11 ms·
U.S. military members' personal data being sold by online brokers
- 23B1 3y agoPDF of the study: https://techpolicy.sanford.duke.edu/wp-content/uploads/sites/4/2023/11/Sherman-et-al-2023-Data-Brokers-and-the-Sale-of-Data-on-US-Military-Personnel.pdf https://techpolicy.sanford.duke.edu/wp-content/uploads/sites...
- wutwutwat 3y agoWe're talking about cybersecurity here. Of course I'll open up that PDF without hesitation! /s https://www.google.com/search?q=pdf+used+in+cyber+attack https://www.google.com/search?q=pdf+used+in+cyber+attack
- jcadam 3y agoI'm sure the military still has a SSN field on EVERY. SINGLE. FORM. they have you fill out while you're in the service. There was talk of replacing that with a "service number" but somehow I doubt they've got around to it yet. Between VA employees leaving laptops full of PII laying around and that big OPM leak several years ago, I apparently have no private life.
- LtWorf 3y agoThe problem is treating the SSN as a username and a password. It should not be the only information required to authenticate people.
- user3939382 3y agoIt should be used for your social security account and nothing else.
- tczMUFlmoNk 3y agoHuh. As a member of a generation that has grown up tacitly understanding that social security will very likely be insolvent/cancelled by the time that we're old enough to qualify for it, and thus we shouldn't rely on it whatsoever—it's surreal to consciously connect these two concepts. For me, "social security number" is just the name for the ID number that so many of us have and are used to writing everywhere. The name is just a string of symbols. It sounds silly, but I've never thought about it in relation to social security. Thanks for the mind-bender. :-)
- SonicScrub 3y agoThere's an interesting story about how the social security number evolved to being much more than just for social security. Quick 5 minute primer: https://m.youtube.com/watch?v=Erp8IAUouus&pp=ygUYY2dwIGdyZXkgc29jaWFsIHNlY3VyaXR5 https://m.youtube.com/watch?v=Erp8IAUouus&pp=ygUYY2dwIGdyZXk...
- askiiart 3y agoShort link without tracking id (si=): https://youtu.be/Erp8IAUouus https://youtu.be/Erp8IAUouus
- dragonwriter 3y ago> As a member of a generation that has grown up tacitly understanding that social security will very likely be insolvent/cancelled by the time that we're old enough to qualify for it Is it “tacitly understanding” when you've been bathed your whole life in active propaganda promoting an idea? Because, on this, if you are in any cohort from Gen X, or maybe the trailing edge of thr Boomers, on, you have been.
- jcadam 3y agoNah, we'll get our SS checks - the Fed will turn the money printer up to 11 if they have to cover the program. Inflation will make them worthless, but we'll get our checks :)
- stonogo 3y agoThe US military does not use the SSN as a username or a password. They've had smartcards, even on Linux, as far back as 20 years ago or more. Users without smartcards have to go through 2FA with a username/password combination and codes over SMS or proper TOTP (depending on agency). The problem is that the entire Department of Defense is still very much a paper-oriented organization, and they got rid of service numbers in the 1970s, leaving the SSN as the only meaningful unique identifier. As a result it gets put on every piece of paperwork associated with a service member. Their own recordkeeping practices have the consequence that if you get almost any paperwork regarding a soldier, it has enough information to gain access to other personal information.
- swells34 3y agoYou've hit the nail mostly on the head. Paper is a problem, for obvious reasons, especially the amount of triplicate hand filled forms that require all of your PII every time. The second issue is access control vs. expediency. Millions of people, all over the world, can digitally access huge amounts of your personal information at a whim, by only having your name, or your military email address. This is an important requirement for quickly checking on a person or their orders or their training status, but at the sacrifice of personal information security for you. It gets even worse going to the VA, which I can say from personal experience, will happily allow just about anyone to have whatever information they want about you. I got a happy surprise letter from them stating that my DD-214, a super identity document, containing information found on a birth certificate, a social security card, a driver's license, plus so much more, had been put on a thumb drive by a third party contractor, along with thousands of other service members info, and sold to a dark web information broker. So, the problem is just that it's to the military's benefit to not protect you.
- LtWorf 3y agoI wasn't talking about the military per se. I was talking about how you can open a bank account just by knowing someone else's ssn
- hindsightbias 3y agoYou should sit in on a call to dfas.mil sometime. Where they ask an 80 year old over a dozen obscure questions on their service record and hang up when you get one of them wrong, resetting the clock 24 hours.
- kube-system 3y agoThe government doesn't do this though, it's mostly banks that are guilty.
- LtWorf 3y agoThe government should regulate the banks.
- kube-system 3y agoI am sure the executive branch would require banks to use a better identifier, if the legislative branch allowed the executive branch to create one.
- RobRivera 3y agoDipi keys are a thing and have been put to good use
- RecycledEle 3y agoI've never heard of "dipi keys." Can you tell me about them?
- randombits0 3y agoChinese hackers stole over 70 million records of current/past military members from the Office of Management and Budget back in April of 2014.
- warner25 3y agoI think you're thinking of the Office of Personnel Management (OPM), not OMB (although I did just learn that the Trump administration proposed to merge parts of OPM into OMB). https://en.wikipedia.org/wiki/United_States_Office_of_Personnel_Management#2015_data_breach https://en.wikipedia.org/wiki/United_States_Office_of_Person... But yeah, compared to that, sadly, this acquisition of much less detailed information about 30,000 service members seems moot.
- trvrsalom 3y agoThere are DOD ID numbers, but they've updated the forms to just ask for both.
- jcadam 3y ago... sounds like DoD.
- warner25 3y agoIn my experience, though, people now freak out if you fill in the SSN field on the form, because that makes it PII with a bunch of requirements for proper storage and transmission. This is despite the fact that most of the other information on the form already makes it PII, regardless of the presence of a SSN. It did take a few years in the mid-2010s for the forms to catch up and replace the SSN field with the DOD ID number. In 2021, I think I was supposed to get new ID tags (dog tags) that would have my DOD ID number instead of my SSN.
- herewulf 3y agoI wish my experience was people freaking out but instead it's continued carelessness and near indifference. Oftentimes with HR NCOs even. I would like to see loss of PII given the same treatment as classified spillage.
- jklinger410 3y agoI heard this on NPR and I appreciate the avenue by which the red flag is being raised, but it bothers the shit out of me, because EVERYONE'S personal data is being sold by online brokers. The implication that their data is more important or something just seems like a ploy to get more eyeballs on the research.
- _yo2u 3y agoSometimes that is all that is needed to move the needle. Tik tok almost moved it but that just made certain swaths of the political spectrum ask for a direct ban (with other downsides eg. 1st amendment concerns) instead of overarching policy reform. "Policymakers should consider the following steps: Congress should pass a comprehensive U.S. privacy law, with strong controls on the data brokerage ecosystem. The most effective step to prevent harms from data brokerage for all Americans would be a strong, comprehensive privacy law."
- permo-w 3y agoif you don't just ban it, you get the whole GDPR consent banner issue. what is the downside of banning it? it's not like businesses couldn't manage advertising before the internet was around
- kube-system 3y agoMore specific statements can be more impactful to the listener. "Everyone's car is getting stolen these days" ... "Yeah, isn't that crazy? What are ya gonna do?" "Your car is getting stolen right now" ... "Wait, what!?!?" I think people really just write off the scale and scope of data privacy in this country as "yeah, sounds bad, but since it's happening to everyone there's nothing I can do about it"
- QuarterReptile 3y agoYeah, I thought this was about the sale of data that had been collected by the military on a compulsory basis; this article is not news. I clicked through because I wanted to see whether the data was health info or OPM breach data.
- 3y ago
- jjkeddo199 3y agoSeeing drone dropped grenades everywhere in Ukraine has made me worried about normalized "drone drop murders" spreading to the rest of the world. With widely available addresses gang violence, political killings, and even online flamewar escalations will become much much uglier. Who needs to do a driveby shooting if you could drop a homemade bomb from a McDonalds bathroom 20 miles away using some jailbroken drone? Violence isn't the only issue either -- Imagine what will happen when courts catch up to the internet age. Get ready for the normalization of digging through decades of comment history to character assassinate people on a whim. This is getting really bad. I don't think society at large is ready for the coming nightmare. -- We need immediate privacy reforms to: 1. Fine companies for requiring unneeded personal data. Fine companies for collecting addresses and numbers when they don't need them. Address + number specifically should be dumped when no longer needed. 2. Fully regulate+audit data-based industries to confirm that anonymized user profiles are truly anonymous. 3. Raise the legal bar allowing usage of personal data to harm an individual. Lawyers and employers shouldn't be able to find+splice your Youtube comment history to try and character assassinate you outside of some felony-tier criminal case.
- fusslo 3y agoare explosives as easy to get as bullets & guns where you live?
- permo-w 3y agoexplosives are a 10 minute youtube video away
- wutwutwat 3y agoWait until someone puts a gun on a drone and shoots up a concert from states away, or another country...
- micromacrofoot 3y agowe're not talking about UAVs here though, someone needs to configure the drone very locally
- wutwutwat 3y agoOn Linkedin there's all kinds of "Top Secret/Security Clearance" groups which lists all the members in that group. Some have 5 thousand people. Sure, some of those users don't actually have clearance at all, but many actually do, and work at firms all doing contracting for the federal government. Call me crazy, but giving out a list of people with clearance to the highest levels of secrets, usually doing tech work, is a bad idea. Even if a tiny fraction of them has anything that can be used as leverage to flip them, they all have targets on their backs and it kinda blows my mind that they all run around proudly plastering such things on their profiles and in public groups. It seems that's the last thing they would all be doing, as to not draw any attention from "the enemy" "TS/SCI cleared IT Professionals" - https://www.linkedin.com/groups/3967699/ https://www.linkedin.com/groups/3967699/
- permo-w 3y agoin a similar area, it absolutely pains me to see the amount of personal information demanded by online job applications. realistically how hard would it be for me to set up a fake job listing on Indeed and just hoover up highly valuable PII? you could even take it further with personality tests, IQ scores, RATs, etc. if you were a foreign power wanting to gather data on defence programmers, for blackmail, corruption, surveillance etc, why wouldn't you do this?
- wutwutwat 3y agoI've been personally dealing with this exact thing. And it doesn't help that linkedin is a shit show of fake companies and job postings that seem to be doing exactly what you said, phishing for PII. Like, why the fuck is a job application asking me for my address? It's a remote job, the absolute most you would ever need is my city. There's a lot of companies that think I'm the very lucky resident at 123 Main St :) The day a job application asks for my SSN is the day I quit tech for good and go work for cash only under the table
- permo-w 3y agoI had an interview with a recruiter recently where I asked them about their data protection practices and they put the phone down on me
- PrimeMcFly 3y agoMost people's data is being sold. No reason military people would be exempt.
- 23B1 3y agoThe reason is twofold: 1. Servicemembers hold security clearances and thus access to critical things. 2. Leaked PII is a national security threat. This report, I'd argue, is good 'marketing' for the very real need for privacy protections nationwide. The U.S. military is, despite its best efforts, still an admired and respected institution.
- PrimeMcFly 3y agoThat doesn't have any relevance to my point. Currently there is no infrastructure in place to secure people with clearance more than anyone else, so it's no surprise their data is available. As for your second point, big shrug. All the data is already out there and isn't going away anytime soon. Best case is to protect future data from being leaked, but the US isn't going to outlaw data brokers anytime soon and holding companies with poor computer security practices to account is very recent.
- 23B1 3y agoYou are incorrect that there's no infra to secure people with clearances. WRT your second point, 'all the data is out there' is an awful argument. The solution is simple: if you want to do business with or in the United States, you must respect its citizens' rights. There's plenty of other comparable regulatory frameworks; food safety, weapons, etc.
- PrimeMcFly 3y ago> You are incorrect that there's no infra to secure people with clearances I'm not. If there was, their data wouldn't be lumped in with everyone else when it's leaked/hacked from all these large different organizations. > WRT your second point, 'all the data is out there' is an awful argument. It's a fact. You won't be able to remove that stuff now that it's out. IT's somewhat an instance of the Streisand effect. Numerous people have it torrented and downloaded locally. > The solution is simple: if you want to do business with or in the United States, you must respect its citizens' rights. That's not any kind of solution, especially when much of the issue is internal.
- asix66 3y agoWhat ever happend from John Oliver's privacy exposé last year? [0] Seems he was going to submit a docket of info collected on congress people which was supposed to nudge actions towards regulating data broker collections and online privacy. [0] https://www.youtube.com/watch?v=wqn3gR1WTcA https://www.youtube.com/watch?v=wqn3gR1WTcA
- egberts1 3y agoI did complain about potential OMB leakage of defense workers to my HR, that too fell on deaf ears. Then this OMB started leaking fingerprints of TS contractors. They caught the Chinese contractor. No telling if damage was done.
- gigel82 3y agoThat reminds me of Strava leaking the workouts of military members, making it very easy to identify the location of secret military bases (this video mentions it: https://www.youtube.com/watch?v=V2WrDZnk33g&t=341s https://www.youtube.com/watch?v=V2WrDZnk33g&t=341s).
- reustle 3y agoI would lean more towards saying that the soldiers leaked their locations, more than Strava itself.
- RecycledEle 3y agoImagine knowing where the enemy is because you bought the info in Bitcoin from a dark web site. Then you hit them with AI-piloted drones. Welcome to a cyberpunk novel I could not get through when I was in college, but now it's real.
- roshin 3y agoThe issue is made so much worse because banks and the like are willing to withdraw money from someone's account with just the SSN and some other basic information. And the banks aren't held accountable when they give your money to a scammer. Rather they blame you for identity theft, and the government sides with the banks.
- juanani 3y ago[dead]
- goodboyjojo 3y agothis is sad. i wish we had better data privacy
- hulitu 3y ago> U.S. military members' personal data being sold by online brokers Everybody's data is being sold by online brokers. Welcome to the 21 century.
- hermannj314 3y agoWe've spent two decades since 9/11 constantly asking everyone if they are active-duty or former military (boarding priority, 10% off at lowes, free meals on veterans day), and now we have a hunch some data might have been leaked? What outcome did we expect? There are some aspects of my work history that no one knows about and I would definitely not share them with a 3rd party just so I can board a plane 3 minutes before everyone else.
- SergeAx 3y agoI live in Europe (non-EU) and can't wrap my head around the fact that selling PD is legal in the US.