In October 2006, the Transportation Security Administration set up a Web site so that travelers whose names were mistakenly on "no fly" lists had a way to request that their names be removed. Thousands of people went onto the site and entered personal data (via Consumerist).

Turns out, the site wasn't very secure, exposing citizens to potential identity theft, accordingto a report released last week by the House Oversight and Government Reform Committee.

The site wasn't hosted by a government domain. The home page where people logged on wasn't encrypted. One of the data submission pages wasn't encrypted and the ones that were weren't properly certified. All of this went unnoticed for four months, even as TSA Administrator Kip Hawley testified before Congress that the agency had assured "the privacy of users and the security of the system" before its launch, the report said.

Thousands of people used the site, including at least 247 travelers who entered large amounts of personal data including their names, addresses, Social Security numbers and places of birth, according to the report.

How did a small, Virginia-based contractor called Desyne Web Services get the no-bid contract in the first place? The TSA "technical lead" used to work at Desyne, went to high school with the company's owner and regularly socialized with him, the report said.

Here's the new TSA site for travelers seeking redress from security delays.

To read the full report, click here [PDF].

Here's TSA's response.