CommuteAir, a regional carrier, left a copy of the U.S. No Fly List on an unsecured server that could be viewed by anyone.