Watch CBS News

Expert warns of data security risks in Richmond's ID card program for undocumented residents

Security expert warns Richmond debit card program may have put target on immigrants' backs
Security expert warns Richmond debit card program may have put target on immigrants' backs 03:39

In 2014, the City of Richmond had what they thought was a good idea: issue identification and debit cards to undocumented residents to help them participate in the modern economy. 

But now, one digital security expert is warning that the city may have painted a big target on their backs.

When Richmond created its ID card for undocumented residents, it was only trying to help.  But Brian Hofer believes their good intentions simply aren't enough.

"Those people, their records are sitting there in a federal database that ICE can click a button and get to," he said.

Hofer is the founder of a data privacy group called Secure Justice. He said the problem with Richmond's system is that the ID cards, which display an address and photo just like a driver's license, also function as debit cards, which means under federal banking laws, all data must be kept for at least five years and are completely accessible by federal agencies, including ICE.

"Any data collected is data at risk," Hofer said. "We can pass all the sanctuary city laws we want to in the world. If the feds want to come in and get that data, they will."

And the worst part, to Hofer, is that the city isn't warning people about the risk when they sign up for the cards. At its March 4 meeting, he tried to raise the issue as the city council was deliberating whether to remove the $25 application fee for the program.

"We believe that applicants should be able to make the decision themselves as to the pros and cons of participating," he told the council. "But they haven't been fully informed."

But despite the warning Hofer was trying to give about the ICE risk when his two minutes were up he was cut off.

However, it appeared that some council members were also not aware of the data security issue and expressed their concerns.

"I don't think it makes sense for us to craft a way to vote on this, changing an ordinance to 'no cost,'" said councilmember Sue Wilson. "We need to scrap the whole program if we find out it can't be secure."

"I think the city has a duty to inform people who apply for a municipal ID what the implications are," said councilmember Soheila Bana.

"Having an ID card so you can identify yourself to the police or a school district, that's a good public policy," Hofer said later.  "But when you don't listen to data privacy people who say, 'hey wait, there's a problem here, the bad guys can also get access to your data,' that's where the disconnect is happening."

And Hofer's fears are not unfounded. During President Trump's first administration, ICE began using California DMV records to access photos and addresses of undocumented residents who got their driver's licenses under the state's AB 60 program.

"ICE was actually getting the AB 60 printouts about folks and showing up to their doorstep saying, 'Is this you?'" Hofer said.

The ID cards for Richmond -- and a similar program in Oakland -- are being administered by a private company called San Francisco Global.  

"I'm not accusing SF Global of doing anything wrong," Hofer said, "but in order for them to operate the program, they have to comply with state, local and federal laws.  And all those federal laws mean they have to retain the data for a certain period of time.  And no document from the City of Richmond warns anybody about that."

Richmond has reportedly removed the debit card function from its program, but the records of anyone who applied for one will remain in an accessible database for at least five years from the time of application.  

Hofer says there is no practical way to completely avoid data collection, but he said cities like Richmond need to embrace better encryption techniques and policies to delete data as soon as possible.  And most importantly, he said, people need to be aware of what they may be signing up for.

View CBS News In
CBS News App Open
Chrome Safari Continue
Be the first to know
Get browser notifications for breaking news, live events, and exclusive reporting.