Slashdot Mirror
NHTSA Complaint Database Oozes Personal Data
EWNiedermeyer writes "Are your name, address, date of birth, driver's license number and Social Security number publicly available online? If you've been involved in an accident, they might be and you would never know. The Department of Transportation's National Highway Traffic Safety Administration solicits defect complaints from the public, which are hosted on NHTSA's public database. There are about 792,000 of these complaints currently online, and as the video at the link proves, many of them are improperly redacted. As a result, the most personal information imaginable is available to anyone who takes the time to troll the database. This is a clear violation of the Privacy Act of 1974, and NHTSA needs to shut down the database until it can control the personal data stored there."
The guy who discovered and reported the leak is a Canadian. The NHSTA is a US Government agency, it is not a Canadian agency. So not only is the government leaking sensitive information, it took a foreigner to discover and disclose it. Embarrassment all around today.
But a large part of the problem is that too many institutions consider the combination of a name and a number to be proof of identity. Take away this, and it's not nearly as problematic.
Yes, it's bad. But anyone willing to pay a hundred bucks to register a corporation in Illinois can buy practically the same information from the DMV.
The society for a thought-free internet welcomes you.
Seems NHTSA has stopped access to it now, according to Edward Niedermeyer's latest at TTAC.
Caveat Utilitor
They've been aware of the problem for 12 years, but the fixes are still working their way through the bureaucracy. Only 34 more reviews and rubber-stamps to go.
To verify your citizenship status. It's required on the license application/renewal form in my state. They were actually using the SSN as the drivers license number a couple decades ago.
Any vehicle-related bureaucracy seems to get the lowest level of IT/administrative talent. Salaries must really suck or something.
Though I do have to say despite continuing to lag behind the curve, they are definitely improving over time on some levels.
Someone had to do it.
I work as a software developer in public safety, and SSN's are an integral part our some of our NCIC queries. Your a body with a number.
'We are trying to prove ourselves wrong as quickly as possible, because only in that way can we find progress.' RPF
Why would the DMV even have your SSN?
AZ, at least, requires it (or a damn good reason why you don't have one - eg: immigrant w/o a work permit) to get a license.
Wrong. The reason for your SSN being collected is Child Support Enforcement.
And ye shall know the truth, and the truth shall make you free.
John 8:32(King James Version)