Honolulu Corporation Counsel Donna Leong, the city’s chief legal adviser, emailed Kokua Line about the data failure affecting Hawaii driver’s licensing systems, after reading that vendor Marquis ID Systems had declined to answer specific questions despite our being referred to MIDS by the city (808ne.ws/328kline).
The personal records of about 66,500 Hawaii residents have been irrecoverable since a MIDS computer server crashed on Sept. 15, corrupting scans of documents they had submitted when applying for a driver’s license or state ID. The city and MIDS held a joint news conference March 22 to publicly disclose the problem, emphasizing that no security breach occurred. MIDS also said backup systems have been improved.
“The city has been working diligently with MIDS to fully understand what happened; those discussions are continuing because of the complexity of the situation,” Leong said in Thursday’s email. “In response to some of the questions that the city asked MIDS to respond to, as it has the first-hand knowledge, we would like to share the following information”:
Question: MIDS’ statement said that it was “quickly determined” that no security or data breach occurred. … On what date was it determined that no security or data breach occurred? And how was that determined?
Answer: “The city is unable to provide you with a specific date; however, MIDS has confirmed to the city that, within days of the September 15, 2017, server crash, it determined that there was no security or data breach as it was purely a hardware failure. MIDS has since undertaken further investigation and has confirmed to the city that the disks containing the data were encrypted, have remained in MIDS’s possession in a secure location, and were not exposed.”
Q: How can the vendor and the city be sure that Hawaii residents’ sensitive personal information was not exposed?
A: “The city cannot say exactly what technical steps were taken by MIDS to confirm that the data was not exposed. However, Gemalto (which owns Marquis ID Systems) has confirmed to the city that the data on the disk was encrypted and remained in MIDS’s possession in a secure location.”
Q: On what date did MIDS determine that some data was unrecoverable?
A: “As MIDS advised in its media statements, after MIDS brought its system back up after the September 15, 2017, crash, its technicians discovered afterward that a portion of fingerprint scans and identity records were unrecoverable. In October, MIDS informed the city that the system had been restored and was fully operational. It appears that, after the crash, MIDS thought the data had been restored when, in fact, some of it had not been recovered. The city does not know the date on which MIDS determined that some data was unrecoverable.”
Q: Why did the server fail? This was asked at the March 22 news conference but not answered.
A: “This is a very technical question and as the disks belong to MIDS, the city is unable to answer the question.”
Q: Does the vendor/city know the identities of the 66,500 affected individuals?
A: “Given the number of possible individuals affected, MIDS and the city continue the discussions to confirm the number and names of the affected individuals.” (As previously reported, the data failure does not affect the validity of any current driver’s license or state ID. No one needs to contact the DMV to see whether they are affected. Once the identities of affected people are confirmed, those individuals will receive a notice explaining the problem and instructing them what to do.)
Write to Kokua Line at Honolulu Star-Advertiser, 7 Waterfront Plaza, Suite 210, 500 Ala Moana Blvd., Honolulu 96813; call 529-4773; fax 529-4750; or email kokualine@staradvertiser.com.
