iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
The fallout from last week’s leaking of the United States’ no-fly list is continuing, with the Transportation Security Administration sharing a new security directive with both airports and airline operators.
The list — which was created in the aftermath of the 9/11 attacks on the US — contains the names of suspected terrorists and other bad actors who are restricted from travelling into or through the US. A Swiss security researcher was able to exfiltrate the list from a domestic carrier last week while casually searching for unsecured servers in her spare time.
While the TSA has not yet published the directive on its own site, it is circulating among some media. It warns all carriers and airports to engage in tighter cyber security procedures. According to a spokesperson who spoke to The Record, it “reinforces existing requirements on handling sensitive security information and personally identifiable information”.
“We will continue to work with partners to ensure that they implement security requirements to safeguard systems and networks from cyber attacks,” the spokesperson told The Record.
As well as the no-fly list and a similar tracking document, the researcher was also able to access some employee records. In an incident report to the Office of the Maine Attorney General, the airline — CommuteAir — revealed that the total number of affected employees was 1,473.
According to a letter sent to employees, and listed as part of the incident report, the compromised data includes “name, date of birth, phone number, address, last four digits of social security number, and information specific to flight crews such as hours flown”.
No financial or health information was thought to have been accessed. Nonetheless, CommuteAir has suggested that its affected employees take advantage of frequent credit checks and has offered a subscription to an identity theft protection plan supplied by LifeLock.
It must be noted that LifeLock has had its own security woes recently.
While CommuteAir and the TSA continue to investigate the incident, the US Congress is also hosting its own inquiries.
“The entire US no-fly list – with 1.5 million+ entries – was found on an unsecured server by a Swiss hacker,” tweeted Republican congressman Dan Bishop last week.
“Besides the fact that the list is a civil liberties nightmare, how was this info so easily accessible? We’ll be coming for answers.”
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.
Be the first to hear the latest developments in the cyber industry.
