Hugo Hacker News

Terrorist watchlist exposed via misconfigured Elasticsearch cluster

cyberlurker 2021-08-18 17:20:51 +0000 UTC [ - ]

> “The terrorist watchlist is made up of people who are suspected of terrorism but who have not necessarily been charged with any crime,” Diachenko wrote. “In the wrong hands, this list could be used to oppress, harass, or persecute people on the list and their families. It could cause any number of personal and professional problems for innocent people whose names are included in the list.”

I’m curious how many journalists are on the list. Now that we are pulling out of Afghanistan, we should reevaluate the other actions we took after 9/11. The patriot act deserves another look and possible edit.

pessimizer 2021-08-18 17:50:53 +0000 UTC [ - ]

You mean being put on a restricted rights/law enforcement attention list with no due process? Definitely. I hate to be the slippery slope guy, but this began with gang affiliation lists.

https://blockclubchicago.org/2021/07/28/police-gang-database...

https://www.tampabay.com/news/publicsafety/crime/police-gang...

https://www.avvo.com/legal-answers/i-was-put-on-the-gang-lis...

https://www.policemag.com/340392/identifying-and-documenting...

tinalumfoil 2021-08-18 18:01:00 +0000 UTC [ - ]

> but this began with gang affiliation lists

Civil courts have been able to exercise significant control of your life, including extended imprisonment without due process, for longer than these lists have been in effect. Frankly Americans have a lot fewer rights than they think they have, including the non-right of due process for being on a government list.

Edit: To pre-empt some comments I know are coming, civil courts do not require due process in the way you probably think of due process: a civil court can act against you without giving you representation, without allowing you to have representation, without you present, in secret from the public, and even without notifying you

EDIT2: While I'm soapboxing I'll note the power the civil court has over you isn't much different than the power three-letter agencies have over you (since they are usually given very broad mandates), it's just that civil courts have been around so much longer it's a good retort to people thinking they used to have rights. Whatever three-letters can't do to you is generally picked up by similar state agencies.

owl_troupe 2021-08-18 19:07:08 +0000 UTC [ - ]

> a civil court can act against you without giving you representation, without allowing you to have representation, without you present, in secret from the public, and even without notifying you

While there is no right to be afforded free legal representation in civil court in most US jurisdictions (some do) and a civil court can render rulings and judgments against parties who are not represented by counsel, a civil court cannot prohibit a party from having legal representation, which is what your comment seems to suggest.

A civil court can render a ruling against a party if the party is not present, but it will typically go to great lengths to ensure that notice is given to parties before doing so (pleadings served to last address by process server, notice published, etc.). There are typically strict requirements that have to be met before civil court can render a ruling or judgment without a party present, especially where there is no indication that the party has received notice first.

A lot of anecdotes about drastic judgments and rulings being handed down by civil courts happen when parties ignore notice of the proceedings. There are a lot of rules for handling cases in civil court and they are grounded in the constitutional right to due process. Notice and due process are taken really seriously in most US jurisdictions. Federal Courts are especially strict about following the rules.

https://www.law.cornell.edu/rules/frcp

stjohnswarts 2021-08-19 15:21:15 +0000 UTC [ - ]

I think the brunt of their points are there are few protections and they tend to have far to much power over those who not in the 1% and can afford to drag a case out for years. Also judges are people too and quite often are affected by emotion. Statistically your are significantly more likely to get off with a better judgement if they've just had a good lunch. https://www.discovermagazine.com/the-sciences/justice-is-ser...

giantg2 2021-08-18 20:18:54 +0000 UTC [ - ]

"A civil court can render a ruling against a party if the party is not present, but it will typically go to great lengths to ensure that notice is given to parties before doing so"

In many types of cases, but not all. Protection from abuse order hearings generally happen without the knowledge of the target of the order.

nieve 2021-08-19 02:10:59 +0000 UTC [ - ]

For good reason, even starting the process can set off violence and it's not instant to complete.

giantg2 2021-08-19 02:32:16 +0000 UTC [ - ]

I honestly don't see a good reason.

The process is commonly abused by divorce lawyers to gain control of the house for their client, and the bar for evidence is extremely low. The way our adversarial justice system is supposed to work is that the truth comes out in a fair fight. This process obviously ignores this foundation.

If there's really enough evidence to suggest immediate violence, then they should be arrested for terroristic threats and other stuff. And let's not forget that the protective order is just a piece of paper and won't stop any violence if the person is truly motivated.

Frankly, I think a lot of civil court actions have been created just to avoid the protections guaranteed in the criminal system.

tinalumfoil 2021-08-18 19:52:06 +0000 UTC [ - ]

> a civil court cannot prohibit a party from having legal representation, which is what your comment seems to suggest.

> https://www.law.cornell.edu/rules/frcp

This is a good point for federal cases, but I meant my comment to cover civil action in state courts too. These are the courts that are most likely to affect someone's life. For instance in California small claims courts you are not allowed to be represented.

Spooky23 2021-08-18 20:36:59 +0000 UTC [ - ]

That’s by design to make justice more accessible. IIRC, you can petition the judge to adjourn the case and move it to normal court.

Also, I believe in small claims as a defendant you can appoint an attorney to represent you. I sued a tow operator in small claims court and the dude who showed up was definitely an attorney.

derefr 2021-08-19 01:29:25 +0000 UTC [ - ]

> I sued a tow operator in small claims court and the dude who showed up was definitely an attorney.

That might be because you were suing a company, though. How would a company "represent itself"? Get the board of directors in?

true_religion 2021-08-19 01:42:10 +0000 UTC [ - ]

Lots of times they just send an executive. See the Uber civil cases.

aidenn0 2021-08-18 23:15:04 +0000 UTC [ - ]

Small claims courts have very limited powers though. They cannot impose any sanction except a small amount of remuneration.

giantg2 2021-08-18 20:17:09 +0000 UTC [ - ]

"Frankly Americans have a lot fewer rights than they think they have"

Very true

CrazyPyroLinux 2021-08-19 02:56:33 +0000 UTC [ - ]

Classic George Carlin - "You have no rights!" https://www.youtube.com/watch?v=m9-R8T1SuG4

vmception 2021-08-18 18:53:32 +0000 UTC [ - ]

I've never had a good experience "pre-empting" comments that will inevitably be used to derail your thread.

In any case, I was mostly thinking that it has to be a form of privilege to feel like a particular slippery slope hasn't happened yet. I think about how the word "privilege" is used, and its more like "exemption from some inconveniences that aren't obvious". Your post about people not noticing that civil courts and agencies have these power over assumed rights is a decent example of that.

godelski 2021-08-18 19:06:57 +0000 UTC [ - ]

Worse than that, sometimes these intelligence agencies create said terrorists.

> Of these defendants caught up in FBI terrorism sting operations, an FBI informant was the person who led one of every three terrorist plots, and the FBI also provided all of the necessary weapons, money, and transportation.

I'm sure such a thing is something no American would agree with. I wouldn't be surprised if similar actions were happening at all levels (gangs to terrorists). I'm sure this also isn't isolated to America either, as it appears to be the incentives that causes this and how we measure success (i.e. how many criminals are caught).

These conversations are extremely complex. But I think we need large social discussions about how to actually solve crime and prevent animosity in the world. I think it is time for a big rethink. If there's 2 million people on a list, I'm not sure that list is very effective. It's like looking for needles in a haystack by adding more hay.

[0] https://www.brandeis.edu/investigate/government-corporate-wr...

frickinLasers 2021-08-18 19:28:48 +0000 UTC [ - ]

> I think it is time for a big rethink.

I'm in. Where's the convention, and how do we get our idiot representatives to play along?

godelski 2021-08-18 20:34:13 +0000 UTC [ - ]

Here's my positions, but of course I'm open to other opinions. I wrote a big list and I realized I could distill a lot of my ideas. For one I'm a big fan of STAR and Approval voting. We've seen over a hundred years of ordinal methods in various countries (including America) and seen the failure. Time to move to what the experts are suggesting. Which brings me to the second point. Lots of these topics are extremely complex and contain a lot of nuance. Us non-experts can see a high level but sometimes these nuanced points matter a lot. So let's not be so aggressive in asserting how right we are. Also, we need to focus on unity. Mic drops and calling people names doesn't help us. We need nuanced and calm conversations. Our fellow citizens, no matter how crazy their beliefs, are not our enemies. Don't dehumanize people, that's divide and rule. Lastly, we need to stay focused. I think there is a new thing to be outraged about every other day. Let's talk about what the big important problems are and focus on those first. Let's recognize that doing so isn't dismissing the other problems. We only have so much bandwidth. Right now we have no such priority list, we're just jumping from thing to thing. Solving problems takes time (a thing we often forget). If our attention to the problem is shorter than the time it takes to solve the problem then we will never solve these problems.

Edit: One thing I wanted to add is that we can have different groups focus on different things. It's not a zero sum game. This is because not everyone is an expert in everything, and thus the utility they contribute isn't the same as every task they contribute to.

arminiusreturns 2021-08-18 20:15:16 +0000 UTC [ - ]

You refuse the two party system and work on a third party geared towards pre-emptive avoidance of the corruption mechanisms that got the two big ones. Do that at the local and state level first, attacking gerrymandering and other incumbent favoring electoral manipulation methods to weaken the two party strangle hold, such as heavy petitioning and lobbying to force state Secretaries of State to fix election laws.

Until we the people are actually represented in the legislative branch nothing fundamental will change. Being that the other branches are largely unaccountable to the citizenry, the legislative branch is the logical entity to focus on (and the fourth estate, heavily under attack by the executive et al)

not2b 2021-08-18 21:33:34 +0000 UTC [ - ]

Under the US system as it is, with first-past-the-post voting and all votes for a state going to the presidential candidate who got the most, a third party can't gain any traction. Worse, third parties under the US system are another vehicle for corruption (example: Republicans paying fees and collecting signatures to get Greens on the ballot to divide the left vote and get a Republican in office, though this problem could be fixed with some form of instant runoff). You'd need constitutional reform.

While imperfect, I think that German electoral system is much better. Any party that gets 5% or more of the vote is guaranteed fair representation, gerrymandering isn't a possibility.

However, in a multiparty system deals still have to be struck to put together governing coalitions, so a party that insists on being purist is likely to be shut out.

nerpderp82 2021-08-19 16:14:53 +0000 UTC [ - ]

> While imperfect, I think that German electoral system is much better. Any party that gets 5% or more of the vote is guaranteed fair representation, gerrymandering isn't a possibility.

How do we bring this to the US?

dane-pgp 2021-08-18 22:24:22 +0000 UTC [ - ]

> to get Greens on the ballot to divide the left vote and get a Republican in office

If people are serious about voting reform (and they should be) then this "spoiler effect" can be weaponized: start a grassroots campaign to vote third party until the Democrats support changing the voting system at the state level (and vote in primaries for Democrats who support this change).

This may lead to few tight state races being lost, but that means that only a small percentage of the population would be enough to get the Democratic Party officials to take notice. To make the signal even more clear, the third party chosen should be one that focuses as narrowly as possible on voting reform, such as the Alliance Party[0], which may also encourage some disgruntled Republicans to temporarily lend their votes, whereas they would be more reluctant to support the Green Party, for example.

Of course there is a danger that voting reform would get portrayed as a pro-Democrat policy (if it isn't already), but once enough Republicans (in majority Democrat states) have experience casting their ballot in a more expressive and representative system, it will be harder for Republicans in other states to oppose it.

[0] https://www.theallianceparty.com/political_reform

godelski 2021-08-19 00:29:28 +0000 UTC [ - ]

To be honest, a lot of this is already happening and I don't think the Democrats care. When voter turnout is high, Democrats win hands down. When voter turnout is low, Republicans win. But the kicker is that both parties thrive when they are losing. This may often be counter intuitive to many people but I think many have bad priors when modeling the game that politicians are playing.

not2b 2021-08-19 01:58:29 +0000 UTC [ - ]

Actually, Democrats are generally in favor of instant runoff voting, and many more liberal places have enacted it.

But yes, there are a lot of professional campaign consultants who have the system wired that they profit whether they win or lose, and many of those work for Democrats.

godelski 2021-08-19 02:53:42 +0000 UTC [ - ]

> Democrats are generally in favor

To be clear are we talking about the politicians or the people? The people, yes. Politicians I'm not so sure about. Also I'd encourage you to read my other comment which addresses ordinal voting (like IRV) and the issues with them. It might be why the party likes it (still having vote splitting in the primaries).

michaelmrose 2021-08-19 02:30:34 +0000 UTC [ - ]

We are looking at a republican party the majority of which would happily end democracy to end the threat of them ever being tossed out again. Tipping the scales in their direction at this critical juncture to motivate Democrats seems like a spectacularly bad idea.

Seems like it would be a better and safer idea to to work towards the same goal using primaries to tilt already democratic districts in the direction of reformers.

godelski 2021-08-19 00:26:37 +0000 UTC [ - ]

> While imperfect, I think that German electoral system is much better.

I often see people compare the US system to European systems and use "party" in both. I think this results in a pretty bad comparison, but takes some nuance to understand why. Democrats and Republicans are more accurately compared to coalitions in European systems than they are to European parties. As a point, AOC or Bernie have very different political ideologies than say Pelosi or Biden, yet are in the same party. Similarly Trump is very different ideologically than say John Kasich. While there is variance within European political parties I believe that we see a larger variance within American parties and thus it makes it more accurate to compare to coalitions.

In addition to this we should recognize that most European systems are working under a parliamentary system which causes this proportionate representation. We don't quite have a system like that in America and it would be tough to change the entire system. This is why many people, such as myself, are proposing systems like STAR or Approval. By being able to score (or rate) candidates (instead of ranking) we can achieve a proportionate representation with very minimal change, especially since systems like Approval already work on current voting machines. It is also a lot easier and more transparent compared to many round systems from ordinal voting.

>(example: Republicans paying fees and collecting signatures to get Greens on the ballot to divide the left vote and get a Republican in office, though this problem could be fixed with some form of instant runoff

But I also want to be clear about this. Ordinal systems (such as IRV/STV) fix this kind of spoiler there is another spoiler that is fairly important: the favorite betrayer. That is because the green party here is called a weak spoiler, they don't have a large voter base. But we need to also be VERY concerned with strong spoilers. For example: if Bernie ran against Biden. Ordinal systems are still vulnerable to this type of spoiler while cardinal systems are resistant to both strong and weak spoilers.

Edit: I wanted to add that we actually saw strong spoilers in the 2016 and 2020 elections, in the primaries. In 2016 it happened in both parties. Bernie and Clinton were a split. Many people didn't vote Bernie because they thought Hillary would better beat Trump. Similarly in the Republican party you had Trump, Cruz, and Kasich. Many Republicans liked a moderate like Kasich but didn't think he was a strong candidate. In the 2020 election we again saw this vote splitting in the Democratic primaries. While these cases are more obvious, such splitting also happens a lot in congressional races and other down ballot races.

dane-pgp 2021-08-19 11:38:42 +0000 UTC [ - ]

> most European systems are working under a parliamentary system which causes this proportionate representation.

Could you clarify what you mean here? There is nothing about a parliamentary system which inherently requires or leads to proportional representation, as the UK system shows. Similarly it would be possible in the US congressional system to have proportional representation by having multi-member districts (as was allowed[0] before 1967) and using a system like STV, also called multi-winner ranked-choice voting.[1]

> cardinal systems are resistant to both strong and weak spoilers.

While I support any serious alternative to FPTP, it's worth being aware of the deficiencies of Approval voting. Firstly, it can confront voters with difficult questions about whether they support a certain candidate enough to approve of them. For example, a Democrat voter might hedge their bets by voting for a moderate Republican to prevent a more extreme Republican winning, while hoping that enough Republicans approve of a moderate Democrat.

Secondly, though, I think that an important goal for a voting systems is that it doesn't increase (and ideally decreases) the dependence on voting machines. As recent events have shown, every additional element to a voting system is just expanding the attack surface for people to target FUD at, and a voting machine is a complex system which is very hard for the average voter to reason about (even if the purported hardware designs and source code were publicly available).

While it is still feasible to count Approval ballots by hand, and the process can be split between districts to produce sub-totals which can be summed, the fact that a given ballot can have multiple marks on it does increase the complexity for human counters, which makes the counting slower and more expensive. In particular, if there are N candidates in an election, then a FPTP ballot can be placed onto one of N piles, whereas 2^N piles are needed to group all possible Approval votes physically together.

I don't know how much that complexity would actually slow down the counting, but in a world where election workers are being threatened with violence for doing their job, even an extra hour of counting is hard to justify. Fortunately, though, there is a voting system which satisfies the above criteria, namely Asset Voting.[2] In its single-winner variant, the election proceeds just like a FPTP one, with the same ballot papers, instructions, and counting process, but after the count is complete, the candidates from fewest to most votes get to reassign their share to a remaining candidate, until one candidate has a majority. This removes the spoiler problem, and relies on the fact that voters are choosing someone to represent them and who can therefore be entrusted with the job of assigning their votes to the ultimate winner if necessary.

[0] https://www.amacad.org/ourcommonpurpose/recommendation-1-3

[1] https://en.wikipedia.org/wiki/Single_transferable_vote

[2] https://en.wikipedia.org/wiki/Proportional_representation#As...

amznthrwaway 2021-08-18 21:59:18 +0000 UTC [ - ]

The third party would need to get local traction first. This is the best way forward on a number of dimensions, but most third party candidates go national instead, because while it cannot effect change, it is substantially more profitable.

godelski 2021-08-18 20:38:23 +0000 UTC [ - ]

Honestly voting is high on my priority list. The reason is because I believe that voting will have a lot of downstream effects. It will make a lot of other things easier. But I don't believe we should be trying to change things at the national level at this point (that's down the line). I think we should be trying to implement systems like STAR and Approval at local levels. City, County, State. We know that these are the systems the experts are suggesting. So let's stop doing the same experiment we've seen fail a hundred times. And while the dragon is the end goal, if we can't defeat the low level monsters it would be insane to go fight the final boss.

some_hacker_55 2021-08-18 21:01:58 +0000 UTC [ - ]

So status quo then.

Cmon hackers, think harder…

frickinLasers 2021-08-18 21:27:00 +0000 UTC [ - ]

There have been many third parties, and I'm not aware of any that have achieved even middling success (maybe Libertarian?) since I've been alive. How would this party fare any better?

notsureaboutpg 2021-08-18 23:49:33 +0000 UTC [ - ]

The most egregious one for me was The Newburgh Sting.

It blows my mind that you can get an FBI informant to spend months convincing some of the poorest people in whole country to blow up a building they've never seen, promise them a quarter of a million dollars to do it, and then claim they are terrorists when they accept.

If that's not entrapment nothing is

dillondoyle 2021-08-18 20:30:10 +0000 UTC [ - ]

plus even more relevant to HN is when authorities are using algorithms as a scapegoat. we probably know what will happen when they start using black box ML with a ton of bias baked in.

There is a scary (gross in my mind) story that reports on some dystopian pre-crime Minority Report Sheriff targeting kids.

Looks like the court case is in process, though not sure why court didn't immediately shut it down pending trial given how (to my non-lawyer brain) this seems that plaintiffs will almost definitely prevail given clear violations of multiple Amendments.

From the reporting: "Over the span of five months, police went to his home 21 times. They also showed up at his gym and his parent’s place of work. The Tampa Bay Times revealed that since 2015, the sheriff's office has made more than 12,500 similar preemptive visits to people.

These visits often resulted in other, unrelated fines and arrests that further victimized families and added to the likelihood that they would be visited and harassed again. In one incident, the mother of a targeted teenager was issued a $2,500 fine for having chickens in the backyard. In another incident, a father was arrested because his 17-year-old was smoking a cigarette. These behaviors occur in all neighborhoods, across all economic strata—but only marginalized people, who live under near constant police scrutiny, face penalization."

https://projects.tampabay.com/projects/2020/investigations/p...

https://ij.org/press-release/pasco-families-win-round-one-in...

mikem170 2021-08-18 23:01:35 +0000 UTC [ - ]

I've heard of this, going back a year or two. The sheriff's target the households presented by the algorithms with the intention of fining, arresting, and otherwise legally harassing the targeted families in an attempt to drive them out of town.

Selective enforcement of laws is a problem, and there are plenty of laws to selectively enforce.

Tabular-Iceberg 2021-08-19 06:40:10 +0000 UTC [ - ]

> fine for having chickens in the backyard

Land of the free. The arbitrary harassment of the population is one thing, but then there is that mountain of actual laws and regulations that would be considered an overreach even by the standards of most totalitarian dictatorships in the world. What could possibly be wrong with having chickens in the back yard?

Akronymus 2021-08-19 07:30:04 +0000 UTC [ - ]

The slippery slope is only a fallacy if there is no reasoning presented between steps though.

"We should track who is gang affiliated" -> "We should track who has done terroristic acts" -> "We should track who is affiliated with terrorists" -> "We should track who may be affiliated with them"

All seem to be reasonable steps, which IMO makes it not a case of the slope being a fallacy.

grawprog 2021-08-19 00:09:16 +0000 UTC [ - ]

>but this began with gang affiliation lists.

An old coworker of mine was on a gang registry because of people he associated with when he was a teenager. He was in his late 20's-early 30's when we worked together. Really nice guy, super hard working, spent his free time gaming or hanging out with his girlfriend, got really into his puppy and being a dog owner. Hadn't been around gangsters for at least a decade.

He'd regularly get pulled over and hassled by cops just because when they scanned his plate he'd show up as being on the gang registry. Ended up losing his license for several months because his friend who was his passenger one time had a very small amount of weed in a bag in his pocket when he got pulled over.

Pretty much any time cops are around or even whenever he drives, there's always a chance he's going to get pulled over and harassed randomly.

Not because of anything he ever did, just because he chose the wrong friends when he was young.

andai 2021-08-18 20:20:21 +0000 UTC [ - ]

The slope to totalitarianism is always slippery.

vkou 2021-08-18 18:08:10 +0000 UTC [ - ]

> You mean being put on a restricted rights/law enforcement attention list with no due process?

What novel 'due process' do you believe is necessary for the police to unintrusively start investigating someone?

We already require judge-issued warrants for intrusive investigations (Searching your things, tapping your phone lines, arresting you, etc).

I don't believe there's any country in the world that requires a judge to review the police putting you on a list as a person of interest. I am no legal scholar, so I should probably cut myself off right here - but do you not think that perhaps, there is a valid reason for this? You're inventing novel legal practices without precedent, here.

pessimizer 2021-08-18 18:37:31 +0000 UTC [ - ]

If I, as a police department, put you on a secret list of possible pedophiles based on the fact that we saw you speaking to another person on that list, noticed you in a board game store patronized by many local young Magic: The Gathering fans, you were single with no children, and you were the brother of someone who once dated the sister of the cop who put you on the list, would you have a problem with that?

What if we weren't allowed to confirm or deny you were on the list, except to a prospective landlord or employer who filled out a form?

What if there were no way to find out those were the reasons I put you on the list, and no appeals process to be removed from the list?

What if you couldn't prove standing in court because there was no legal way to prove you were on the list at all without a friendly judge?

> You're inventing novel legal practices without precedent

Which is why people are forced to rely on the racial makeup of these horrifying lists in order to challenge them. The problem becomes a lot clearer if your local police force makes up a list of all Jews in the neighborhood (whatever criteria they decide to use, i.e. "valid reason") for special treatment.

edit: and, of course, what if the list leaks, and is used as an automated first step for disqualification by employers and landlords for the rest of your life?

vkou 2021-08-18 18:53:50 +0000 UTC [ - ]

Would I have a problem with being on a list that, from my perspective, I can't tell the difference between being on it, and not on it?

I don't know, I wouldn't be able to tell. If a tree falls in the forest, and nobody's there to hear it, does it matter to anyone whether it makes a sound?

> What if we weren't allowed to confirm or deny you were on the list, except to a prospective landlord or employer who filled out a form?

You're swinging at strawmen. Nobody in this thread is defending intrusive lists.

For some reason, though, you are conflating unintrusive lists (Which don't require oversight anywhere in the world) with intrusive lists (Which do require oversight in... well-governed parts of the world).

Do you have arguments against the former? I'm not interested in being convinced that the latter are bad, I'm already convinced that they are bad.

> edit: and, of course, what if the list leaks, and is used as an automated first step for disqualification by employers and landlords for the rest of your life?

If there's an unholy decades-long alliance between the FBI, the background check bureaus, and millions of employers and landlords, that neither my federal, state, or municipal government is interested in doing anything about, I think my main problem is not 'the FBI has a list'. I think my main problem is 'My society, on every imaginable level, is broken.'

salawat 2021-08-18 19:41:22 +0000 UTC [ - ]

>Would I have a problem with being on a list that, from my perspective, I can't tell the difference between being on it, and not on it?

>I don't know, I wouldn't be able to tell. If a tree falls in the forest, and nobody's there to hear it, does it matter to anyone whether it makes a sound?

Spoken like someone who hasn't had the long arm of the law drop in on them before, or a person who "doesn't care about that liberty anyway, so why not vote it away?"

Just because you don't see the problem doesn't mean it isn't there. Just because you didn't see the tree fall, doesn't mean the world is uneffected. These are concepts 3-4 year olds manage to divest themselves of once they grap the permanence of objects. Just because you don't get much out of a liberty doesn't mean that it's cool to force the loss of it on somebody else. Liberty is to be treasured and protected. The selective relinquishment, revocation, or limiting of one for anyone should be a Big. Frigging. Deal.

The fact people are so cavalier with wisking away the freedoms that underpin American Civil Life on mere suspicion of something that the State is not even required to be transparent about should disturb everybody.

isoskeles 2021-08-18 21:41:57 +0000 UTC [ - ]

I don't understand this response. He was told it was a "secret list." Why would you take such a tone in response to him saying he might not have a problem since he doesn't know about the list? It's a hypothetical about a secret list, and since he doesn't immediately agree with the conclusion, you browbeat him about not having the long arm of the law drop down on him, etc.

More importantly, this:

> Spoken like someone who hasn't had the long arm of the law drop in on them before, or a person who "doesn't care about that liberty anyway, so why not vote it away?"

Who are you quoting here? No one said this at all.

I'm actually disgusted by your comment and the logic you present in it.

octaonalocto 2021-08-18 20:31:18 +0000 UTC [ - ]

Your tone is inappropriate, please try to make your point without implying GP is dumber than a third grader. It implies malicious intent and is bad for discussion.

RHSeeger 2021-08-18 18:12:57 +0000 UTC [ - ]

The problem is when that list is used to prevent you from accessing common services, like fly on planes.

Edit: Because people assumed I was talking about the no-fly list specifically; I'm not. The terror watch list also winds up being used to cause problems for people.

From: THE PROGRESS AND PITFALLS OF THE TERRORIST WATCH LIST By: COMMITTEE ON HOMELAND SECURITY https://www.govinfo.gov/content/pkg/CHRG-110hhrg48979/html/C...

> Inaccurate watch list information also increases the chances of innocent persons being stopped or detained because of misidentification.

A page by the ACLU goes into some detail. https://www.aclu.org/other/us-government-watchlisting-unfair...

That list, and others, are not innocent "we're just keeping an eye on these people" lists. Their use causes serious harm.

vkou 2021-08-18 18:24:41 +0000 UTC [ - ]

Yes, that is a problem. But that's not what the parent poster is talking about. It's absolutely irrelevant to this conversation.

The parent poster takes issue with the fact that an unintrusive person of interest list exists, and wants oversight on it. This is an absolutely unprecedented legal take.

It doesn't help that they are conflating the two (one of which is, at a first glance reasonable, and the other is not), when they are not the same thing. All that does is muddy the waters.

__blockcipher__ 2021-08-18 19:40:00 +0000 UTC [ - ]

There’s no such thing as an “unintrusive” list. They make the lists for a reason.

vkou 2021-08-18 20:28:44 +0000 UTC [ - ]

If that's the case, you should have no trouble answering two simple questions:

1. What do you think happens to people on it?

2. Which of those actions should require judicial oversight, but currently don't?

So far, the only answers to those questions in this thread have been 'imagine if...' tangents. I don't need to imagine strawmen, I'd like to know what is currently wrong.

Imagining disasters is how we're in this mess, I'd like to know what the actionable problem is.

RHSeeger 2021-08-18 21:22:02 +0000 UTC [ - ]

> Imagining disasters is how we're in this mess

I posted some links in my original comment that talk about specific problems. That being said, "allowing those in authority to do things that could be used inappropriately... and then it turning out that they did exactly that" doesn't require ANY imagination. The US government engages in such behavior on a daily basis.

vkou 2021-08-18 22:12:07 +0000 UTC [ - ]

Please note the four demands the ACLU makes in the publication you linked.

None of them demand that police lists should not exist, or that judicial oversight should be necessary to put a person on one.

Instead, they demand that:

1. The lists be accurate.

2. The lists be accurate.

3. Allowing people to contest them on a case-by-case basis.

4. To not blacklist people from employment based on them.

The ACLU seems to be in agreement with me.

RHSeeger 2021-08-19 00:10:28 +0000 UTC [ - ]

I don't see them agreeing with you at all. I see you saying "the lists are fine", whereas they are saying "the lists are not fine, but would be ok if these things were true (but they're not atm)". Personally, I don't think it's enough. I think someone being known to be on the terror watch list is likely to cause them all sorts of problems; and anyone can be put on the list for pretty much any reason.

harimau777 2021-08-19 14:26:46 +0000 UTC [ - ]

We can't answer that because the lists are secret. That's part of the problem.

AnimalMuppet 2021-08-18 18:20:18 +0000 UTC [ - ]

Except that, if I understand correctly, this is not the no-fly list. So...

mikem170 2021-08-18 23:15:01 +0000 UTC [ - ]

This is how the KGB, Stasi, and other secret police organizations work. It's a way to extra-judicially monitor and control the population. This should give you pause for thought. Law enforcement that the public can trust is a big deal. Our government already bends the laws quite a bit to suppress dissent, we shouldn't enable them to do more of this.

It's a lot more straight-forward if the police investigate crimes reported to them by citizens. That's what they are supposedly there for, right?

vmception 2021-08-18 18:33:15 +0000 UTC [ - ]

Its not a slippery slope when we've been at the bottom of the slope your whole life

pessimizer 2021-08-18 18:41:27 +0000 UTC [ - ]

The people on the bottom of the slope are the people on the lists. As they grow to 1.9MM people.

__blockcipher__ 2021-08-18 19:33:38 +0000 UTC [ - ]

> The patriot act deserves another look and possible edit.

Boy, that was the understatement of the year.

The patriot act doesn’t need an edit or another look. It needs to be completely abolished, yesterday.

arthurcolle 2021-08-18 19:56:00 +0000 UTC [ - ]

It expired already.

plorkyeran 2021-08-18 20:31:25 +0000 UTC [ - ]

Portions of it expired. Large parts did not.

southerntofu 2021-08-19 07:37:18 +0000 UTC [ - ]

Dismantling the State's oppression system goes further than having legal constructs expire. As long as there is parliaments, police, prisons and borders, the State will use those to oppress people, and no amount of using the oppressor's tools (legislation) can change that.

"Just" dismantle the psychopathic institutions that govern our societies (a revolution) and make sure anyone who attempts to rebuild them is look down on with contempt.

beambot 2021-08-18 18:30:51 +0000 UTC [ - ]

> The terrorist watchlist [...] could be used to oppress, harass, or persecute people on the list and their families.

So... what was it actually used for? Wasn't this the same list that results in extra scrutiny at airports & whatnot -- wouldn't that count as harassment?

staticautomatic 2021-08-18 22:01:31 +0000 UTC [ - ]

Yeah it’s already used for that purpose…by the government.

ashtonkem 2021-08-18 17:34:46 +0000 UTC [ - ]

Given the history of the FBI deciding that journalists and activists are actually terrorists to be suppressed? Probably quite a few.

flatiron 2021-08-18 21:17:02 +0000 UTC [ - ]

Wouldn’t that be hard in practice though? Journalists typically have to travel for work so it would soon be apparent. And if they work for a big media outlet would be instantly litigated.

ashtonkem 2021-08-18 21:48:04 +0000 UTC [ - ]

This is the terrorism watch list, not the no fly list. Any of us could be on that list and it would take a while for us to know.

The no fly list is much smaller, and far less ambiguous in its impact. You’re on that, you’ll find out the first time you try and fly.

southerntofu 2021-08-19 07:46:59 +0000 UTC [ - ]

Most journalists working for big outlets are docile when asked politely not to publish on a certain topic (either by their boss, or by government agencies), and that's how they avoid problems. See for example Glenn Greenwald's choice to leave the Guardian in order to publish the Snowden papers. For the french-speaking among us (not sure you can find english subtitles), the documentary "Les nouveaux chiens de garde" (the new watchdogs) goes into detail, interviewing sociologists and journalists, about the ties between the mainstream capitalist media establishment and other circles of power (industry, political parties).

About the no-fly list specifically, you should really check out https://en.wikipedia.org/wiki/No_Fly_List#Notable_cases . Some relevant quotes:

> TSA refused to allow an Air France flight from Paris to Mexico to cross U.S. airspace because it was carrying Colombian journalist Hernando Calvo Ospina

> On August 19, 2009, Air France flight AF-438 was not allowed to cross into U.S. airspace because of the presence on board of one Paul-Emile Dupret, a civil servant at the European Parliament for 18 years, who had written some articles criticizing the EU's policies toward Latin America because they are aligned too closely with those of the United States

> A U.S. citizen, stranded in Colombia after being placed on the No Fly List as a result of having studied in Yemen

> In October 2008, the Washington Post reported that Maryland State Police classified 53 nonviolent political activists as terrorists, and entered their names and personal information into state and federal databases

Seems like it's not hard in practice for psychopaths in uniforms to abuse secretive powers given to them.

lostlogin 2021-08-18 19:34:06 +0000 UTC [ - ]

> “In the wrong hands…”

It’s in the wrong hands already - the wrong hands made the list, and there are plenty of examples of what has happened to various misidentified people over the years.

stjohnswarts 2021-08-19 15:16:47 +0000 UTC [ - ]

There is nothing Patriotic about the Patriot Act and it needs to be fully rescinded. That law is a travesty in every way. It was knee jerk reactionary law that shouldn't have been in place more than a couple years.

syrrim 2021-08-18 17:42:30 +0000 UTC [ - ]

Didn't the patriot act expire without renewal?

southerntofu 2021-08-19 07:50:45 +0000 UTC [ - ]

Police and secret services are notably very good at ignoring existing laws protecting the rights of the people, so i don't think a law expiring changes much for those psychopaths.

weaksauce 2021-08-18 18:22:24 +0000 UTC [ - ]

huh interesting. So is it basically gone then or were there any permanent things that came from it?

giantg2 2021-08-18 20:23:14 +0000 UTC [ - ]

Some things were made permanent under subsequent laws (or at least extended). For example, financial reporting for people depositing "large" amounts of cash. I think it started out at $10k under the patriot act. Now I think it's $5k. That is a good bit of cash, but it could easily be made selling a used car or something.

silisili 2021-08-18 21:57:13 +0000 UTC [ - ]

Unless it changed very recently, I'm pretty sure it's still 10k.

ls612 2021-08-19 01:49:45 +0000 UTC [ - ]

And that wasn’t from the Patriot act, it was from the Bank Secrecy laws of the 70s

giantg2 2021-08-19 02:22:42 +0000 UTC [ - ]

I don't know where I saw the limit change - maybe I got that part confused.

The patriot act did expand the bank secrecy act.

https://complyadvantage.com/knowledgebase/usa-patriot-act/

jellicle 2021-08-18 21:24:04 +0000 UTC [ - ]

90% of the Patriot Act was permanent law and is law today. A few of the most objectionable parts had "sunset" provisions in them and those (after several rounds of modifications and numerous extensions) are what has, finally, been allowed to expire. Most of the provisions of the Patriot Act are in effect today and will be until a future Congress changes them.

dopamean 2021-08-18 17:57:10 +0000 UTC [ - ]

It did.

pibechorro 2021-08-18 21:18:09 +0000 UTC [ - ]

Edit? Cancel it entirely.

sschueller 2021-08-19 06:09:59 +0000 UTC [ - ]

Senator Ted Kennedy was mistakenly matched with someone on the list back in the Bush era around 2004. How can you make that mistake?

justinzollars 2021-08-18 17:35:27 +0000 UTC [ - ]

I'm curious about this list too. For example are Islamic people I know on it? There are never any details on how to access these lists. The article could be fake for all I know.

EGreg 2021-08-18 20:20:36 +0000 UTC [ - ]

The PATRIOT act was largely the result of US foreign policy affecting domestic policy and erosion of civil liberties:

https://magarshak.com/blog/?p=349

In an ideal world, we'd be constantly re-evaluating both foreign and domestic policies, but will we?

Remember this signed by Obama: https://www.aclu.org/press-releases/president-obama-signs-in...

And he was not able to even close down Gitmo

programmarchy 2021-08-18 17:41:17 +0000 UTC [ - ]

I thought that the Patriot Act was not renewed as of December 2020. It failed to pass in the Senate because Trump threatened a veto. [1]

[1] https://en.wikipedia.org/wiki/Patriot_Act#cite_note-256

ipaddr 2021-08-18 17:51:34 +0000 UTC [ - ]

Interesting no one reported this. Either everyone missed this or it is still in place.

LeifCarrotson 2021-08-18 18:03:53 +0000 UTC [ - ]

In their defense, there has been an awful lot going on.

The EFF reported on the expiration in the brief window when there were no authorizations:

https://www.eff.org/deeplinks/2020/04/yes-section-215-expire...

It's being reintroduced as the equally doublespeak "USA FREEDOM Reauthorization Act":

https://www.congress.gov/bill/116th-congress/house-bill/6172

I'd be interested to know if any behavior was changed during the few weeks that the permissions were not covered by either law.

adventured 2021-08-18 18:16:50 +0000 UTC [ - ]

To be fair, they do have to reauthorize the Freedom Unmitigated Bill for Appropriations Reconciliation Defense act every year or we're not allowed to leave our homes. Those F35-Liberty planes aren't going to pay for themselves.

vmception 2021-08-18 18:34:33 +0000 UTC [ - ]

this is the second backronym pun I've seen today, whats going on?

rate-limit edit:

I don't think Baader Meinhoff applies when I already know what a backcronym is and also have to extrapolate the first letter of all the words to get the joke.

Was there a show or pop culture thing that has people leaning towards this joke?

If anything, this could be a perceptive bias where I am forcing meaning into something, but a FUBAR Defense Act is exactly what that poster was going for. Who knows about the other one I saw earlier.

vlovich123 2021-08-18 18:53:51 +0000 UTC [ - ]

Likely just Baader–Meinhof phenomenon[1]. Interestingly, I think that phenomenon ignores the superset of when you actually had seen something multiple times before but for whatever reason started noticing the frequency more frequently (eg you’ve seen backronym’s before, but you’re happening but your brain has decided to notice them more because maybe you saw them in quicker succession than you’re used to).

[1] https://en.wikipedia.org/wiki/Frequency_illusion

MichaelApproved 2021-08-18 18:00:58 +0000 UTC [ - ]

EFF reported on it.

https://eff.org/deeplinks/2020/12/section-215-expired-year-r...

> "On March 15, 2020, Section 215 of the PATRIOT Act—a surveillance law with a rich history of government overreach and abuse—expired due to its sunset clause. Along with two other PATRIOT Act provisions, Section 215 lapsed after lawmakers failed to reach an agreement on a broader set of reforms to the Foreign Intelligence Surveillance Act (FISA)."

A4ET8a8uTh0 2021-08-18 17:58:28 +0000 UTC [ - ]

Short answer, its spirit lives on. Not to search very far, FinCEN did not stop contacting financial institutions for 314(a) compliance.

https://www.fincen.gov/sites/default/files/shared/314afactsh...

datavirtue 2021-08-18 18:38:40 +0000 UTC [ - ]

I'm on a huge greenfield application project at a major bank to collect and send patriot act mandated information to FinCEN. The Patriot act expiring did not even come up and I had no idea it expired. I thought it was a shoe-in for rubber stamping.

adamrezich 2021-08-18 18:12:28 +0000 UTC [ - ]

definitely interesting but certainly unsurprising

rolph 2021-08-18 18:34:00 +0000 UTC [ - ]

this suggests many of the processes that have become constituative due to patriot act, maybe are still occurring outside of a legal framework, it seems patriot act is still in the system even if not renewed

pibechorro 2021-08-18 21:17:40 +0000 UTC [ - ]

Edit?

irrational 2021-08-19 04:35:19 +0000 UTC [ - ]

I wonder how many of the participants in the Jan 6th insurrection are on it.

lancemurdock 2021-08-18 21:08:11 +0000 UTC [ - ]

> The patriot act deserves another look and possible edit.

once you give the gov power, it is never given back to the people.

Rd6n6 2021-08-18 17:21:38 +0000 UTC [ - ]

Wikipedia says the no fly list only had 47k people on it. The terror watch list had about 1.9M though, so this must be the terror watch list.

1.9M people is a massive number of people

> The No Fly List is different from the Terrorist Watch List, a much longer list of people said to be suspected of some involvement with terrorism. As of June 2016, the Terrorist Watch List is estimated to contain over 2,484,442 records, consisting of 1,877,133 individual identities.

https://en.m.wikipedia.org/wiki/No_Fly_List

LeoPanthera 2021-08-18 20:25:52 +0000 UTC [ - ]

jaclaz 2021-08-19 10:29:58 +0000 UTC [ - ]

>1.9M people is a massive number of people

I would say incredibly massive.

I mean, to get onto that "terrorist" list (if it is of US origin) most probably it means that the person must have traveled to or within the US by plane (or applied for a Visa, or similar), otherwise the fields of passport_id and country_of_issuance can be empty and (false or real) matches only depend on name, surname and date of birth.

In Italy something that is similar to the US SSN is the Codice Fiscale that can be thought as a condensed string based on Surname, Name, Sex, Date of birth, and place of birth (each italian comune, think of a municipality has its own alphanumeric code).

At the time it was introduced, there were of course a number of "collisions" due to homonimy or partial homonimy (the algorithm uses only some consonants of Surname and Name, making collisions more likely) and a provision for an "exception" was made, altering last character (which is a control character and normally is a sort of hash of the other data).

This allowed up to 26 people born in the same municipality on the same day and with same (or similar) surname and name to get a distinct codice fiscale.

For strangers the code for place of birth is instead of municipality the much more generic country of birth.

The amount of collisions with foreigners staying in Italy or however needing the codice fiscale (coming from a few countries) zoomed to higher than that and now there are quite a few "non-standard" codice fiscale where one (or more) of the numeric characters has been replaced by a letter character according to a substitution algorithm 0=L, 1=M, etc. starting from the last (rightmost) number.

This has raised the number of possibilities from 26 to (I believe) 128 or so and for the moment the system still works.

However, last data I could find, is 2016 and there were 36,000 "collisions" on 94,000,000 total, (in 2000 it was some 24,000 on 80,000,000 or so).

I wonder what kind of probabilities there are, if you have a common enough name and you are born in a country for which there are many entries in that list to be "picked" for homonimy, if the passport info is either empty or not used.

OJFord 2021-08-18 17:25:09 +0000 UTC [ - ]

The submitted article does say watch list, it's just the title here that ~has~ had the error. (Editing it was fair enough IMO, at least to remove from 'and boy'...)

tvirosi 2021-08-18 18:10:19 +0000 UTC [ - ]

Or the 47k no fly number is just a lie

jedimastert 2021-08-18 18:38:40 +0000 UTC [ - ]

It's pretty easy to check, but I'm guessing it's just far easier to get yourself on the watch list.

mrits 2021-08-18 20:17:00 +0000 UTC [ - ]

Must be really annoying when your terrorist cousin comes over and uses your wifi on the holidays.

jedimastert 2021-08-18 23:01:17 +0000 UTC [ - ]

47k vs 1.9M, meaning it's apparently 40x easier to get on one than the other.

2021-08-18 20:29:47 +0000 UTC [ - ]

Joker_vD 2021-08-18 17:44:09 +0000 UTC [ - ]

You know, I can understand why the Terrorist Watch List is secret ― but not why the No Fly list is. If there is a list that governmental agencies and/or commercial companies are obliged to check you're not on before providing you with their service, then surely such list must be public or at the very least, one should be able to easily inquire about whether he/she is on it or not.

For a related example, Russian government maintains a list of banned Internet resources. The list is not public — at least in theory — but there is an official web site where you can input an URL or a domain name and it would response either with "no, it's not on the list", or with "yes, it's on the list, here's who ordered it and when".

janmo 2021-08-19 05:07:07 +0000 UTC [ - ]

https://www.no-fly-list.com/ Not sure if it is a fake or real.

londons_explore 2021-08-18 20:30:54 +0000 UTC [ - ]

Surely the easy way to check if a name is on the list is to book a flight in that name. If the booking gets rejected, it's on the list.

Repeat for every name you want to check, and make use of the airlines free cancellation policy so you don't actually have to spend money.

ch4s3 2021-08-18 20:39:55 +0000 UTC [ - ]

Sometimes they just turn people away at security without an explanation.

TheFreim 2021-08-18 23:00:34 +0000 UTC [ - ]

Yeah this happened to some political activist recently.

ch4s3 2021-08-19 01:44:30 +0000 UTC [ - ]

Happened to a classmate of mine in college who had the same name as some hokani commander’s wife. Luckily her brother worked at the state department and knew some Clintons.

kevin_thibedeau 2021-08-19 03:11:47 +0000 UTC [ - ]

I knew a Mexican citizen with a green card who was always having trouble reentering the US and never knew why. I looked at the most wanted list and saw there was a fugitive with the same first and middle name, albeit no resemblance and different family name. Didn't matter. He would have to be interviewed for 30 minutes to verify identity.

datavirtue 2021-08-18 18:41:54 +0000 UTC [ - ]

It's not a secret, just need-to-know basis.

outworlder 2021-08-18 19:51:02 +0000 UTC [ - ]

potato potato

scrps 2021-08-16 18:55:35 +0000 UTC [ - ]

>The researcher considers this data leak to be serious, considering watchlists can list people who are suspected of an illicit activity but not necessarily charged with any crime.

"In the wrong hands, this list could be used to oppress, harass, or persecute people on the list and their families."

I'd imagine being on a list that limits your personal freedom without being charged with a crime and convicted falls pretty squarely within the definition of being oppressed & persecuted before even considering any second order effects of the list being leaked.

sschueller 2021-08-16 19:20:07 +0000 UTC [ - ]

The list should be public or at least I should have the right find out if I am on that list.

MeinBlutIstBlau 2021-08-16 19:48:43 +0000 UTC [ - ]

You can request if youre on the tsa no fly list iirc.

GordonS 2021-08-19 13:02:45 +0000 UTC [ - ]

I wouldn't be at all surprised if they used asking if you are on the list as grounds to add you to the list.

brokenmachine 2021-08-17 00:42:47 +0000 UTC [ - ]

Wouldn't you find out if you tried to book a flight?

imglorp 2021-08-18 20:33:23 +0000 UTC [ - ]

Book or board? The difference is you bought the tickets in one case and might not get the money back.

MeinBlutIstBlau 2021-08-17 03:04:47 +0000 UTC [ - ]

sorry...I mean TSA watch list. But yes you're right haha.

ClumsyPilot 2021-08-18 17:25:11 +0000 UTC [ - ]

As expected, it is only a matter of time untill all the intensely private data collected by NSA and pals is leaked or stolen and used by criminals for fraud and extortion.

vmoore 2021-08-18 18:08:27 +0000 UTC [ - ]

This. Eventually all sensitive data becomes concentrated enough that it becomes leakable material

sneak 2021-08-18 18:48:34 +0000 UTC [ - ]

The main databases the NSA has are far too large to be easily leaked.

Even blueleaks was <1T (~300GB iirc) and many people had trouble downloading it. I am sure many IC databases are several hundreds or thousands of times larger even without indices.

It's not like you could just throw up a 4000TB torrent for a 7z of all of the north american phone call metadata for last year.

nonameiguess 2021-08-18 20:05:58 +0000 UTC [ - ]

When I worked on the main NRO ground processing station for electro-optical collections, we were generating double-digit petabytes daily, and that back in 2008. Don't even know what it's up to now.

Not only is there no practical way for anyone other than maybe Google or CERN to download that much data, unlike the no-fly list, actual classified information isn't attached to any networks that can be accessed from outside of a secure facility. This means the only way to egress data is for an inside threat to copy it onto USB drives or possibly optical media, maybe steal hard drives. But there are pretty hard limits to what you can just bulk copy. It can't be much more than a person can hide in a bag.

BrandoElFollito 2021-08-18 21:05:28 +0000 UTC [ - ]

Glad to see that CERN was mentioned, it is not that often that their IT resources are known (and they are huge)

rsbrans 2021-08-18 21:01:02 +0000 UTC [ - ]

I have a feeling this post may be agedlikemilk worthy in the not so distant future...

deadalus 2021-08-18 18:13:44 +0000 UTC [ - ]

Usually by an insider.

waynesonfire 2021-08-18 19:05:53 +0000 UTC [ - ]

sounds like a use case for the BLOCKCHAIN!

rodgerd 2021-08-19 02:31:34 +0000 UTC [ - ]

Well, there are reports that the Taliban have gained control of a bunch of biometric scanning and reporting tools used by the US forces in Afghanistan so...

loceng 2021-08-18 20:31:09 +0000 UTC [ - ]

Or a list of allies and talent to hire or leverage.

r1ch 2021-08-18 20:02:07 +0000 UTC [ - ]

It's amazing how many hacks and data breaches all come down to dangerous default settings. Elasticsearch defaulted to no security, anyone hitting the IP has full access to the cluster. MongoDB is another infamous example. Even today, one of my sites is being DDoSed by a bunch of 2007-era Ubiquiti network devices which use ubnt / ubnt as the root login and naturally got exposed to the internet. Bad defaults linger for a long time.

southerntofu 2021-08-19 08:04:03 +0000 UTC [ - ]

And that's why some of us use firewalls, and/or avoid the Docker craze like hell.

WrtCdEvrydy 2021-08-18 17:08:52 +0000 UTC [ - ]

I wonder if this will end up on haveibeenpwned?

"The FBI leaked your name as a terrorist"

imglorp 2021-08-18 17:37:21 +0000 UTC [ - ]

I would like to know if any grumbling about the agencies on social media--like this post--has landed me on the watch list.

tubbs 2021-08-18 17:33:04 +0000 UTC [ - ]

That would be funny (I guess). At any rate, neither email addresses nor phone numbers were part of the leak.

gjsman-1000 2021-08-18 17:52:48 +0000 UTC [ - ]

The freaking FBI leaked your info. Not a stupid private organization. The FBI. And also, because the FBI doesn't tell people they are watching them, there was absolutely nothing - no product, no service - you could have just not signed up for to avoid this leak.

What next, the IRS?

nullc 2021-08-18 17:58:21 +0000 UTC [ - ]

> What next, the IRS?

Already happened: https://www.propublica.org/article/the-secret-irs-files-trov...

They don't disclosed how many parties were included, but their description of their validation (they verified it against 60-some public figures who had separately disclosed their tax filings) suggests that it's probably a significant fraction of the US population.

giantg2 2021-08-18 20:29:07 +0000 UTC [ - ]

OPM had a breach affecting 22M.

https://en.m.wikipedia.org/wiki/Office_of_Personnel_Manageme...

Edit: why downvote?

mike_d 2021-08-18 19:20:51 +0000 UTC [ - ]

Did you miss the whole OPM shit show? But hey, at least you get 10 years of free credit monitoring!

rdtsc 2021-08-18 18:46:26 +0000 UTC [ - ]

Wonder if they did it on purpose. I can't figure out what the purpose might be - a whistleblower wanting to raise awareness about it and realizing they didn't want to have to relocate to Russia or say live an Ecuadorian embassy for years. Or, I can imagine, a rogue agent wanting to warn someone they are on the list without communicating with them privately, so there is no metadata linking them, and they "accidentally" leaked the whole list.

2021-08-18 18:49:10 +0000 UTC [ - ]

tomasreimers 2021-08-18 19:41:34 +0000 UTC [ - ]

Yes, Equifax largely leaked many people's identity.

goodluckchuck 2021-08-18 18:01:58 +0000 UTC [ - ]

I wonder if we can even trust the CCP to not leak our party membership!?

int_19h 2021-08-18 21:13:52 +0000 UTC [ - ]

What really bugs me about these lists isn't just that they exist, but that there's continuous clamoring to expand the scope in which they are applied. For example:

https://www.theatlantic.com/politics/archive/2015/12/no-fly-...

So, basically, politicians have found it to be a convenient tool to skirt due process concerns in general when pushing for their favorite agenda.

southerntofu 2021-08-19 08:09:26 +0000 UTC [ - ]

Databases of people are the exact opposite of human rights. IBM famously enabled the nazi holocaust to go faster/further because of their punch-card databases. Eastern Germany Stasi, and KGB/FBI scandals famously pushed for privacy regulations in pretend-free countries like France (Loi Informatique et Libertés, 1978). Anything that uniquely identify someone else (ID card, phone number, DNA) is a tool of tyrants to oppress their people.

raxxorrax 2021-08-17 14:39:23 +0000 UTC [ - ]

It is amazing what the hunt for terrorism has done to modern countries. They only look fearful and weak, exactly what professional terrorists always wanted them to be.

Anyone who knows bureaucratic behavior knows that even in the absence of real terrorists, people will find their way onto lists like these.

I hope the lists will leak to a wide audience. Find the cases that are wrong and sue those responsible behind the desks. This is the only way this can stop.

The website is extremely horrible. Did use a dev browser without adblock. Grave mistake.

criticaltinker 2021-08-18 17:01:50 +0000 UTC [ - ]

> [cybersecurity researcher Bob Diachenko] was able to find about 1.9 million records detailing individuals’ no-fly statuses, full names, citizenship, genders, passport numbers, and more.

> “it seems plausible that the entire list was exposed”

nurgasemetey 2021-08-18 17:24:07 +0000 UTC [ - ]

Out of curiosity, how can I search myself?

sergiomattei 2021-08-18 21:34:09 +0000 UTC [ - ]

Yeah, I'm curious! I recall the NSA's XKeyscore was revealed to put Linux Journal readers in watch lists.

krapp 2021-08-18 21:39:24 +0000 UTC [ - ]

>I recall the NSA's XKeyscore was revealed to put Linux Journal readers in watch lists.

No, it didn't.

See this comment by grkvlt[0] and another debunking here[1]

[0]https://news.ycombinator.com/item?id=12070156

[1]https://blog.erratasec.com/2014/07/validating-xkeyscore-code...

sergiomattei 2021-08-18 22:44:46 +0000 UTC [ - ]

Thank you for the clarification! Did not know this.

clipradiowallet 2021-08-18 18:26:27 +0000 UTC [ - ]

Inquiring minds want to know

2021-08-18 19:18:53 +0000 UTC [ - ]

nullc 2021-08-18 17:59:47 +0000 UTC [ - ]

Leaks are for intelligence operatives to act with plausibility deniability ("It was hackers!").

They are not for you to use to create accountability by discovering inappropriate inclusions and demanding answers.

jl6 2021-08-18 17:23:20 +0000 UTC [ - ]

Would love to know how the FBI dealt with transliteration deduplication of non-Latin names, cf. the many spellings of Muammar Gaddafi. Although I guess they would just use whatever’s on the passport?

oa335 2021-08-18 20:11:13 +0000 UTC [ - ]

They didn’t. I know of several people with an extremely common name (Basically Muslim equivalent of “John Smith”) who were unable to fly or cross borders, even with the “Redress numbers” that they are supposed to give out in case of mistaken identity.

jessaustin 2021-08-19 02:11:18 +0000 UTC [ - ]

This reminds me of "interstate crosscheck", in which a "Tyrone E. Brown" voting in Pennsylvania was enough to kick a "Tyrone M. Brown" off the voting rolls in Kansas.

https://www.gregpalast.com/interstate-crosscheck-on-the-verg...

_moof 2021-08-18 20:03:28 +0000 UTC [ - ]

"In the wrong hands, this list could be used to oppress, harass, or persecute people on the list and their families."

Teetering on the brink of an epiphany.

dane-pgp 2021-08-18 22:32:37 +0000 UTC [ - ]

The person who you're quoting is likely a "SelfAwarewolf":

"A person who, when trying to criticize those who match a certain description, fails to realize that they have (in the process of criticizing others) revealed themselves to match the exact same description"

https://neologisms.rice.edu/index.php?a=term&d=1&t=24708

jessaustin 2021-08-19 02:14:15 +0000 UTC [ - ]

There is no reason to think that Bob Diachenko is such a person. He didn't take part in the authoritarian project that generated these lists.

_moof 2021-08-19 15:55:02 +0000 UTC [ - ]

I probably should've added that as a parenthetical - those words weren't spoken by the people who made the list.

And it's hard to tell how much of an implied wink is behind that quote. I know if I'd said it, I'd have done so with subtext.

kamray23 2021-08-19 09:04:20 +0000 UTC [ - ]

Indeed, he simply prevented the list's proliferation

voldacar 2021-08-18 23:33:31 +0000 UTC [ - ]

So somebody found the terrorist watchlist and didn't upload it anywhere or start a torrent, but instead took some screenshots and gave vague descriptions of the data to journalists?

I'd like my reality unmediated, please

jimmaswell 2021-08-19 02:09:47 +0000 UTC [ - ]

Maybe they wanted to mitigate their risk of major prison time.

smitty1e 2021-08-19 00:45:54 +0000 UTC [ - ]

Among the basic concepts of American Civil Rights used to be Sixth Amendment right to confront accusers.

Legal weenies may engage in mental gymnastics to rationalize the evil of no-fly lists.

They deserve the receiving end of their perfidy.

thepasswordis 2021-08-18 18:55:47 +0000 UTC [ - ]

Suggestion:

Take the Facebook leak from earlier. Create hundreds of collections if 1.9M people. Release it to the dark web.

Just flood then zone with noise. FBI can still keep their list (and know it’s legit), and peoples privacy will be ensured.

Otherwise this is going to 100% get integrated into various social credit systems we have in the US.

Ceezy 2021-08-18 17:29:16 +0000 UTC [ - ]

These people are morons! They claimed to be crème de la crème and watch. Few years ago they wanted to force Apple to create a "secure backdoor". Hope we gonna get more details.

Sorry for the rant

ClumsyPilot 2021-08-18 17:50:47 +0000 UTC [ - ]

I wonder how many hacks happened purelu because of these backdoors

thephyber 2021-08-19 02:40:11 +0000 UTC [ - ]

I’m curious if anyone who is on the leaked list now has standing in court to litigate their status, whereas they could not prove their status/data before.

One of my biggest complaints with national security programs is that they tend to argue that transparency (even to the voters and elected representatives whom these programs ostensibly protect) threatens the program. Sometimes when leaks happen, it gives the citizens a tool they didn’t previously have to challenge those programs.

hughrr 2021-08-18 18:23:04 +0000 UTC [ - ]

Awaiting future headline “Secret CSAM hash list leaks online”.

Keeping lists secret appears to be something the human race is really really bad at.

grishka 2021-08-19 01:26:17 +0000 UTC [ - ]

It's so secret it gets distributed to every compatible iOS device, right

woodruffw 2021-08-18 20:17:46 +0000 UTC [ - ]

> Additionally, the researcher noticed some elusive fields such as "tag," "nomination type," and "selectee indicator," that weren't immediately understood by him.

I'm not sure about the others, but "selectee indicator" might be whether the individual is on the Selectee list used for SSSS flagging[1].

[1]: https://en.wikipedia.org/wiki/Secondary_Security_Screening_S...

gjsman-1000 2021-08-18 17:43:02 +0000 UTC [ - ]

Just an hour ago I was having a dialogue with someone on Hacker News saying we needed a national ID system after the T-Mobile hack. I said that the US Government should not be trusted to be any more secure than T-Mobile with such a system.

I rest my case.

creato 2021-08-18 18:39:46 +0000 UTC [ - ]

A national ID doesn't necessarily have data security implications any more than the current state-by-state DMV system does.

The relevance of a national ID is (presumably) so that banks can check identity more reliably, i.e. making security breaches like the T-Mobile one irrelevant. It wouldn't matter if your SSN was public information.

adolph 2021-08-18 20:09:53 +0000 UTC [ - ]

> check identity more reliably

Most states in the current system seem to have a crude biometric identity verification of a photo plus point in time stats of height/weight/coloring, all of which is nominally protected/validated by counterfeit protection. How would a national ID be any different?

nautilius 2021-08-18 22:10:37 +0000 UTC [ - ]

Do you have to have a 'crude state ID'? Is there any legal pressure to keep the data on it up-to-date? Are the standards for 'crude state IDs' identical between states or would you have to know the rules and regulations of 50 different jurisdictions?

adolph 2021-08-19 15:45:50 +0000 UTC [ - ]

> Do you have to have a 'crude state ID'?

It is not an explicit legal requirement but encouraged through a coercive network of public/private regulation.

> Is there any legal pressure to keep the data on it up-to-date?

There are legal consequences for failing to update data.

> Are the standards for 'crude state IDs' identical between states or would you have to know the rules and regulations of 50 different jurisdictions?

Yes, within the United States there is a "Real ID" standard promoted across states by the federal government. A business operating in any particular jurisdiction is benefited by counsel regarding localization.

mikem170 2021-08-18 23:33:26 +0000 UTC [ - ]

Conversely, is there a reason we should be optimizing the regulations we, actual human beings, live under for the convenience of national/international corporations?

nautilius 2021-08-19 13:10:45 +0000 UTC [ - ]

That's a completely different question, well worth to be debated.

My point is that currently, we don't have anything like a national ID.

jedimastert 2021-08-18 18:41:01 +0000 UTC [ - ]

It's not like "the government" doesn't already have all of this information. Most information on an ID is OSI anyways. I can go from my name to everything on my state-issued license from public records.

jackson1442 2021-08-18 20:04:28 +0000 UTC [ - ]

We already have a national identity card- the social security card. Problem is, it's absolutely terrible at being an ID card, so we should replace it with something more secure that is purpose-built.

If we're going to treat this magic number like a national ID number, the least we can do is buff it up a little.

YeBanKo 2021-08-18 22:09:10 +0000 UTC [ - ]

We already have a national id system. It’s called a passport, a birth certificate, a DMV id or driver’s license, a social security number. Those are all national id systems.

BeFlatXIII 2021-08-19 07:43:25 +0000 UTC [ - ]

That sounds like five half-assed ID systems. Such is the fear of government databases: it prevents a central database with proper oversight so fifteen worse ones take its place and store stuff that never would have been admitted to the hypothetical single DB.

YeBanKo 2021-08-19 08:26:10 +0000 UTC [ - ]

What is so half assed about passports as national ID system?

dr_kiszonka 2021-08-18 23:35:01 +0000 UTC [ - ]

Genuine question because I don't really understand how IDs work in the US: is there a database or a system that would allow an agency to keep track of all of your IDs, like driving licenses from different states, etc.? Is there anything similar that institutions like banks could use? Also, my understanding is that most Americans use a driving license as their ID. Are passports the only national, i.e., not state-level, IDs available to Americans?

YeBanKo 2021-08-19 04:49:39 +0000 UTC [ - ]

Passport and SSN are national ids. They are issued by the Federal government, so it is nation wide database.

On top of that, states have their own ID systems. Typically there are 2 options: just a state ID or driver’s license, that serves also as an ID. Most people in the US get driver’s license early(permits as early as 15), so there aren’t that many who has just the ID.

Now, SSN is issues upon birth. Before you know it, you can already start paying taxes.

For passport you need to apply, typically you would need it if you wanted to travel outside of the US. Otherwise, you rarely need it. This is because for the most part you deal with state bureaucracy, as most of the day to day life falls within state’s jurisdiction. Driving, getting married, divorced, buying things like a vehicle or a real estate, opening a bank account, domestic aur travel, etc. Some can live their entire lives without a passport, because a state ID will suffice. Even for things like voting in federal elections - you don’t need a passport. Contrary to many people’s beliefs, in the US the states vote, not people. This is/was by design. Now it gets more centralized, but the original concept is close to EU in terms of states autonomy. This means, that even for federal elections procedures vary greatly by state (its been on the news a lot lately). Moreover, you aren’t required to have an ID. It is not illegal not to have an ID or be off the grid.

Before 9/11 you could even go to Canada using state ID only. Now I think even it’s possible, probably only if you have some special kind of ID.

This is how things have been until recently. Then REAL ID came around. Because states rules governing ID issuance, they vary greatly. So we ended up with some states’ IDs that were as easy to counterfeit as printing a piece of paper. Some states would not do a due diligence verifying your name or address and would just take your word for it. READ ID is to addresses: mandates minimum protection level, due diligence a state needs to do to confirm address, etc. New federal regulations does not allow air travel with state ID that don’t comply with REAL ID requirements. Few states still don’t, so residents of those states will need passports for domestic travel. I think this trend will continue beyond air travel.

States aren’t required to share this data with federal government or each other. It is, however, a requirement for REAL ID. At the same time there are many businesses, that specialize in aggregating various identity information a out people. Credit bureaus are such businesses as well. They aren’t only in business of credit checks, but also identity verification, employment verification, etc. Some of these companies have federal, state and local agencies among their clients.

Fun fact: you can board a domestic flight without an ID. For example, if you lost it. TSA has a procedure to establish your identity. This includes asking you a bunch of facts about your life, such as where you lived in year X, last 3 cars you owned, your spouse full name and birthday, etc. I suspect they maybe using one of the credit bureaus identity verification product offerings.

jandrewrogers 2021-08-18 22:21:47 +0000 UTC [ - ]

A passport and SSN are national IDs. Birth certificates and DMV docs are State IDs only.

2021-08-18 18:46:58 +0000 UTC [ - ]

tomc1985 2021-08-18 19:50:12 +0000 UTC [ - ]

Elasticsearch is like the security breach gift that keeps on giving...

kieselguhr_kid 2021-08-18 20:19:15 +0000 UTC [ - ]

I mean, the FBI should 1000000% know better than to expose their unsecured Elasticsearch cluster to the internet. While Elasticsearch should be more secure by default, I'd say the blame is much more on the agency.

tomc1985 2021-08-18 20:22:58 +0000 UTC [ - ]

Has Elasticsearch done anything to fix its ridiculously bad lack of access control?

People are fucking stupid, and expecting them not to fuck this up is a big ask. Too big, in fact.

Secure by default or GTFO

clipradiowallet 2021-08-18 20:50:14 +0000 UTC [ - ]

Elasticsearch has nothing to fix - the product does precisely what the config tells it to. Maintainers of various distros ES packages are largely responsible for any [mis]configuration there.

If you'd like to read how you can secure ES, go do that: https://www.elastic.co/what-is/open-x-pack

PS: x-pack is the piece that adds authorization/authentication to ES.

altdataseller 2021-08-18 21:48:26 +0000 UTC [ - ]

You can setup username and pass auth in newer versions of Elastic without paying for xpack (I think at version 6 or up?)

clipradiowallet 2021-08-19 13:52:48 +0000 UTC [ - ]

X-pack is free now, they don't make you license it anymore. I wasn't aware of how to setup username/pass without it though (other than something like an nginx proxy in front of 9200/tcp with basic auth)

kieselguhr_kid 2021-08-18 20:31:29 +0000 UTC [ - ]

I think it's reasonable to expect the FBI to not expose this. I'm with you on Elasticsearch being too insecure but you're talking about secret government info. If they put that on the open internet that's a serious failure on their part and they'd have fucked it up with another tool if they weren't fucking it up with ES.

twobitshifter 2021-08-18 21:24:49 +0000 UTC [ - ]

It’s not clear it was the FBI, the server was in Bahrain. This could be bigger than just an FBI screwup. Why is US SSI in an server in Bahrain?

tomc1985 2021-08-18 23:18:30 +0000 UTC [ - ]

It could be something for the local US embassy. I knew some people in the foreign service that worked there once

baybal2 2021-08-19 01:46:41 +0000 UTC [ - ]

Can you tell more about that?

tomc1985 2021-08-19 04:10:45 +0000 UTC [ - ]

Not much to tell... old forum friend from back when forums were the big thing. We'd play videogames together that weren't too sensitive to lag in our off hours. She had a few stories from life there, I forget what her role was. At one point she got to shake the hand of the president and she showed me a picture of it. We lost touch and I have no idea what she's up to now.

Saris 2021-08-18 21:28:07 +0000 UTC [ - ]

It's crazy how many instances are setup to be accessible from the internet, but they don't bother to secure it.

outworlder 2021-08-18 19:50:41 +0000 UTC [ - ]

"Misconfigured Elasticsearch cluster"

Doubly so. No passwords _and_ it was exposed. There's no real reason to ever directly expose a database to the internet for 0.0.0.0/0. Heck, there's no reason to expose to any routable address.

Yeah sure zero trust or whatever. Still, why even risk it? Layers.

2021-08-19 01:17:32 +0000 UTC [ - ]

Saris 2021-08-18 21:24:49 +0000 UTC [ - ]

>There's no real reason to ever directly expose a database to the internet for 0.0.0.0/0

And open the host firewall too, there were quite a few layers of absolute incompetence involved here!

atonse 2021-08-18 20:32:07 +0000 UTC [ - ]

This is what I came here to ask.

How did this server even have a public IP?

sonicggg 2021-08-18 18:08:22 +0000 UTC [ - ]

Where is this alleged list then? Very convenient that this guy is not disclosing a link to this supposed leak. I think someone wants notoriety.

mygoodaccount 2021-08-18 20:20:40 +0000 UTC [ - ]

It looks like it was "leaked", as in, publicly exposed server indexed by a few search engines. It's possible that this researcher was the only one to come across it, and reported it immediately. In which case it'll never see the light of day.

serf 2021-08-18 22:53:32 +0000 UTC [ - ]

"The exposed server was taken down about three weeks later, on August 9, 2021. It's not clear why it took so long, and I don't know for sure whether any unauthorized parties accessed it."

three weeks open on the internet; it seems unlikely that no other party accessed it.

afrcnc 2021-08-18 21:55:03 +0000 UTC [ - ]

mygoodaccount 2021-08-18 20:08:26 +0000 UTC [ - ]

Did some perusing - can't find it anywhere you'd normally find these things. Let me know if anyone does!

commandlinefan 2021-08-18 20:21:58 +0000 UTC [ - ]

At least last time I looked at it, ElasticSearch is shockingly insecure by default (as are Mongo, Cassandra, Hadoop, and everything else that's popular in the relatively recent Java ecosystem).

MichaelMoser123 2021-08-19 01:18:58 +0000 UTC [ - ]

For a system like ES there is encryption in transit and encryption at rest.

https://docs.aws.amazon.com/elasticsearch-service/latest/dev... amazon elastic search gives you the option of encrypting the data at rest (meaning it is encrypted by amazon ES when stored persistently) - they use KMS for key management, so it should have a per record symmetric key that is encrypted by master symmetric key. It's notable that the amazon fork has added this functionality, this does not seem to be part of elastic search proper (please correct me if I am wrong)

Elastic search proper is only talking about encryption in transit https://www.elastic.co/what-is/elastic-stack-security?ultron... Here they say that they don't have encryption at rest https://www.elastic.co/guide/en/cloud-enterprise/current/ece...

Now you can possibly encrypt the records at the application level, but that makes them unsearchable; however the ability to search the stuff is arguably the point of having it in elasticserarch.

snarf21 2021-08-18 20:30:34 +0000 UTC [ - ]

Yeah, this is the same as Wi-Fi routers all being admin/password. They finally started assigning them random pwds. Why isn't secure by default chosen?

l0b0 2021-08-18 20:48:52 +0000 UTC [ - ]

That's easy: perverse incentives.

1. Secure by default makes for a higher barrier to entry. It's human nature to want to keep barriers of entry low for your life's work. (I have similar thoughts around copyleft licenses being better for the users but hard to sell to the creators.)

2. Security is "available" to anyone savvy enough to clear all the hurdles to secure the system, so the creators feel justified to blame the user.

3. The product is developed with an assumption that something outside the product is supposed to provide security. For example, the Go.CD devs (excellent product otherwise) scoffed at the idea of improving their crappy password hashing (single round of SHA256 with no salt IIRC), instead suggesting that I should wrap the service in some other, safer authentication mechanism.

Saris 2021-08-18 21:23:43 +0000 UTC [ - ]

It's crazy how much stuff is just no auth and listens on all interfaces by default.

ransom1538 2021-08-18 18:22:43 +0000 UTC [ - ]

Can someone post the list?

throwaway4688f 2021-08-18 18:24:09 +0000 UTC [ - ]

Where is the torrent, dammit? Internet ain't what it used to be.

SevenSigs 2021-08-19 00:43:06 +0000 UTC [ - ]

Where can I get the list? This should definitely public (unless they just put random people on the list).

southerntofu 2021-08-19 08:18:41 +0000 UTC [ - ]

It should definitely be public, but it isn't. And just like any political repression database, it's filled with random people.

tester756 2021-08-18 20:08:02 +0000 UTC [ - ]

Why "misconfigured" Elastichsearch being reason appears this often?

mienski 2021-08-19 00:43:04 +0000 UTC [ - ]

Think I've posted this before but my employer paid Elastic for the official training - and even that course included everything on how to set up, run and tune ES but applying any security was only covered in the advanced course that you had to pay another $x thousand dollars to attend.

So even doing official Elastic training still leaves you with a nice footgun.

rodgerd 2021-08-19 02:40:57 +0000 UTC [ - ]

Yeah. "Not leaking data" is basically a pay-for way for Elastic to commercialise the tool. A pretty shitty way, I would say.

kieselguhr_kid 2021-08-18 20:17:31 +0000 UTC [ - ]

By default, Elasticsearch is unsecured. If you manage your own ES cluster, you have to go through a few steps to secure it manually. Lots of people either don't know/don't care about this though, so they regularly expose their data to the whole internet.

Saris 2021-08-18 21:26:56 +0000 UTC [ - ]

It has no authentication by default, and it listens on all interfaces instead of just localhost by default.

I used it for a while at home for a project, and setting up auth was quite a process, very difficult compared to most other databases.

thepasswordis 2021-08-18 18:53:03 +0000 UTC [ - ]

So this is definitely going to be used for character assassinations right?

2021-08-18 19:43:12 +0000 UTC [ - ]

1023bytes 2021-08-18 19:12:47 +0000 UTC [ - ]

Perhaps yet another unsecured MongoDB?

alexfromapex 2021-08-18 18:43:35 +0000 UTC [ - ]

The fact this wasn't protected by a VPN is amazing

trident5000 2021-08-18 20:27:57 +0000 UTC [ - ]

Once government agencies are given approval from congress they typically have very little oversight from that point on including from congress. Its why we get abusive behavior from so many of them.

NSA: Prism

DEA: Asset forfeiture

FBI/CIA: Abusing fisa and using five eyes to spy domestically

IRS: Political targeting

etc etc etc

giantg2 2021-08-18 20:32:04 +0000 UTC [ - ]

ATF: Approving background checks on known traffickers and continuing to sell them guns even after there were concerns they couldn't track the weapons. (And ruby ridge, and waco... )

throwaway0a5e 2021-08-18 23:58:01 +0000 UTC [ - ]

ATF is the one of the few federal agencies that's simultaneously hated by both the right and the left. They bring crime to poor urban areas with their anti-gun trafficking operations and violate people's 2a rights left and right with their mundane administrative operations and enforcement thereof. Nobody who knows what they do likes them.

giantg2 2021-08-19 02:17:41 +0000 UTC [ - ]

Even the FBI dislikes them. Both Waco and Ruby Ridge started as botched ATF operations that the FBI had to take over.

londons_explore 2021-08-18 20:25:04 +0000 UTC [ - ]

With 1.9 million people,there must be plenty of people here whose data is in this list.

Any of you care to comment?

southerntofu 2021-08-19 08:17:22 +0000 UTC [ - ]

I have no clue if i'm on the list. However as an anarchist i believe there are chances i'm on there, because we anarchists are opposed to all forms of domination and exploitation, so there's a lot of people in power who are angry at us. The ancestor of Interpol, the first international conference gathering psychopaths from political police from across the planet in 1898, was famously a conference "for social defense against anarchists": https://en.wikipedia.org/wiki/International_Conference_of_Ro...

I have had many friends over the years go through prison and put on "terrorism" lists by the french secret service for their political activities. Government is tyranny. Governments only exist to serve the rich and powerful, and ensure nothing ever changes. If you're not convinced, you can look up FBI's "COINTELPRO", of which the current no-fly list program and terrorism-creation program (search for "How the FBI creates terrorists", plenty of documented cases) are just a continuation of COINTELPRO and other FBI/CIA programs designed to prevent the people from exerting their free will and right to organize.

hcduytWW 2021-08-19 11:55:24 +0000 UTC [ - ]

Christian Garreth is my name and i reside here in Los Angeles, i work as a dispatcher and got dropped down from work in regards to Covid-19 but before the incident i was able to save some funds hoping to invest someday into some good business that can really brings out good income, before I got dropped from my job due to covid-19 i came across a broker trading site which deal on cryptos and i signed up with the site and a representative called me, it was a female voice, she made me feel comfortable and i trusted the process so i decided to invest with $8500 in Bitcoin, after three months of loosing my job i decided to make a withdraw and i was ask to pay more then i did until i noticed i have paid $46,980 US Dollars which led me into debt and the worst of all was that the whole thing was a scam so i decided to look for a means to get my funds back. then i came across several hackers online about 4 of them who took my money and take advantage of my situation, i totally gave up and i lose my apartment along the process so i was squatting with a friend of mine who works at a grocery shop, it was my lucky day when i got referred by someone close to me to email wizardharry (@) programmer (.) net or WhatsApp him +1- (807) 808 - 6168, i did as instructed and when i explained everything to him, he only asked me for details and the cost of the services and it was very affordable and understood by me so i decided to give it a try, a try turns out to be something great and bigger than my expectation. today I'm a happy man and all my funds were recovered by him and my life changed for good. please don't fail to contact wizard harry for scam funds recovery.

2021-08-19 05:08:36 +0000 UTC [ - ]

tom7 2021-08-18 19:14:32 +0000 UTC [ - ]

It leaked so hard that nobody outside of mainstream media saw it. You people are idiots.

dukeofdoom 2021-08-18 18:06:08 +0000 UTC [ - ]

So basically a list of Trump supporters. Well known for their opposition to COVID measures, and claims of election fraud, and belief that Trump can be reinstated.

c3534l 2021-08-18 18:14:09 +0000 UTC [ - ]

What makes you say its a list of Trump supporters?

dukeofdoom 2021-08-18 18:20:20 +0000 UTC [ - ]

They build a fence around the capital to protect against them.

Since there's no way there are actual 1.9 million terrorists in the US. 1.9 million/326 million is about 1 person out of 200 on that list.

In all likely hood, its just a list composed of people in opposition to government.

Can't be many BLM protestors, and leftists, since government is flying their flags. Simple deductive reasoning will get you to that this list is mostly Trump supporters from his populist movement.

Just read the latest Terrorism Threat bulletin from DHS. Then visit Gab.com, if you have any doubts on the overlap.

Summary of Terrorism Threat to the U.S. Homeland

https://www.dhs.gov/ntas/advisory/national-terrorism-advisor...

jjulius 2021-08-18 19:43:54 +0000 UTC [ - ]

You could've distilled your answer to the question by simply saying, "Pure speculation based on a faulty assumption that only US citizens are on this list".

wolverine876 2021-08-18 20:53:57 +0000 UTC [ - ]

And the falsehood that government only puts people with right-wing beliefs on watchlists.

c3534l 2021-08-18 21:09:47 +0000 UTC [ - ]

So are you saying you're just guessing because you believe the government has it out to get Trump supporters? If, it turned out, there was a similarly large number of people on the list prior to Trump's election, would that change your mind? I think the concern that an extra-judicial list this large certainly has the potential for abuse, and America's 3-letter agencies have historically used the auspices of national security to target and harass political opponents and personal enemies. However, you don't have any reason to suspect that this list contains that group specifically, right? Other than just some perceived marginalization by mainstream society, that is.

tubbs 2021-08-18 18:42:53 +0000 UTC [ - ]

The list seemingly not just citizens of the United States.

sunshineforever 2021-08-18 22:49:06 +0000 UTC [ - ]

It's so ironic that you think they are falsely putting right-wing people on the list when historically it has been leftists to receive such treatment.

datavirtue 2021-08-18 18:43:20 +0000 UTC [ - ]

Another Q drop.

2021-08-18 18:49:37 +0000 UTC [ - ]

TekMol 2021-08-18 17:25:24 +0000 UTC [ - ]

What would happen if you put all these people together on an empty island?

aaomidi 2021-08-18 17:27:54 +0000 UTC [ - ]

They would be super confused since there is really no checks on who gets put on this list.

OneLeggedCat 2021-08-18 17:49:51 +0000 UTC [ - ]

You'd have about 1.9 million people on an island, the vast majority of which are normal, average people.

fouc 2021-08-18 17:59:06 +0000 UTC [ - ]

who is John Galt?