German military PC sold online had classified missile info

BERLIN — Weighing in at a hefty 11 pounds, with a tiny 128 MB of working memory and a decades-old Pentium III processor, a used laptop recently bought by a German cybersecurity firm had its heyday long before the first iPhone was built.

But the laptop’s new owner says it has one standout feature: Its hard drive carried — without encryption or even password protection — a confidential user manual and schematics for a surface-toair missile system that Germany’s air force still uses.

“How the computer ended up on eBay is currently unclear,” Nadine Krüger, a spokeswoman for Germany’s defense ministry, said Tuesday. The ministry is investigating how the laptop was sold with its hard drive in tact and easily accessible.

The systems it contained could not be used to control missiles, let alone launch them, according to defense ministry information. But its embarrassing sale on eBay underscores the major personnel and equipment problems that have plagued the German federal armed forces, which are considered a key component of NATO, since even before President Donald Trump’s repeated calls for Germany to increase its military spending.

Only about a third of its Eurofighter jets and combat helicopters fly, according to 2018 figures. Last year, just three of six submarines and well under half of its two dozen A400M transport planes were determined fit for purpose. And the laptop sale surfaced amid news that a major U.S.-led defense exercise in Europe would be curtailed because of the coronavirus pandemic.

The information found on the laptop’s hard drive relates to software for a surface-toair rocket, the Ozelot, that Germany’s air force uses to protect ground troops from bombers and helicopters. The Bundeswehr did not disclose the number of Ozelots currently in service.

The information is classified at the lowest level, according to the federal armed forces, known as the Bundeswehr. According to German law, its contents “could be detrimental to the interests of the Federal Republic of Germany or one of its states.”

The computer — built at the turn of the millennium and equipped with a removable battery and rugged padding for field use — was probably decommissioned as part of a system upgrade in 2014, Krüger, the defense ministry spokeswoman.

In Germany, army surplus is usually resold by VEBEG, a state-owned company. How this computer made it into the hands of an eBay seller was not immediately clear.

“We have very strict security rules for the divestment of surplus IT equipment,” Krüger said, noting that hard drives are usually removed from military computers when they are taken out of use.

The laptop was bought by G Data CyberDefense, a German company with 500 employees that prides itself on having built one of the first anti-virus software programs in the 1980s. Hauke Gierow, a company spokesman, described the computer as “an old thing from the early 2000s.”

“It’s not the kind of thing you can use in your office,” he said Tuesday. “We bought it purely out of curiosity.”

That included the chance that there might be something interesting on the hard drive, Gierow said — and the hunch turned out to be correct, even if the buyer didn’t realize it immediately.

G Data bought the computer from a German eBay seller late last year for about $100, and it was only recently that the company’s technicians looked at the find. On the company blog, another employee, Tim Berghoff, describes finding system software for the Ozelot on the unencrypted drive. The computer, which runs Windows 2000, was not protected by a password.

Such noncompatible and outdated computers are still used to control many armies’ most modern weapons systems, which aren’t upgraded nearly as often as commercially available computers. Thomas Wieland, an independent military expert who runs a blog specializing in German military matters, said the phenomenon was especially noticeable on big weapon systems like ships and airplanes.

“That’s the reason you’ll find computers in the Bundeswehr still running on Windows 2000 or XP,” he said, referring to two operating systems that are likely older than some of the soldiers using them.

Nor was this the first time that a hard drive in an army surplus computer was found to contain classified information. In July, a Bavarian forest ranger found a classified manual for the mobile rocket artillery unit “Mars” on one of four laptops he had bought.

On eBay, the seller of the computer containing the confidential information says it has sold 16 similar laptops. It is not clear what happened to the other 15.

An employee reached at the reseller said the company sold up to 20 laptops a month, most of them of much more recent models.