[BreachExchange] California DMV data breach exposes thousands of drivers’ Social Security information

[Destry Winant]

https://www.latimes.com/california/story/2019-11-05/california-dmv-security-breach-immigration-federal-county-agencies

SACRAMENTO —  Already besieged by problems including long wait times,
the California Department of Motor Vehicles on Tuesday said it
suffered a data breach in which federal agencies, including the U.S.
Department of Homeland Security, had improper access to the Social
Security information of 3,200 people issued driver’s licenses.

Notices of the data breach went out to those whose Social Security
information — including whether or not a license holder had a Social
Security number — was accessed during the last four years by seven
agencies, including the Internal Revenue Service, the Small Business
Administration, and district attorneys in San Diego and Santa Clara
counties.

Some of the data were accessed as part of investigations into criminal
activity or compliance with tax laws, officials said.

The issue was discovered by the DMV on Aug. 2 and access to the
information was cut off, officials said. The disclosure of the
information did not involve hacking or sharing information with
private individuals, according to DMV spokeswoman Anita Gore.

“Protection of personal information is important to DMV, and we have
taken additional steps to correct this error, protect this information
and reaffirm our serious commitment to protect the privacy rights of
all license holders,” Gore said. “That’s why DMV immediately began
correcting the access error following a legal compliance review,
ensured that no additional confidential information was disclosed to
these entities, and has implemented several additional layers of
review.”

The data breach is a particularly sensitive issue because California
lawmakers decided in 2013 to issue driver’s licenses to immigrants in
the country illegally who can provide proof of identity and California
residency. State officials have promised that information on those
license holders would not be shared with federal immigration
officials.

The information shared with the seven outside agencies included
whether a license holder had a verified Social Security card or was
ineligible to be registered with Social Security, officials said.

The agency said 88 people who received or applied for an AB 60 license
without proof of legal status had their information accessed. Six of
those whose information was accessed by Homeland Security had applied
for or received an AB 60 license.

One immigrant rights advocate noted that only a small number of AB 60
license holders are affected.

“There are presently over 1 million people who have successfully and
safely obtained an AB 60 driver’s license in our state,” said Layla
Razavi, policy director of the California Immigrant Policy Center. “If
you are not one of the ... individuals who received this notice from
the DMV, then you were not impacted by an unauthorized disclosure.”

The San Diego and Santa Clara district attorney offices accessed
information in 3,000 of the cases announced Tuesday, officials said.

The letter to customers notes that state law requires notification of
“unauthorized acquisition of computerized data that compromises” the
confidentiality of personal information.

“We sent this letter and the attached notice to you based on having,
in the past, shared your Social Security information in error,” wrote
Albert C. Hwang, the DMV’s chief privacy officer.

The controversy comes as the DMV has been struggling in the last year
to overcome a series of problems, including hours-long wait times at
some field offices, computer crashes and mistakes in automatically
registering people to vote.

In July, Gov. Gavin Newsom hired tech industry executive Steve Gordon
as director of the DMV — its third in a year — to modernize and
streamline the agency so that it can more efficiently and securely
serve customers.

At the time he announced the appointment, the governor said: “People
are outraged by their experience at DMV.”

The new problems come just months after a state audit in March found
“significant deficiencies” in DMV operations, including technology and
staffing problems and poor management practices.

The long wait times have also been blamed in part on the federal
requirement that the state issue a Real ID, a new driver’s license and
identification card required for airline passengers flying
domestically starting in October 2020. Officials estimate up to 28
million Californians may apply for the card in the next year,
officials say.

The DMV has also faced criticism for glitches in its “motor voter”
program. The agency acknowledged tens of thousands of errors as people
were unknowingly registered to vote or mistakes were made in their
registration status.

The agency has 9,711 employees, 172 field offices and a $1.3-billion
budget, and is tasked with licensing 27 million drivers and
registering 35.7 million motor vehicles.