Tulsi Gabbard Reused the Same Weak Password on Multiple Accounts for Years

Tulsi Gabbard, the director of nationwide intelligence, used the identical simply cracked password for completely different on-line accounts over a interval of years, in line with leaked information reviewed by WIRED. Following her participation in a Sign group chat through which delicate particulars of a navy operation had been unwittingly shared with a journalist, the revelation raises additional questions on the safety practices of the US spy chief.

WIRED reviewed Gabbard’s passwords utilizing databases of fabric leaked on-line created by the open-source intelligence corporations District4Labs and Constella Intelligence. Gabbard served in Congress from 2013 to 2021, throughout which period she sat on the Armed Companies Committee, its Subcommittee on Intelligence and Particular Operations, and the International Affairs Committee, giving her entry to delicate data. Materials from breaches reveals that in a portion of this era, she used the identical password throughout a number of electronic mail addresses and on-line accounts, in contravention of well-established finest practices for on-line safety. (There isn’t any indication that she used the password on authorities accounts.)

Two collections of breached information revealed in 2017 (however breached at some earlier unknown date), often called “combolists,” reveal a password that was used for an electronic mail account related along with her private web site; that very same password, in line with a combolist revealed in 2019, was used along with her Gmail account. That very same password was used, in line with information relationship to 2012, for Dropbox and LinkedIn accounts related to the electronic mail tackle tied to her private web site. In response to information relationship to 2018 breaches, she additionally used it on a MyFitnessPal account related to a me.com electronic mail tackle and an account at HauteLook, a now-defunct ecommerce website then owned by Nordstrom.

Information of those breaches have been obtainable on-line for years and are accessible in industrial databases.

The password related to all of the accounts in query consists of the phrase “shraddha,” which seems to have private significance to Gabbard: Earlier this yr, The Wall Avenue Journal reported that she had been initiated into the Science of Identification Basis, an offshoot of the Hare Krishna motion into which she was reportedly born and which former members have accused of being a cult. A number of former adherents instructed The Journal that they imagine Gabbard acquired the title “Shraddha Dasi” when she was allegedly acquired into the group. Gabbard’s deputy chief of employees, Alexa Henning, responded to questions from The Journal at the time by posting them on X and accusing the information media of publicizing “Hinduphobic smears and different lies.”

“The information breaches you’re referring to occurred nearly 10 years in the past, and the passwords have modified a number of occasions since,” wrote Olivia Coleman, a Gabbard spokesperson, in response to questions from WIRED. “As our deputy chief of employees has already made clear on a lot of events, the DNI has by no means and doesn’t have affiliation with that group. Trying to smear the DNI as being in a cult is bigoted habits.“

“Your bigoted lies and smears of a cupboard member and your story fomenting hinduphobia is famous,” wrote Henning in response to a follow-up query about the chance of Gabbard’s password containing the identical title she was reportedly acquired into Science of Identification Basis with, given her denials that she has ever been affiliated with the group. “This was properly litigated throughout her affirmation listening to so congrats on being about 6 months late to this story. Nice job.”