A copy of the famed No Fly List, vastly expanded after the 9/11 attacks and now populated by more than a million people who are 5 years old, have common Arabic names, or simply upset some random cop or official, was left to be found on an unsecured cloud server. And it was soon found.
BleepingComputer reviewed a portion of these lists—provided as two CSV files named, 'NOFLY' and 'SELECTEE.' The latter list likely names some of the passengers who undergo a Secondary Security Screening Selection (SSSS) at airports when flying into the U.S.
The no-fly spreadsheet posted on the forum contains 1,566,062 records, and includes duplicates/spelling variations of some names. The 'SELECTEE' list comprises 251,169 records. The presence of duplicates and aliases in the list implies the total number of exposed names are fewer than 1.5 million.
The ironic thing about official secrecy is that the lack of accountability turns it into a gravity well for junk. Those reading the lists say they're full of gibberish and dupes.
