Experts: California lacked safeguards for gun owner info

Jul 1, 2022, 4:22 PM | Updated: 7:24 pm
Ettore Russo fires his pistol at an indoor shooting range during a qualification course to renew hi...

Ettore Russo fires his pistol at an indoor shooting range during a qualification course to renew his Carry Concealed handgun permit at the Placer Sporting Club in Roseville, Calif., on Friday, July 1, 2022. The California Department of Justice improperly revealed names and other identifying information on a website that was designed to show general data about the number and location of concealed carry gun permits.. The Placer Sporting Club provides instructions and qualifies gun owners who want to carry a concealed weapon. (AP Photo/Rich Pedroncelli)

(AP Photo/Rich Pedroncelli)

SACRAMENTO, Calif. (AP) — Cybersecurity experts say the California Department of Justice apparently failed to follow basic security procedures on its website, exposing the personal information of potentially hundreds of thousands of gun owners.

The website was designed to only show general data about the number and location of concealed carry gun permits, broken down by year and county. But for about 24 hours starting Monday a spreadsheet with names and personal information was just a few clicks away, ready for review or downloading.

Katie Moussouris, founder and CEO of Luta Security, said there should have been access controls to make sure the information stayed out of the reach of unwanted parties, and the sensitive data should have been encrypted so it would have been unusable.

The damage done depends on who accessed the data, she said. Criminals could sell or use the private identifying information, or use permit-seekers’ criminal histories “for blackmail and leverage,” she said.

Already some are attempting to use the information to criticize gun control advocates who they say were revealed as having concealed carry permits. An online site called The Gun Feed included a post calling out a top lawyer for the Giffords Law Center to Prevent Gun Violence. But the center said the site had the wrong person — someone with the same name as its lawyer.

Five other firearms databases were also compromised, but Attorney General Rob Bonta’s office has been unable to say what happened or even how many people are in the databases.

“We are conducting a comprehensive and through investigation into all aspects of the incident and will take any and all appropriate measures in response to what we learn,” his office said in a statement Friday.

It said one of the other databases listed handguns but not people, while the others, including on gun violence restraining orders, did not contain names but may have had other identifying information.

“The volume of information is so incredibly sensitive,” said Sam Paredes, executive director of Gun Owners of California.

“Deputy DAs, police officers, judges, they do everything they can to protect their residential addresses,” he said. “The peril that the attorney general has put hundreds of thousands of people … in is incalculable.”

Attorney Chuck Michel, president of the California Rifle and Pistol Association, said he has been fielding hundreds of calls and emails from gun owners looking to join what he expects will be a class-action lawsuit.

The improper release came days after the U.S. Supreme Court made it easier for people to carry hidden weapons, and as Bonta worked with state lawmakers to patch California’s newly vulnerable concealed carry law.

No evidence has so far revealed that the leak was deliberate. Independent cybersecurity experts said the release could easily have been lax oversight.

Bonta’s office has been unable to say whether and how often the databases were downloaded. Moussouris said the agency has that information if it was keeping access logs, which she called a basic and necessary step to protect sensitive data.

Tim Marley, a vice president for risk management at the cybersecurity firm Cerberus Sentinel, questioned the speed of the agency’s response to a problem with a website that should have been constantly monitored.

“Given the sensitive nature of the data exposed and potential impact to those directly involved, I would expect a response in much less than 24 hours from notification to action,” he said.

Bonta’s office said it is reviewing the timeline to see when it discovered the problem.

The design of public websites “should always be done with an effort to design security into the process,” Marley said.

Developers also need to properly test their systems before launching any new code or modifying existing code, he said. Yet often organizations rush changes because they are focused “on making it work over making it work securely.”

Every Republican state senator and Assembly member called on Bonta, a Democrat running for reelection, to increase his disclosures about the information lapse, which they said violates state law. They also asked for specific information about the release and investigation, and senators criticized the department for an apparent lack of testing and security.

Copyright © The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

AP

Robert Terwilliger, right, of Williamsburg, Pa., who is participating in a Lyme disease vaccine tri...
Associated Press

Major test of first possible Lyme vaccine in 20 years begins

DUNCANSVILLE, Pa. (AP) — Researchers are seeking thousands of volunteers in the U.S. and Europe to test the first potential vaccine against Lyme disease in 20 years — in hopes of better fighting the tick-borne threat. Lyme is a growing problem, with cases rising and warming weather helping ticks expand their habitat. While a vaccine […]
15 hours ago
FILE -Senate Majority Leader Chuck Schumer, D-N.Y., speaks to reporters after a closed-door policy ...
Associated Press

How Schumer’s messy style delivers for Dems: ‘I persist’

WASHINGTON (AP) — Shoes off, an almost-empty container of leftovers, an unfinished glass of wine — this was the exhausted portrait of one of the most powerful Democrats in Washington after Senate passage of President Joe Biden’s sweeping health, climate and economic package. New York’s Chuck Schumer effectively moved from minority to majority leader of […]
15 hours ago
Associated Press

Police: Man who killed 3 children, self livestreamed threats

A man authorities say shot and killed his three young children before turning the gun on himself livestreamed threatening messages on social media shortly before the killings, Oklahoma City police said Monday. Police identified the man as Francoise Littlejohn, 30, and said in a press release that a relative saw the livestream early Saturday morning […]
15 hours ago
FILE - Fetty Wap appears at the MTV Video Music Awards in Newark, N.J. on Aug. 26, 2019. Fetty Wap,...
Associated Press

Rapper Fetty Wap jailed after alleged FaceTime death threat

NEW YORK (AP) — Rapper Fetty Wap was jailed Monday after, prosecutors say, he threatened to kill a man during a FaceTime call in 2021, violating the terms of his pretrial release in a pending federal drug conspiracy case. Wap, whose real name is Willie Maxwell, told the man, “Imma kill you and everybody you […]
15 hours ago
Associated Press

How major US stock indexes fared Monday 8/08/2022

Stocks closed flat on Wall Street as investors prepare for a busy week of updates on inflation. The S&P 500 gave up early gains and closed lower. The Dow Jones Industrial Average edged higher and the Nasdaq fell slightly. Small-company stocks outpaced the broader market in a sign of investors’ confidence in the economy. Retailers […]
15 hours ago
FILE - Director Lars von Trier appears at the premiere of the film "The House That Jack Built" at t...
Associated Press

Filmmaker Lars von Trier diagnosed with Parkinson’s

Danish filmmaker Lars von Trier, known for films like “Melancholia” and “Dancer in the Dark,” has been diagnosed with Parkinson’s disease, his production company Zentropa said Monday. The company said it released the information in order to avoid speculation about his health leading up to the premiere of his series “The Kingdom Exodus” at the […]
15 hours ago

Sponsored Articles

...
Sanderson Ford

Don’t let rising fuel prices stop you from traveling Arizona this summer

There's no better time to get out on the open road and see what the beautiful state of Arizona has to offer. But if the cost of gas is putting a cloud over your summer vacation plans, let Sanderson Ford help with their wide-range selection of electric vehicles.
(Courtesy Condor)...
Condor Airlines

Condor Airlines shows passion for destinations from Sky Harbor with new-look aircraft

Condor Airlines brings passion to each flight and connects people to their dream destinations throughout the world.
...
Carla Berg, MHS, Deputy Director, Public Health Services, Arizona Department of Health Services

Vaccines are safe if you are pregnant or breastfeeding

Are you pregnant? Do you have a friend or loved one who’s expecting?
Experts: California lacked safeguards for gun owner info