The details of a global spying operation headed by the Department of Defense have been exposed after security researchers discovered data pertaining to the program on three publicly available Amazon Web Services Inc. servers.

The data, discovered by the team at UpGuard Inc., consists of at least 1.8 billion scraped online posts from individuals across the globe. They were seemingly gathered by CENTCOM and PACOM, the U.S. Central and Pacific military commands groups, respectively, in what appears to be a program of gathering and analyzing data from social media.

Although some of the data appeared vague and random, other parts were clearly security-related, with posts pertaining to politics in places like Pakistan and Iraq, as well ISIS and other jihadi groups.

Spying by the Department of Defense is hardly a startling revelation, but as UpGuard pointed out, much of the data was scraped from U.S. citizens within the United States itself, raising concerns as to the legality of the Pentagon spying on U.S. citizens, as well as raising privacy concerns.

The exposure of the data was said to have been caused by a contractor uploading the data to an Amazon S3 storage instance and then making its setting public. That means the data was freely available to anyone who knew where it was located, without the need for a password. Amazon, which sets these S3 “buckets” private by default, says best practice calls for restricting access to only those who absolutely need it.

Whether the contractor intentionally set up the S3 instance this way for convenience or did so in error is not clear at this stage, but if it was in error, it would be far from the first case. Barely a month goes by without yet another enterprise user having their data accessed because of an AWS S3 instance set to public access.

Recent cases of companies failing to secure their AWS S3 instances include Accenture PLC, Verizon Communications Inc., Dow Jones & Co., military contractor TigerSwan and defense contractor Booz Allen Hamilton Inc.

As the news of Department of Defense data first hit Friday, the state-funded Australian Broadcasting Corporation media network, also had data leaked because of a “misconfigured” AWS S3 instance.

Referring to that story specifically, Carl Wright, chief revenue officer at AttackIQ Inc., told SiliconANGLE that these cases should serve as a wake-up call for enterprises when it comes to cloud security.

“Many organizations are rapidly adopting cloud based services because of the fluid and elastic benefits it creates for the business,” Wright said. “It is imperative, as they embrace these capabilities, that they continuously use validation to ensure constantly changing cloud assets are secure and properly configured. This incident was easily avoidable and continues to highlight the lack of investment today, in effective security controls validation.”

Photo: Department of Defense