The way the no fly list was shared, it was absolutely inevitable that this would happen. A much more secure way to handle this:

1. Airlines are each given a no fly list that only includes tokens, e.g. each person's name hashed with a secret key that is specific to the airline, on a periodic basis.

2. When the airline wants to check if a user is on the list, they hit a government-owned service that returns the user's token (again, the token will be unique for each airline because each airline gets their own secret key).

3. The airline would then check the token against their revoked token list.

The benefit of this is:

1. The full token list by itself is useless

2. Even if the airlines API credentials are stolen, the response from the government-owned service is useless on its own.

3. So a bad guy would need to steal the token list AND the API creds to get any value, and even then it would be easy for the government to detect unusual access patterns to their service.

Remember back in the late 90s when we all used to store passwords in plain text? Yeah, we know how that turned out, and in this case, storing the list not only in plain text but sharing it to tons of different companies willy nilly is a million times worse if you expect it to stay secret.