Kokua Line readers had something to do with the city’s revelation — belated as it was — that the highly sensitive personal records of more than 100,000 Hawaii residents were corrupted in a computer failure in September.
At a news conference Thursday, the city and its vendor, Marquis ID Systems, flatly asserted that there was no security breach and portrayed the problem as an inconvenience, particularly for a subset of people who will have to resubmit documents the next time they
apply for a Hawaii driver’s
license or state ID. They glossed over questions about why the server failed — a server containing scanned copies of people’s birth certificates, Social
Security cards, fingerprints and other information prized by identity thieves — and didn’t say how they knew no hack occurred. The city and its vendor must provide those details and more. Before we get to that, some background:
The REAL ID Act is a federal law that imposes strict requirements on states’ issuance of driver’s licenses and IDs if those credentials are to be accepted for certain federal purposes, such as boarding commercial aircraft. The post-9/11 law aims to deter terrorists from getting fake IDs and has been controversial since before its 2005 passage.
Critics decry it as a privacy-invading national ID program that burdens states lacking the money and technical expertise to safeguard the sensitive data people must submit. Full enforcement has been delayed for years and is now set for
October 2020.
Hawaii is among about
30 states already in compliance. However, unlike all but one of the others, Hawaii did not initially include a “gold star” on its compliant credential. That changed in
January, and is when the Kokua Line readers come in.
Once the “gold star” ID became available, the city said that people who had
already met all REAL ID requirements and wanted to exchange their current license or state ID for one with a gold star could do so without bringing in all their documents again or being fingerprinted or photographed anew. It was a streamlined process akin to getting a duplicate, and it worked that way for many people — but not for all.
Kokua Line heard from folks who waited in long lines at the driver’s licensing office, only to be told that their files couldn’t be retrieved, that they’d have to submit new fingerprints, take a new photograph, bring back their birth
certificate. Individual experiences varied, but all these readers wanted to know what was going on.
We sent detailed questions to the city Feb. 8 and received a promise the same day that answers would be forthcoming. They never arrived. We followed up
March 2, again by email,
and received no response.
Then came Thursday’s news conference, at which the city and its vendor disclosed that a Hawaii-based Marquis ID Systems server containing multiple hard disks had crashed Sept. 15; that the Indiana-based backup system was so flawed that it did not save scanned files; that the city was informed of the failure at the time but didn’t comprehend its magnitude; and that the city’s Department
of Customer Services, which oversees driver’s licensing and state IDs, found out from Marquis on Feb. 12
that tens of thousands
of corrupted files could not be recovered. (DCS had sought that information
because Kokua Line and
others were asking, a city spokesman confirmed.)
Marquis ID Systems said records of 66,500 people were irretrievable as of Thursday, down from more than 102,000 originally affected. The company emphasized that all data remains in its possession, encrypted and unreadable.
Still, vague responses at the news conference raise more questions. We emailed the city and the vendor Thursday evening, but as of Sunday noon had received no reply. Here are some of the questions we’re following up on:
Why did the server fail? How is the vendor sure it was not hacked? Marquis ID Systems said it was determined “quickly” after the Sept. 15 server crash that no hack occurred, while the city said it was determined “fairly quickly.” On what date was the vendor certain there was no security breach?
At the news conference,
a Marquis executive said he didn’t know why the server failed, begging off with, “I’m not a technical expert.”
No city official responded,
either.
A full public explanation, however technical, is necessary — and overdue.
Write to Kokua Line at Honolulu Star-Advertiser, 7 Waterfront Plaza, Suite 210, 500 Ala Moana Blvd., Honolulu 96813; call 529-4773; fax 529-4750; or email kokualine@staradvertiser.com.