DMVs in the U.S. are selling drivers’ information to private investigators | Hacker News Reader

DMVs in the U.S. are selling drivers’ information to private investigators

vice.com

130 pointsjonas2131 comments

Not surprised the data is being used for investigations, surprised it's being sold to private investigators. There's a big difference between bribing the person behind the service desk counter to do a license plate lookup, and actually just selling the data for profit.

Fastrak data is also for sale. I thought I remembered reading that someone used it to stalk their ex but I'm having trouble digging that up.

https://www.latimes.com/business/story/2019-08-12/toll-road-...

Nobody is buying these data directly from DMV offices except for a few gigantic brokers. The PI's, along with lots of other people, are buying it from the brokers.

The data includes "a nine-digit ZIP code, date of birth, phone number, and email address". That's just asking for identity fraud.

Those details are all public record. They are not exactly useful without more information

> Those details are all public record.

I don't know about the US, but in the EU this is PII, and therefore falls under GDPR.

Except this is an article regarding the USA so the gdpr is irrelevant.

Edit: downvote all you want but the us doesn't follow gdpr. The DMV doesn't serve Europe. Much of the world doesn't have to care about the gdpr. The information sold is all easily accessible from public records and a tiny bit of web scraping. Going back to the original point. It's not that easy to steal identities without actual private information

How other countries (in this case an ally) deal with an issue is relevant as it allows you to reflect and learn from it.

It's not relevant to the discussion. It's about DMVs in the US.

I don't believe we will reach consensus about the relevance of that. Hence I refrain from continuing this discussion with you.

I’m a bit surprised that this came as a surprise to a lot of people. In some states, like Florida, they don’t even need to pay very much for this data and it’s very open via the Voter database.

In Florida you can even get the exact DL# by following the formula and using the DMV website to verify the appended last digit. The last digit is just +1 based on how many people have the same name & year of birth as you.

Beware- I’m not entirely sure but changing a URL might be considered criminal “hacking”.

https://services.flhsmv.gov/DLCheck/

no 'hacking' required :o

Even better... https://services.flhsmv.gov/VirtualOffice/Welcome.aspx

Just need last name + DoB

Data in voter databases has a lot of restrictions on its usage.

Sure, I'll be sure to go tell that shadowy organization in SomeRandomCountry that they can't do X with it. The reality is, this data is published online freely for look up, they don't need to sign up for it themselves.

FYI this is governed by a federal law called the Driver's Privacy Protection Act

https://www.law.cornell.edu/uscode/text/18/2721

I have worked with the vendors who procure and sell these data. Happy to answer any questions.

The public should know the economics of how their privacy is sold online. What is the price of something like this? Are there any restrictions on use? Do you have an example data license agreement, etc? Do you have example of column definition / schema to understand the scope of data?

As I mentioned in reply to another comment, the restrictions on use are listed in section (b)Permissible Uses of the DPPA.

The price varies considerably depending upon what kind of data you're after (and setting aside volume discounts). Things like driver's license searches, vehicle searches, auto accidents, and moving violation history cost $0.50 to $2.00 if you're buying a la carte, but you're usually getting these data as part of a report costing $5.00 to $10.00. You can pull detailed driving records from about 18 different states at cost of anywhere between $7 and $25, depending on which state it is (these reports are a la carte only).

I don't have a license agreement I'm allowed to send you, but I can tell you that many government agencies around the country have contracts with these brokers, so if you know the name of the product/company selling the data then you can find some of the contracts online.

Except for those expensive reports, you never really know where the data you're looking at came from. I suppose I could run identical searches on people with the DPPA data flag turned on or off to compare but haven't had occasion to. You basically just get back whatever fields you request-- they might be populated with DPPA data and they might not. You never know and the broker's don't annotate the response with anything indicating the data's provenance.

How does one go about obtaining this info as a private entity?

1) Be a business and not an individual

2) Call a broker and tell them you want an account

3) Give a reason for wanting or needing the data that they approve of

4) Undergo an audit of your business and physical office

5) Complete paperwork saying you want access to the DPPA data and what your permissible use is

6) Profit

Thanks for this info. What kind of a broker? Is there a website for audit requirements?

Also, who are the vendors that sell this data?

I refer to the major vendors in the space as brokers because they re-sell data from sources you'd have a hard time negotiating with directly.

The big ones are mainly legal tech giants and credit agencies. TransUnion makes a product called TLO, LexisNexis makes one called Accurint. I forget the names of the other products, but WestLaw/Bloomberg and Experian have them too.

Thank you!

Any restrictions on use of such data? I know voter registration databases have tons of restrictions

Yeah. They are described in section (b)Permissible Uses in the link.

Interesting, thank you. It seems that the only permitted uses of this are for government-led investigations or to do things related to your car. Any other use without express consent of the individual is expressly prohibited.

That's not an accurate characterization of the permitted uses. Permitted uses 4, 5, and 6, for example, are all well beyond the scope of what you described.

I wouldn't be surprised if DMV employees walk into PI offices and do side deals (circumvent the official channel for a discount, and, for the money to flow to the employee directly).

If you ask nicely with a sob story you can get it for free.

(I was trying to track down my father's 69 mustang not stalk someone)

hasn't this been for years? I mean you pay online for this when searching of plate numbers.

Reply on news.ycombinator.com