Maia Arson Crimew's "No-Fly List" Leak

Submission 42,171

Overview

Maia Arson Crimew's "No-Fly List" Leak refers to the January 2023 leak of a purported 2019 version of the American TSA's "No-Fly List" by a Swiss LGBTQ+ hacker named Maia Arson Crimew who leaked the info involving terrorists on her blog maia.crimew.gay. The leak inspired mass news coverage (first by the Daily Dot), memes and online discourse predominantly on Twitter and TikTok. Many highlighted her photo called Holy Fucking Bingle and discussed backlash reiterated by lesbian Twitter users about her identity as a "bi lesbian."

Background

Maia Arson Crimew is a 23-year-old Swiss developer and computer hacker^[10] formerly known as Tillie Kottmann (also known as deletescape and antiproprietary). She first became known for her hacking in July 2020 when she leaked the source codes of many companies like Intel and Nissan.^[11] She maintains a Telegram channel called "ExConfidential."^[10]

TSA No-Fly List Leak

On January 19th, 2023, Daily Dot^[1] journalists Mikael Thalen and David Covucci published an exclusive article titled, "U.S. airline accidentally exposes ‘No Fly List’ on unsecured server," in which they stated that a Swiss hacker known as "maia arson crimew" leaked a 2019 version of the "Terrorist Screening Database" (also known as the TSA's "No-Fly List") on her website (maia.crimew.gay^[2]). The leaked list included roughly 1.5 million names and aliases of people who have been barred from air travel due to having suspected or known ties to terrorist organizations.

The Daily Dot reached out to Maia Arson Crimew for questioning, who said, among other things:

“It’s just crazy to me how big that Terrorism Screening Database is and yet there is still very clear trends towards almost exclusively Arabic and Russian sounding names throughout the million entries.”

On her website's home^[2] page, it states:

hello i am maia arson crimew (it/she) and i am gay, mostly for girls, and i'm a tiny kitten :3

i know lot's of things about cyber security, programming and far too little about music but i still try to do all those things at once. if you like the things i do here or on social media you can support me on ko-fi. links to the various things i do can be found in the footer. if you're looking for some more serious info about me, there is wikipedia for that.

The blog^[3] post on her website that centered on the leak was titled, "how to completely own an airline in 3 easy steps and grab the TSA nofly list along the way," and it was created on January 19th, 2023, in conjunction with the Daily Dot's piece. The section outlined how she purportedly hacked the TSA's "no-fly list" by randomly browsing Zoomeye, the Chinese Shodan, and "looking for exposed jenkins servers that may contain some interesting goods." She then found "an exposed jenkins server belonging to CommuteAir."

The blog post included many self-made memes from Maia Arson Crimew including one in the style of a GIF caption reading, "this aviation shit getting serious" (shown below, left). Once she found the "no-fly list," she posted a photo of a stuffed Sprigatito Pokémon with the caption, "holy shit, we actually have the nofly list. holy fucking bingle. what?! :3" (shown below, right).

Maia Arson Crimew ended the blog post with a section titled, "so what happens next with the nofly data," in which she stated that the no-fly list data would only be handed over by her to parties "with legitimate interest," specifically writing:

while the nature of this information is sensitive, i believe it is in the public interest for this list to be made available to journalists and human rights organizations. if you are a journalist, researcher, or other party with legitimate interest, please reach out at nofly@crimew.gay. i will only give this data to parties that i believe will do the right thing with it. alternatively the data is now also available for access (upon request) via DDoSecrets.

Online Reaction

On January 19th, 2023, one of the Daily Dot journalists that broke the story, Mikael Thalen, posted a tweet^[4] that announced the publishing of his article, gaining roughly 3,400 likes in four days. The tweet gained more engagement as it was retweeted and quote retweeted by various users, racking up its views to over 1.2 million in four days.

Soon after, Twitter users began reacting to the story in viral tweets, such as Twitter^[5] user SarahBurssty on January 19th, who emphasized in a tweet, "the person who ended up cracking the TSA no fly list is a trans person whose blog is bright pink and purple like its still the mid-2000s …" gaining roughly 5,200 likes in four days (shown below, left). Also on January 19th, Maia Arson Crimew posted her own QT^[12] of Thalen's tweet,^[4] writing, "this was one of the most fun stories i've worked on so far, thanks for the great collaboration once again Mikael and David," and gaining over 800 likes in four days (shown below, right).

Many memes and reactions about her hack centered on her status as a member of the LGBTQ+ community, as well as about the "old web" aesthetic of her website. For instance, on January 21st, 2023, Twitter^[6] user PunishedLink tweeted two screenshots with one showing her blog's homepage and the other showing the various news outlets covering the leak, captioning them, "Someone leaking the entire no fly list on this fucking blog is the funniest thing I've ever seen." The tweet received roughly 109,900 likes in two days (shown below).

Holy Fucking Bingle

Maia Arson Crimew's photo of a stuffed Sprigatito Pokémon soon evolved into its own meme primarily due to her caption for the photo that centered on the phrase Holy Fucking Bingle. For instance, on January 21st, 2023, Twitter^[7] user E3kHatena wrote, "'holy fucking bingle. what?! :3' might be the funniest string of obviously transfem text this year and it’s on a blog leaking the fucking no fly list," earning over 12,000 likes in two days (shown below).

Maia Arson Crimew's "Neopronouns and Bi Lesbian" Discourse

Despite many in the LGBTQ+ community reacting positively to Maia Arson Crimew's No-Fly Leak, a certain number of lesbian Twitter users became disgruntled with her identity as a self-proclaimed "bi lesbian." Her since-deleted tweet that sparked the backlash read, "neopronouns slap and ive used them myself for a while before !!! while we're at it im a bi lesbian for the record." Some Twitter users were angered, like one QT that read, "ever had your worldview SHATTERED and everything you love STRIPPED AWAY AND BURNED" (shown below).

The aforementioned QT screenshot was tweeted^[8] by Maia Arson Crimew on January 22nd, 2023, who captioned it, "let me just tell u that this is not a normal way to react to someones queer identity," and received over 790 likes in one day. Other tweets from Maia Arson Crimew about the backlash received more engagement, like one tweet^[9] posted by her on January 22nd that read, "let me just delete that tweet i dont have the energy to deal with people cancelling me over an innocent word i use to describe myself y'all are incredibly childish," and earned roughly 3,600 likes in less than a day (shown below).