"We are not clean on OpSec, sir"

The British Broadcast Channel reportedly said that a major data breach is threatening the lives of thousands of Afghans, which are now being secretly relocated to the UK. There have been more severe OpSec fails this year and for that reason I would like to talk a bit about them.

Our world is undergoing a period of high tension, that's for sure. Afghanistan has fallen, Europe has seen its first major conflict since WW2 that is still ongoing (althought that doesn't mean that there weren't other, minor or medium-scale conflicts in the European continent during that era), there's a chaotic situation over in Gaza and a civil war over in Myanmar (also known as Burma), just to name a few ongoing conflicts. That means that it is imperative for all sides to try and keep a basic level of security and anonymity, which we aren't seeing in either case.

Case No. 1: Baby, I added a journalist to a national security chat

I honestly don't think that something like that has ever happened before and I also don't know from where to begin. First things first, how on earth does a person accidentally add another one on a group chat without understanding it? On any platform you can imagine, you must either type that user's name or click on them and click on another button that says "Invite", while some platforms also have a confirmation dialog after that. I don't use Signal, and probably never will, so I don't know how inviting a person to a group chat works, but honestly just that fact that a third-party was added to a national security group chat by a supposed "national security advisor" (Mike Waltz's position at the time) without him even realizing about it yields questions not only about him but also for the party that appointed him to that position. In our case, the added member was a top-tier journalist, but what if that was someone else, someone that might be an enemy informant?

Secondly, I would imagine that the U.S. government uses its own kind of secure chat communication for such delicate manners. I am not going to roast them about this fact, since there's a consensus that Signal as an app is pretty secure, I am going to roast them however for using a modified, insecure version of Signal for such top-level communications. We are in 2025, secure communication is an issue has been solved over and over again, there are no more excuses for such incompetent from top-tier government officials.

Oh, and before I leave this section, President Trump himself uploaded some satellite photos of an Iranian launchpad which was pretty high-detailed and is widely thought to be an OpSec leak, since it revealed to a large degree the resolution of U.S. satellites. In case you don't remember that, it was all the way back to 2019.

Case No.2: What do you mean Excel is not secure enough?

Apparently, this whole data breach the U.K. has suffered is because some fella uploaded their spreadsheet containing the personal details of almost 19 000 people who had at one point asked the British to come over to the U.K to flee the Taliban. Oh the incompetence...

Firstl of all, if that wasn't obvious, do not store sensitive data in a spreadsheet. I've heard that there's a newly-discovered technology that some people call "databases" that not only makes it much easier to process the personal details of those people, but also if it is combined with another new discovery, "authentication", promises to prevent such security leaks. I am not saying that there won't be data breaches - there always will be, either by incompetence or by other means

Secondly, according to the British Broadcast Channel again, "Fearing the document could fall into the hands of the Taliban, the government sought to supress any knowledge of it by getting a court injunction.", utilizing a strategy known as security through obscurity, which is known to have worked every time someone attempted it. Thankfully in our case, it seems like most people mentioned in the spreadsheet are unaffected and that lots of them have now relocated to the U.K.

It is a Brave New World out there

Computers are here to stay. They aren't going anywhere. If they go, so will we. We ought to teach people how to use those incredible machines correctly. In our case, people must learn to be a little more careful with whom they add into a group chat and where they upload their Afghanistan-related spreadsheet. We are only seeing the beginning of the effects of digital illiterature: what if tomorrow or next year or next decade people lose their lives because someone accidentally upload something they shouldn't to a website or because they added the wrong person at the group chat? We ought to learn from our mistakes, and only time will tell whether we do or not.