Saturday, February 6, 2016

La Paz County and Internet Security

If you just woke up from a Rip Van Winkle slumber, then you might not already know or have not head of attorney-client privilege, that it means anything you share with your attorney is private, and that it is something so sacred that not even the highest court in the land can pierce.

And you also might not already know that your medical record, for example, is also a matter of privacy between you and your doctor, equally as sacred as the attorney-client privilege, if not more so in some cases.

In fact, for an attorney or doctor there is no quicker route to the unemployment line than if he or she were to violate your right to privacy, which is not only statutorily protected but is also a constitutional guarantee.

So, if a doctor or attorney can't disclose your privacy, what about a county official?  Can s/he behave with reckless abandon, carelessly or willfully placing you at risk of disclosing your social security number, bank account number, date of birth, and other vital information about you, such as the names and ages of your children, for example? 

And if an official does violate your privacy, is he or she headed for the soup kitchen line as quickly as a doctor or attorney would?

You would think so, but not so fast.

As editor I'm aware of a recent case where a La Paz County taxpayer had requested a copy of a check used to pay 2015 property taxes.  When a copy of the check arrived via email, sent by none other than the La Paz County Treasurer, herself, the taxpayer was shocked to discover that the treasurer had actually attached a facsimile of the check to an unsecured, open email message. In other words, the taxpayer's checking account number, nevermind the actual signature, is now on hard drives at the county, at the email provider, and who knows where else in between, completely at risk for hacking by anyone with a little bit of technical knowledge about unsecured networks.

Note:  The La Paz County Reckoning won't disclose the taxpayer's name, out of respect for one's right to privacy.

In the taxpayer's own words: "If her [the treasurer's] outrageous outburst was not shocking enough for me as an already stunned taxpayer, what followed was about on the order of shooting the messenger for bringing bad news."

Without belaboring you with all the nitty-gritty details, the bottom line is this: when the taxpayer finally pointed out  the egregious violation of internet security, the treasurer would have nothing of it, and eventually told the taxpayer that if further emails would be forthcoming, then she, the treasurer, would file a harassment report with the La Paz County Sheriff's Office.

In fact, the taxpayer had lots more to ruminate about:

"Who, today, can believe such outrageous, impetuous, irresponsible behavior on behalf of any elected official?" wrote the taxpayer.

"If my reaction, alone, is not enough to shock the conscience of any normally aspirated individual, what does it say about other elected officials and county personnel that have been made aware of the violation of internet security but yet have made no effort to contact me or even notify a correction of this violation to privacy?

"Like me, you are probably now wondering about the training and qualifications of our public officials, and have as many questions as I do.

"For example:

"Does La Paz County have encryption software to secure and transmit sensitive data, such as PGP or TrueCrypt?  If not, is it even qualified as a custodian of vital statistics and sensitive data of taxpayers and residents?

"Why is the county even in possession of cancelled checks?

"Are all canceled checks held in a secure safe, or does the treaurer store them in a box in some corner or closet of her office?

"And when cancelled checks are finally disposed of, does the treasurer just toss them into a dumpster?

"Is the county using a third-party contractor or software to process checks online? If so, what amount of due diligence has her office and the county performed to qualify such contractor?

"Is it too much trouble for the county to simply deposit the checks into its bank account, so that checks can be processed in a manner that facilitates our banks from becoming the eventual custodian?

"Shouldn't the county refrain from doing online banking of any nature, as everyone well should by now, to help thwart the epidemic of cybercrime?

"Given so many county officials have already been made aware of this egregious violation of privacy, not to mention members of the press as well, you're probably wondering if a special meeting of all county officials has yet taken place, the purpose for which would be to review county and department policy, as it relates to reckless behavior when it comes to internet privacy and security in today's insane world where everyone, openly and without shame, digitizes our lives and then places it online.

"Oh, yeah, and when there should be accountability for screw-ups, public officials throw reverses and threaten taxpayers, instead.

What do you think about this taxpayer's experience with La Paz County? 

Post your comments or questions below!




No comments:

Post a Comment