Grab A US Military Device Full Of Biometric Data For Only $68 At Ebay! [Sponsored]
The War on Terror will never end. It's a multi-billion dollar boondoggle that ensures we will always live in fear, even if we realistically have nothing to fear. The war we waged for the hearts and minds of Afghanistan residents lasted long enough that soldiers participating in another US losing effort weren't even born when the war began.
We may exit war zones but our tech often doesn't. The logistics of massive military operations makes it impossible to secure/destroy everything we've brought into war zones. I fully understand the complexity. Far too often, I can't find my car keys or sunglasses or whatever when I need them. And that's just things related to a single person with a single base of operations. Multiply that by dozens or hundreds or thousands. Things are left behind. Devices vanish into the fog of war. The bigger the deployment, the harder it is to manage the minutia.
So, it's not necessarily mismanagement that brings us to this incredible story. It's simply that when things become too big to manage effectively, stuff - extremely awkward and unfortunate stuff - happens. And when you acquire something for next to nothing, you can still make bank by selling electronics and the personal information they contain for low, low prices.
The shoebox-shaped device, designed to capture fingerprints and perform iris scans, was listed on eBay for $149.95. A German security researcher, Matthias Marx, successfully offered $68, and when it arrived at his home in Hamburg in August, the rugged, hand-held machine contained more than what was promised in the listing.
The device's memory card held the names, nationalities, photographs, fingerprints and iris scans of 2,632 people.
Most people in the database, which was reviewed by The New York Times, were from Afghanistan and Iraq. Many were known terrorists and wanted individuals, but others appeared to be people who had worked with the U.S. government or simply been stopped at checkpoints. Metadata on the device, called a Secure Electronic Enrollment Kit, or SEEK II, revealed that it had last been used in the summer of 2012 near Kandahar, Afghanistan.
Yikes. We all want to believe something like this would never happen. I imagine the US military never thought such a thing would be possible. But here we are, watching security researchers click BUY IT NOW" to grab biometric info (not to mention the device housing it) for about $0.025 per person.
The device is the offspring of the War on Terror declared by George W. Bush following the September 11, 2001 attacks. Twenty years later, the war has created problems too big to manage properly, resulting in the offloading of military tech containing sensitive info on consumer-oriented websites. Given the price this was acquired for, it's possible the seller didn't even know what they had in their possession, other than some inscrutable chunk of military tech.
It's not only a storehouse for sensitive data collected by the US military during Afghanistan operations, it's also an attack vector.
The SEEK II has a tiny screen, a miniature physical keyboard and an almost comically small mouse pad. A thumbprint reader is protected by a hinged plastic lid at the bottom of the device. Like an ancient Polaroid camera, the machine unfolds to allow iris scans and to take photos. Mr. Marx used the SEEK II on himself; when he turned it off, a message popped up, asking to connect to a U.S. Special Operations Command server to upload the new collected biometrics."
The fact that it still attempts to connect to military servers suggests no one's aware the device is lost. That also suggests there's not much follow-up happening to ensure devices no longer possessed by the US military are stripped of their remote access capabilities. The prompt to connect may be little more than IF/THEN" coding, but as long as servers still treat abandoned devices as valid input options, the possibility that military servers containing even more personal data may be illicitly accessed still remains.
But that's the power of the internet marketplace, folks. eBay has everything you need! And it still exists, despite the eruption of dozens of competing marketplaces! And let's face it, Craigslist and Amazon are far less likely to sell you secondhand military tech. So, come back to the original 800-lb. gorilla of online auctions! eBay can get you what you want, even if it's government equipment loaded with sensitive info!
[Disclosure: the author of this post once purchased an autographed Skinny Puppy album on eBay. The author has never been paid or given free products from eBay or its management, despite his repeated, irrational demands that the internet owes me." There are no affiliate links in this post despite the misleading title.]