Maryland courts web site displays Social Security numbers (still)
Technorati Tag: Security Breach
Date Reported:
8/5/08
Organization:
State of Maryland
Contractor/Consultant/Branch:
District Court of Maryland
Commonwealth of Virginia
District of Columbia (Washington D.C.)
Victims:
Certain drivers cited for traffic violations in Maryland
Number Affected:
Unknown
Types of Data:
Name, address, race, gender, height, weight, date of birth, driver's license number, vehicle description, charge, plea, disposition, and in some cases Social Security number*
*Read Response section below for details
Breach Description:
"WASHINGTON (AP)- Drivers in Virginia and Washington, D.C. whose driver's licenses have their Social Security numbers and who got traffic tickets in Maryland will find those numbers posted on a state Web site."
Reference URL:
The Roanoke Times
WBOC Channel 16 News
The Examiner
WMDT Channel 47 News
Report Credit:
Taryn Luntz, The Examiner
Response:
From the online sources cited above:
Virginia and D.C. drivers whose driver's licenses displayed their Social Security numbers will find those numbers and other personal information posted on a Maryland Web site if they received traffic tickets in the state.
Traffic citations are listed in Maryland's court records, which the state makes publicly accessible online.
[Evan] This has been something I have struggled with for some time. Court records are "public" information, but many times there are things said or otherwise disclosed in court that should remain private in my opinion. How does it serve the public good to post sensitive private information such as Social Security numbers?
The traffic citation records show a person's full name, address, sex, height, weight, birth date and driver’s license number, which is sometimes the same as his or her Social Security number
A quick search for a popular name on the state's Judiciary Case Search Web site will instantly pull up thousands of records spanning more than 30 years.
[Evan] And this is still the case. I ran a quick search this morning (8/13/08) and found numerous Social Security numbers.
Maryland has never used Social Security numbers when issuing driver’s licenses, but Virginia and the District have.
[Evan] It probably made pretty good sense to Virginia and D.C. officials at the time.
Virginia ended the practice in July 2003, although drivers were able to keep their old licenses until they expired, which in some cases was not until this year
[Evan] I wonder what prompted them to change the practice in 2003. If it was to stop the disclosure of Social Security numbers, it probably would have made sense to recall old licenses at the same time. The District Court of Maryland case information site includes information that dates back many years, so what was done is done as far as this breach is concerned.
Washington began offering drivers the option of having random numbers on their driver's licenses instead of their Social Security numbers in 2001
[Evan] This didn't go far enough to address the risks in my opinion.
Washington stopped issuing licenses with Social Security numbers on them altogether after federal regulations banned the practice in 2004.
But Maryland's court records date back decades, and drivers from D.C., Virginia or any state that once used Social Security numbers on licenses will find their Social Security numbers online today if they received Maryland tickets during that time.
A spokesman for the Maryland courts system was not immediately able to determine whether the number could be removed from the public record at the person's request.
[Evan] Maryland really should remove any reference to Social Security numbers on it's site. Knowing without a doubt that sensitive information is exposed and choosing to do little (if anything) about it is not cool. My advice would be to remove the "Drivers License" display for any "Issuing State" matching "VA" or "DC" until the database can be searched for nine digit driver's license numbers and the information purged. What do I know?
People who find their Social Security numbers listed on the Web site can place a fraud alert with one of the three major credit bureaus at no charge
[Evan] How will people know to check, and how will they know where to check?
Maryland officials say people who find their numbers listed on the Website should place a fraud alert with a credit bureau immediately.
[Evan] It seems like Maryland has an obligation to do more to secure this information.
Commentary:
There are potentially hundreds or thousands of Social Security numbers exposed on this government sponsored/managed web site and they are still exposed as of the time of this posting. I am not a lawyer, nor do I intend to play one on TV, but is there some law that prevents Maryland from removing the sensitive information (namely Social Security numbers) from this site? Or is it just not a priority for them to do so?
I decided not to post the actual site URL because I do not want to refer the wrong people there. It is not hard to find. If you are motivated you can find it yourself.
Maybe if we pretend it's not really there.
Past Breaches:
January, 2008 -Maryland Department of Assessments & Taxation web exposure
August, 2007 - Maryland Department of the Environment, Stolen Laptop, Unknown Number of Victims
Date Reported:8/5/08
Organization:
State of Maryland
Contractor/Consultant/Branch:
District Court of Maryland
Commonwealth of Virginia
District of Columbia (Washington D.C.)
Victims:
Certain drivers cited for traffic violations in Maryland
Number Affected:
Unknown
Types of Data:
Name, address, race, gender, height, weight, date of birth, driver's license number, vehicle description, charge, plea, disposition, and in some cases Social Security number*
*Read Response section below for details
Breach Description:
"WASHINGTON (AP)- Drivers in Virginia and Washington, D.C. whose driver's licenses have their Social Security numbers and who got traffic tickets in Maryland will find those numbers posted on a state Web site."
Reference URL:
The Roanoke Times
WBOC Channel 16 News
The Examiner
WMDT Channel 47 News
Report Credit:
Taryn Luntz, The Examiner
Response:
From the online sources cited above:
Virginia and D.C. drivers whose driver's licenses displayed their Social Security numbers will find those numbers and other personal information posted on a Maryland Web site if they received traffic tickets in the state.
Traffic citations are listed in Maryland's court records, which the state makes publicly accessible online.
[Evan] This has been something I have struggled with for some time. Court records are "public" information, but many times there are things said or otherwise disclosed in court that should remain private in my opinion. How does it serve the public good to post sensitive private information such as Social Security numbers?
The traffic citation records show a person's full name, address, sex, height, weight, birth date and driver’s license number, which is sometimes the same as his or her Social Security number
A quick search for a popular name on the state's Judiciary Case Search Web site will instantly pull up thousands of records spanning more than 30 years.
[Evan] And this is still the case. I ran a quick search this morning (8/13/08) and found numerous Social Security numbers.
Maryland has never used Social Security numbers when issuing driver’s licenses, but Virginia and the District have.
[Evan] It probably made pretty good sense to Virginia and D.C. officials at the time.
Virginia ended the practice in July 2003, although drivers were able to keep their old licenses until they expired, which in some cases was not until this year
[Evan] I wonder what prompted them to change the practice in 2003. If it was to stop the disclosure of Social Security numbers, it probably would have made sense to recall old licenses at the same time. The District Court of Maryland case information site includes information that dates back many years, so what was done is done as far as this breach is concerned.
Washington began offering drivers the option of having random numbers on their driver's licenses instead of their Social Security numbers in 2001
[Evan] This didn't go far enough to address the risks in my opinion.
Washington stopped issuing licenses with Social Security numbers on them altogether after federal regulations banned the practice in 2004.
But Maryland's court records date back decades, and drivers from D.C., Virginia or any state that once used Social Security numbers on licenses will find their Social Security numbers online today if they received Maryland tickets during that time.
A spokesman for the Maryland courts system was not immediately able to determine whether the number could be removed from the public record at the person's request.
[Evan] Maryland really should remove any reference to Social Security numbers on it's site. Knowing without a doubt that sensitive information is exposed and choosing to do little (if anything) about it is not cool. My advice would be to remove the "Drivers License" display for any "Issuing State" matching "VA" or "DC" until the database can be searched for nine digit driver's license numbers and the information purged. What do I know?
People who find their Social Security numbers listed on the Web site can place a fraud alert with one of the three major credit bureaus at no charge
[Evan] How will people know to check, and how will they know where to check?
Maryland officials say people who find their numbers listed on the Website should place a fraud alert with a credit bureau immediately.
[Evan] It seems like Maryland has an obligation to do more to secure this information.
Commentary:
There are potentially hundreds or thousands of Social Security numbers exposed on this government sponsored/managed web site and they are still exposed as of the time of this posting. I am not a lawyer, nor do I intend to play one on TV, but is there some law that prevents Maryland from removing the sensitive information (namely Social Security numbers) from this site? Or is it just not a priority for them to do so?
I decided not to post the actual site URL because I do not want to refer the wrong people there. It is not hard to find. If you are motivated you can find it yourself.
Maybe if we pretend it's not really there.
Past Breaches:
January, 2008 -Maryland Department of Assessments & Taxation web exposure
August, 2007 - Maryland Department of the Environment, Stolen Laptop, Unknown Number of Victims
Posted by Evan Francen at 8/13/2008 9:31 AM 
Categories: State of Maryland, District of Columbia, State of Virginia, Poor Design
Categories: State of Maryland, District of Columbia, State of Virginia, Poor Design
Posts Atom 1.0
Why don't we just pretend that criminal can only use social security numbers and driver's license numbers and birth dates, etc. to do nothing but ruin somebody's credit. Let's forget about any other form of havoc that can be rendered with this information. Why I bet with a little investigation, you can find a person who resembles you and get a state issued driver's license with your picture on it, get a passport, marry people using the bogus name and clean out spouses' life savings from banks, use other people's health insurance, collect on life insurance instead of the real beneficiary, etc. I have clients that can easily make a million per year with this information and wreck numerous lives. What is the Government's problem? They have to check grandma's shoes before letting her walk into a state office building, but leave this sort of information on line?
Reply to this