Oklahoma Leaks Tens of Thousands of Social Security Numbers, Other Sensitive Data

2008-04-15

Maybe Oklahoma should start an online registry of the idiot developers who put this system together, and the managers who let them.

Erick · 2008-04-15

When a corporation does this, they take a huge hit in the form of lawsuits, stock drops, and lost business. When the government does it, it's a big brouhaha news story, maybe one person gets fired, and then it's back to business as usual.

ParkinT · 2008-04-15

anon:
Wow, and I live in Oklahoma... thankfully I've never had a reason to be registered in such a database, but still... makes me wonder what else my great state may be doing in the realm of WTF.

April 12, I added your name to the list with a properly formed URL.

elias · 2008-04-15

EPE:
Please, do not go to "Advanced Search" at Goolge, and do not look for pages containing SELECT FROM WHERE in the URL... Please, do not do it, oh please!

Thanks. I pressed your "Do Not Press" button, and now my faith in humanity is at an all-time low.

Alex Papadimoulis · 2008-04-15

MadJo@Work:
Euhm, Alex, the blurring of the email addresses in that last picture doesn't really work, I can figure almost all of them out. Might want to use a black pen next time instead of blurring. The Social Security numbers are blurred a bit better, but still it would be better still to use a black pen in whatever photo editing program you are using,

I'd be very impressed if someone managed to unblur the numbers from the first image. Of course, they'd just learn that not all obscured things have useful data behind them (such as that pdf from Not Too Particular), but I bet it'd be a fun exercise.

And yes, I suppose I could have blurred the emails a bit better. Then again, just about all of them are in the DOC's office directory or the various sherrif departments' contact pages. I guess I'll go blur those y#######om addresses... because, you know, random y#######om addresses are so hard to find, and there's so much damage one can do knowing one.

2008-04-15

I "have personal knowledge" of the I.T. department at Oklahoma DOC. The guy that wrote their Sex Offender Registry system was a contractor. He was with a company that no longer exists. He was NOT a competent programmer.

The administration at DOC has not supported the I.T. department in many years. They play the blame game, and usually get away with it. George Floyd probably didn't report the FIRST phone call to the idiot he works for. That will give them an excuse to use Mr Floyd as a scapegoat. Agency Director Justin Jones has seen the I.T. department as a personal enemy for a long time - not realizing that he is blaming the wrong people for the problems there.

The I.T. staff at Oklahoma DOC are not the villains here. The fault lies with Directors and Deputy Directors.....

BTW, have a look at this link: http://www.okhouse.gov/Documents/OKRVSDFinalReport080103.pdf

Have a look at the part on Information Technology. (page 231 on...)

2008-04-15

Looks like they need this consultant quick!

Oklahoma DCS Central Purchasing Division Status: Open Bid Number: 1310002506 Description: Department of Corrections is soliciting proposals from vendors to provide consultant services to assist DOC in determining requirements, direction, and the acquisition of a new offender management system.
Buyer: Liza Hanke

Find on http://www.dcs.state.ok.us/Solicitations.nsf, or direct link

dmitriy · 2008-04-15

From the article:

... names, addresses, and social security numbers of tens of thousands of Oklahoma residents were made available to the general public for a period of at least three years.

This appears to me to be the worst part of this story.

2008-04-16

http://newsok.com/article/3230675/1208345421

The bloggers used certain search parameters to troll for the information.

captcha: validus

Certainly not...

2008-05-12

I recieved notification about this breach of security today. Just today. Though the form letter is dated April 18, 2008; it is post marked 05/09/2008.

This notification gives the politically correct version of your statement. They are pretty sure a breach happened, that I was included in it and then the definitions and law concerning such an event.

It never says by whom, for what purpose. Who was negligent, what was to be done about it and how that information was presented at that time.

You see, I fall into a rather unique category, whereby my crime does NOT fall into the category of requiring you to register as a sex offender. HOwever, the written words on my records appear to indicate that I should and during the suspended part of my sentence I was actually required to register. After eight months of being registered as a sex offender and fighting the status legally to no avail, I voluntarily returned to serve my remaining time and was released without the registration requirement.

I have since been arrested by local authorities for failure to register (without incident but due to a 'sweep' of an area of town I live in)and that charge was dismissed after waiting 54 days in jail for that determination.

So now I get this vague notice that someone who was not supposed to, got some information that was not supposed to be made public and did what with it I don't know.

I have had a hard enough time dealing with the public information that is misleading, yet publicly available. I can only imagine what could be taking place with information that was legally supposed to have been protected.

2008-05-12

I am on the Oklahoma registry, and got this in the mail today (May 12) from the Oklahoma DOC:

April 18, 2008 NOTICE According to Oklahoma law, a state agency owning computerized data that contains personal information must inform any Oklahoma resident when there is reasonable basis to believe that such personal information may have been acquired by an unauthorized person. The Oklahoma Department of Corrections has a reasonable basis to believe that your personal information may have been acquired by an unauthorized person on or about April 10, 2008.

The law defines "breach of the security of the “System” as unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the state agency, board, commission or other unit or subdivision of state government.

"Personal information" means the first name or first initial and last name of an individual in combination with any one or more of the following data elements: social security number, driver license number, or account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to the financial account of an individual.

This notice is provided in compliance with 74 O.S. § 3 113. 1. Please be advised that the agency is working diligently to prevent further security breaches. If you have questions, please go to www.doc.state.ok.us and access the appropriate link.

They're "working diligently" to prevent further security breaches... gee, I feel safer already :rolleyes:

Oklahoma Leaks Tens of Thousands of Social Security Numbers, Other Sensitive Data

Featured Comments