Kokua Line continues to seek details about the computer failure affecting Hawaii residents who applied for a driver’s license or state ID between Feb. 25 and Sept. 15, 2017, the date a server and backup system managed by Marquis ID Systems failed. The city referred many of our questions to MIDS, the vendor, which refused to answer most of them.
Question: Marquis ID Systems has said there was no breach of Hawaii residents’ personal information. On what date was it determined that no security or data breach occurred? And how was that determined?
Answer: Andrew Pereira, a spokesman for Honolulu Mayor Kirk Caldwell, referred these questions to Tauri Cox, a spokeswoman for Gemalto, the global digital security company that owns Marquis ID Systems, having acquired it in 2014. Cox declined to answer the questions, instead providing a statement, dated Tuesday, nearly identical to one the company had issued Thursday. “I realize that our statement doesn’t cover all of the questions asked, but unfortunately, that is the only information we can give at this time,” she said.
Q: How can the vendor and the city be sure that Hawaii residents’ sensitive personal information was not exposed? Please be more specific in your description of the evidence that no security/data breach occurred, even if the explanation is technical.
A: Pereira referred the question to Cox, who declined to answer.
Q: On what date did MIDS determine that some data was unrecoverable?
A: Pereira referred the question to Cox, who declined to answer.
Q: On what date did MIDS notify the city that some data was unrecoverable? Which agency was notified?
A: Pereira said the city Department of Customer Services was “officially notified that data was unrecoverable on Feb. 14, 2018.” The data includes scanned copies of birth certificates, Social Security cards, photographs and fingerprints. The irretrievable files belong to 66,500 Hawaii residents who applied for driver’s permits, licenses or state IDs from Feb. 25 to Sept. 15, 2017.
Q: Can or will the city’s contract with MIDS be canceled?
A: The city isn’t thinking about that now. “At this time, we are focusing on working with MIDS on an action plan that will inform customers about what they need to bring, and when, if they want” a duplicate driver’s license or ID with a gold star, the standard mark of REAL ID compliance, said Pereira. Cox did not respond.
Q: Does the city have any financial recourse against MIDS to compensate for this failure?
A: “We are working with MIDS on an action plan that includes MIDS paying for the cost of the duplicate license application fees of affected customers who want to obtain duplicate licenses,” Pereira said. Cox did not respond.
Q: Why did the server fail? How is the vendor/city certain that the server was not hacked or cyber-attacked?
A: Pereira referred these questions to Cox, who declined to answer them. She did provide a company statement, dated Tuesday, that said, “It was quickly determined, and confirmed on further investigation, that there was no security or data breach as it was purely a hardware failure. The discs containing the data are encrypted and have remained in our possession in a secure location.”
Q: Why didn’t the city notify the public when the server crashed in September?
A: “Our driver license centers continued normal operations during this period using work-around measures to continue to serve the public. There was no disruption to service. The city was not aware that some data was not recoverable until February 2018,” Pereira said.
Write to Kokua Line at Honolulu Star-Advertiser, 7 Waterfront Plaza, Suite 210, 500 Ala Moana Blvd., Honolulu 96813; call 529-4773; fax 529-4750; or email kokualine@staradvertiser.com.
