US Military Leaks its Secrets Online

athloi writes "Detailed schematics of a military detainee holding facility in southern Iraq, geographical surveys and aerial photographs of two military airfields outside Baghdad and plans for a new fuel farm at Bagram Air Base in Afghanistan are among the items accidentally left online by government agencies and contractors."

Let's head this off at the pass...

[SoapBox17]

Before anyone cries foul...

From TFA:

"None of the drawings are classified and we believe they were all handled appropriately per the government's direction," said CH2M Hill spokesman John Corsi. But the company added a password protection to its FTP site after the AP's inquiry and referred the direct request for the documents to the government.

The DOD has a special category of Unclassified documents called "For Official Use Only" (FOUO) which prevents the information from being released to the public under the FOIA. This information was not classified, but was not supposed to be released.

Re:okay, explain that one

[jank1887]

FOUO is specifically designated to NOT be used as a way of keeping Unclass info away from FOIA inquiries. It's for things that aren't government secrets, but shouldn't be shared with the general public. You would likely agree with many of these. Examples:

Privacy Information, Social security numbers, medical, etc.
Company Trade Secrets
Legal documents, law enforcement documents, with limits
And there are others, some discretionary. Full definition in Chapter 4 here (~100 page PDF):
http://www.dtra.mil/documents/be/5400.7-R.pdf [dtra.mil] BUT, from Chapter 4:

C4.1.1. General. Information that has not been given a security classification pursuant to the criteria of an Executive Order, but which may be withheld from the public because disclosure would cause a foreseeable harm to an interest protected by one or more FOIA Exemptions 2 through 9 (see Chapter C3.) shall be considered as being for official use only (FOUO). No other material shall be considered FOUO and FOUO is not authorized as an anemic form of classification to protect national security interests..

Re:Let's head this off at the pass...

[CodeBuster]

But the company added a password protection to its FTP site after the AP's inquiry

I hope they realize that FTP does not encrypt the transport, and thus the password, and that this is only marginally better than no password at all until they bother with encrypting the underlying connection (port forwarding 21 or whatever port they are using through an SSH tunnel for example).