According to a report in The New York Times, German researchers who bought biometric capturing devices on eBay discovered private US military information stored on their memory cards. 

This data set, which primarily came from Iraq and Afghanistan, contained fingerprints, iris scans, pictures, names, and descriptions of the individuals. Several of them allegedly collaborated with the US army, and if the devices fell into the wrong hands, they might wind up as targets.

The Chaos Computer Club, a group of academics led by Matthias Marx, paid an average of under $200 for six of the devices on eBay. They were propelled by a 2021 The Intercept revelation that claimed the Taliban had stolen biometric technology similar to that used by the US military. 

They looked to see if there was any personal information on those who supported the US Military that would put them in danger. The report claims that they were 'shocked' at the findings. They discovered 2,632 people's names, nationalities, pictures, fingerprints, and iris scans on one device's memory card.

 Additional metadata indicates that it was used in the summer of 2012 close to Kandahar, Afghanistan. A other device that was used in Jordan in 2013 had a small number of the fingerprints and iris scans of US military personnel.

A 2011 manual for the devices stated that such technologies were employed to identify rebels, validate local and international citizens' access to US bases, and link people to incidents. One item was purchased at a military auction, and the vendor said they were unaware that it held sensitive data. 

The fact that the memory cards contained sensitive data suggests that the US military could have decreased the danger by simply erasing or destroying them before selling them. 

According to Brig. Gen. Patrick S. Ryder, spokesman for the Defense Department, 'the department is unable to authenticate the veracity of the alleged data or otherwise comment on it since we have not analysed the material contained on the devices. The agency asks the return of any devices that might contain personally identifiable information for additional investigation.