Hacker News Reader

The gov is absolutely responsible. They chose the vendors, they implicitly (or explicitly) approved their storage policies. The time range for these 'temporarily stored files' was Jan 1 to Dec 10 2020, aka a whole year.

Yes, but it's not sufficient to stop there. We need to ask the five whys -- why did this vendor get chosen? Why were the criteria developed that led to this vendor selection? etc. etc.

Yes, they are responsible to their users, but I'm going to guess that they have been put into a tough situation to modernize and increase in scale while also dramatically reducing budgets.

We can never give the government a pass because of one of their vendors. Allowed to continue, this provides for an easy circumvention of the constitution and due process.

> Don't they bear some responsibility for choosing a crappy 3rd party service?

Reminds me of this Mitchell & Webb sketch about identity theft: https://www.youtube.com/watch?v=CS9ptA3Ya9E

Weirdly even with no legal recourse/repercussions for the abuse/misuse of personal information, people still love shifting blame for it, whether to their contractual partners or even users themselves. Almost like they know what they did was wrong.

The blame thing is largely down to the fact the unemployment office in WA is already under massive scrutiny for paying out almost a billion dollars in fraudulent claims last year.

https://www.seattletimes.com/seattle-news/state-auditor-weak...

(Article mentions $600 million but there have been more claims found since then).

how many hundreds of millions do we need to lose before we elect competent auditors?

Yes they’re absolutely responsible. It’s not the job of affected citizens to police the choices of this agency or account for such risks. They can reasonably expect competence and safe handling of their private information, and the consequences of third party choices should be borne by the agency who hired them. They are also free to pursue action against that third party but it is ultimately their problem to own. Unfortunately that may not help anyone if the third party just folds and declares bankruptcy when they face lawsuits.

All government contracts that outsource a service with private data to a third party should have an absolute requirement that the data itself is not to be shared without approval and that it had to be necessary for the service's functionality to do that sharing and that the data access logs must be under the direct control and review of a government auditor.

I know why this isn't how it's done: because those third party contractors are selling your data and that's how they get the low bid for those contacts.

many (probably most) of the government services in CA require some information leakage to google, at the very least via captcha, but often via search integration, sometimes analytics, occasionally via google forms/sheets/firebase/cloud as the backend. it's infuriating. we should not be subject to google for any gov services, period.

I also live in Kitsap and I'm curious what privacy issues you ran into? I'd normally try to use John/Jane Doe info for this type of thing but it sounds like they were requiring ID. Were you able to find a workaround?

I also live in Kitsap, am privacy-conscious and personally curious

The privacy issue was that the 3rd party that provided the ferry reservation system (https://www.kitsaptransit.com/fast-ferry-reservations -- temporarily suspended) had a privacy policy allowing them to sell/share/give any information entered into the reservation system with any other 3rd party for any reason (marketing, advertising, analytics, whatever). I would link the privacy policy but their reservation system is no longer active due to COVID I guess?

I looked it up in my email and I also found that later on they switched to requiring a social media (facebook, google, something else?) account in order to reserve a spot on the taxpayer funded, government-run ferry. I actually quoted part of the privacy policy in my (unanswered) email to kitsap transit:

Sharing Information

We may disclose information collected from and about you as follows;

    ...
    With our marketing partners, advertisers, or other third parties who may send you information about their own products and;
    ...

Contacting the company pretty much never works, but I've found contacting my representative to be quite effective. They have much more weight when they then contact the company.

  later on they switched to requiring a social media

This is outrageous. Contact is in my profile. If enough people complain to our reps maybe we can impact this in a positive way.

>I ran into the same thing with the Kitsap County (also WA) passenger only ferry service ticketing system.

Is there an international border there or something? Do you need to provide all sorts of information just to pay cash at the terminal(s)?

> Is there an international border there or something?

I don't think so? I think that one goes to Seattle from a couple spots in Kitsap County.

No. The system when originally started had more people than seats so they had an online reservation system. You had to reserve to get a seat, but you didn't have to actually pay to reserve (until some point later?). There is some info about it here but I guess they temporarily stopped doing reservations: https://www.kitsaptransit.com/fast-ferry-reservations

If I recall you had to provide name, address, phone number, and email address.

you and other citizens are being tracked via "public" transport. USA railways have done this for decades. It is a revolving door to law enforcement and commercial use of that data.