Department of Revenue CCW Privacy Breach Scandal Summary

Since the scandal developed over the Department of Revenue's scanning and apparent sharing of identity documents on CCW application and renewal (KY3 video), many people have expressed concern, especially after the state Highway Patrol verified that CCW data has in fact been shared despite clear privacy protections in the law. This article will attempt to summarize what has happened, including input from the Lawrence County Sheriff, Brad Delay, and what it means for Lawrence County residents. Because participation in the Sheriff's Auxiliary requires a current and valid Missouri CCW, this scandal has been of direct interest to our volunteers and our Sheriff has been active in combatting the problem. [Version 1.1 links added] 
From the Sheriff: Any Lawrence County resident who is currently experiencing problems with the licensing office over scanning of CCW-related documents please 1) do not be confrontational and 2) contact the Lawrence County Sheriff. From the Commander: Auxiliary Volunteers or applicants needing to obtain or renew a CCW endorsement, and experiencing these problems, please inform the Chief of Staff (Capt. Krista Haymes) or Personnel Adjutant (Sgt. Susan Durbin) so that you are not considered non-compliant. 
The mess, or at least the public perception of it, started in March when Stoddard County resident Eric Griffin filed suit against the Department of Revenue alleging that the DOR was scanning and storing identity documents used for CCW application and renewal contrary to Missouri law. Specifically, when going to a license office to renew a CCW, Griffin was not allowed to use the existing Missouri CCW as proof of identity and was required to bring an original birth certificate and other documents which the DOR proceeded to scan into an electronic database. Lt. Governor Pete Kinder held a press conference supporting the law suit and stated that Stoddard County was part of a statewide process whereby the Department of Revenue was replacing (still functional) equipment in the county license offices with machines to scan and store identity documents. Urban areas received the new machines first with rural communities such as Lawrence County experiencing a slower rollout. Kinder also spoke at the Firearms Freedom Symposium in Springfield where our volunteers and the Sheriff were conducting community outreach. At the time, Kinder said that his investigations suggested a deeper process intended to comply with the Federal Real ID Act of 2005 which, as of 2008, the Department of Revenue was directly forbidden to comply with by Missouri law, making it a criminal offense to violate the privacy of CCW data. It was believed that the Missouri Department of revenue received federal funds explicitly to implement Real ID compliance contrary to Missouri law and this was the subject of a developing Missouri Senate Committee hearing.
 
OK, so why is compliance with Real ID a problem? The Real ID Act of 2005 required states to improve drivers' licenses in order to make forgery more difficult. That, specifically, was not considered a problem by most people. The Act also, however, specifically required machine readable biometric information encoded in the licenses, centralized this information along with high quality scans of identity documents (e.g. birth certificate) in a federal database, and left states footing the bill. The centralized database, contrary to the intent of foiling forgery, created potential one-stop-shopping for identity theft and near-perfect forgery for any of thousands of officials who would have access to the data (or any criminals who gained access), and, if the Real ID were integrated into government and commerce at the level specified, made it possible for accident, computer error, or data tampering to destroy people's lives. Through repeated verification of the individual's data through the centralized database as a citizen went about their business, another method of tracking lawful activity was also enabled.
Due to these concerns, Missouri, along with a number of other states, declined to participate and citizens overwhelmingly supported this via the referendum which resulted in the laws prohibiting the DOR from implementing Real ID in Missouri without consent of the legislature. Despite threats from the federal government to bar Missouri citizens from airline travel and government buildings, the concerted resistance of the states resulted in the Department of Homeland Security backing down and canning Real ID (or so it appeared at the time).
That is where the scandal started. Once the senate committee started digging into the matter, the problem became much larger. In testimony before the committee and in a press conference, Governor Nixon denied that any unlawful sharing of CCW data had occured, said that there was no central database, and that the scanning of documents was in the name of security. The same day, the Missouri Highway Patrol revealed to the committee that CCW data had, in fact, been shared with federal officials, despite the law and without even a written request or justification, on at least two ocassions. The data shared consisted of all 185,000 Missouri CCW records sent via email and CD-ROM sometime in 2011. Social Security, the recipient of the data, was attempting to find Missouri residents who were on disability for a 'mental defect' who also held CCWs so that either their disability benefits or their CCW would be revoked. Considering the misuse of Post-Traumatic Stress Disorder (PTSD) counseling records to deny veterans access to firearms without any due process and the spectre of gun-confiscation in New York and California, this was alarming to many Missourians. In questioning a witness from the Social Security Administration, Kurt Schaefer, Appropriations Committee Chairman, pointed out that this with done apparently without concern to the fact that the legal threshholds for and definitions of mental illness for disability and for the CCW application were completely different. Worse yet, it was revealed that Social Security was partnering with the BATFE on the project and therefore that the data may have spread further. The Highway Patrol said that Social Security had been unable to read the data and it had been destroyed, but there is no way to ensure destruction of digital data once it has gotten into the wild: digital copies are cheap and impossible to trace.
Testimony suggested that the CCW data was extracted by the Highway Patrol from the MULES Missouri-wide law-enforcement database where it arguably should not have been accessible (to that extent) in the first place. Sheriff Delay confirmed that this issue was disturbing and being investigated.
Although this revelation was not precisely related to Real ID, it was an example of exactly what many Missourians feared when the privacy protections were voted into law and also made it clear that either a) Governor Nixon did not know what was going on with respect to distribution of the data and therefore the assurances were empty or b) that he gave false information to the senate committee. A recent discovery that Nixon had received a letter from DHS Secretary Janet Napolitano thanking him for his efforts to comply with the Real ID Act of 2005 suggest that both a) and b) may be the case.
What is being done to resolve these issues?
The Stoddard County lawsuit sought an emergency injunction to stop the scanning of information. The judge denied the injunction but the lawsuit continues, as has the senate committee investigation.
As stated above, rural rollout of the new machines was delayed compared to urban license offices. Lawrence County seems to have not had the new machines available until April. The Lawrence County Sheriff stated in our monthly meeting that he visited the Mount Vernon license office as soon as the new machines arrived, provided them with a copy of the statute and strongly advised them to not install the new machines until the issue was resolved. The Director of the DOR had resigned and disciplinary action was moving forward in the state Highway Patrol over the disemination of CCW data. The same day of that meeting, 16 April, Governor Nixon announced in a press release that he would order the scanning of documents to cease. A bill had been introduced in the Missouri legislature (HB 859 and HB 436 ) to remove all authority over CCW permits from the DOR and provide funding for the county sheriff to print the IDs (which would also, it seems, solve the issue of the breakdown of the county badge machine and of IDs for Sheriff's Auxiliary volunteers; the Sheriff's Office would simply produce those IDs itself). A separate bill was introduced to allow the legislature (according to provisions already in the state Constitution) to remove appointed government officials for cause (such as the director of the DOR) in a process similar to impeachment.
At this point, therefore, it looked like issues were well on their way to being resolved. It was still unclear exactly how much data had been unlawfully diseminated and how far it had gone, but the ongoing violations would apparently stop. At our monthly meeting, however, one of our volunteers who had just gone through the CCW process stated that she had been to the Mount Vernon license office to get her CCW endorsement and that their documents had been scanned. In the next few days, I spoke to a local who had attempted to renew his CCW, was required to furnish more documentation than usual and an attempt was made to remove the documents from his sight and scan them. He left the office, forgoing the renewal, and spoke to the Sheriff, who advised him not to process the renewal until the situation could be resolved. Sheriff Delay stated that he intended to visit Jeffereson City personally early in the week of 29 April to ensure that the situation was resolved.
The removal of authority over the CCW endorsement from the Department of Revenue is moving forward in the legislature. HB 436, which also contains this measure has passed the Missouri Senate as of Thursday, 2 May. My understanding is that the MO House and Senate must conference to reconcile the differences between the House and Senate versions and then vote to approve the reconciled bill before they go to the Governor for signature. The measure is supported by veto-proof majorities in both the House and Senate. Both bills also contain provisions to allow school districts to appoint armed school security officers according to POST-defined training/requirements (school dsitricts may choose not to do so) plus other changes to Missouri firearms law and are therefore also important to read and discuss in the community.
Governor Nixon is slated to testify tomorrow, Friday 4 May, before the senate committee hearing.