Historical article, reviewed October 2026. In January 2023, security researcher maia arson crimew publicly described finding government watchlist files on an exposed CommuteAir development server. The report concerned older copies of the No Fly and Selectee lists, rather than a newly created list of ordinary airline customers.
What this article can establish
The researcher’s original disclosure is the starting point for the incident’s public history. A security researcher’s account, a company’s response and an official investigation are different kinds of evidence. Claims about the number of affected people or the complete contents of a leaked file require particular care.
Earlier versions of this article included unsupported claims about identification numbers, addresses, credit monitoring and a total of 10,000 victims. Those details have been removed. We do not reproduce names from the exposed files or provide links to copies of personal records. A person’s presence in an old file does not establish their current status or guilt.
A watchlist is not an airline passenger manifest
The No Fly List and additional-screening lists have different purposes. Treating them as interchangeable makes it harder to understand both the security issue and the privacy concerns. They should also be distinguished from reservation systems, employee records and the information a traveler supplies while buying a ticket.
An airline’s access to sensitive information creates a responsibility to protect it across development tools and cloud storage as well as customer-facing systems. The useful lesson is to restrict access, limit unnecessary copies and review where sensitive data is retained; the incident is not a reason to download leaked records.
If repeated screening affects your travel
Use the official DHS Traveler Redress Inquiry Program for qualifying difficulties such as repeated delays, denied boarding or apparent mistaken identity. Additional screening alone does not prove that someone is on a watchlist. Keep your booking details consistent with your identification, preserve relevant correspondence and follow the official process rather than relying on a third-party search of leaked data.