I-Team Investigation Reveals Massive Security Breach In Dallas County
Follow CBSDFW.COM: Facebook | Twitter
DALLAS (CBS11 I-TEAM) - Your social security number--and your child's-- may have been exposed on a government website for more than decade. The CBS I-Team discovered A major security breach involving tens of thousands of North Texans. And, as shocking as the information being out there, is how long I-Team Senior Investigative Reporter Ginger Allen had to pressure Dallas County to fix the problem.
If you file a case in Dallas County Courts, your case documents are public information- accessible by anyone.
But the I-Team discovered some very private information in those files. In a matter of seconds, we found a Dallas' mom's child custody case…and her address, driver's license number, social security number…even, her child's social security number. The private information was all included in her court documents. It was needed for the court case.
But when the I-Team showed the mom all the information we had gathered out of her files by simply logging onto the Dallas County Court online records site, she was stunned.
"I'm upset. You have it and who else has it?" said Tiara.
She is so concerned about identity theft that she shreds her junk mail.
"This is the highest level. This is not some little company mom and pop shop. This is the government that has our information and it's out there for everyone else to get."
Another single mom filed for child support in 2011. The I-Team found her entire file as well as her address, driver's license number, and social security number.
"This is how you get credit, a job, my license as a nurse," Collette said stunned.
But she was more upset when we showed her that we also had gathered all that information from her file on her two young daughters. Again, we found in it all, in a matter of seconds, on the Dallas County online records site.
"I don't even know what to say when I see that," said Collette.
Why Was The Information Out There?
Ike Vanden Eykel heads one of the biggest family practice law firms in Texas.
"It's a reasonable conclusion on our part that the government is going to protect that information, " said Vanden Eykel studying the cases we printed.
"You've got full name, residence, address, social security number, drivers license, home phone...all in one paragraph."
Ike Vanden Eykel with Ginger Allen (CBS11)
Vanden Eykel says the state pushed electronic filing in the 90's rushing to rid courthouses of paper files. Then, he explained that Dallas County made those files available online for anyone to see. No password required. No protection provided.
"When you do something that quickly and that irrationally, you need to expect there are going to be breaches," said Vanden Eykel.
Some attorneys, like Vanden Eykel, who specialize in divorce and family court cases, say they knew they had to protect their client's sensitive information so they removed the private data before filing their cases.
But not all attorneys did.
How Many North Texans Are Exposed?
By Dallas County's own admission, tens of thousands of North Texans were exposed according to Dallas County District Clerk Felicia Pitre.
The I-Team first contacted the courts about the breach in August 2015. Pitre agreed to an interview about it in October. She told the I-Team her first thought was to shut the online records system down immediately. She is the only person with the authority to do that.
She told us, "I wouldn't want my child's information on line. It would cause me grave concern."
But then Pitre later told the I-Team she realized how much attorneys rely on the online files and how taking them away would clog the courts causing an unbearable backlog.
Why CBS 11 Held The Story
As a news organization, CBS 11 decided to the hold the story until she could fix the problem. We did not want to point identity thieves to the sensitive information of tens of thousands of North Texans who could be put at risk.
Pitre told us, "It's an issue. I am concerned."
But then, weeks turned to months and the information remained out there on line. So, we went back to the District Clerk repeatedly. She said she was working on a fix. By November, we began asking some of the County Commissioners about the issue. We reached out the Court Administrator Daryl Martin. Each official said he or she was very concerned about the information being out there, but no one had the power to shut the system down and take it off line except Felicia Pitre.
I-Team Goes To The Supreme Court
So, the I-Team took the issue to Austin - the Supreme Court of Texas in late November.
"I think we all, every day, need to be concerned that we are putting the public's information at risk, " responded David Slayton, Court Administrator of the Supreme Court of Texas.
"So you want the public to know that you and the Supreme Court have stepped in and are trying to fix this?" asked I-Team Investigator Ginger Allen.
"Absolutely! The Supreme Court has been looking at this for over a decade," said Slayton explaining that this was a concern of the Justices when e-filing was mandated and counties began making the information available on line.
Slayton explained that he had consulted the Justices prior to our visit. Speaking on the Chief Justice's behalf, Slayton told us, "We'll continue (to look into this) until the day we're sure this information is not out there."
But Slayton also repeatedly explained that the Supreme Court did not have the power to remove the information from the Dallas County website. Again, he reiterated what so many county officials had told the I-Team— the cases could only be taken off line by the District Clerk.
"It's certainly a risk to the public and the individuals whose information is in those records," said Slayton.
Dallas County Family Court records (CBS11)
Dallas County Commissioners Agree To A Fix
But back in Dallas, in early December, just one day after our visit the Supreme Court, the I-Team learned the Dallas County Court Administrator Daryl Martin deemed this an emergency situation.
District Clerk Felicia Pitre sent the County Commissioners a briefing saying the "sensitive data was inappropriately" included in the Family Court records on line.
She asked the commissioners to approve a contract with I-Docket, a company which could remove the sensitive data from the court files. The briefing states the "District Clerk anticipates that the records will be fully available to the public via I-Docket by December 11, 2015.
Nothing Happens - Sensitive Data Remains Accessible To Anyone
Again, as a news organization, CBS 11 decided to hold the story. While we wanted to alert the tens of thousands of North Texans who had sensitive information so easily accessible, we did not want to alert potential identity thieves.
But again, we waited another two months questioning the court, county commissioners, the court administrator, and county judges. We repeatedly reached out to the District CLERK and the Supreme Court by email trying to find out why it was taking so long.
I-Team Emails County Judge
By the end of January, Ginger Allen wrote County Judge Clay Jenkins. While his office returned the call, she never heard directly from him.
However, a week after emailing Jenkins, Court Administrator Daryl Martin told Allen he was holding a meeting to get answers. He explained that I-Docket had successfully removed all of the social security numbers.
Six Months Later - Security Breach Finally Closed
By early February, six months after our investigation began, the Dallas County online records search was removed from the county website. A new link now directs the public to I-Docket, a site which requires your personal information and a fee to access the documents which are now social security number-free. In a paragraph above the link to the new records search, a paragraph states the courts changed the system because of "the growing public concern over identity theft."
The I-Team repeatedly asked county officials to explain why this process, which put so many North Texans at risk for so long, took so long. No one would comment on camera. Many of them repeatedly told us that Felicia Pitre was an elected official and they did not want to respond.
The I-Team returned to visit Attorney Ike Vanden Eykel after the site was fixed. Attorneys from his office had been part of a committee from the legal community which had been working to fix this site also.
Ginger Allen asked, "Is there any excuse for why this took so long?"
"There is no rational or logical reason for this to have taken six months," he said repeatedly saying the word 'shocked' was an understatement.
"Six days would have been way too long."
This all raises many questions about how long your information may have been out there.
One North Texas mother who filed for child support in 2005 told the I-Team she recently had her identity stolen. She wonders if this is why,
"They are supposed to protect us and they are giving our information to the thieves," said Cherlyn.
Why You May Still Need To Contact The Courts
If you have a child custody, paternity, child support, or divorce case that was filed in the Dallas County courts from 2000-2015, you should log on and review your files to make sure that your sensitive data has been removed. The District Clerk told the I-team that those of you who filed cases between 2009 and 2015 should be the most concerned.
If you find personal data in your file, you should contact Dallas County courts immediately to have that information redacted.
To search your records, go to Dallas County Records Online.
http://www.dallascounty.org/applications/english/record-search/rec-search_disclaimer.php
For questions related to District Courts Case Information, you can contact DC-Inquiry@dallascounty.org.
For questions related to County Courts Case Information,you can contact CC-Inquiry@dallascounty.org.
For a Redaction Request, go to
http://www.dallascounty.org/department/districtclerk/forms/SSN_redaction_form_2015_rev111715.pdf
(©2016 CBS Local Media, a division of CBS Radio Inc. All Rights Reserved. This material may not be published, broadcast, rewritten, or redistributed.)