It’s a fact of life that everyone makes mistakes, but leaving the no-fly list exposed on the internet is a particularly egregious error. That’s the situation that U.S. airline CommuteAir found themselves in when a Swiss hacker known as “maia arson crimew” discovered an unsecured server while using the specialized search engine Shodan. The server was reportedly filled with sensitive information, including a version of the no-fly list from four years ago, which was conveniently labeled “NoFly.csv.”
According to a blog post from crimew titled “how to completely own an airline in 3 easy steps,” the hacker found the server purely out of boredom. They were just casually browsing when they stumbled upon the exposed server belonging to CommuteAir. “At this point, I’ve probably clicked through about 20 boring exposed servers with very little of any interest, when I suddenly start seeing some familiar words,” crimew says in their blogpost. “‘ACARS’, lots of mentions of ‘crew’ and so on. Lots of words I’ve heard before, most likely while binge-watching Mentour Pilot YouTube videos. Jackpot.”
CommuteAir, a regional U.S. airline based in Ohio, confirmed to the Daily Dot that the information on the server was authentic. The server has since been taken offline. The data included a 2019 version of the federal no-fly list that included first and last names and dates of birth, as well as certain employee and flight information. CommuteAir has submitted notification to the Cybersecurity and Infrastructure Security Agency and is continuing with a full investigation.
The information from the server has already been analyzed by researchers, with some claiming that it shows how heavily biased the no-fly list is against Muslim people. While there is no official number for how many names are on the list, Sen. Dianne Feinstein (D-Calif.) suggested in 2016 that there were over 81,000 people on the list.
This incident serves as a stark reminder of the importance of cybersecurity in the modern age, especially when it comes to sensitive information like the no-fly list. It’s a cautionary tale for companies and organizations of all sizes to take the necessary steps to protect their data and avoid a similar fate as CommuteAir.
