Classified US Military Information Exposed Through Online Flash Cards
Online study services like Chegg and Quizlet have grown increasingly popular among students in recent years (the author included) and apparently among US military servicemembers as well. Anything from unit chains of command to lists of military acronyms have been converted into flash cards for online study. One Quizlet user, apparently a member of the US Navy, created a set (linked here) to memorize the basic capabilities of naval aircraft.
Unfortunately, a recent open-source investigation by Foeke Postma from Bellingcat revealed that some of the publicly available sets included highly classified information such as the number and location of US nuclear weapons at key military facilities.
All Postma needed to do was to search up a number of common nuclear-related words and acronyms like “WS3” (Weapons Storage and Security Systems) and/or the names of US military bases on Google and through the search engines of flash-card-hosting services. Rather quickly, a huge amount of card sets was made available. Often, the profile names and profile pictures could be linked back to LinkedIn accounts of servicemembers.
One set simply titled “Study!” included confidential information on the nuclear weapons stored at Volkel Air Base in the Netherlands including which vaults (or weapons shelters) were “HOT” and which were “COLD”. Some other cards related to the base included details on things like the authenticators present on badges allowing access to restricted areas of Volekl base.
After its investigation, Bellingcat contacted NATO, US, Dutch and other national commands about the security issue alongside links to a plethora of relevant flash card sets. Since then, a large number of sets including “Study!” have been taken down although many of these have remained publicly available for many years; some date back to 2013. Worst of all, even some of the removed sets can still be accessed through the Wayback Machine and even if the sets had never been made public, the information should probably not have been uploaded to platforms like Quizlet to begin with.
The full investigation by Foeke Postma on Bellingcat is available here.