“This shouldn’t have happened,” Mr Baker said. “It is a disaster for the people whose data is being made public. In the worst case, the consequences can be fatal.”
What we consider before using anonymous sources. Do the sources know the information? What is their motivation for telling us? Have they proven reliable in the past? Can we confirm the information? Even with these questions met, The Times uses anonymous sources as a last resort. The reporter and at least one editor know the identity of the source.
Of the six devices the researchers purchased on eBay — four SEEKs and two HIIDEs, for Handheld Interagency Identity Detection Equipment — two of the SEEK II devices contained sensitive data. The second SEEK II, with location metadata showing it was last used in Jordan in 2013, was found to contain the fingerprints and iris scans of a small group of US military personnel.
When The Times reached out to him, an American whose biometric scan was found on the device confirmed that the data was probably his. He previously served as a naval intelligence specialist and said his data, and that of every other American found on these devices, was most likely collected during military training. The man, who spoke on condition of anonymity because he still works in the intelligence field and was not authorized to speak publicly, asked for his biometric file to be removed.
Military officials said the only reason these devices would contain data on Americans is because they are used during training sessions, a common practice in preparation for their use in the field.
According to the Defense Logistics Agency, which handles the disposal of millions of dollars of surplus Pentagon equipment each year, devices such as the SEEK II and the HIIDE should never have entered the open market — much less an online auction site like eBay. Instead, all biometric collection equipment is supposed to be destroyed on site when it is no longer needed by military personnel, as are other electronic devices that once contained sensitive operational information.
How eBay sellers got their hands on these devices is unclear. The device containing the 2,632 profiles was sold by Rhino Trade, a surplus equipment company in Texas. The company’s treasurer, David Mendez, said it bought the SEEK II at a government equipment auction and didn’t realize that sensitive data would reside on a decommissioned military device.
“I hope we didn’t do anything wrong,” he said.
The SEEK II containing the US troop information came from Tech-Mart, an eBay seller in Ohio. Tech-Mart owner Ayman Arafa declined to say how he obtained it, or two other devices he sold to investigators.
