4 ms·

“I want to be clear: This was an attack on a third-party service provider. The Employment Security Department did nothing to cause this, and is not responsible

“I want to be clear: This was an attack on a third-party service provider. The Employment Security Department did nothing to cause this, and is not responsible in any way for this incident,” McCarthy said. They've been saying this since it hit the news at least a couple of weeks ago. Don't they bear some responsibility for choosing a crappy 3rd party service? Maybe the lowest bidder? I ran into the same thing with the Kitsap County (also WA) passenger only ferry service ticketing system. They require a ton of personal information but they're using a 3rd party provider to process payments and reservations. Said 3rd party provider has(had?) a very open "privacy" policy (which should be called the "information sharing policy") which basically allowed them to share all the information with whoever they want for any reason. I contacted Kitsap Transit and they just didn't care. They don't see any problem, saying "everybody does that." When I pushed back, they forwarded me an email from the 3rd party where someone there claimed "we don't actually share it." and that was as far as I got. It's such a shame that our own government can't treat personal information with respect.

mistrial9 6y ago
you and other citizens are being tracked via "public" transport. USA railways have done this for decades. It is a revolving door to law enforcement and commercial use of that data.
colonelxc 6y ago
The gov is absolutely responsible. They chose the vendors, they implicitly (or explicitly) approved their storage policies. The time range for these 'temporarily stored files' was Jan 1 to Dec 10 2020, aka a whole year.
- Pfhreak 6y ago
  Yes, but it's not sufficient to stop there. We need to ask the five whys -- why did this vendor get chosen? Why were the criteria developed that led to this vendor selection? etc. etc. Yes, they are responsible to their users, but I'm going to guess that they have been put into a tough situation to modernize and increase in scale while also dramatically reducing budgets.
- sitkack 6y ago
  We can never give the government a pass because of one of their vendors. Allowed to continue, this provides for an easy circumvention of the constitution and due process.
indigochill 6y ago
> Don't they bear some responsibility for choosing a crappy 3rd party service? Reminds me of this Mitchell & Webb sketch about identity theft: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E Weirdly even with no legal recourse/repercussions for the abuse/misuse of personal information, people still love shifting blame for it, whether to their contractual partners or even users themselves. Almost like they know what they did was wrong.
- alasdair_ 6y ago
  The blame thing is largely down to the fact the unemployment office in WA is already under massive scrutiny for paying out almost a billion dollars in fraudulent claims last year. https://www.seattletimes.com/seattle-news/state-auditor-weak-security-accounting-errors-in-600-million-unemployment-fraud/ https://www.seattletimes.com/seattle-news/state-auditor-weak... (Article mentions $600 million but there have been more claims found since then).
  - natas 6y ago
    how many hundreds of millions do we need to lose before we elect competent auditors?
thelinuxaccount 6y ago
I also live in Kitsap and I'm curious what privacy issues you ran into? I'd normally try to use John/Jane Doe info for this type of thing but it sounds like they were requiring ID. Were you able to find a workaround?
- bndw 6y ago
  I also live in Kitsap, am privacy-conscious and personally curious
- saberworks 6y ago
  The privacy issue was that the 3rd party that provided the ferry reservation system (https://www.kitsaptransit.com/fast-ferry-reservations https://www.kitsaptransit.com/fast-ferry-reservations -- temporarily suspended) had a privacy policy allowing them to sell/share/give any information entered into the reservation system with any other 3rd party for any reason (marketing, advertising, analytics, whatever). I would link the privacy policy but their reservation system is no longer active due to COVID I guess? I looked it up in my email and I also found that later on they switched to requiring a social media (facebook, google, something else?) account in order to reserve a spot on the taxpayer funded, government-run ferry. I actually quoted part of the privacy policy in my (unanswered) email to kitsap transit: Sharing Information We may disclose information collected from and about you as follows; ... With our marketing partners, advertisers, or other third parties who may send you information about their own products and; ...
  - tacitusarc 6y ago
    Contacting the company pretty much never works, but I've found contacting my representative to be quite effective. They have much more weight when they then contact the company.
  - bndw 6y ago
    later on they switched to requiring a social media This is outrageous. Contact is in my profile. If enough people complain to our reps maybe we can impact this in a positive way.
lambda_obrien 6y ago
All government contracts that outsource a service with private data to a third party should have an absolute requirement that the data itself is not to be shared without approval and that it had to be necessary for the service's functionality to do that sharing and that the data access logs must be under the direct control and review of a government auditor. I know why this isn't how it's done: because those third party contractors are selling your data and that's how they get the low bid for those contacts.
clairity 6y ago
many (probably most) of the government services in CA require some information leakage to google, at the very least via captcha, but often via search integration, sometimes analytics, occasionally via google forms/sheets/firebase/cloud as the backend. it's infuriating. we should not be subject to google for any gov services, period.
nobody9999 6y ago
>I ran into the same thing with the Kitsap County (also WA) passenger only ferry service ticketing system. Is there an international border there or something? Do you need to provide all sorts of information just to pay cash at the terminal(s)?
- dmoy 6y ago
  > Is there an international border there or something? I don't think so? I think that one goes to Seattle from a couple spots in Kitsap County.
- saberworks 6y ago
  No. The system when originally started had more people than seats so they had an online reservation system. You had to reserve to get a seat, but you didn't have to actually pay to reserve (until some point later?). There is some info about it here but I guess they temporarily stopped doing reservations: https://www.kitsaptransit.com/fast-ferry-reservations https://www.kitsaptransit.com/fast-ferry-reservations If I recall you had to provide name, address, phone number, and email address.
throwawaysea 6y ago
Yes they’re absolutely responsible. It’s not the job of affected citizens to police the choices of this agency or account for such risks. They can reasonably expect competence and safe handling of their private information, and the consequences of third party choices should be borne by the agency who hired them. They are also free to pursue action against that third party but it is ultimately their problem to own. Unfortunately that may not help anyone if the third party just folds and declares bankruptcy when they face lawsuits.

mistrial9 6y ago

you and other citizens are being tracked via "public" transport. USA railways have done this for decades. It is a revolving door to law enforcement and commercial use of that data.

colonelxc 6y ago

The gov is absolutely responsible. They chose the vendors, they implicitly (or explicitly) approved their storage policies. The time range for these 'temporarily stored files' was Jan 1 to Dec 10 2020, aka a whole year.

Pfhreak 6y ago
Yes, but it's not sufficient to stop there. We need to ask the five whys -- why did this vendor get chosen? Why were the criteria developed that led to this vendor selection? etc. etc. Yes, they are responsible to their users, but I'm going to guess that they have been put into a tough situation to modernize and increase in scale while also dramatically reducing budgets.
sitkack 6y ago
We can never give the government a pass because of one of their vendors. Allowed to continue, this provides for an easy circumvention of the constitution and due process.

indigochill 6y ago

> Don't they bear some responsibility for choosing a crappy 3rd party service? Reminds me of this Mitchell & Webb sketch about identity theft: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E Weirdly even with no legal recourse/repercussions for the abuse/misuse of personal information, people still love shifting blame for it, whether to their contractual partners or even users themselves. Almost like they know what they did was wrong.

alasdair_ 6y ago
The blame thing is largely down to the fact the unemployment office in WA is already under massive scrutiny for paying out almost a billion dollars in fraudulent claims last year. https://www.seattletimes.com/seattle-news/state-auditor-weak-security-accounting-errors-in-600-million-unemployment-fraud/ https://www.seattletimes.com/seattle-news/state-auditor-weak... (Article mentions $600 million but there have been more claims found since then).
- natas 6y ago
  how many hundreds of millions do we need to lose before we elect competent auditors?

thelinuxaccount 6y ago

I also live in Kitsap and I'm curious what privacy issues you ran into? I'd normally try to use John/Jane Doe info for this type of thing but it sounds like they were requiring ID. Were you able to find a workaround?

bndw 6y ago
I also live in Kitsap, am privacy-conscious and personally curious
saberworks 6y ago
The privacy issue was that the 3rd party that provided the ferry reservation system (https://www.kitsaptransit.com/fast-ferry-reservations https://www.kitsaptransit.com/fast-ferry-reservations -- temporarily suspended) had a privacy policy allowing them to sell/share/give any information entered into the reservation system with any other 3rd party for any reason (marketing, advertising, analytics, whatever). I would link the privacy policy but their reservation system is no longer active due to COVID I guess? I looked it up in my email and I also found that later on they switched to requiring a social media (facebook, google, something else?) account in order to reserve a spot on the taxpayer funded, government-run ferry. I actually quoted part of the privacy policy in my (unanswered) email to kitsap transit: Sharing Information We may disclose information collected from and about you as follows; ... With our marketing partners, advertisers, or other third parties who may send you information about their own products and; ...
- tacitusarc 6y ago
  Contacting the company pretty much never works, but I've found contacting my representative to be quite effective. They have much more weight when they then contact the company.
- bndw 6y ago
  later on they switched to requiring a social media This is outrageous. Contact is in my profile. If enough people complain to our reps maybe we can impact this in a positive way.

lambda_obrien 6y ago

All government contracts that outsource a service with private data to a third party should have an absolute requirement that the data itself is not to be shared without approval and that it had to be necessary for the service's functionality to do that sharing and that the data access logs must be under the direct control and review of a government auditor. I know why this isn't how it's done: because those third party contractors are selling your data and that's how they get the low bid for those contacts.

clairity 6y ago

many (probably most) of the government services in CA require some information leakage to google, at the very least via captcha, but often via search integration, sometimes analytics, occasionally via google forms/sheets/firebase/cloud as the backend. it's infuriating. we should not be subject to google for any gov services, period.

nobody9999 6y ago

>I ran into the same thing with the Kitsap County (also WA) passenger only ferry service ticketing system. Is there an international border there or something? Do you need to provide all sorts of information just to pay cash at the terminal(s)?

dmoy 6y ago
> Is there an international border there or something? I don't think so? I think that one goes to Seattle from a couple spots in Kitsap County.
saberworks 6y ago
No. The system when originally started had more people than seats so they had an online reservation system. You had to reserve to get a seat, but you didn't have to actually pay to reserve (until some point later?). There is some info about it here but I guess they temporarily stopped doing reservations: https://www.kitsaptransit.com/fast-ferry-reservations https://www.kitsaptransit.com/fast-ferry-reservations If I recall you had to provide name, address, phone number, and email address.

throwawaysea 6y ago

Yes they’re absolutely responsible. It’s not the job of affected citizens to police the choices of this agency or account for such risks. They can reasonably expect competence and safe handling of their private information, and the consequences of third party choices should be borne by the agency who hired them. They are also free to pursue action against that third party but it is ultimately their problem to own. Unfortunately that may not help anyone if the third party just folds and declares bankruptcy when they face lawsuits.