Sometimes you do not need a hacker to have sensitive data exposed. A discovery by security consultant Mackeeper last week revealed that an Air Force backup drive was easily accessed and contained a treasure trove of data. Along with names, addresses, and other personal identifying data, the documents found included the security clearance renewal applications (SF86) for two four star generals as well as detail of an investigation of a three star accused of diverting $50,000 from the National Guard.
Zdnet reviewed the documents and found “names and addresses, ranks, and Social Security numbers of more than 4,000 officers.” Another document listed personnel with their security clearance levels, including some with code word level clearances. Still another spreadsheet contained information about officers under investigation by the military. The website notes “Though many of the files were considered “confidential” or “sensitive,” a deeper keyword-based search of the files did not reveal any material marked as classified.”
Service Member and Celebrity Data Compromised
The drive also contained “a list of Social Security numbers, passport numbers, and other contact information on high-profile figures and celebrities, including Channing Tatum.” This was apparently related to a tour that the actor took to Afghanistan in 2015.
Also found on the drive were “gigabytes” of Outlook files and at least one backup. The files exposed years of email.
The information exposed by some of these documents is enough to allow a criminal to steal an identity. Exposure of security clearances, especially code word clearances, poses a threat to national security as well as to the individuals, who could be subject to increased personal risk because of what they know.
A potent source of blackmail material would be the officers under investigation list, as well as material in the SF86s, notes The Hill. An officer may not want embarrassing or compromising information revealed and that provides a lever for unfriendly intelligence agencies.
MacKeeper notes that the device is no longer online. They are unable to determine if anyone other than themselves accessed the drive while it was publicly available. None of the reporting news media were able to obtain comments from anyone in the military or government on the situation.
