Flood victims revictimized: another Metro identity breach of citizen personal information

A couple of days ago local tweets started crossing my feed that some flood victims' personal information, including bank account numbers had been posted on the Metro Tax Assessor's WebPro government site. Here is the Tennessean's follow up on the story:

Three property owners had private information exposed on the county web site, according to the Assessor's office. Rooker said he was first made aware of the information being posted by the Metro Legal Department this morning. As originally reported Dozens of flood victims seeking property tax relief may have had personal documents like checks [to pay for repairs] posted for public view on the Davidson County Assessor’s web site.

This is at least the 5th data breach of Davidson County citizen information since 2007, when laptops containing personal voter information where stolen from the Metro Election Commission. A Metro computer security laptop was stolen from a car shortly after that. Another incident involving exposure of 18,000 Metro Public School students' and 6,000 parents' personal information on Google occurred last year. Earlier this year an employee with Policy Studies, Inc. was given access to private Metro child support records with information like Social Security numbers, which he promptly attempted to sell.

Government just keeps privatizing more and more of its functions involving sensitive personal information without any accountability. Worse, yet, the information keeps getting breached. This running government like a business project does not seem to be working too well, especially for average Nashvillians. In the latest case, those who have already been victimized by May flood waters were revictimized by exposure of their identities.

Another Privatized Government Security Breach in Nashville

This one involves the U.S. Attorney's Office and private contractor Policy Studies Inc.

A Second December Data Breach in Metro Government on Karl Dean's Watch

For the second December running since Mayor Karl Dean took office, a privately-held company contracting with Metro government has failed to protect the social security numbers and other identity information of large numbers of Nashvillians. December 2007 saw the break in and theft of Metro Election Commission computers due to a lax security contractor. December 2008 saw the public disclosure on search engines of Metro public school student and parent information due to the failure of the private consulting firm, Public Consulting Group.

I wonder what we have to look forward to in December 2009? And when is Metro government going to stop privatizing the oversight of sensitive information and start implementing its own security measures? Can we ever feel any modicum of security with the current administration running the show?

HT: PostPolitics

Cavalcade of Capitalists: Senior Financial Analyst Arrested for Selling 2 Million Customer Profiles

Hence, the value of corporate ethics in American society: not only is defunct Countrywide a predatory lender who lured consumers with "teaser rates," but their workforce included a white collar criminal who sold millions of customers' mortgage profiles, including social security numbers on the black market. Sounds like a regular den of thieves.

A white collar criminal, huh? Watch the justice system go easy on him.

Just Get the Money They Owe Us and End It

Why even give Wackenhut a second chance to justify their contract with Metro? I see the Wackenhut SUV driving around streets in Salemtown on a daily basis, and I always wonder what it is about our neighborhood that draws the security guards away from their Metro Water Services post on 3rd Avenue, North.

The Election Commission Laptops Weren't the Only Things Stolen on Wackenhut's Watch

According to Channel 4:

Under their watch of Metro buildings, six laptops have been stolen along with 20 packs containing emergency equipment, an AC unit, two cameras and 20 CD ROMs.

Running government like a business is good, huh? Metro Government should get its house in order, fire Wackenhut, and hire its own security force so that voters have control over changing things when security generates insecurity.

Training Programs and Advisory Boards?

I'm all for tightening security protocols at Metro, but last Christmas' security breach seemed to be the result of a security company with a lax track record, the failure to turn on a security camera switch, the absence of an alarm system, and a nonchalant atmosphere about computer passwords at the Election Commission. All of those things could still exist with training programs and advisory boards. Where is the negative reinforcement for the lack of oversight?

Oh No You Di-in't!

Another hole in Metro's security alert system uncovered by the Tennessean in the wake of the stolen Election Commission laptops:

Employees of the election commission and Metro Information Technology Services had learned on Dec. 26 that a computer router stolen along with the laptops had been unplugged at 9:45 p.m. on Christmas Eve ....

But police didn't learn until Jan. 2, the day officers told the public, that the router had been unplugged at 9:45 p.m. on Dec. 24, police spokesman Don Aaron said this week.

Metro election and IT employees amazingly allowed an entire week to lapse between their discovery of the loss of delicate voter information and their first call to police.

And as far as I know nobody but the security guard who was playing Christmas music when the break-in occurred has been disciplined or has lost their government job on this security failure.

I Guess This New Hire Won't Figure into the Proposed Metro Department Cuts

Mayor Karl Dean announces hire of a new computer security expert to fix what's wrong or lacking with Metro IT measures. Still no word on whether Metro is installing building alarm systems where there are none.

BREAKING: Detectives Report that Stolen MEC Laptop Buyers Will Be Arrested Tonight

One of the more exciting pieces of news divulged at tonight's Salemtown Neighbors business meeting was that two persons who bought Metro Election Commission laptops from the homeless thief who stole them on Christmas Eve will be arrested tonight. Metro Detectives attended the neighborhood meeting to talk about the theft and sale of the computers containing 337,000 voters' social security numbers, and they told us that two specific persons are due for arrest tonight: one is turning himself in willingly and the other is on the lam, but he is expected to be apprehended. The detectives also told the group that they did not believe that any voter information was compromised.

Stopped Sweating the Stolen Laptops Yet?

Just when you thought you could exhale:

During the examination of the computers, police discovered a compact disc in one of the laptops, and that disc contained information including voters’ Social Security numbers.

[Metro Police Chief] Serpas said no fingerprints were found on the disc, but police can’t be sure that no one took it from the computer and copied it. Election Commission staff told police that the disc probably had been in that computer since November 2006 .... Serpas said the experts can’t rule out the possibility that someone used high-tech equipment to copy or scan information in the computers, but he said that is highly unlikely.

“If someone had very sophisticated equipment and software, they may have imaged the software,” he said.

When Free Trade Feels Like Captivity

The mortgage market collapse is increasing our dependence on foreign wealth.

With a growing share of investment coming from so-called sovereign wealth funds — vast pools of money controlled by governments from China to the Middle East — lawmakers and regulators are calling for greater scrutiny to ensure that foreign countries do not gain influence over the financial system or military-related technology ....

Debate is swirling in Washington about the best way to stimulate a flagging economy. Despite divided opinion about the merits, foreign investment may be preventing deeper troubles by infusing hard-luck companies with cash and keeping some in business.

The most conspicuous beneficiaries are Wall Street banks like Merrill Lynch, Citigroup and Morgan Stanley, which have sold stakes to government-controlled funds in Asia and the Middle East to compensate for calamitous losses on mortgage markets. Beneath the headlines, a more profound shift is under way: Foreign entities last year captured stakes in American companies in businesses as diverse as real estate, steel-making, energy and baby food.

Is there a ceiling on how much American real estate foreign investors might scoop up and control with bottoming out real estate prices?

And talk about your absentee landlords. I heard a zoning official the other day say that land owners who live in other states are the most difficult to hold accountable for zoning violations. What about the landlords who live in Canada or Europe?

And while we're on the subject of this panacea of wonderful things that some keep telling us that free trade brings, let's go back to my old credit account with GE Money, which had its computer tapes containing 650,000 customers' social security numbers disappear. Aren't those tapes much harder to recover if they're floating around a black market in Indonesia or Thailand? The GE phone operator I spoke with the other day had an Indian or Pakistani accent, so chances are good that she was talking to me from Asia. How in the hell are investigations of this disappearance coordinated on a global level, and how hard would it be to pursue legal redress if I have to recover losses?

Police Report Laptop Information Did Not Appear to Be Accessed

News 2 reports that the homeless burglar sold the two Election Commission laptops he stole on Christmas Eve for $80 and a six-pack of beer to a Downtown "rave-type coffee shop." The computers changed hands 3 or 4 times before police located them but the police are satisfied that the security of voters' personal data was not compromised in the transactions.

In the meantime, police expressed suspicion about the coffee house, given that they found other pieces of computer hardware and software throughout.

WaPo Late on the Uptake

WaPo readers are just now reading the dated story on the Nashville laptop theft absent the details about apprehension of the burglar and recovery of the hard drives. Sheesh. Robert McMillian's story, which was slightly stale when it ran in ComputerWorld on Tuesday, was picked up by PCWorld and then WaPo today.

Lest You Think Private Companies Are Not Prone to Exposing You to Identity Theft

NPR reports that computer security is lacking all over:

GE Money, a unit of General Electric that handles credit card operations for J.C. Penney and other retailers, says a computer tape has gone missing, and it has the personal information of about 650,000 customers. The loss includes social security card numbers for about 150,000 people.

I am fairly sure that we had a GE Money account in the past through Wolf Camera. Oh boy. Exposed once again.


UPDATE: Yep. We did have a GE Money Bank credit account, and I found this ironic warning emblazoned in large bold print across an old bill we got from them:

IN ORDER TO PROTECT YOUR ACCOUNT PRIVACY, WE ARE UNABLE TO PROVIDE ACCOUNT INFORMATION TO ANYONE OTHER THAN THE CARDHOLDER(S) OR AN AUTHORIZED PARTY.

Unable? Au contraire. GE Money seems more than able to provide up to 650,000 cases of account info to anyone but the cardholders.

If You Knew A Hard Drive With Your Identity Data Ended Up at a "Rave-Type Coffee Bar" in South Nashville Would You Feel Relief?

Police reported a few hours ago that the homeless burglar accused of stealing two Metro Election Commission laptops lead them to a "rave-type coffee bar" in South Nashville, where the MEC hard drives containing 335,000 voter social security numbers were located. Later, police were lead to a Goodlettsville home where the laptops themselves were located.

The police are due kudos as the singular Metro Department functioning optimally through this crisis, but I'm sure money gleaned from identity theft could buy a lot of Ecstasy and glow sticks, so we are by no means out of the woods. We still don't know what was done with the data on the hard drives by the java-ravers. The fact that the homeless burglar and not the java-ravers led police to the hardware whereabouts makes me wonder what was done with the data in the wake of the total media saturation of this story. Hopefully, police will be able to find out whether they copied it, stored it, used it, or sold it to other young enterprising types fond of trip hop and industrial electro breaks.

Accused Laptop Burglar Admits to Christmas Eve Heist

News release from Metro Police:

Accused burglar Robert Osbourne, who surrendered at police headquarters early today, has admitted to the Christmas Eve break-in of Metro’s Election Commission offices on 2nd Avenue South. Osbourne has been booked on a charge of burglary and is being held in the Metro Jail in lieu of $80,000 bond.

The ongoing investigation into this case by Central Precinct detectives led to this afternoon’s recovery of a computer router taken during the burglary. The place from which the router was recovered is not being disclosed at present. Detectives continue in their efforts to recover two Dell laptop computers also taken from the Election Commission.

Osborne's admission that he is the burglar on Christmas Eve puts to bed the fired Security Guard's contention that the laptops were stolen before he was on duty on Dec. 24.

CRIME ALERT: Homeless Convicted Burglar is Suspected by Police in Metro Laptop Theft

A former resident of the Union Rescue Mission who has a buglary and cocaine-related rap sheet has been linked through a DNA-match of blood left at the Metro Office Building broken into on Christmas Eve. The suspect is still on the lam.

The Union Rescue Mission has a women's facility on Rosa Parks Boulevard near Garfield Street, so we have a number of homeless individuals who hang around the intersection of 7th Avenue North and Garfield and over on Rosa Parks near I-65. The 45-year-old suspect is Robert Osbourne and police have released the following photo:



If you see this man contact the police, because he likely has information as to the whereabouts of Election Commission laptops containing 337,000 Nashvillians' social security numbers.

Cyberirony: Metro Computer Security Chief Had Laptop Stolen from Car Last Week at the Height of Security Audit

Seriously, when are high level managers going to start being sacked for Metro Government security breaches? The failure occurred when an IT official who is in charge of computer security left his laptop in his car at his Franklin home and thieves broke in and stole it (video). That's right: the official in charge of security, the guy who is helping study how vulnerable Metro's computers could be, the person who probably makes recommendations to other departments on how to secure laptops had his unsecure laptop stolen!

I can't help but think back on all of the seeming distancing IT Director Sandy Cole did at the Jan. 3 Public Safety meeting between her department and unsecure computers elsewhere. This just reinforces my perception that there was some bureaucratic ass covering on the 3rd. And what of her explanation that IT employees take laptops home so they can be available 24 hours a day? Was the security official staying in his car in the driveway all night to be available? And finally, someone in the Mayor's Office needs to explain why no one was told about this event for an entire week; not even Council Members knew until the media asked them today. Why was it necessary to keep this story on the down-low? Did they think it would take the wind out of the Mayor's new initiative?

HT: VV

Election Commissioner Changes Course on Laptop Passwords

If we can believe it, good news comes from the Election Commission today. Back on January 3, Ray Barrett told the Council's Public Safety Committee that he did not know whether one of the MEC laptops stolen on Christmas Eve was one of the laptops that he reported as having passwords taped on the outside.

Today the Tennessean reports:

A password taped to a laptop stolen from the Davidson County Election Commission had been changed and could not be used to access voters’ Social Security numbers in the computer, a commission official said Tuesday ....

Barrett said that contrary to reports, a laptop left under a desk was inside a bag not visible to a thief and had an old password taped on top.

The reports I saw on the laptops were based on Mr. Barrett's own comments that I heard him give to the Council committee nearly two weeks ago.

Let's hope that this is the final word on the facts about the passwords and that we other shoes don't drop in the future. It seems fantastic at this point.