UK Special Forces soldiers' personal data was floating around WhatsApp in a leaked Army spreadsheet
- Reference: 1622644091
- News link: https://www.theregister.co.uk/2021/06/02/uk_special_forces_data_breach_whatsapp/
- Source link:
The document, seen by The Register , contained details of all 1,182 British soldiers recently promoted from corporal to sergeant – including those in sensitive units such as the Special Air Service, Special Boat Service and the Special Reconnaissance Regiment.
Special Forces soldiers’ identities are supposed to be protected from public disclosure in case terrorists target them or their families. Yet yesterday an Excel file was freely being passed around on WhatsApp groups after being leaked from inside the Ministry of Defence.
[1]
The spreadsheet detailed personnel posted to 18 Signals Regiment, the SAS and SBS' communications experts, and their specialisms
The document, which appeared to have last been modified late yesterday morning by a corporal working as a clerk for one unit's Regimental Career Management Officer (RCMO), was available for download on WhatsApp with no password protection or government protective markings such as “confidential” or “secret”.
To help protect UK Special Forces soldiers’ identities, whenever they enter the public eye they are always referred to by the MoD as serving with their former unit. So a paratrooper from that regiment’s 2nd Battalion who joins the SAS and is later decorated at Buckingham Palace for secretly smiting the Queen’s enemies is always named publicly as “Trooper Bloggs, 2 PARA”.
[2]
Yet the spreadsheet busted this convention by linking soldiers’ former and current units together, under separate headings of “capbadge” and “unit.”
[3]
The leaked spreadsheet included details of non-special forces units as well
Worst of all, as well as naming newly promoted senior non-commissioned officers, the spreadsheet disclosed their unique service numbers. These can be cross-referenced against public records to enable service histories to be traced – potentially outing former SF personnel years after they retire.
The spreadsheet’s only nod to privacy was a one-line warning that said: “NOT TO BE DISCLOSED BEFORE 0900 HOURS UK LOCAL 03 JUN 21.” Ironically, it appeared to have originated from a secretive Royal Marines unit.
[4]
Royal Marines Poole is the base of the Special Boat Service
A former Army source told The Register the practice of sharing newly promoted people’s personal details in a spreadsheet accessible by the entire 80,000-strong British Army was routine, but said: “Normally this is passworded and kept on the intranet.”
[5]British Army adopts WhatsApp for formal orders as coronavirus isolation kicks in
[6]MoD: Our networks are in 'unacceptable' state and both data and IT bods are stuck in silos
[7]US Army develops natural-language voice-command AI for robots, tanks, etc. For search'n'rescue. For now
[8]Prince Philip, inadvertent father of the Computer Misuse Act, dies aged 99
Details of soldiers posted to non-sensitive units were also viewable in the spreadsheet, which covered the entire Army: all units from the Army Air Corps to the Royal Welsh Fusiliers.
An Army spokesperson told The Register : “We are aware that the Corporal to Sergeant Promotion Board results have been obtained by some media outlets. The results of this Board are not due for release internally in MOD until 3rd June.”
[9]
He added: “The leak of this information to media outlets is being investigated by the MoD and it would be inappropriate to comment further at this time.” ®
Get our [10]Tech Resources
[1] https://regmedia.co.uk/2021/06/02/screenshot_whatsapp.jpg
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YLerIC@yqwIPL2nDYKBmLAAAAMY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://regmedia.co.uk/2021/06/02/screenshot_whatsapp_6.jpg
[4] https://regmedia.co.uk/2021/06/02/whatsapp_2_poole.jpg
[5] https://www.theregister.com/2020/03/18/army_adopts_whatsapp_orders_coronavirus/
[6] https://www.theregister.com/2021/05/28/mod_digital_it_strategy_report/
[7] https://www.theregister.com/2021/04/21/military_judi_ai/
[8] https://www.theregister.com/2021/04/09/prince_philip_obituary/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YLerIC@yqwIPL2nDYKBmLAAAAMY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
"leaving an unencrypted USB stick on a train"
On purpose or by accident?
On this side of the pond, we had personnel data on security clearances go missing often enough that I became convinced that some subcontractor was taking kickbacks for periodically misplacing it. That the British Army data ended up on WhatsaApp makes me think it was just ideologically motivated. Foreign intelligence usually does't post the stuff that they capture.
I thought the Army was the reference case for not attributing to malice that which is adequately explained by stupidity
sharing newly promoted people’s personal details in a spreadsheet accessible by the entire 80,000-strong British Army was routine
What a great idea. Especially in GPRD times.
Those involved can apply to win [1]this trophy .
[1] https://www.hodgesbadge.com/dumb-cluck-award-trophy/p/CRWTB0S5-FW/
"Who is General Fskup" ?
.. and what's he doing on my computer?!
Well that's going to be a tea, no biscuits meeting if ever I've seen one.
I'm Spartacus !
Ah, so they are capable of naming soldiers then.
Several thoughts
Once upon a time the army had a separate network which would have avoided this, I guess a bean counter thought they would save the mod money by having its personnel killed off instead of paying pensions.
Second there is no reason on earth why the whole army needs to see every promotion in the army so the decision to publish it was stupid, probably driven by some left wing political correctness bull shit
Whoever is resonsible
for this security breach should be jailed, they have potentially put people's lives at risk. It's more than a ticking off offence.
Issue new service numbers?
And credit those new numbers with accrued service to ensure pension entitlements &c?
This one needs proper mitigation methinks, not a subscription to a credit reporting agency.
Even worse than leaving an unencrypted USB stick on a train :-(