State of Georgia Driver’s License Files Hacked

Government programmer, hired without a background check, arrested for accessing license files.

Dick Petty

ATLANTA (AP) - A programmer for the state's data agency, who apparently was hired without a background check, has been charged with computer trespassing and theft for accessing Georgia driver's license files without authorization.

Asif Siddiqui, a Pakistani who sued federal authorities last year for dragging their feet on his naturalization petition, was arrested April 28 at the Georgia Technology Authority's offices near the state Capitol, the agency said Friday.

The action came after the agency discovered he had logged into the database outside of work hours without having a reason to do so.

"He used to work on this system but there was no reason for him to be involved in any way" when the intrusion was found, said Tom Wade, the agency's director.

The agency has no idea how many files were accessed or what, if any, personal information may have been compromised, Wade said. The files potentially included names, addresses, home telephone numbers and Social Security numbers of thousands of Georgians.

An investigation by the Georgia Bureau of Investigation will help determine if any other state databases were tapped and what Siddiqui may have intended to do with any information he accessed, Wade said.

"Because of the confidential nature of the files and because he was going in during off-work hours and he had no reason to be doing it, we contacted the attorney general and the GBI and asked them to investigate," he said.

A man who answered the telephone at Siddiqui's home referred questions to attorney Ed Garland. Garland's secretary said the attorney couldn't take a telephone call because he was preparing for a federal case.

All the charges filed against Siddiqui - two counts of computer trespassing and one count of computer theft - are felonies, carrying penalties of up to 15 years in prison and fines of $50,000.

The Georgia Technology Authority is the state's data arm, managing its databases and communications systems.

Siddiqui was hired to work in the agency in May 2001. Wade said Siddiqui apparently wasn't required to undergo a background screening because he had previously worked for the Department of Natural Resources and the Department of Human Resources.

Altogether, Siddiqui worked for the state of Georgia for nine years. He was fired the day after his arrest.

In March 2004, Siddiqui sued Homeland Security Director Tom Ridge and other officials in U.S. District Court in Atlanta for dragging their feet on his naturalization petition. He had applied to become a U.S. citizen in May 2003.
Acting as his own attorney, Siddiqui asserted he first was told his application couldn't be adjudicated until a "name check" was completed by the FBI. Then, he said, he was informed the FBI check had been completed, but met further delays and was not told why.

A document filed in conjunction with the lawsuit showed that he even went to then-U.S. Rep. Johnny Isakson, now a U.S. senator, to help him uncover a reason for the delay. The document was from a government agency that Isakson forwarded to Siddiqui that suggested the delay was due to a backlog of applications.

Siddiqui dropped the lawsuit a month later without explanation.

Meanwhile, Wade said he intends to tighten security at his agency.

"We have been reviewing and putting together tighter internal controls," Wade said. "We're limited access on a need-to-know basis, checking our logs and monitoring."

http://www.securityinfowatch.com/article/article.jsp?siteSection=306&id=4031

Click here to return to the E-zine and/or close this window