New Jersey DMV Employees Caught Selling Identities

phaedrus5001 writes "Ars has an article about two New Jersey DMV employees who have been accused of selling personal information they routinely had access to. The NJ prosecutor's office claims (PDF) their investigation 'uncovered that two employees of the New Jersey Motor Vehicle Commission were providing the names, addresses, dates of birth and social security numbers of unsuspecting residents that they obtained through their employment. They were charging as little as $200 per identity.'"

Comments

This is more proof

[Anonymous Coward]

More proof that the best government is the one that governs least.

Re:This is more proof

[s73v3r]

Because a private company would never be caught doing something like this. Nope. They are all completely above any kind of corruption.

Re:This is more proof

[0123456]

Because a private company would never be caught doing something like this. Nope. They are all completely above any kind of corruption.

Unlike the DMV, a private company can't force you to use their services. Nor can they push a unique identifier on you which is then used as an id by numerous different databases.

Re:This is more proof

[cptdondo]

Great soundbite. Now expand on it. Tell us how, exactly, you would put your proposal into practice.

Fewer cops? Less regulations? Which ones? Fewer teachers? No DMV (and no vehicle registrations, or safety regulations, or license plates, or insurance?)

I want to know.

Re:This is more proof

[zAPPzAPP]

If the private company owns any of your local infrastructure, or it got an outsourcing deal for a former gouvernment service that you need to use, how do you avoid them?
Because that's what "less gov" means around here.

Re:This is more proof

[cptdondo]

Experian? Other credit rating companies?

I'm sure I could come up with a lot of others that disprove your hypothesis. There are lots and lots of private companies that we have to do business with. We have no choice in the matter.

Re:This is more proof

[DanTheStone]

Obviously the government shouldn't know your Social Security number...

Re:This is more proof

[Anonymous Coward]

Yes, and our roads will be awesome when any asshole can just hop into a car and put the pedal on the floor....

You haven't driven in Boston, have you?

Re:This is more proof

[Jessified]

Well, just like if you don't like airport security you don't have to fly, if you don't like the DMV you don't have to drive, amiright? /sarcasm

Re:This is more proof

[vlm]

No DMV (and no vehicle registrations, or safety regulations, or license plates, or insurance?)

The following licenses I have, or previously held, none of which are "IDs" requiring SS number:
ham radio license
GROL
former private pilot license (maybe this has changed to photo now?)
former fishing license
several former military operators licenses including really weird stuff like immersion heater (I kid you not) and RTFL rough terrain forklift
my library card is functionally a license as opposed to an ID card
my old non-photo college ID card (I guess those are mostly photo "real forms of ID" now?). It was mainly used at the library and to pay for photocopies.
My temp drivers license when I was 15 until I passed my formal DL test had no "id" properties, it just gave me permission to drive with a parent in the car supervising me.

Functionally American drivers license functionality is merged with ID card functionality, as if any separation is impossible, but its certainly not required. None of the stuff you listed requires ID directly, although registration title transfer is gonna require the services of a notary, and the notary will demand an ID, or the DMV personnel could operate as notaries, ending up right where we started...

Re:This is more proof

[jmottram08]

. . . ummmm every asshole does jump in a car, every day. Or do you think that the DMV regulates drivers? Because regulation means that some cant do it, and with tests for a drivers licence entirely on a computer and renewals online, they arent actually regulating -anything-, except for age.

These anti-regulation people would say that the market adjusts and insurance prices would keep the bad drivers off the road. Do you honestly think that without a drivers licence telling people that they can drive that millions would die? ...because.... no. A drivers licence literally only tells you that you are over 18, and that is it.

Re:This is more proof

[rickb928]

Well, at least not for your dirver's license. Kinda like using the same password everywhere. Break into one, break into them all.

Re:This is more proof

[jmottram08]

You have a lot more choice in the matter than with governmental agencies.

Re:This is more proof

[neonKow]

You are probably forced to use Experian a lot more than you are forced to use New Jersey DMV.

Re:This is more proof

[lucifuge31337]

"I'll take the sniper rifle and a couple of boxes of ammo. Am I convicted felon with a history of violence? No sir, I am not. Why thank you, you have a good day too!"

This might be a convincing argument if it weren't for the fact that one can do this in most states legally for a private party face to face transfer. Also, "sniper rifles" aren't all that scary. They are typically nothing more than an off the rack deer rifle (that you can walk in and buy from Wal Mart) with a bipod and a different stock. Better ones have some accuracy work done to them, but it's really not much of a huge difference.

Re:This is more proof

[jackbird]

A credit check is increasingly becoming part of employment screening, and is entirely necessary for both renting and purchasing a home (unless buying the home for cash). Being homeless rises above "inconvenient."

Providing a social security number is also required to open a bank account, the lack of which is also a bit more than "inconvenient."

Re:This is more proof

[Bigby]

I don't sign up for services when they require a Facebook account because I don't have a Facebook account. I, as a human being located in the United States of America do not need a Facebook, Google, or Yahoo account. In fact, more than half the country don't have any of those accounts.

You can't say the same thing about who is in a DMV system. Even if you don't drive or even not allowed to drive, you need to have identification. Just the basic idea of being a human being in the US at 20 years of age will get you arrested for not having proper identification. That is wrong. Alliances between companies is wrong, but on such a lower level it isn't even funny.

Re:This is more proof

[rickb928]

This is the debate. If you don't like the restrictions, don't drive.

This is the WRONG attitude and approach.

We expect our government to, among other things, serve us by managing certain things. One of these is the licensing of drivers, so that we can be marginally safe on the roads, that entirely unqualified drivers are not allowed to operate vehicles, and that dangerous drivers are removed from the road to some degree. Imperfection is rampant, but it works farly well.

Driving is, in much of American a NECESSITY. To claim it is a privilege may be linguistically accurate, but it is not accurate at all. It is a necessity for most of us.

In that light, our governments' role shoudl never be to make licensing as difficult as possible, nor should it be to force applicants to exert themselves merely to satisfy the bureacracy's self-serving purposes. It should be the goverments' role to facilitate and deliver the needed service, IE licensing etc.

The argument that driving is a privilege is to leave open the option that for some reason, we should serve our govermnent. The opposite is the desired relationship, and one that should be not only normal, but expected.

I know you're being sarcastic, and you're excused from being the target this screed. But some people actually hold that driving as a privilege means that the agencies can be permitted to make it difficult to maintain the privilege.

That is wrong.

Re:This is more proof

[cptdondo]

It might interest you that there used to be way fewer teachers, no administrators, no dept of education ... and the quality of education was way higher.

Citation, please. Hard data, not more soundbites.

Re:This is more proof

[Anonymous Coward]

Actually it is forced on you. Just try going through your entire life without ever having credit pulled on you. Want a phone? Credit check. Internet? Credit check. Car insurance? Credit check. Rent an apartment? Credit check.

Or how about a job? Credit check.

None of these involve providing credit, and all of them are part of a normal responsible American lifestyle. Yet you still get a credit check.

Re:This is more proof

[Bigby]

If you never used credit, then you simply won't have a credit history. Your potential employer will ask why. You will say that you don't believe one should rely on debt. Any employer that refuses someone because they don't have a credit history is foolish. Remember, it isn't a bad credit history; it is NO credit history.

You can get a phone and Internet without credit. It is just month-by-month and requires a large deposit.

All these examples can do all the credit checking they want. They will just find no history with a lot of inquiries. Most places understand the difference.

The only problem will be around purchasing online, booking a flight, or getting a hotel room.

Re:This is more proof

[Hentes]

In a private company, it's not the employees who do this, and they charge more for it.

Re:This is more proof

[lucifuge31337]

I'm a competitive target shooter.

Every last thing you listed is a bolt or semi that is under no regulation past any other long arms in most states. Same as a .22lr plinker rifle.

Ever been involved in law enforcement? Because, with very few exceptions (larger departments) these guys only have the budget for Rem 700s in .308 done up by an outfit like Iron Brigare Armory. So your grandfather's 30-06 deer rifle has more muzzle energy.

Re:This is more proof

[icebraining]

Our ID card here in Portugal is a smartcard with a key pair. When connected to an appropriate reader, it can provide copies of the public key or sign stuff with the private key (without ever copying it to the machine).
You don't need a smartphone, a data plan or know what is a key pair or even that your card has one.

If you want to authenticate when physically present, just insert it in their reader and input the PIN (as said, the private key will NOT be copied out of the card, so it's safe).

If you want to authenticate online with it, you just need a $16 reader (available on big retail stores) which is supported by IE, Firefox, Safari and Chrome, using PKCS#11 or similar.
Again, no need to understand how it works - the follow the simple steps on the site.

Re:This is more proof

[erroneus]

Yeah, this is thought to be funny, but in reality, the SSN should be used only for Social Security purposes. Instead it is a national serial number which was everyone's concern when the program was set up.

Texas does not use the SSN for the driver's license... not yet anyway... not the last time I got it renewed. I hate to see when other states disregard this and abuse its citizens for a bit of convenience like this. And of course, the SSN is a widely abused thing and the more abused it is, the more damage abusers can case innocents. It's annoying.

Re:This is more proof

[mcgrew]

If the manufacturer and/or seller of a gun is liable for what the new owner does with it,

He isn't. Where are you getting this nonsense?

or a bartender is liable for what a patron does after purchasing booze,

He isn't liable selling booze to a sober person. Are you ten years old? It is definitely irresponsible to sell booze to someone who's drunk, especially if you know he's driving. In this case the bartender is responsibe, as he should be.

or I get in trouble for selling you a class 4 laser and you do something dumb

But you don't. Are you trolling, or are you really that ignorant?

Thats how it works in private aviation, anytime anyone crashes for any reason, the vehicle manufacturer gets sued, because that's where the money is.

Citation needed... and considering the earlier fantasies in the same comment, it needs to be a damned good citation.

Re:This is more proof

[silverspell]

If you have NO credit history whatsoever, then yes, I think it's a fair bet that you're the kind of person who's too attached to his fantasies of perfect autonomy, and who uses words like "sheeple". Such a person is someone I'd rather not hire, if an equally (or more) competent candidate is available; they're generally tiresome, pedantic, and childish, and see themselves as enlightened figures in a world of fools.

It's a serious hassle to do without credit in this society, and you have to have some serious ideological baggage to make a lifelong point of doing so. More to the point, credit represents a willingness to take on obligations to other people and fulfill them over the long term. Going into long-term debt and repaying it in a timely manner is a sign (not 100% reliable, but still a sign) good judgment, fiscal discipline, and personal integrity.

If someone isn't willing to do that -- if they go to great lengths to retain the fantasy that they can give it all up at any time and head off into the wilderness, perfectly autonomous and beholden to no one -- then it seems to me that they probably haven't come to terms with adulthood.

Re:This is more proof

[Oswald McWeany]

Yes- but if you don't go to the DMV you can't be entered into the public lottery that everyone craves:

Jury duty.

Re:This is more proof

[Kamiza Ikioi]

That's a great system that the United States will never adopt. Between the tin foil hats and the Apocalypse believers, we're thoroughly terrified against any type of secure identity verification cards. Because, after all, it's a slippery slope to reading your brain, watching you have sex with your wife using satellite x-ray vision, and tattooing 666 on your forehead.

So... "no need to understand how it works"? I see you've not encountered sheer stupidity in its raw, unbridled form. Welcome to the United States!

Re:This is more proof

[Bucky24]

Often having no credit history is worse then having bad credit. If you have bad credit at least the companies checking you know that you're high risk to give money/service to. If you have none then they don't know, and that bothers them even more. An employer will wonder if maybe your identity is fake, since having a long credit history is probably the best way to show you are a real person.

Re:This is more proof

[Anonymous Coward]

Correction: We are rightfully concerned about being *compelled* to use such an identification scheme.

I see you've not encountered sheer stupidity in its raw, unbridled form.

No doubt there are some people who refuse to be a cog in the machine for stupid reasons. But many people have considered the consequences and decided they prefer to not have these so-called "smart IDs." Reasonable people can disagree, but it is certainly remarkable that your stance is basically "damn your preferences, damn your reasoning, you are stupid!"

Re:This is more proof

[icebraining]

How exactly is this worse than having an SSN?

Re:This is more proof

[interval1066]

Are these activities without credit? I haven't had a problem doing any of these things, I use an ATM card.

Re:This is more proof

[icebraining]

(...) if you stop your average bible-thumper on the street he can clarify it for you.

Well, as I said, I live in Portugal, a place where the majority of Christians are pro-choice and 90% are in favor of contraception and sex before marriage. Finding a true bible-thumper on the street in a city is extremely improbable.

But I don't get what do you mean "to buy stuff". Buy what? It's not a credit/debit card, just ID.

Re:This is more proof

[WindBourne]

There is a reason for that. Basically, we saw what happened in Germany and have back lashed against it. I will say trhat I grew up with jews that had numbers on their forearms. Some told me what happened with great sadness or hate in their voice, while others, when I asked, just gave a look that said that they just died remembering what happened (I was guessing that they only recalled it in their dreams, which I am quite sure, haunt those that are still alive to this day).

Somewhere along the line, we have to figure out a way to provide a decent ID, while at the same time, stopping it from being use d negatively. In light of how easily that that W/neo-cons did so much damage in the USA and in the world, I doubt that we can ever get that to happen.

Not surprised

[Lyrata]

I wouldn't pay more than $200 to be from New Jersey, either!

Re:Not surprised

[Moheeheeko]

I would pay a hellova lot more, however, to have a fake ID saying im NOT from New Jersey.

SSNs?

[Manip]

Why can normal day to day employees even view plain text social security numbers? Wouldn't it make a lot more sense to hide that information like banks do with credit card numbers?

Also, I find it ironic that these two relatively low level criminals will get the book thrown at them, but when the DMV legally sells that information to marketing companies everyone is happy. I guess they don't sell SSNs but still, thin line.

Re:SSNs?

[Moheeheeko]

You would be suprised. At the local Community college, thats like a student ID number.

Re:SSNs?

[the_fat_kid]

normal day to day employees can probably read them because we have become lax about where we use our SSN.
Want a phone? SSN
want a rental? SSN
want credit? SSN
talk to someone at support? SSN

Once upon a time these were supposed to be a Secret number that you only shared with the government and an employer.
Now it's how you prove your citizenship and credit worth.

Re:SSNs?

[flaming error]

Social Security Numbers were never really meant to be all that secret.

Every organization that decided to use them as a secret was stupid, and if they were intended to secure anything important, irresponsible/criminal.

SSNs, like biometrics, have all the right characteristics for account ids, and all the wrong characteristics for a password.

Re:SSNs?

[Narcocide]

I've seen employers use it as the employee ID too. One place I worked at you had to type your SSN in to a physical console twice a shift (to punch in and out.)

Re:SSNs?

[jmottram08]

Lets be clear here, it was criminal to use them for anything other than social security for anyone, private or government.

Now it is illegal for any government agency to require you to give your SS#, apart from the social security office.

Re:SSNs?

[ColdWetDog]

We needed a universally unique personal identifier. Only the feds could actually create one, and the SSN is the only one they ever got political consensus to create.
The real problem is treating it as both identification and authentication.

Three ID's for Credit Reporting Agencies under the sky,
Seven ID's for Three Letter Agencies in their halls of stone,
Nine ID's for each system you log on to.

One ID for the DHS on it's dark throne,
In the Land called DC, where the shadows lie.

One ID to rule them, One ID to find them
One ID to normalize the database and in the darkness bind them.
In the land called DC where the shadows lie.

(Apologies to just about everyone)

Re:SSNs?

[DRBivens]

Lets be clear here, it was criminal to use them for anything other than social security for anyone, private or government.

Now it is illegal for any government agency to require you to give your SS#, apart from the social security office.

{{Citation Needed}}

I don't believe you're correct. A person's SSN is also their TIN, so the IRS requires it. Also, HHS requires it for Medicare (and--I think but am not sure--Medicaid), FEMA requires it on disaster aid loan applications, and every employer is required to collect (and report) it for tax purposes, not just for FICA. Have you ever tried to open a back account without one?

I suspect there are others examples.

Re:SSNs?

[Urza9814]

Once upon a time these were supposed to be a Secret number that you only shared with the government and an employer.

No. SSNs were NEVER supposed to be private. It's a freakin account number. The problem isn't them being used publicly, the problem is them being assumed private.

Re:SSNs?

[PatDev]

I'm assuming this is sarcasm. If it is not, my apologies.

But no, there is no possible way to lockdown a computer to prevent data from leaving it. You can mitigate by limiting the amount of data that can leave it, but you can't prevent data from coming off it (at least not while being used for its intended purpose at the DMV).

Sure, you can install filtering software to DPI everything leaving the machine and uninstall all text editors and remove the ability to install additional software. But at some point, the operator has to read information off the screen, and that's the analog hole you've hit right there. Even if sufficient surveillance is employed to prevent employees writing SSNs down on paper, there is still the possibility of the employee just remembering them. Given that a 9-digit SSN doesn't really have 9 bits of entropy and names are generally easy to remember, I'm guessing an employee using mnemonics could still easily recall 3 identities per shift. At $200 or more per identity, an extra $600 per shift is enough of a payday to motivate someone to try.

Re:SSNs?

[mcgrew]

Are you kidding, or are you young? Keeping SS#s secret is a new thing. Hell, they used to print your SS# on your driver's license. ID theft didn't become a big problem until the internet.

Re:SSNs?

[mcgrew]

Thanks, but I wouldn't need it anyway. And someone gave it an "informative", I'm guessing that most young people today don't realize that SS was never intended to be an ID number, and in fact one of the reasons for being against SS when it was first enacted was that it would become a "national ID card", and were assured that "oh, no, we'll gurantee it isn't ID". Now they don't even bother printing that "Not to be used for identification purposes" on it.

You're Going To See More and More of This.

[smpoole7]

It's not a government vs. private sector thing, either. The simple fact is, you will always be able to find some corruptible person who's will to sell (or "leak," if he/she is just trying to harm a rival) information.

I'm a geek and I loves me some technology, but still, I'm not blind to the dangers of giant databases filled with sensitive data And to be honest, I itch at the thought that anyone -- be it the federal government (with the Affordable Health Care Act) or private business (think of some large, national hospital group) has access to all of my medical records -- including prescriptions, diagnoses, and all the rest of it.

But I don't know what the answer is. Someone smarter than me will have to come up with that.

Re:You're Going To See More and More of This.

[Sir_Sri]

The answer is government run healthcare with a government run database. Then if your medical records leak out it is *only* a privacy violation, and cannot effect further access to employment or medical care.

The advantages of a functioning single database are enormous. Depending on where you live, you may have to carry all of your relevant records between specialists as you get sent through the system when something is wrong with you. Each of those steps risks you losing something important, and puts undue pressure on the doctor you are seeing to assess whatever you bring them right there in front of you, while you're waiting. Assuming everything you bring is in a format they can use, and if not, well then there's a lot of time spent faxing/phoning etc. back and forth. The risk that your privacy can be invaded is well outweighed by the fact that your allergy to some random medication, or obscure but potentially serious condition is going to show up in a record somewhere when you get into a car accident on holiday out of province/state.

I'm in canada, so the only people who particularly care about my medical records but wouldn't be granted access to them are, my 'spouse' my kids (which I don't have but you get the idea), and well, that's it. And it doesn't matter who runs the healthcare system, if there's something in there I'm trying to hide, it's equally likely they'll be told regardless of who runs the database. But in a system where that information matters to insurance companies and employers, well then you have a problem.

The DMV thing having SSN's is unfortunate, but I guess it makes sense. Criminal activity (which I guess would be tied to your SSN?) is going to impact your ability to interact with the DMV, and as a government agency they're authorized to collect that data. Unfortunately, there's not a lot you can do to secure information they have legal access to under normal circumstances, it doesn't matter if it's paper or electronic.

Re:You're Going To See More and More of This.

[dkleinsc]

The solution that someone much smarter than me (Bruce Schneier) has repeatedly proposed is this: When doing something that involves sensitive data, you don't verify identity, you verify transactions. For instance, if you want to transfer money from your bank account, the question is not "Are you smpoole7?", it's "Does smpoole7 really want $150,000 to go to an account in Pakistan?". A smart bank will use alternate ways of contacting you (if they're really worried, they might even ask that you do this in person) to confirm that it is in fact your intent.

This has a lot of ancillary benefits that probably make it worth the expense. For instance, it helps catch errors by the actual owner of the account.

Re:You're Going To See More and More of This.

[Em Adespoton]

I'm sorry you feel that way. To many of us around the world, the US War on Public Healthcare looks an awful lot like the US War on Drugs. The information is only valuable because of how it can be (mis)used. Give everyone equal access to what the private information grants a select few, and the problem goes away. Of course, there *are* other problems created, but not of the "chop off your nose" variety.

Re:You're Going To See More and More of This.

[dkleinsc]

Here's Schneier's essay describing this approach much better than I did.

Sigh

[Aerorae]

I didn't realize that our identities were so worthless. Whether it is attributed to evil, or a lack of humanity on the part of the two employees, this represents a fundamental problem among people today: "Doesn't affect me, so I don't care."
I believe that will destroy us even faster than bank collapses or political corruption, in a sense because those maladies are results of the "I don't care" problem. "I can buy these horrible securities, if it goes bad, it doesn't affect me, so I don't care", "My constituents want this, sure it'll put 100,000 people out of work, but it doesn't affect me, so I don't care", "Hell I'll sell peoples identities, sure they'll be plagued by this for a matter of decades to come, but it doesn't affect me, so I don't care."
People need to care about things that don't affect them or else this world is very very doomed.

Re:Sigh

[Jeng]

If the person cared about others they wouldn't be working at the DMV.

Re:Sigh

[Anonymous Coward]

Welcome to the repercussions of the "Me" generation. It all started with shifting focus from the outside and how to fit into society and live with others to the inside. People don't know how to empathize with others any more. If it feels good to them, do it. Thanks hippies.

Social security numbers?

[schwit1]

How does providing a SSN verify that the DL requester is who they say they are?

Re:Social security numbers?

[JJJJust]

It doesn't directly.

But, through SSOLV (Social Security Online Verification), DMVs match name and date of birth in SS record to name and date of birth on driver license/ID. If they don't match, no license is issued until the social security or license record is updated.

Re:Social security numbers?

[vlm]

How does providing a SSN verify that the DL requester is who they say they are?

My father did occasional DB consulting work for a collections agency in the 90s, so this is at best hearsay, non the less:

Places that accept personal checks, like to take either the DL number directly or a pointer to the DL such as a grocery store loyalty card.
The DL number points to a theoretically valid SS number.

So, if a guy bounces a check, standard procedure if he completely fell off the face of the earth, with the assistance of the judge, was to ask the bank for money from other accounts owned by the same SS number (presumably the guys savings acct or a CD), garnish the wages based on SS number, etc. Traditionally this was the step where they discovered identity theft (WTF you mean, I live in WI but I bought a used truck in AZ with a personal check that bounced etc etc).

I guess, depending on the state, its possible for a judge to put a hold on a drivers license renewal if a rubber stamped court judgment isn't paid. Also if criminal charges are filed, it can follow the DL number.

$200 is not cheap

[argmanah]

If you work in computer security and have dealt with the black market for stolen identities, you'll find out that $200 an identity is really pricey. It's a little scary, but the market rate for this kind of information is more like $5 a pop.

downside to buying IDs from DMV

[corbettw]

You have to stand in line for hours just waiting to get the CD with the data on it. And don't get me started on all the forms you have to fill out!

time to make an example...

[drew_92123]

And give these greedy assholes a decade or two in prison with no chance of parole.

I'm really not worried...

[Oswald McWeany]

I'm really not worried; at the speed the DMV moves, we'll have already lost to China in WWIII and have a Chinese ID card (and number) long before they manage to actually sell my American SSN.

Too bad we allowed the lobyists...

[forkfail]

... to bribe the legislature to weaken the laws concerning social security numbers. Used to be that it was actually illegal to use a SS number for any purpose other than tracking your social security. Now it's basically the key into all your private accounts.