US nuclear weapon bunker security secrets spill from online flashcards since 2013

Leaked data proves very educational


Details of some US nuclear missile bunkers in Europe, which contain live warheads, along with secret codewords used by guards to signal that they’re being threatened by enemies, were exposed for nearly a decade through online flashcards used for education, but which were left publicly available.

The astonishing security blunder was revealed by investigative journalism website Bellingcat, which described what it found after “simply searching online for terms publicly known to be associated with nuclear weapons.”

The flashcards “detail intricate security details and protocols such as the positions of cameras, the frequency of patrols around the vaults, secret duress words that signal when a guard is being threatened and the unique identifiers that a restricted area badge needs to have,” Bellingcat reported.

Merely googling “PAS” (protective aircraft shelter), “WS3” (weapons storage and security systems) and “vault” (the US military term for nuclear weapons bunkers) together with the names of US Air Force stations in Europe came back with flashcards used in training and hosted on websites Chegg, Quizlet, and Cram.

Materials found by Bellingcat suggested the protocols had been in use as recently as April, though the oldest dated back to 2013. The flashcards themselves have since been deleted, with the US Air Force telling Bellingcat it was “investigating the suitability of information shared via study flashcards.”

Some flashcards included the locations and sightlines of surveillance cameras pointed at key entrances, and the locations of modems networking the vaults’ systems with the wider base. Precisely which vaults were being used to store nuclear warheads was detailed in some cards.

The investigative website’s findings are similar to the open-source intelligence it found when looking at beer-rating app Untappd last year. Using Bellingcat’s techniques, The Register was able to easily identify key government personnel working in militarily sensitive establishments.

Online OPSEC is important: subscribing to ebooks website Scribd and searching for certain terms can reveal all manner of confidential manuals and handbooks, and slide-deck website Prezi occasionally contains internal slideshows the content of which probably wasn't intended to be published to the wider world.

Think of it this way: if you’re uploading sensitive data to a website that isn’t operated by or contracted to your company (or the government in this case), you probably shouldn’t do it. Particularly if you're guarding nuclear weapons. ®


Other stories you might like

  • NASA delays SLS rollback due to concerns over rocky path to launchpad
    The road to the Moon is paved with... river rock?

    NASA's Moon rocket is to trundle back into its shed today after a delay caused by concerns over the crawlerway.

    The massive transporter used to move the Space Launch System between Vehicle Assembly Building (VAB) and launchpad requires a level pathway and teams have been working on the inclined pathway leading to the launchpad where the rocket currently resides to ensure there is an even distribution of rocks to support the mobile launcher and rocket.

    The latest wet dress rehearsal was completed on June 20 after engineers "masked" data from sensors that would have called a halt to proceedings. Once back in the VAB, engineers plan to replace a seal on the quick disconnect of the tail service mast umbilical. The stack will then roll back to the launchpad for what NASA fervently hopes is the last time before a long hoped-for launch in late August.

    Continue reading
  • Datacenter operator Switch hit with claims it misled investors over $11b buyout
    Complainants say financial projections were not disclosed, rendering SEC filing false and misleading

    Datacenter operator Switch Inc is being sued by investors over claims that it did not disclose key financial details when pursuing an $11 billion deal with DigitalBridge Group and IFM Investors that will see the company taken into private ownership if it goes ahead.

    Two separate cases have been filed this week by shareholders Marc Waterman and Denise Redfield in the Federal Court in New York. The filings contain very similar claims that a proxy statement filed by Switch with the US Securities and Exchange Commission (SEC) in regard to the proposed deal omitted material information regarding Switch's financial projections.

    Both Redfield and Waterman have asked the Federal Court to put the deal on hold, or to undo it in the event that Switch manages in the meantime to close the transaction, and to order Switch to issue a new proxy statement that sets out all the relevant material information.

    Continue reading
  • Google to pay $90m to settle lawsuit over anti-competitive behavior on the Play Store
    US developers that qualify could receive more than $200,000

    Google is to pay $90 million to settle a class-action lawsuit with US developers over alleged anti-competitive behavior regarding the Google Play Store.

    Eligible for a share in the $90 million fund are US developers who earned two million dollars or less in annual revenue through Google Play between 2016 and 2021. "A vast majority of US developers who earned revenue through Google Play will be eligible to receive money from this fund," said Google.

    Law firm Hagens Berman announced the settlement this morning, having been one of the first to file a class case. The legal firm was one of four that secured a $100 million settlement from Apple in 2021 for US iOS developers.

    Continue reading
  • Devops tool Jenkins now requires Java 11: This might sting a bit
    Final shift set for version 2.357 of developer automation platform

    It has taken a while, but the Jenkins project confirmed this week that Java 11 will be required from this week's Jenkins 2.357 and for the upcoming September LTS release.

    Jenkins, originally authored by Kohsuke Kawaguchi, recently passed its 10th anniversary. Originally known as Hudson, before the Oracle / Sun deal resulted in a fork, the platform is a veteran of the continuous integration and continuous delivery world. It is also written in Java.

    It's going to be a bit of a wrench. Java 11 itself was released in 2018 as a long-term support version, and the Jenkins LTS core has been Java 11-capable for a while now. The June LTS also supports Java 17 (the latest LTS of Java SE.)

    Continue reading

Biting the hand that feeds IT © 1998–2022