Slashdot Mirror
NHTSA Complaint Database Oozes Personal Data
EWNiedermeyer writes "Are your name, address, date of birth, driver's license number and Social Security number publicly available online? If you've been involved in an accident, they might be and you would never know. The Department of Transportation's National Highway Traffic Safety Administration solicits defect complaints from the public, which are hosted on NHTSA's public database. There are about 792,000 of these complaints currently online, and as the video at the link proves, many of them are improperly redacted. As a result, the most personal information imaginable is available to anyone who takes the time to troll the database. This is a clear violation of the Privacy Act of 1974, and NHTSA needs to shut down the database until it can control the personal data stored there."
The US government can't get anything right! Oh, what's that? This is an article about the Canadians? Well, we shouldn't let the facts get in the way of an opening to deride the US government.
'Political power grows out of the barrel of a gun.' - Mao Tse-tung
The guy who discovered and reported the leak is a Canadian. The NHSTA is a US Government agency, it is not a Canadian agency. So not only is the government leaking sensitive information, it took a foreigner to discover and disclose it. Embarrassment all around today.
But a large part of the problem is that too many institutions consider the combination of a name and a number to be proof of identity. Take away this, and it's not nearly as problematic.
Yes, it's bad. But anyone willing to pay a hundred bucks to register a corporation in Illinois can buy practically the same information from the DMV.
The society for a thought-free internet welcomes you.
Seems NHTSA has stopped access to it now, according to Edward Niedermeyer's latest at TTAC.
Caveat Utilitor
Why would the DMV even have your SSN?
Look, even the State of NY couldn't simply take a cut of horse racing bets without losing money.
This issue is a bit more complicated than you think.
That you never get into an accident. If you do, then you must accept that it's just god punishing you for being evil
this in california
Things should be blackened oot, eh?
There are SO many tools to offer idiot-resistant redaction that it almost amazes me how stuff can still get out:
1: Most databases offer views, that can easily block out sensitive tables.
2: Office 2003 and 2007 have redaction tools available.
3: Adobe Acrobat has redaction under the Advanced menu.
4: Everyone knows the trick of printing out stuff, covering it with black permanent marker or opaque papers, then photocopying it to make sure the data is obfuscated.
And these are just off the top of my head. There is no excuse for failing to protect data.
Are people with EZ-pass / I-pass on that list as well?
As a result, the most personal information imaginable is available to anyone who takes the time to troll the database
Hey, database! You know what I SELECTed * FROM last night? Yo momma!
Slashdot is the culprit now, for pointing out where the data was to be found.
Rome taught me patience and assiduous application to detail. Virtues which temper the boldness of great, general views.
Insightful comment on that website
Telegraph Road
June 3rd, 2010 at 8:59 pm
I find it hard to believe NHTSA's database contains names, VINs, and other confidential information from real folks. I thought it only contained made-up information from UAW allies trying to make Toyota or NHTSA look bad. Maybe I need to get my information elsewhere.
How can a number that you are required to give to every man and their dog (driver licence, student enrolment etc.) even be considered secret enough that it proves ID?
Perhaps the (ab)use of the SSN is why the Australian Government specifically prohibit the use of a tax file number as an identifier by anyone other than the Tax Office and only financial organisation have the right to ask for it (and none can compel, but they have to tax high if you don't give the number over). The driver licence number has become a default ID number here, and although most credit application forms ask for it I've still got new credit without including my licence number.
> Slashdot is the culprit now, for pointing out where the data was to be found.
Philosophically, most of slashdot is against security through obscurity, so occasionally an article will pop up saying to everyone in the neighborhood "Hey, look everyone! These fifty thousand front doors are open, even though you might not have noticed driving by!"
I'm not sure whether it's because slashdotters want to incentivize fixing the system or whether they just want to point out how badly it's designed and implemented. (The latter is pointing to an absurdity, the former is sometimes a consequence of the latter, but the latter would also meet other instrumental objectives, such as mockery or intellectual interest.) Probably a combination.
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
I live in a state (New Mexico) that issues drivers licenses to illegal immigrants. It has no effect on the number of uninsured drivers; in fact, our premiums are generally much higher here than anywhere else precisely because you're more likely to get into an accident with an uninsured driver. We're also a border state.
I think the rate of uninsured drivers has far more to do with the fact that we're one of the poorest states in the union than it does with whether we issue driver licenses to immigrants or not. That we're a border state means we're more likely to have uninsured immigrants (hint: not surprising). It doesn't mean there's a correlation, so I think your point is moot. Issuing driver licenses to illegals has absolutely no net change on the number of insured drivers. It only guarantees that they're more likely to be licensed (which doesn't really matter if they rear-end you and they're uninsured, because your insurance has to foot the bill anyway, and as a result everyone's premiums keep going up).
He who has no
I employ others.
one 'gentrified' employee had a decades old card that said
"for social security purposes not for identification"
my how times have changed....
every day http://en.wikipedia.org/wiki/Special:Random
n/t
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
So, this complaint database contains the photographs of my genital warts, and the way I had them camouflaged by being tattooed in contrasting stripes of telephone-black and white-white. That's the most personal information that I can imagine.
Maybe the submitter, summary writer, or original author has a particularly small and limited imagination based on a small and limited range of personal experiences. Or maybe they are desperate for hits.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"