Thread by @MatthewFoldi

NEW from me @TheSpectator:

@HomelandGOP, led by #NC08's @RepDanBishop and #TN07's @RepMarkGreen, is demanding answers from TSA after the massive data breach

Here's what they want TSA to answer ASAP

thespectator.com/topic/house-re…

(1/xx)

#NC08's @RepDanBishop and #TN07's @RepMarkGreen are investigating @TSA to work out how a prolific Swiss hacker who identifies as a “tiny kitten” was able to obtain over a million entries from the No-Fly List.

thespectator.com/topic/house-re…

(2/xx)

The hacker was able to access a 2019 version of the list after what she described as just a few hours!

Following the hack, @HomelandGOP's @RepDanBishop immediately suggested that @HouseGOP planned to learn how this data was left so exposed.

https://twitter.com/RepDanBishop/status/1616892105758236673

(3/xx)

In a letter to @TSA_Pekoske, #NC08's @RepDanBishop — and @HomelandGOP's @RepMarkGreen — outlined questions about the “alarming” hack, which they call “a matter concerning cybersecurity, aviation security, as well as civil rights and liberties.”

thespectator.com/topic/house-re…

(4/xx)

While the Republicans sit on the committee that oversees @TSA, they wrote that they were unaware of the massive data breach until they read about it in the media!

thespectator.com/topic/house-re…

(5/xx)

The hacker, who describes herself as a “mentally ill enby polyam trans lesbian anarchist kitten,” boasted about her successful hack in terms bordering on the flippant at times, but Bishop and Green say that the hack is no laughing matter.

thespectator.com/topic/house-re…

(6/xx)

The hacker claimed she “may have been able to exploit access to the server to cancel or delay flights and even switch out crew members.” She also bragged to the Record that she “had access to pretty much all their infrastructure in some way”!

thespectator.com/topic/house-re…

(7/xx)

The materials she obtained include 2019's Federal Terrorist Screening Dataset, as well as that year’s No-Fly List. She has not publicly released the data, but did name some, including notorious Russian arms dealer Viktor Bout, as proof.

thespectator.com/topic/house-re…

(8/xx)

The fact that the No-Fly List contained over a million names, including Bout’s and some members of the Irish Republican Army, prompted consternation from across the political spectrum.

thespectator.com/topic/house-re…

(9/xx)

#NC08's @RepDanBishop told me that “the No-Fly list has ballooned to an absurdly high number of people. The civil rights abuses of the list have been well-documented, and these are only exacerbated by this hack.”

thespectator.com/topic/house-re…

(10/xx)

Even the @ACLU echoed @RepDanBishop’s criticisms from the left.

thespectator.com/topic/house-re…

(11/xx)

Among the questions they want @TSA_Pekoske to answer are when @TSA learned of the hack, whether there were instances of unauthorized individuals canceling flights or changing crew member assignments, and what threat assessments it has conducted.

thespectator.com/topic/house-re…

(12/xx)

The hack itself shows how vulnerable flight data is. In a blog posted creatively titled “how to completely own an airline in 3 easy steps,” the hacker explained how she both “owned” CommuteAir “and grab[bed] the TSA nofly list along the way.”

thespectator.com/topic/house-re…

(13/xx)

She “found pretty much all [personally identifiable information] imaginable for each of their crew members. full names, addresses, phone numbers, passport numbers, pilot’s license numbers, when their next linecheck is due and much more.”

thespectator.com/topic/house-re…

(14/xx)

In addition to private information of flight crews, she “had trip sheets for every flight, the potential to access every flight plan ever, a whole bunch of image attachments to bookings for reimbursement flights containing yet again more PII...

thespectator.com/topic/house-re…

(15/xx)

...,airplane maintenance data, you name it. i had owned them completely in less than a day, with pretty much no skill required.”

thespectator.com/topic/house-re…

(16/xx)

The hacker describes her shock at finding the No-Fly List itself as follows: “holy shit, we actually have the nofly list. holy fucking bingle. what?! :3”

Lawmakers are much less amused, and much less likely to use emojis, in expressing anger.

thespectator.com/topic/house-re…

(17/xx)

“Whether you’re a Swiss hacker or a Mexican drug lord, you know that under Secretary Mayorkas’s so-called leadership, the United States is completely unsecured,” #MS04's @RepEzell told me.

thespectator.com/topic/house-re…

(18/xx)

TSA is under Alejandro Mayorkas’s leadership, and Republicans like #MS04's @RepEzell have been fiercely critical of the embattled Homeland Security secretary.

thespectator.com/topic/house-re…

(19/xx)

The push by #NC08's @RepDanBishop and #TN07's @RepMarkGreen for @TSA accountability comes at an awkward time for the Biden admin, which spent the Christmas season scrambling to address thousands of flight cancellations.

thespectator.com/topic/house-re…

(20/xx)

Beyond TSA, the Biden admin is facing @HouseGOP criticism that its transportation secretary, @SecretaryPete, is unprepared — or uninterested — in doing his job.

thespectator.com/topic/house-re…

(21/xx)

“There’s no substitute for experience, which @PeteButtigieg obviously does not have,” #IN06's @RepGregPence told me.

thespectator.com/topic/house-re…

(22/xx)

#MI05's @RepWalberg, who represents Buttigieg’s new home state of Michigan, agreed, saying that @PeteButtigieg is “fully unprepared for what he’s doing.”

thespectator.com/topic/house-re…

(23/xx)

Now that @HouseGOP has subpoena power, and no shortage of ire for @TSA_Pekoske, @SecMayorkas and @PeteButtigieg, this demand for answers by @RepDanBishop and @RepMarkGreen is a sign of what’s to come.

thespectator.com/topic/house-re…

(24/xx)

“This is only the beginning of our work fighting to bring accountability to the alphabet soup of federal agencies,” @RepDanBishop’s communications director @AllieMcCandless told me.

thespectator.com/topic/house-re…

(25/xx)