For sale on eBay: Military fingerprint and iris scan database

“This should not have happened,” Becker said. “It is a disaster for the people whose data is being exposed. In the worst case, the consequences can be severe.”

Of the six devices the researchers purchased on eBay — four SEEKs and two HIIDEs, for portable interagency identification equipment — two of the SEEK II devices contained sensitive data. A second SEEK II, with site metadata showing it was last used in Jordan in 2013, appears to contain the fingerprints and iris scans of a small group of US service members.

When The Times arrived, an American whose biometric scan had been found on the device confirmed that the data was likely his. He previously worked as a naval intelligence expert and said his data, and that of any other American on the devices, was likely collected during a military training course. The man, who spoke on condition of anonymity because he still works in the intelligence business and was not authorized to speak publicly, asked that his biometric profile be deleted.

Military officials said the only reason these devices could contain data on Americans was because they were used during training sessions, which is common practice to prepare for their use in the field.

According to the Defense Logistics Agency, which handles the disposal of millions of dollars in excess Pentagon materials each year, devices like the SEEK II and HIIDE should never have made it to the open market—let alone an online auction site like eBay. Instead, all biometric collection equipment is meant to be destroyed on site when military personnel no longer need it, as is the case with other electronic devices that once contained sensitive operational information.

It’s unclear how eBay sellers acquired these devices. The 2632-profile device was sold by Rhino Trade, a Texas surplus equipment company. The company’s treasurer, David Mendez, said he bought the SEEK II at a government equipment auction and didn’t realize the decommissioned military device would have sensitive data.

“I hope we don’t do anything wrong,” he said.

The SEEK II came with US Forces information from Tech-Mart, an Ohio-based eBay seller. The owner of the store, Ayman Arafa, refused to reveal how he acquired it or the two other devices he sold to the researchers.