Arizona DMV Sells Drivers' Photos and SSNs to Private Investigators | Hacker News Reader

Arizona DMV Sells Drivers' Photos and SSNs to Private Investigators

vice.com

>But as multiple private investigators explained to Motherboard, the reasons investigators can give to DMVs in order to access data can be overbroad and open to abuse.

So, what do we do then? Create laws to fix the possible abuse or create laws to prohibit the selling of this information in the first place? Why was this allowed originally?

>"This is a revenue generating contract"

It is disgusting to me that they would be willing to forfeit privacy for money, but in today's game, I fully expect it at this point.

Edit: clarity.

This is a byproduct of trying to run governments more like businesses. A government's primary responsibility shouldn't be to make money, but the idea of lower taxes is attractive to so many in our current political environment, even if it means sacrificing basic rights to privacy like this.

If we think about citizens as shareholders of a government, we as citizens don't possess the same feedback loop that corporations do via the markets. Every stock purchase is a vote of confidence in a company to a degree, insofar as one buys a stock with the hope that it will increase in value. Unfortunately, the public doesn't have a fast feedback loop like this, and a lot of these decisions are made under the assumption that public either won't ever find out about it, or they'll be distracted by other issues.

The feedback loop for government is supposed to be voting, but that’s really slow and the politicians have gotten so good at distracting people during campaigns, nobody seems to be paying attention to the things they are actually doing when in office.

Governments only need a check of approval from the masses, businesses need people willing to pay for their product... Two incredibly different things

The problem is that the metrics are wrong... government organizations should be run like businesses, but the ways in which people are measured and rewarded should not be profitability, but impact. Businesses that are run to maximize revenue seldom do it... instead they make bad short term decisions. Businesses that use metrics like engagement and satisfaction as maximization criterion, inevitably maximize revenue as a side-effect. The same should be applied to government -- even more so.

Preach.

Peter Drucker, in the 90s, encouraged businesses to emulate non-profit organizations. He was popularizing case studies which showed some of the most effective, efficient orgs in the world were non-profits.

From wiki:

"The importance of the nonprofit sector,[35] which he calls the third sector (private sector and the Government sector being the first two). Non-Government Organizations (NGOs) play crucial roles in the economies of countries around the world."

https://en.wikipedia.org/wiki/Peter_Drucker#Key_ideas

I like your use of "metrics". I usually frame market design in terms of "incentives", but I might adopt your frame.

Price discovery and surplus (profit) are not the only possible metrics. Markets can, and have been, designed to optimize pretty much every other conceivable goal as well.

But the thrall of corporatism (aka Freedom Markets™) keeps those alternatives out of public discourse. Anything not optimized for surplus (profit) is dismissed with pejoratives like socialism.

> government organizations should be run like businesses, but the ways in which people are measured and rewarded should not be profitability, but impact.

"Impact" can't be tied too strongly to number of people affected because one of the things governments do is take on jobs which must be done but which are unprofitable because too few people need them done to make it into a market. This should be obvious, but it's also obvious that "number of people" is a really easy thing to measure, so, like the drunk looking for her car keys under the streetlight because the light is better, all organizations tend to build metrics on top of the data that's easiest to get at.

This makes sense in some cases, but there are several functions of government that are fundamentally money-losing prospects that wouldn't change when optimizing for impact. I agree that the metrics around government efficacy can be improved, but arguing that increasing impact will always or almost always lead to profitability isn't feasible in many government cases. The fear I have with such an approach is that if governments indirectly promise profitability via maximizing impact and they fail, then you still have the same problem you started with.

A perfect example of a project that will only ever lose money but is very important to the public is the Hanford Nuclear site[0]. The US government discovered recently that the nuclear waste site was leaking radioactive chemicals and threatening to taint the Columbia River water supply, which millions depend on. Cleaning up the radioactive waste will cost tens to hundreds of billions, and the best possible outcome is that everyone still gets clean drinking water. That should be the most desirable outcome, but even if successful, the government won't generate a profit from it, nor should they. Utilities shouldn't be priced to be profitable, they should be priced to be sustaining and accessible to those who need them.

0: https://en.wikipedia.org/wiki/Hanford_Site

Yes. There should be metrics around how effectively such a disaster is cleaned up. Profitability is not the only thing that is a metric -- as I stated in my original post.

Impact of what metric though? If one of the metrics they are trying to maximize is something like "Number of fugitives making their court date" then they are still going to make private data available for bounty hunters and their affiliates.

One of the interesting things about the church I grew up with is that the church constitution strictly limited how you can ask for money for the church fund - only once per week at the first Sunday service. This was obviously very limiting, but strictly defining what cash flows were acceptable also (in my eyes) helped prevent a lot of the greed and prosperity focus that infects many other churches.

I can’t help but wonder whether authors of constitutions would see benefit to strictly defining what income flows are acceptable. The founding fathers in the US took a few steps in this direction by strictly* defining what kinds of federal taxes were acceptable, but didn't really go beyond that.

*Maybe too strictly - economists generally agree that apportioning all your taxes is a bad idea because it can be pretty regressive, and we needed amendments to get around that for income tax.

State of RI has an oddly worded question near Section G:

http://www.dmv.ri.gov/documents/forms/license/License%20App%...

> EXCEPT AS AUTHORIZED BY LAW, THE DMV WILL NOT DISCLOSE PERSONAL INFORMATION WITHOUT YOUR CONSENT

> DO YOU CONSENT TO SUCH DISCLOSURE [ ] YES [ ] NO

It's pretty easy to just blindly check off yes and then sign it. It's my understanding that answering yes to that question permits them to sell license information.

Government databases should be free for the public to access or restricted only to government entities. Selling to limited classes of private buyers is incredibly shady.

The original argument for needing to charge for this data was made in the era of Xerox machines and faxes where you literally were paying someone to flip through a filing cabinet and make photocopies or run it through a fax machine. It's why we see like a crazy per page cost and other nonsense - those things make sense when you are literally printing a copy.

But in the digital era? The price of duplicating a pdf or a textfile is a few processor cycles and a spot of ram. If you really need to charge for it, charge a few dollars a year as a flat subscription across all systems. Or alternatively, allow someone like the Internet Archive to make it available on their dime.

There are legitimate cases for approved release to private citizens. For example, the standard for public health cancer research is getting records from state registries.

Of course, in those situations, the requirement is that no personal identifiers will be leaked, and it's for the public good.

Right but if the records are anonymized, then why can't the public view them. The research is going to be published anyway and then that sample will be public anyway.

They are not anonymized. We may not always give out things like contact information or fields specifically for joining to other datasets, but we assume the provided data is enough to reasonably identify patients. Age, city, date of diagnosis, race (which can be specific nations for Asian and Pacific Islanders), and the fact they have cancer can be very good clues. If the requestor knows somebody with cancer, it wouldn't be hard to learn other things about them by looking up their record.

It isn't hard to become a P.I. so maybe some of us should become a P.I. and start requesting data on lawmakers, then send petitions to their home address. I believe that would be legal.

The government inserts catch-all clauses in the terms of those licenses for exactly that kind of eventuality.

>and start requesting data on lawmakers

You think that they won't have a carve out for themselves? Privacy for me, but not for thee.

Rich people don’t put their home address on their ID. In the same way their home is not in their name.

In some states it is very hard, such as CA. You need to apprentice. So if it ever comes up on the ballot, reject stupid license requirements.

You can often get this information from publicly available voter registration data as well.

DMV information isn't opt-in. It's a forced by-product of licensing requirements to legally drive on the road. Most people wouldn't want to give any information if given a choice but the laws of states for registering and driving requires it.

That information is not the property of any DMV.

It definitely makes it seem farcical to see our representatives crucifying Facebook for selling browsing data when states are apparently selling everything you would need to actually damage someone financially, and not just hypothetically. With an ID and a SSN, you can quickly get down to business with a lot of different types of transactions, and gain lateral access to accounts from there.

As a AZ resident, this is insane. Calling my state Senator and Rep today to ask why this is allowed. Will update if they actually respond (not likely).

AZ is ridiculously anti-ordinary person in its laws and structure. Rental laws are tilted completely in favor of the landlord, employment entirely in favor of the employer, etc. Your small comfort is that AZ driver's licenses don't expire until you turn 65 so your DL photo will be increasingly out of date as time passes.

It's been run by the GOP as a retirement destination for the last few decades. Go figure.

This happens in nearly all states. Every time I transfer a car title I'll get inundated with "your warranty is expired" physical mail spam, voicemails and text.

https://www.caranddriver.com/features/a32035408/dmv-selling-...

Government data should not be monetized.

I think we need to re-evaluate what governments consider 'public' data.

Arizona DMV selling records is wrong (and a massive privacy invasion) but it is the least of your worries.

Quoting a recent HN post - At the time of his arrest Ngo (the bad guy/haxor) was averaging 160,000 monthly queries (aka fullz) to Experian with no questions asked.

See Part I and II of 'Confessions of an ID Theft Kingpin' to see how easy it was to submit a 'I am a Private Investigator, I Pinky Swear' application that ultimately he (Ngo) pivoted to full Experian database access.

[1] https://news.ycombinator.com/item?id=24285784 [2] https://news.ycombinator.com/item?id=24295501

Driving without a license in Arizona is usually just a $120 fine, but it can be up to $750 and have up to 4 months in jail, so just skipping the driver's license is probably not a good way to protect your information.

For those in other states that sell this information, driving without a license might be more viable.

In my state, Washington, for example driving without a license is a misdemeanor carrying a fine of up to $1000 and up to 90 days in jail, but if you have another form of acceptable ID on you when stopped it is instead just a traffic infraction with just a $250 fine. A passport works as acceptable ID.

Here's a site with the driving without a license laws for all the states [1], although I'm not sure it is accurate. For Arizona it mentions that usual $120 fine, and mentions that things like driving on a suspended license can be a class 1 misdemeanor, but doesn't say anything about class 2 misdemeanors. A couple Arizona traffic law firm sites I found, though, say that simple driving without a license can be a class 2 misdemeanor.

[1] https://www.drivinglaws.org/topics/driving-without-a-license

Some states even sell their driver database to foreign companies operating toll roads.

I would guess you could put a stop to this by purchasing, then publishing the SSN for all of the high level Arizona government officials on a pastebin.

The SSNs may be new, but the photographs are not.

When I worked in television news, we would pull people's drivers' license photos all the time. In the states where I worked, they were considered public documents.

This is typically done via a Freedom of Information request, for your license data, much or all of which is a Public Record. It's not nefarious on the part of the government, it's one of the checks and balances placed upon our government. The PIs, however...

Private businesses must give a privacy notice with a way to opt out from information sharing. Is this not a requirement for a DMV?

Edit: I have seen this in banks and credit card issuers. Maybe it's just banking requirement?

Didn't Vice run this same story, but for California a month ago?

yes: https://news.ycombinator.com/item?id=24210623

In Europe this is not a problem. The GDPR would forbid usage of the data for a different purpose than for which it is collected, you simply would have no legal basis for this.

I am aware of a UK police officer that sold data from the registry to PIs and he got sentenced to several years and jail and lost his job. This sort of thing should never be institutionalized.

My first question here:

Why is the DMV in possession of nuclear-powered attack sub's, and for what and why do Private Investigators need those?

Lots of retirees in Arizona, so presumably they're hunting boomers.

Oh ok, that partially answers my question but then, why Arizona and not Ohio?

AZ is ridiculously anti-ordinary person in its laws and structure. Rental laws are tilted completely in favor of the landlord, employment entirely in favor of the employer, etc.

I'm sorry it was a "Insider"-Joke about SSN's, Boomer is another name for SSBN's (The ballistic rocket Carrier of Sub's) and one class of those SSBN's is the Ohio Class.

But still thanks for the explanation, did not know that.

Some states have privatized their distribution of drivers licenses. Can you be surprised this is happening? Even the People’s Republic of California is profiting off selling this data and it is of course a state owned operation.

Privacy doesn't exist: see http://dev.ti.com/tirex/explore/node?node=AB64dFbicd2BPc23jv...

The minute there was technology available that allowed people to see and hear through walls privacy died. It now costs less than $5,000 and if you have the right antenna you can see inside of homes from long distance and listen to people's diaphragms which allow you to listen to their inner-thoughts.

The default demo software for that particular device is to allow for listening to heartbeats but with the right modifications listening to the human diaphragm is just a matter of effort. There are people at several universities working on these kinds of imaging projects using mmwave right now even though the technology to do this has been available for over fifty years.

Your otherwise reasonable comment is tainted by the outlandish claim about inner thoughts, unsupported by the link. Typo?

>The minute there was technology available that allowed people to see and hear through walls privacy died.

JFYI:

https://en.wikipedia.org/wiki/The_Dead_Past

"Happy goldfish bowl to you, to me, to everyone, and ..."

Reply on news.ycombinator.com