
Arizona DMV Sells Drivers' Photos and SSNs to Private Investigators - DyslexicAtheist
https://www.vice.com/en_us/article/pky8a8/dmv-mvd-sell-photo-ssn-private-investigators
======
apacheCamel
>But as multiple private investigators explained to Motherboard, the reasons
investigators can give to DMVs in order to access data can be overbroad and
open to abuse.

So, what do we do then? Create laws to fix the possible abuse or create laws
to prohibit the selling of this information in the first place? Why was this
allowed originally?

>"This is a revenue generating contract"

It is disgusting to me that they would be willing to forfeit privacy for
money, but in today's game, I fully expect it at this point.

Edit: clarity.

~~~
save_ferris
This is a byproduct of trying to run governments more like businesses. A
government's primary responsibility shouldn't be to make money, but the idea
of lower taxes is attractive to so many in our current political environment,
even if it means sacrificing basic rights to privacy like this.

If we think about citizens as shareholders of a government, we as citizens
don't possess the same feedback loop that corporations do via the markets.
Every stock purchase is a vote of confidence in a company to a degree, insofar
as one buys a stock with the hope that it will increase in value.
Unfortunately, the public doesn't have a fast feedback loop like this, and a
lot of these decisions are made under the assumption that public either won't
ever find out about it, or they'll be distracted by other issues.

~~~
stanfordkid
The problem is that the metrics are wrong... government organizations _should_
be run like businesses, but the ways in which people are measured and rewarded
should not be profitability, but impact. Businesses that are run to maximize
revenue seldom do it... instead they make bad short term decisions. Businesses
that use metrics like engagement and satisfaction as maximization criterion,
inevitably maximize revenue as a side-effect. The same should be applied to
government -- even more so.

~~~
save_ferris
This makes sense in some cases, but there are several functions of government
that are fundamentally money-losing prospects that wouldn't change when
optimizing for impact. I agree that the metrics around government efficacy can
be improved, but arguing that increasing impact will always or almost always
lead to profitability isn't feasible in many government cases. The fear I have
with such an approach is that if governments indirectly promise profitability
via maximizing impact and they fail, then you still have the same problem you
started with.

A perfect example of a project that will only ever lose money but is very
important to the public is the Hanford Nuclear site[0]. The US government
discovered recently that the nuclear waste site was leaking radioactive
chemicals and threatening to taint the Columbia River water supply, which
millions depend on. Cleaning up the radioactive waste will cost tens to
hundreds of billions, and the best possible outcome is that everyone still
gets clean drinking water. That should be the most desirable outcome, but even
if successful, the government won't generate a profit from it, nor should
they. Utilities shouldn't be priced to be profitable, they should be priced to
be sustaining and accessible to those who need them.

0:
[https://en.wikipedia.org/wiki/Hanford_Site](https://en.wikipedia.org/wiki/Hanford_Site)

~~~
stanfordkid
Yes. There should be metrics around how effectively such a disaster is cleaned
up. Profitability is not the only thing that _is_ a metric -- as I stated in
my original post.

------
542458
One of the interesting things about the church I grew up with is that the
church constitution strictly limited how you can ask for money for the church
fund - only once per week at the first Sunday service. This was obviously very
limiting, but strictly defining what cash flows were acceptable also (in my
eyes) helped prevent a lot of the greed and prosperity focus that infects many
other churches.

I can’t help but wonder whether authors of constitutions would see benefit to
strictly defining what income flows are acceptable. The founding fathers in
the US took a few steps in this direction by strictly* defining what kinds of
federal taxes were acceptable, but didn't really go beyond that.

*Maybe too strictly - economists generally agree that apportioning all your taxes is a bad idea because it can be pretty regressive, and we needed amendments to get around that for income tax.

------
jasonjayr
State of RI has an oddly worded question near Section G:

[http://www.dmv.ri.gov/documents/forms/license/License%20App%...](http://www.dmv.ri.gov/documents/forms/license/License%20App%20v2%20RI.pdf)

> EXCEPT AS AUTHORIZED BY LAW, THE DMV WILL NOT DISCLOSE PERSONAL INFORMATION
> WITHOUT YOUR CONSENT

> DO YOU CONSENT TO SUCH DISCLOSURE [ ] YES [ ] NO

It's pretty easy to just blindly check off yes and then sign it. It's my
understanding that answering yes to that question permits them to sell license
information.

------
travisoneill1
Government databases should be free for the public to access or restricted
only to government entities. Selling to limited classes of private buyers is
incredibly shady.

~~~
vharuck
There are legitimate cases for approved release to private citizens. For
example, the standard for public health cancer research is getting records
from state registries.

Of course, in those situations, the requirement is that no personal
identifiers will be leaked, and it's for the public good.

~~~
travisoneill1
Right but if the records are anonymized, then why can't the public view them.
The research is going to be published anyway and then that sample will be
public anyway.

~~~
vharuck
They are not anonymized. We may not always give out things like contact
information or fields specifically for joining to other datasets, but we
assume the provided data is enough to reasonably identify patients. Age, city,
date of diagnosis, race (which can be specific nations for Asian and Pacific
Islanders), and the fact they have cancer can be very good clues. If the
requestor knows somebody with cancer, it wouldn't be hard to learn other
things about them by looking up their record.

------
LinuxBender
It isn't hard to become a P.I. so maybe some of us should become a P.I. and
start requesting data on lawmakers, then send petitions to their home address.
I believe that would be legal.

~~~
sroussey
Rich people don’t put their home address on their ID. In the same way their
home is not in their name.

------
sys_64738
DMV information isn't opt-in. It's a forced by-product of licensing
requirements to legally drive on the road. Most people wouldn't want to give
any information if given a choice but the laws of states for registering and
driving requires it.

That information is not the property of any DMV.

------
bonestormii_
It definitely makes it seem farcical to see our representatives crucifying
Facebook for selling browsing data when states are apparently selling
everything you would need to actually damage someone financially, and not just
hypothetically. With an ID and a SSN, you can quickly get down to business
with a lot of different types of transactions, and gain lateral access to
accounts from there.

------
12xo
As a AZ resident, this is insane. Calling my state Senator and Rep today to
ask why this is allowed. Will update if they actually respond (not likely).

~~~
dhosek
AZ is ridiculously anti-ordinary person in its laws and structure. Rental laws
are tilted completely in favor of the landlord, employment entirely in favor
of the employer, etc. Your small comfort is that AZ driver's licenses don't
expire until you turn 65 so your DL photo will be increasingly out of date as
time passes.

~~~
charwalker
It's been run by the GOP as a retirement destination for the last few decades.
Go figure.

------
anon73044
This happens in nearly all states. Every time I transfer a car title I'll get
inundated with "your warranty is expired" physical mail spam, voicemails and
text.

[https://www.caranddriver.com/features/a32035408/dmv-
selling-...](https://www.caranddriver.com/features/a32035408/dmv-selling-
driver-data/)

------
SN76477
Government data should not be monetized.

~~~
BitwiseFool
I think we need to re-evaluate what governments consider 'public' data.

------
Pick-A-Hill2019
Arizona DMV selling records is wrong (and a massive privacy invasion) but it
is the least of your worries.

Quoting a recent HN post - At the time of his arrest Ngo (the bad guy/haxor)
was averaging 160,000 monthly queries (aka fullz) to Experian with no
questions asked.

See Part I and II of 'Confessions of an ID Theft Kingpin' to see how easy it
was to submit a 'I am a Private Investigator, I Pinky Swear' application that
ultimately he (Ngo) pivoted to full Experian database access.

[1]
[https://news.ycombinator.com/item?id=24285784](https://news.ycombinator.com/item?id=24285784)
[2]
[https://news.ycombinator.com/item?id=24295501](https://news.ycombinator.com/item?id=24295501)

------
tzs
Driving without a license in Arizona is usually just a $120 fine, but it can
be up to $750 and have up to 4 months in jail, so just skipping the driver's
license is probably not a good way to protect your information.

For those in other states that sell this information, driving without a
license might be more viable.

In my state, Washington, for example driving without a license is a
misdemeanor carrying a fine of up to $1000 and up to 90 days in jail, but if
you have another form of acceptable ID on you when stopped it is instead just
a traffic infraction with just a $250 fine. A passport works as acceptable ID.

Here's a site with the driving without a license laws for all the states [1],
although I'm not sure it is accurate. For Arizona it mentions that usual $120
fine, and mentions that things like driving on a suspended license can be a
class 1 misdemeanor, but doesn't say anything about class 2 misdemeanors. A
couple Arizona traffic law firm sites I found, though, say that simple driving
without a license _can_ be a class 2 misdemeanor.

[1] [https://www.drivinglaws.org/topics/driving-without-a-
license](https://www.drivinglaws.org/topics/driving-without-a-license)

------
kevin_thibedeau
Some states even sell their driver database to foreign companies operating
toll roads.

------
tyingq
I would guess you could put a stop to this by purchasing, then publishing the
SSN for all of the high level Arizona government officials on a pastebin.

------
reaperducer
The SSNs may be new, but the photographs are not.

When I worked in television news, we would pull people's drivers' license
photos all the time. In the states where I worked, they were considered public
documents.

------
falcolas
This is typically done via a Freedom of Information request, for your license
data, much or all of which is a Public Record. It's not nefarious on the part
of the government, it's one of the checks and balances placed upon our
government. The PIs, however...

------
dhdhhdd
Private businesses must give a privacy notice with a way to opt out from
information sharing. Is this not a requirement for a DMV?

Edit: I have seen this in banks and credit card issuers. Maybe it's just
banking requirement?

------
dehrmann
Didn't Vice run this same story, but for California a month ago?

~~~
detaro
yes:
[https://news.ycombinator.com/item?id=24210623](https://news.ycombinator.com/item?id=24210623)

------
jacquesm
In Europe this is not a problem. The GDPR would forbid usage of the data for a
different purpose than for which it is collected, you simply would have no
legal basis for this.

I am aware of a UK police officer that sold data from the registry to PIs and
he got sentenced to several years and jail and lost his job. This sort of
thing should never be institutionalized.

------
nix23
My first question here:

Why is the DMV in possession of nuclear-powered attack sub's, and for what and
why do Private Investigators need those?

~~~
liability
Lots of retirees in Arizona, so presumably they're hunting boomers.

~~~
nix23
Oh ok, that partially answers my question but then, why Arizona and not Ohio?

~~~
dhosek
AZ is ridiculously anti-ordinary person in its laws and structure. Rental laws
are tilted completely in favor of the landlord, employment entirely in favor
of the employer, etc.

~~~
nix23
I'm sorry it was a "Insider"-Joke about SSN's, Boomer is another name for
SSBN's (The ballistic rocket Carrier of Sub's) and one class of those SSBN's
is the Ohio Class.

But still thanks for the explanation, did not know that.

------
godzillabrennus
Some states have privatized their distribution of drivers licenses. Can you be
surprised this is happening? Even the People’s Republic of California is
profiting off selling this data and it is of course a state owned operation.

------
holidayacct
Privacy doesn't exist: see
[http://dev.ti.com/tirex/explore/node?node=AB64dFbicd2BPc23jv...](http://dev.ti.com/tirex/explore/node?node=AB64dFbicd2BPc23jvVjcg__VLyFKFf__LATEST)

The minute there was technology available that allowed people to see and hear
through walls privacy died. It now costs less than $5,000 and if you have the
right antenna you can see inside of homes from long distance and listen to
people's diaphragms which allow you to listen to their inner-thoughts.

The default demo software for that particular device is to allow for listening
to heartbeats but with the right modifications listening to the human
diaphragm is just a matter of effort. There are people at several universities
working on these kinds of imaging projects using mmwave right now even though
the technology to do this has been available for over fifty years.

~~~
jaclaz
>The minute there was technology available that allowed people to see and hear
through walls privacy died.

JFYI:

[https://en.wikipedia.org/wiki/The_Dead_Past](https://en.wikipedia.org/wiki/The_Dead_Past)

"Happy goldfish bowl to you, to me, to everyone, and ..."

