest is that 21% of Americans studied by a researcher at Carnegie Mellon believed they would be the victim of a terrorist attack within a year. That number proved to be a way-outsized overestimate, but I think it's easy to see how people accept new curtailments to freedoms (especially someone else's freedoms) if 1-in-5 of them believe they'll be personally attacked.
LatteLazy 4y ago
I generally agree but... Remember: the alternative of (non-government required) deplatforming is that anyone can do anything they want on any platform. Want to flood knitting forums with porn? Well they cannot refuse you! And that just makes it impossible for anyone to actually organise anything without constant trolling...
- mrguyorama 4y ago
  That knitting forum won't exist because if you upload child porn the website owner goes to jail, so they don't let you upload anything.
pc86 4y ago
Some of these are perpetrated by a government or agent of a government and shouldn't be tolerated at all. Some of these are perpetrated by private companies and it's a much more gray area whether or not it's ok. "De-platforming" gets a lot of press but Twitter, Facebook, et al are under no obligation to let any particular person or group use their platform, nor should they be.
thepasswordis 4y ago
There are two opposing groups: 1) Power comes from the people. It is centered in churches, families, and limited local city governments. 2) Power comes from the government. The federal government has the most power and the power decreases all the way down to the local level, which has the least power. The second group, obviously, has become richer and more powerful. It has also done a good job of capturing the minds of the richest and smartest people in the country, who have been convinced that problems require government solutions. There are a lot of people who don't accept these sorts of things, but they're called racists, white nationalists, nazis, and all other sorts of horrible (and usually illogical) things. To people who aren't politically active or don't have a good understanding of political philosophy, these accusations are very effective. "What you oppose a national list of people who are standing in the way of our great society? What are you a nazi?" etc.
- PentelicoMarble 4y ago
  I’d love an example of a person from the first group who was called a white nationalist because they think power comes from the people and not the government.
  - thepasswordis 4y ago
    Every single person who participated in the truckers rally in Canada.
    - mrguyorama 4y ago
      Ah, so the Nazi flag had nothing to do with it?
      - thepasswordis 4y ago
        The Nazi flag was there because somebody was calling Trudeau a nazi. As in: the thing they were there protesting they thought was similar to Nazism, and they think that is a bad thing which is why they are there protesting. There was as far as I can tell one instance of somebody doing this, and they were immediately denounced and told to stop. I agree, btw. Trudeau is an authoritarian, but he isn't a Nazi.
azov 4y ago
I honestly don’t understand the use case. Let’s imagine the list is public and the process is transparent. Who would you put on it and for what purpose? Who are those people dangerous enough to never be allowed on a plane (despite being searched, xrayed, water bottles and corkscrews taken away from them), yet not dangerous enough to roam free everywhere else?
morpheuskafka 4y ago
Here's what I don't get: 1) At some point, if you are on the list, they will have to tell you. If you were on the Selectee list, they could try to pretend that the additional screening was random/risk-based, but if they don't let you fly at all, they have to tell you that. 2) Aren't most of the people on the KST (know/suspected terrorist) list non-US citizens? If so, they have no chance of legally entering the US, so if they are flying here, they must be using a false identity. I'm not sure what the point of even having them on the list.
- spuz 4y ago
  > Aren't most of the people on the KST (know/suspected terrorist) list non-US citizens? If so, they have no chance of legally entering the US. I'm not following here. Why would being a non-US citizen give you no chance to enter the US?
  - post-it 4y ago
    They can just get turned away at customs when their passport is scanned.
  - morpheuskafka 4y ago
    Because if the government even thinks you might be a terrorist, they are not going to give you a visa/allow you to enter. And those checks are far more thorough than the checks to board a plane. The only exceptions I could see would be some of those people might be allowed in as representatives of a foreign government, and there might be a few people who already have green cards and the US doesn't have enough evidence to remove them.
    - spuz 4y ago
      This is assuming anyone you might want to add to the no-fly list is not already a US citizen.
breadbreadbread 4y ago
de-platforming isn't a state operation. it is a community moderation and liability management tool among private entities in a shared space. I think its a false equivalency to say that "not being allowed to spew hate speech on twitter" is the same as "having your house stolen by the government". Also twitter has an appeal process and most of the time they just ask you to delete a tweet.
- imwillofficial 4y ago
  This was shown to be false in the twitter files
  - greenhorn360 4y ago
    You're going to need to be more specific than that. I read them and you're making this up.
    - ChickenNugger 4y ago
      I guess you missed this one: https://twitter.com/mtaibbi/status/1613932017716195329 https://twitter.com/mtaibbi/status/1613932017716195329
      - darkarmani 4y ago
        Didn't that tweet say that twitter refused to take it down?
      - greenhorn360 4y ago
        A staffer of one politician asked Twitter to take content down and they refused. That sure doesn't look like a state level operation to me.
        ChickenNugger 4y ago
        >6.Even when Twitter didn’t suspend an account, that didn’t mean they didn’t act. Schiff’s office repeatedly complained about “QAnon related activity” that were often tweets about other matters, like the identity of the Ukraine “whistleblower” or the Steele dossier: https://twitter.com/mtaibbi/status/1613932028784742400 https://twitter.com/mtaibbi/status/1613932028784742400 >7.Twitter policy at the time didn’t ban QAnon, but “deamplified” such accounts. About the batch of tweets that included those above, Twitter execs wrote: “We can internally confirm that a number of the accounts flagged are already included in this deamplification.” https://twitter.com/mtaibbi/status/1613932028784742400 https://twitter.com/mtaibbi/status/1613932028784742400
exabrial 4y ago
> Also, there must some justice process for getting in and out of this list. This is backwards: there should be a justice process _for getting onto_ said list in the first place. The US Government has 0 authority to remove a right from a US citizen without a trial. The US Constitution is silent on whether or not this applies to non-citizens unfortunately, but my recommendation is handcuff the government's power whenever possible.
- Hamuko 4y ago
  Is flying a right?
  - exabrial 4y ago
    I mean, breathing or eating isn't listed in the constitution... are those rights?
    - Hamuko 4y ago
      Would the "right to eat" also mean the "right to food"?
      - notch898a 4y ago
        Positive right to be given food is different than negative right to not be stopped from obtaining food. Blocking someone from riding in a common carrier ordinarily open to the public falls under the "negative right" which is the variety of rights usually ascribed.
  - simple-thoughts 4y ago
    Yes, freedom of movement is a human right.
    - Hamuko 4y ago
      I feel like people have tried to use this as justification for operating a motor vehicle without a government-mandated license without much success.
Animats 4y ago
In one area, they don't, at least in the US. It was proposed at one point that the "no fly" list also be used as a "no gun" list. The gun nuts screamed.
- mrguyorama 4y ago
  The gun nuts scream at everything, anything, and sometimes when it's nothing. The no fly list still shouldn't be used for gun control. If we want gun control, we should look to do it in a way that doesn't further entrench the horse shit the USA implemented after 9/11
com2kid 4y ago
> List like these must be publicly available to anyone, like credit history/score. Devil's advocate, but the point of the no fly list is to stop someone carrying a flagged ID->person mapping from getting onboard an airplane. (Because fake IDs exist, IDs are not 1:1 to people!) If the no fly list was public, then people who wanted to get on an airplane and cause devastation would see if their current ID is blacklisted, and if so, go get a new ID under a different name. Hard but not impossible, especially with RealID constantly being delayed. If America had verified identifying documents that couldn't be easily forged, this wouldn't be a problem, but that isn't the infrastructure we have right now, and it really wasn't the infrastructure we had when the no fly list was implemented. Without biometric IDs, the no fly list is essentially a blacklist of IDs. How the list is used in practice is a separate discussion from the threat modeling exercise of should the list be public.
lamontcg 4y ago
Animal Farm was Orwell's critique of communism. 1984 was Orwell's critique of liberal democratic capitalism.

photonbucket 4y ago

How does the no-fly list work in practice? Are they just told 'no, go away' when they try to board a plane, or are they arrested?

carrja99 4y ago
I have always imagine walking through airport security like a normal person, then out of the blue you are tackled, arrested and charged with “illegal attempt to board a plane” and sentenced to twenty years in a federal prison. An over-reaction to be sure… I expect no less from modern US laws enforcement.
- PM_me_your_math 4y ago
  That's quite the imagination. You get denied a boarding pass if you are on a no fly list, asked to leave the airport, and told to contact DHS. If you are on the terror watch list, or have active arrest warrants from a court, you will be arrested. If you attempt to evade and resist arrest, then yes, you will probably get tackled and tuned up. People usually confuse the terrorist watch list with the no-fly list. The former being a list of persons known to having some involvement in terror activities in groups designated as terrorist groups by the US State Department. The No-Fly list is generally full of criminals, unruly passengers, and people who have gotten violent on flights with crew or other passengers. It is also imperfect, with false positives occurring with people who have the same name as another listee. It should be noted that the US government may not use the No Fly List to prevent U.S. citizens or permanent residents from returning home to U.S. territory, since doing so is a violation of the 14th amendment.
  - notch898a 4y ago
    What's the basis for arresting someone for just being on a watch list? That sounds unconstitutional. I was added to a watch list long ago that results in me being tossed in a cell and "detained" for up to 24 hours every time I go through customs but they always make it exceedingly clear I'm not under arrest (granted while sitting in immigration holding cell it doesn't feel much different). It really gets annoying just being told by CBP "you know what's next" while never being able to find out what list you've been put on. I hope more of these lists become public.

dotty- 4y ago

Discussion for original blog post detailing how the leak occurred: https://news.ycombinator.com/item?id=34446673 https://news.ycombinator.com/item?id=34446673

aestetix 4y ago

I hope the list is made public soon. The TSA needs to be abolished.

dsfyu404ed 4y ago
The politicians will never abolish a multi-billion dollar jobs program because having such a program to control gives them power. Being able to appoint someone somewhere, make rule changes in favor of this or that group, those are political currency and get exchanged as such in DC.
pg5 4y ago
What would be the alternative?
- ChickenNugger 4y ago
  Why do we need an alternative? Air travel existed for decades without it. Here's a more in-depth article on it: https://www.forbes.com/sites/ellistalton/2019/01/28/is-the-tsa-really-necessary/?sh=303c5b3025e0 https://www.forbes.com/sites/ellistalton/2019/01/28/is-the-t...
- mikecoles 4y ago
  The previous solution.
- somebody78978 4y ago
  We don't need an alternative. I've never understood why we need to go through security to board an airplane, but not to board a train.
  - jxramos 4y ago
    probably the likely outcomes of terrorism. On a plane the whole thing is demolished in a crash because of the kinetic energy involved in colliding with the earth. For a train probably not the same degree of destruction is attainable unless you like bomb a bridge or something of the sort.

scohesc 4y ago

Too bad there isn't a "reason" column showing even a summary of why they ended up on the no-fly list - probably because the reason is too sensitive for the people who regularly access the list to see. "Matters of National Security" and all that jazz.

boomboomsubban 4y ago
Isn't there a bullshit reason for that? Something like if they say why they're put on the list, it becomes an accusation of a crime and then punishment without a trial, but maintaining a list of people who can't fly is somehow OK.
anigbrowl 4y ago
A bunch of information like that (along with citizenship and so on is redacted), probably before the TSA gives it to the airlines. that way they can truthfully say they don't know why their computer said no. The ID fields for the entries start at 1 and run upwards chronologically thought not monotonically because people get removed from the list.
encryptluks2 4y ago
Wonder how many people would be on there out of retaliation for something personal, like their wife leaving them.

yawboakye 4y ago

i was contacted on twitter by the journalist at dailydot who broke the news (https://twitter.com/davidcovucci https://twitter.com/davidcovucci) because i have java code on github from ~10 years ago that reads a certain ‘nofly.csv’ file (https://gist.github.com/yawboakye/3888617 https://gist.github.com/yawboakye/3888617). the interaction was short and i wondered what he was looking for exactly. well, it was joke code, written as part of introduction to java. all this makes me wonder where ‘super-secret-nuclear-codes.csv’ could get me

nebula8804 4y ago
wow so some journalists have found the search bar on github. I knew it wasn't going to last but I wish it remained a hush hush thing longer.
- pphysch 4y ago
  Given the revelations about massive fraud in "Russian bot" detection (e.g. Hamilton 68) I'm inclined to believe the mainstream media is still wholly incompetent at anything of this sort. Probably because the laymen don't know any better.
  - milsorgen 4y ago
    Knoll's Law is a heck of a thing: https://effectiviology.com/knolls-law/ https://effectiviology.com/knolls-law/ Even though I'm aware of this phenomenon I constantly catch myself believing what I read until I remind myself to double check. Of course that leaves huge swaths of things I don't deem important enough to double check. I really wish there was a way to bring about, maybe not more accountability in media, but more faith that a news org or journalist is putting forth their best efforts to communicate correct information. It really is a tough nut to crack in terms resources available.
    - FredPret 4y ago
      You need multiple experts in a given topic to give a briefing to know what is going on. But now we need multiple experts in every single field, and layers of other people to verify that the former are, in fact, experts. The problem of accurate news is unsolvable.

metalcrow 4y ago

Link to the actual forum, since it's not provided for some reason: https://breached.vc/Thread-TSA-NoFly-List-Database-Leaked-Download https://breached.vc/Thread-TSA-NoFly-List-Database-Leaked-Do...

zoklet-enjoyer 4y ago
I can't register because my email isn't whitelisted. Does anyone here have the file?
- gruez 4y ago
  Even if you register you have to pay "credits" (which you get by paying for a subscription) to actually get the file.
  - bojangleslover 4y ago
    Which can only be paid with crypto...
    - from 4y ago
      Were you expecting participants in a criminal conspiracy to take Amex?
      - notch898a 4y ago
        I'm no lawyer but is this even a criminal conspiracy? I thought the 1A covered third party distribution of most stolen secret government information. The media does it and profits and apparently legally.
        from 4y ago
        I guess criminal conspiracy might be the wrong word. There is no prohibition on sharing hacked data as far as I can tell. There is “unauthorized access device” like having CC or SSN numbers but that’s only if you have an intent to defraud. Maybe they could argue stolen property? There is potentially copyright infringement in some cases but this is a government database so that doesn’t apply here.

boomboomsubban 4y ago

I wonder if they got the list from crimew or if they followed the directions on her blog. You'd hope the offending airline would have fixed the issue over the past few weeks but who knows.

rozab 4y ago
She said the data would be shared with journos, researchers or human rights organizations with a legitimate interest. https://ddosecrets.com/wiki/No_Fly_List https://ddosecrets.com/wiki/No_Fly_List If she really didn't do any pre-disclosure then it seems inevitable other people managed to grab it directly. I doubt she had much desire to share it after the long uncomfortable phone call she must have had with the FBI right after the post went live.
- duskwuff 4y ago
  > the long uncomfortable phone call she must have had with the FBI Maia is Swiss. She doesn't have to answer when the FBI calls.
  - super256 4y ago
    > Maia is Swiss. She doesn't have to answer when the FBI calls. According to her Wikipage “her parents' home were raided by the Swiss police at the request of United States authorities” a while ago. https://en.wikipedia.org/wiki/Maia_arson_crimew https://en.wikipedia.org/wiki/Maia_arson_crimew

openasocket 4y ago

What are the ethics of publishing such a list? The act of doing so exposes people and damages their reputations, and because there isn't a just procedure for adding people to that list that damage is likely unfair. It's not like this is the registry of sex offenders, where at least there was an actual court case to determine their registry and there are well-defined procedures for removal in case of mistakes or issues. Shouldn't we advocate for there to be a fair, just procedure for adding and removing people from the no-fly list before making it public?

rwmj 4y ago
Since every airline has a copy of this list you can be pretty sure that anyone who wants access sufficiently already has access. Every government, including enemies of the USA, every security agency, any airline IT employee. I would say distributing it in public is fairly neutral. > Shouldn't we advocate for there to be a fair, just procedure for adding and removing people from the no-fly list before making it public? Absolutely there should be this advocacy, but I don't see how that's connected to whether it is public or not.
kristofferR 4y ago
Most innocent people on this list wouldn't have standing to get removed from this list because they wouldn't have been able to prove they were on it before it was leaked.
- openasocket 4y ago
  I did some googling and couldn't find any examples of that, or any legal commentary suggesting that is the case. According to this ACLU page there is a standard process for you to determine whether or not you are on the list: https://www.aclu.org/know-your-rights/what-do-if-you-think-youre-no-fly-list https://www.aclu.org/know-your-rights/what-do-if-you-think-y... . At least if you're a U.S. citizen or lawful permanent resident that provides you official recognition of whether or not you are on the list. And even if you aren't a US citizen or lawful permanent resident, would a leaked list actually hold up in court?

freitzkriesler 4y ago

If a politician ran on eliminating the nudie TSA scanners and this silly list, I'd vote for him in a heart beat

shadowgovt 4y ago

Our industry is still not, in general, an industry that employs licensed professionals. Subsets of it, to be sure, but there is no such thing as a "computer engineering license" in the same sense as a "civil engineering license," for example. If there were, using production PII in the test infrastructure would be grounds for license revocation.

xwdv 4y ago

Let me tell you about the No-Rent list. Oh yes, if you fuck up a rental car or boat or do any kind of chargebacks for the rental, you will be immediately and automatically added to the No-Rent list for that company. Sometimes these lists can be distributed to central repositories where other rental companies can choose to follow the suggestions and not rent a car to you due to your status as high risk. One of my earliest jobs involved working on a system with such a list. I’ve had quite a bit of experience in engineering solutions to keep people in check. I suspect there might be something for real estate, but more fragmented. You could end up on a no-rental list and be banned from renting property. I am certain Airbnb has such a list as well.

Cyph0n 4y ago
Great, as if dealing with car rental companies wasn’t already a nightmare.
- xwdv 4y ago
  You have nothing to worry about if you’re a regular well mannered citizen. Otherwise why rent to someone with a history of making a company lose money each time they rent? Some customers aren’t worth the hassle.

BXLE_1-1-BitIs1 4y ago

Including the birthdate would be an improvement. Here in Canada, there's babies that get put through enhanced screening for having a flagged name, but there's an IT contract out there for many millions to provide something like redress numbers. ChatGpt could likely generate the SQL for well under a million.

mabbo 4y ago
One time I went on a work trip and brought my intern along- we were meeting the people his intern project would be used by in person. Fun trip all around. When our flight landed back in Toronto I said something like "Grab a coffee after customs and then head home?" and he's like "You go ahead. I have one of those names and I'm going to be here for a while." "Come again?" "There's someone out there who has the same name as me and because of whatever he did I now have to spend an hour in customs every time I come back to Canada." Sure enough, he texted me later saying "Alright, I'm through- you still at the airport?". I was at home, getting ready for bed.
- shwoopdiwoop 4y ago
  Is this not what re-dress numbers are supposed to solve? Once you get one assigned, you can enter them at the time of booking to prevent problems that might occur by sharing the same name with a known no-fly individual.

deleted 4y ago

[deleted]

jeffwask 4y ago

This is one of those terrifying security and operational scenarios. Sure the TSA can say nothing on our end was compromised but if the data is readily accessible to download and accessed by every mom and pop carrier with a 3 person IT staff that can barely keep the lights on is anything actually secure?

mrguyorama 4y ago
It's a weird concept that doesn't make sense: "Nobody can see it but every single company that interfaces with airline booking NEEDS to see it". The only way around this would be for DHS to host a web endpoint that took a name and answered whether they were on the list. This still has some problems like being able to enumerate over time.
- thewebcount 4y ago
  I mean, it's even more absurd than that. The data itself is rife with errors. Senator Ted Kennedy had to have himself removed from the list several times[0]. [0]https://www.cnn.com/2015/12/07/politics/no-fly-mistakes-cat-stevens-ted-kennedy-john-lewis/index.html https://www.cnn.com/2015/12/07/politics/no-fly-mistakes-cat-...
- eddsh1994 4y ago
  You could detect that enumeration and would require a list of everyones name - maybe add a DOB and a price per API call and it'd go down.
  - orev 4y ago
    Enumeration doesn’t have to mean using a brute force search. One could simply make the api call and then update a local database with the result. That local database would then become the potentially exposed data.
- htag 4y ago
  > This still has some problems like being able to enumerate over time. 1. There are eight billion people. Even if you had everyone's first name, last name and DOB you couldn't ask for more names (or more foreign names) then the size and location of your airline would allow without raising red flags with the wrong type of people. You would never get the complete list this way. 2. If you ask a DHS server if someone is allowed on an airplane, and they say no, there's a good chance that eventually someone at DHS will start to investigate. It's going to look a little bad if you don't have a reason for looking up the name. It's going to look very bad if this happens many times. 3. I wonder if an end user of an airline webportal could try to purchase tickets in someone else's and then see if it's denied to check if someone is on the no fly list.

gala8y 4y ago

OT: You could write a PhD not leaving their (bleepingcomputer) cookie consent pop-up.

LinuxBender 4y ago

I'm honestly surprised it's taken this long for one of these lists to be leaked. Many businesses are required to pull this and many other lists into their applications to approve/deny people and this is not just airlines. For the longest time these lists were on an unencrypted FTP server with a simple username/pw. I only had to deal with this because one of our firewalls did not play well with FTP. I tried to convince them to use HTTPS or SFTP. Hopefully they have at least done that by now.

baybal2 4y ago

[dead]

O__________O 4y ago

Assuming this list doesn’t include anyone who’s on the Secondary Security Screening Selection (SSSS) list by default: - https://wikipedia.org/wiki/Secondary_Security_Screening_Selection https://wikipedia.org/wiki/Secondary_Security_Screening_Sele...

advisedwang 4y ago
The article mentions a separate SELECTEE.csv presumed to be SSSS list.

kristofferR 4y ago

Interestringly the spreadsheet includes the columns SID,CLEARED,LASTNAME FIRSTNAME,MIDDLENAME,TYPE,DOB,POB,CITIZENSHIP,PASSPORT/IDNUMBER,MISC, but only LASTNAME, FIRSTNAME, DOB is populated. And there are some guys from 1911 and 1912 there.

ding_dang 4y ago

Breached is the new site of the RAID Forum that was taken down a few months ago.

bastardoperator 4y ago

The names are almost exclusively middle eastern.

willmadden 4y ago
The OFAC/Sanctions list is also overwhelmingly middle eastern. The OFAC list is public. The "nofly" list should be too.

sschueller 4y ago

What security benefit is there for this list being secret? Sure privacy may be an issue but I should have the right to know if I am on it as I see absolutely not benefit if this list being secret other than the government having another reason to put people in jail. Also if you know you are on it you can save the airlines and everyone else a lot of trouble by not trying to fly in the first place. Does the list even state why you are on it?

capableweb 4y ago
I'm guessing the official position is something like "If a suspected terrorist know they are a suspected terrorist, their behavior might change in order to hide easier, and sometimes we put suspected terrorists on the no-fly list, so if they could see that, they could figure out we now suspect them of something.". But that's just a guess, maybe there are better reasons out there.
- skywhopper 4y ago
  And yet, if they are on the selectee list and get pulled for SSSS screening every time they fly, they'll probably know.
  - naasking 4y ago
    If the list were public they could know this in advance though, and send someone who hasn't yet been flagged and so attacks would be harder to thwart. This is only hypothetical though, and given the size of the list I'm skeptical it's all that reliable to begin with.
  - capableweb 4y ago
    Maybe they handle it the same as if you trigger the anti-fraud system for the various IT companies ie they don't tell you anything but "I'm sorry but we cannot accept payments from you and I can't tell you why". To be honest, the whole thing sounds like a farce, just trying to get some understanding from perspective I don't myself hold.
- 4y ago

skywhopper 4y ago

I'm very curious about this list and whether I'm on it. I have an extremely common Anglo-American first+last name and there was a period of years when I would regularly get my boarding pass stamped "SSSS" and pulled aside for the secondary screening almost every time I flew, which at the time was 5-6 times a year or more. Now, my name is truly so common that I have convinced myself there was something more than just that name triggering the SSSS designation. Otherwise, most major airports would have been patting down someone with my name multiple times a day. I suppose that's possible, but if so it would really damn the value of this sort of list. The extra screening did seem to depend on which airline and which airports I was using, so maybe there was something else going on. Or maybe some dude with my name just crossed some line he shouldn't have and me and everyone else with that name paid the price for a few years.

lalopalota 4y ago
If you made it on to the plane, you weren't on the "no-fly" list. maybe some other list, but not this one.

omgomgomgomg 4y ago

Oh dear, yes we understand this is the world post 911, but many, many criminals will simply use entirelly fake identities. And the data hygiene and itegrity are horrible,there are dead people on it.

capableweb 4y ago

Seems there is a blog post authored by the same person credited in the dump ("maia arson crimew") describing how the data was acquired here: https://maia.crimew.gay/posts/how-to-hack-an-airline/ https://maia.crimew.gay/posts/how-to-hack-an-airline/ ("how to completely own an airline in 3 easy steps and grab the TSA nofly list along the way") Discussed 10 days ago on HN (1024 points | 642 comments): https://news.ycombinator.com/item?id=34446673 https://news.ycombinator.com/item?id=34446673

hn_throwaway_99 4y ago

The way the no fly list was shared, it was absolutely inevitable that this would happen. A much more secure way to handle this: 1. Airlines are each given a no fly list that only includes tokens, e.g. each person's name hashed with a secret key that is specific to the airline, on a periodic basis. 2. When the airline wants to check if a user is on the list, they hit a government-owned service that returns the user's token (again, the token will be unique for each airline because each airline gets their own secret key). 3. The airline would then check the token against their revoked token list. The benefit of this is: 1. The full token list by itself is useless 2. Even if the airlines API credentials are stolen, the response from the government-owned service is useless on its own. 3. So a bad guy would need to steal the token list AND the API creds to get any value, and even then it would be easy for the government to detect unusual access patterns to their service. Remember back in the late 90s when we all used to store passwords in plain text? Yeah, we know how that turned out, and in this case, storing the list not only in plain text but sharing it to tons of different companies willy nilly is a million times worse if you expect it to stay secret.

mitthrowaway2 4y ago
Maybe the government could also make this service available to parents, who can query it to find out if they should pick a different name for their baby? Seriously, using names for a no-fly-list is falsehood 21. https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...
- Scoundreller 4y ago
  Happens in Canada too. A 6 year old ended up on the list. Four years later; they were still on it with the government promising a fix the next year… https://www.cbc.ca/news/politics/canada-no-fly-list-kids-meeting-public-safety-minister-1.5403518 https://www.cbc.ca/news/politics/canada-no-fly-list-kids-mee... https://www.cbc.ca/news/canada/toronto/no-fly-list-canada-1.5396974 https://www.cbc.ca/news/canada/toronto/no-fly-list-canada-1....
dosethree 4y ago

gggggg5 4y ago

My comment linking to the file seems to have been quietly censored by dang or some other moderator. Not [flagged], just [dead]. https://news.ycombinator.com/item?id=34583299 https://news.ycombinator.com/item?id=34583299 Linking to this file does not seem to violate any documented HN rules, and download links charging money for the file were allowed to stay up.

Denatonium 4y ago
The Wayback Machine has it archived!