Army bungles sensitive data for hundreds of immigrant recruits

By Alex Horton / The Washington Post

Army officials inadvertently disclosed sensitive information of hundreds of immigrant recruits from nations such as China and Russia, in a breach that could aid hostile governments in persecuting them or their families, a lawmaker and former U.S. officials said.

A spreadsheet intended for internal coordination among recruiters was accidentally sent to recruits and contained names, full Social Security numbers and enlistment dates. The list was sent out inadvertently at least three times between July 2017 and January 2018.

The breach prompted at least a dozen asylum claims amid concern that if the list were intercepted and recruits are forced to return to autocratic nations such as China or Russia, their enlistments would be harnessed to punish recruits or their families with jail time, harsh interrogations or worse, said Rep. Tom Malinowski, D-N.J., a former human rights official in the State Department under President Barack Obama.

“If that list is floating out there, it would potentially be incredibly dangerous for (recruits). In some countries, it can even be a death sentence,” Malinowski told The Washington Post, referring to China and Russia. It is not clear if those governments have obtained the list.

The list contained sensitive data of more than 4,200 immigrant recruits. Of those, more than 900 Chinese Mandarin speakers and dozens of Russian speakers are on the spreadsheet, according to a copy obtained by The Post.

The breach carries a tinge of irony. The Army negligently gave sensitive personnel information to recruits the Pentagon says present elevated security risk, which could then become a propaganda victory for adversarial governments.

Chinese citizens found to seriously breach national security are subject to the death penalty, according to criminal law there. Punishment for foreign collusion in China ranges from 10 years to life in prison.

The Army said recruiting officials investigated the breach and “ensured corrective actions were taken,” according to Col. Michael Indovina, a spokesman for Army Training and Doctrine Command, though his statement did not elebaorate on what action was taken.

“We acknowledged the severity of this inadvertent disclosure of sensitive personal information; upon notification of this release, the command immediately reported the disclosure, and while we determined that the risk of further disclosure was minimal, swift actions were taken by the command to mitigate further release,” Indovina said.

The data breach has been used as supporting evidence in at least a dozen asylum claims for Chinese recruits who fear government retaliation, according to someone with knowledge of the claims who asked not to be named.

Abhishek Bakshi, an Indian recruit, said he received the list by accident in July 2017 from an Army recruiter in Wisconsin who asked if he wanted to schedule a security interview. The spreadsheet was disturbing, said Bakshi, whose name is also on the list.

“The list could be a risk to those people,” Bakshi told The Post. He filed an affidavit to support one Chinese asylum claim that has since been used for other claims. The breach, he wrote, “increases the danger of persecution of Chinese [recruits].”

Margaret Stock, an immigration attorney and retired Army officer, said she is aware of six Chinese recruits who have been granted asylum. There are dozens of others waiting on pending claims overseen by her and other attorneys, she said.

All of the affected recruits were part of the Military Accessions Vital to the National Interest recruitment program, which has rotated more than 10,400 immigrants into the force with promises to quickly naturalize them in exchange for badly needed medical and language skills. It was shuttered in 2017 following security fears and increased background checks that paralyzed vetting resources within the government.

Chinese recruits filing for asylum are concerned that extensive background checks implemented in 2016 will deny them enlistment for innocuous reasons, and some have waited so long that their visas have expired, exposing them to deportation. That has heightened concern they may be forced into the waiting arms of hostile governments.

“The Defense Department is coming up with any reason to fail them,” Stock said.

In another email to another Chinese recruit, an Army Reserve aviation unit at Fort Knox, Kentucky, received the list in Dec. 2017, among other documents related to enlistment, after it was forwarded among a chain of recruiting officials.

His name was also on the list. “I was shocked to receive the spreadsheet,” he wrote in an October asylum claim for himself. “I surmised that Army personnel didn’t bother to look at the Excel attachment before forwarding it.”

The lists also include the status of intelligence agency checks and background investigations that are similar to the scope of top-secret clearances.

Malinowski said recruits or their families could be imperiled if adversarial intelligence networks learned of their enlistments and detained them to probe their understanding of the enlistment process, security at U.S. installations “or anything that may be useful.”

While the list does not provide a country of origin, languages are listed using Defense Department linguistics codes, and program participants must be foreign-born. One list has circulated as early as July 2017, and variations of the list have included home addresses, obtained emails show.

Updated lists referred to in emails as late as January 2018 may contain more names.

Malinowski has said that other evidence of enlistment could be gathered by adversarial powers, such as social media posts and communication surveillance. But the spreadsheets can confirm enlistments and fill in any gaps they do not have, removing any speculation, he said.

The Defense Department had used caution to handle personal information of immigrant recruits, underscoring the need to safeguard their families in hostile nations, said Naomi Verdugo, a former senior recruiting official for the Army at the Pentagon.

Since 2009, when the MAVNI program began, officials would instruct Army public affairs staff to clear the use of photos, names and other details in media stories with immigrants who were particularly vulnerable.

“If you’re from Canada, it’s probably not an issue,” Verdugo said. “If you’re from Pakistan, it could be a problem.”

The practice was in place in 2015, when Verdugo left, she said, though it is unclear if Army or defense officials follow the same policies.

The Justice Department has successfully argued in a lawsuit that identities and personal information of certain immigrant recruits should be protected. The recruits “have a right to privacy and may not wish to be identified,” a U.S. attorney wrote in an August filing.

The MAVNI program intended to harness skills in short supply among U.S.-born troops. But now, Malinowski said, Chinese recruits granted asylum may just be refugees instead of soldiers.

“Wouldn’t it have been better if we got the benefit of their intended service?” he asked.