It used to be very common for various state and local government agencies, such as the Department of Motor Vehicles, to sell their records, containing vasts amounts of personally identifiable information (PII), as a revenue stream. That changed when Rebecca Schaeffer’s stalker killed her in 1989 after paying $250 to get her address, and other PII on file, from the California Department of Motor Vehicles.
After this horrible, tragic demonstration of how very bad things can happen when people have full reign to get access to PII, states started enacting drivers protection acts to keep the PII the agencies had on file from being accessed in such egregiously irresponsible ways. Finally, a U.S. federal law, the Drivers Privacy Protection Act (DPPA) was enacted to help protect the PII in drivers’ records.
So, I found the following inappropriate release from a state agency to be very interesting…
On July 21, 2008 the U.S. District Court for the Western District of Missouri filed a class action suit against the Missouri Department of Revenue (DOR) for violating federal law when it sent PII from motor-vehicle records to data brokers, Shadowsoft Inc.; Shadowsoft reportedly told the DOR the PII was needed for verifiying their customer information. Shadowsoft Inc. then sent the data to publicdata.com, who then put the PII up for sale on the Internet.
The lawsuit defines the class of plaintiffs as all individuals with a Missouri driver’s license whose “highly restricted personal information” was disclosed.
The class action suit could contain as many as 2.5 million members, and, being tried under the U.S. federal Drivers Privacy Protection Act (DPPA) could result in liquidated damages of up to $2,500 per violation…a possible grand total of $6.25 billion. The prosecuting attorney, Don P. Saxton, indicated that he may pursue other damages as well.
The Missouri DOR said in a July 23 statement…
“Safeguarding personal information is one of the Department’s top priorities. This administration has taken aggressive action to correct the complacency of the past and to protect Missourians’ personal information,” said Director of Revenue Omar Davis. “The companies involved in this abuse were lawfully entitled to receive the information provided and certified, under penalty of perjury, that they were obtaining and using the information in accordance with the law. The companies intentionally deceived the Department, and their access to the information was immediately revoked when we discovered their deception in February.”
Davis cited the Department’s recently thwarted attempts to enhance motor vehicle and driver license systems’ security and to increase the record sales prices as key components of an effort to further protect Missourians’ information.
“There are significant vulnerabilities in the current motor vehicle and driver systems. Many Missourians may be unaware that current law allows out-of-state companies to cheaply buy their personal motor vehicle records and then sell this information to make a quick buck. Raising the price for access to personal information would make it substantially more difficult for these businesses to buy and resell Missourians’ personal information,” said Davis.
Since 2005, the Department has implemented stricter guidelines for the receipt, storage, and destruction of records containing restricted personal information. The Department now requires all customers with the highest level of access to motor vehicle and driver license information to undergo recertification to retain access to these records. Through this recertification process, 2,672 accounts were closed for inadequate responses. In addition, the Department has made it a priority to conduct audits of individuals and companies with access to personal information, a new safeguard implemented by this administration.”
Really, “current law allows out-of-state companies to cheaply buy their personal motor vehicle records and then sell this information to make a quick buck. Raising the price for access to personal information would make it substantially more difficult for these businesses to buy and resell Missourians’ personal information“…!!??
What law is this? The statement did not say.
No, seriously! What law is this? If there is such a law…WHY??
Hmm…
Apparently…
1) the DOR’s procedures were, or are not adequate; were not followed because of poor or non-existent training;
2) the data brokers were really convincing and great social engineers;
3) the contract with the data brokers was not a comprehensive one;
4) or some combination of all the previous.
Tags: awareness and training, DPPA, Information Security, IT compliance, IT training, Missouri Department of Revenue, policies and procedures, privacy training, publicdata.com, risk management, security training, Shadowsoft, social engineering