Slashdot Mirror
NHTSA Complaint Database Oozes Personal Data
EWNiedermeyer writes "Are your name, address, date of birth, driver's license number and Social Security number publicly available online? If you've been involved in an accident, they might be and you would never know. The Department of Transportation's National Highway Traffic Safety Administration solicits defect complaints from the public, which are hosted on NHTSA's public database. There are about 792,000 of these complaints currently online, and as the video at the link proves, many of them are improperly redacted. As a result, the most personal information imaginable is available to anyone who takes the time to troll the database. This is a clear violation of the Privacy Act of 1974, and NHTSA needs to shut down the database until it can control the personal data stored there."
The guy who discovered and reported the leak is a Canadian. The NHSTA is a US Government agency, it is not a Canadian agency. So not only is the government leaking sensitive information, it took a foreigner to discover and disclose it. Embarrassment all around today.
http://www.dot.gov/pia/nhtsa_artemis.htm
what?
Ice Cream has no bones.
But a large part of the problem is that too many institutions consider the combination of a name and a number to be proof of identity. Take away this, and it's not nearly as problematic.
Yes, it's bad. But anyone willing to pay a hundred bucks to register a corporation in Illinois can buy practically the same information from the DMV.
The society for a thought-free internet welcomes you.
Seems NHTSA has stopped access to it now, according to Edward Niedermeyer's latest at TTAC.
Caveat Utilitor
Why would the DMV even have your SSN?
They've been aware of the problem for 12 years, but the fixes are still working their way through the bureaucracy. Only 34 more reviews and rubber-stamps to go.
Look, even the State of NY couldn't simply take a cut of horse racing bets without losing money.
This issue is a bit more complicated than you think.
That you never get into an accident. If you do, then you must accept that it's just god punishing you for being evil
If thats the case for an errant mistake of judgment, what is are the biblical ramifications of immoral activities? By your standards all politicians and murderers should have already spontaneously combusted and turned into piles of dog turds that are succinctly eaten by a pack of rabid grues. If only...
'We are trying to prove ourselves wrong as quickly as possible, because only in that way can we find progress.' RPF
I think you need to get your sarcasm detector checked out...
excuse for failing to protect data:
The backend computer system is dumb, slow, old and badly coded, but connects flawlessly with other backend computer systems state wide and federally.
All the staff understand the gui.
It was built and contracted to a faith based firm that gives to both parties and has deep roots in the local community.
Many public, private and dark databases like the current system and lax data protection laws.
You entered the data freely, now it belongs to anyone with a database, no questions asked.
Domestic spying is now "Benign Information Gathering"
As a result, the most personal information imaginable is available to anyone who takes the time to troll the database
Hey, database! You know what I SELECTed * FROM last night? Yo momma!
Slashdot is the culprit now, for pointing out where the data was to be found.
Rome taught me patience and assiduous application to detail. Virtues which temper the boldness of great, general views.
Things should be blackened oot, eh?
Yes, just set the foreground and background to the same colour. These guys are amateurs.
http://michaelsmith.id.au
How can a number that you are required to give to every man and their dog (driver licence, student enrolment etc.) even be considered secret enough that it proves ID?
Perhaps the (ab)use of the SSN is why the Australian Government specifically prohibit the use of a tax file number as an identifier by anyone other than the Tax Office and only financial organisation have the right to ask for it (and none can compel, but they have to tax high if you don't give the number over). The driver licence number has become a default ID number here, and although most credit application forms ask for it I've still got new credit without including my licence number.
> Slashdot is the culprit now, for pointing out where the data was to be found.
Philosophically, most of slashdot is against security through obscurity, so occasionally an article will pop up saying to everyone in the neighborhood "Hey, look everyone! These fifty thousand front doors are open, even though you might not have noticed driving by!"
I'm not sure whether it's because slashdotters want to incentivize fixing the system or whether they just want to point out how badly it's designed and implemented. (The latter is pointing to an absurdity, the former is sometimes a consequence of the latter, but the latter would also meet other instrumental objectives, such as mockery or intellectual interest.) Probably a combination.
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
The problem isn't so much lack of redaction tools as it is the volume and quality of data coming in. NHTSA probably gets thousands of documents a month, and, if the cited documents are any example, they're usually poorly scanned PDFs or JPEGs. To go through manually and redact all personal data from all those documents would be very expensive and time consuming. So, of course, no sensible manager is going to allocate personnel to the task until it becomes an actual problem. This isn't a government problem, nor is it a private industry problem. Its a problem with management in general.
We all know what to do, but we don't know how to get re-elected once we have done it
I live in a state (New Mexico) that issues drivers licenses to illegal immigrants. It has no effect on the number of uninsured drivers; in fact, our premiums are generally much higher here than anywhere else precisely because you're more likely to get into an accident with an uninsured driver. We're also a border state.
I think the rate of uninsured drivers has far more to do with the fact that we're one of the poorest states in the union than it does with whether we issue driver licenses to immigrants or not. That we're a border state means we're more likely to have uninsured immigrants (hint: not surprising). It doesn't mean there's a correlation, so I think your point is moot. Issuing driver licenses to illegals has absolutely no net change on the number of insured drivers. It only guarantees that they're more likely to be licensed (which doesn't really matter if they rear-end you and they're uninsured, because your insurance has to foot the bill anyway, and as a result everyone's premiums keep going up).
He who has no
Perhaps the politicians are our punishment for voting for them.
He who has no
I employ others.
one 'gentrified' employee had a decades old card that said
"for social security purposes not for identification"
my how times have changed....
every day http://en.wikipedia.org/wiki/Special:Random
n/t
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
So, this complaint database contains the photographs of my genital warts, and the way I had them camouflaged by being tattooed in contrasting stripes of telephone-black and white-white. That's the most personal information that I can imagine.
Maybe the submitter, summary writer, or original author has a particularly small and limited imagination based on a small and limited range of personal experiences. Or maybe they are desperate for hits.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"