‘It’s an obvious problem’: Class action lawsuit alleges WA’s DOL left door open for identity fraud

The Washington State Department of Licensing (DOL) is facing a class action lawsuit after it allegedly left a door open to identity fraud affecting more than 10,000 people, caused by a faulty program on its website.

Joel Ard, an attorney at Ard Law Group, is suing the DOL after numerous instances of identity fraud occurred over a six-year period, all traced back to one licensing change the DOL made.

“It’s an obvious problem,” Ard said on “The John Curley Show” on KIRO Newsradio. “It’s my understanding that a lot of people, close to 10,000 at least, were affected by driver’s license redirects alone, in a six-year period.

How a 2018 DOL change opened the door for fraud

Ard provided an in-depth analysis of the problem, which stemmed from a DOL decision to ramp up accessibility, but left its system lacking in security.

“I’m happy to talk about what I’ve discovered,” Ard said. In 2018, [DOL] tried to do two things at once. Anybody who’s been in the state long enough can remember that their old driver’s license number used to have the first five characters of their last name, middle initial, and a long alphanumeric string. As it turns out, that alphanumeric string was not random; it was generated by an algorithm based on your birth date.

“So if you knew someone’s name and birth date, you could tell them what their driver’s license number was. Little party trick,” Ard continued. “The DOL wisely said, ‘That’s not particularly safe or secure, we need to get rid of that.’ The other thing they did in 2018 was launch License Express, so that people wouldn’t have to go into the license office to do stuff. The trouble is they decided to do both of these at once.”

‘Completely insecure’: How anyone could redirect another person’s license to a new address

Ard noted that while the defect is no longer present, it was completely insecure and exposed tons of sensitive information to anyone searching for it.

“It no longer works, but it was there,” Ard said. “You could go into License Express and put in your name, your birth date, and your driver’s license number, and change your information. The trouble is that the driver’s license number was completely insecure, because if you knew someone’s name and birth date, you could derive their driver’s license number.

“One of the places that had people’s names and birth dates is the voter registration database, which is public record,” Ard continued. “You can request it from the Secretary of State. Takes about five minutes to get it, and they used to give it to you with the full birth date in it. So, somebody could have gotten the list of names and birth dates of every single person in Washington, and gone into the License Express website, logged in as that person, and redirected their driver’s license to a new address.”

Curley wondered if a person did take all those steps for nefarious purposes, what would the benefit be for the person who redirected another person’s driver’s license to a different address?

“It certainly is the key to a lot of prospects of identity theft,” Ard said. “The information in the driver’s license database is really core to your identity and being able to prove that you are who you are. If I wanted to be John Curley, I’d get your driver’s license, bleach my hair a little bit, and stop shaving. Next thing you know, I could be you.”

Watch the full discussion in the video above.

Listen to John Curley weekday afternoons from 3 – 7 p.m. on KIRO Newsradio, 97.3 FM. Subscribe to the podcast here.

Follow @https://twitter.com/jcurleyshow