http://www.sptimes.com/2004/10/01/Hernando/Glitch_opens_access_t.shtml By COLLEEN JENKINS Times Staff Writer October 1, 2004 A Miami Herald reporter alerted local child welfare authorities this week to a software glitch that made available thousands of confidential child-abuse and foster care records to anyone with Internet access. Those files contained detailed information about the 3,966 children under the watch of Kids Central, the private consortium that handles foster care and related services for at-risk children in the Department of Children and Families' District 13, which includes Citrus, Hernando, Marion, Lake and Sumter counties. Names of foster children, birth dates, Social Security numbers, photographs, case histories and even directions to children's foster homes were accessible with a password that had been published on Kids Central's Web site, the Herald reported. DCF officials, who monitor the competitively bid contract with Kids Central, immediately ordered that the site be shut down after the reporter informed them of the security breach Wednesday morning. "We take confidentiality of client files as most critical," said Janice Johnson, a longtime DCF administrator who became chief executive officer of Kids Central in Ocala. "We do take this very, very seriously." Kids Central took over foster care, adoptions and other services for at-risk children in District 13 earlier this year as part of a statewide effort to put child welfare services in the hands of community-based care providers. Six local social service providers comprise the consortium: the Centers (formerly Marion-Citrus Mental Health Center), the Children's Home Society, Camelot Inc., the Harbor Behavioral Healthcare Institute, the Life Stream Behavioral Center and Eckerd Youth Alternatives. Part of the transition last spring included adopting a new computer system, called CoBRIS, the Community Based Resource Information System. The system was developed by Edmetrics, a Tallahassee company that was founded by former DCF Secretary James Bax but has no social service technology experience, the Herald reported. In an e-mail response to a Times phone call on Thursday, Edmetrics defended its product, saying the company's software exceeds industry standards for maintaining confidentiality. The unauthorized access was the result of "human error," a company employee said. "Review of security logs has assured us that this reporter was the only unauthorized access into the system," Edmetrics spokesman Steven Stark said. "We will be vigilant to ensure the integrity and security of the CoBRIS system." Johnson said Kids Central was one of the first agencies of its kind in Florida to implement the system. The Web-based CoBRIS allows caseworkers to tap into the state's child welfare database with a password from wherever they are. Apparently, some caseworkers had trouble getting into the database. So the technology staff added a link where people could post their help requests and read others made by their colleagues - without using a password. That's where the trouble occurred. According to the Herald, some of the replies to help requests included specific log-in identities and the corresponding passwords. The newspaper reporter used that information to enter a world of records, including caseworker notes and reports from home visits, that are meant to be kept from the public eye. When Mary Jane Kuhn learned of the breach on Thursday, the president of the Foster Parents Association of Hernando County wasn't pleased. She doesn't tell anybody where her family lives for fear of what a foster child's parents might do with the information, she said. "If they were first-class citizens, obviously we wouldn't have (their kids)," Kuhn said. "It bothers me a lot that they would have access to that. I know some foster parents would probably give up their license if they knew it." Kids Central and DCF officials have no evidence that any child was hurt as a result of the error. Officials said it was illegal to access the confidential database using someone else's identity, but they did not accuse the Herald reporter of breaking the law. "It's not like a hacker got into the system," Johnson said. "Someone was able, through a mistake, to get a password and access the system." Regardless of how the security breach came about, child welfare officials moved swiftly to fix it. Before restoring the Web site Thursday, computer specialists reset all passwords and created a new security measure that requires a log-in and password to access the help function. Passwords now will be handed out only over the phone or in person and not through e-mail. Also, users making a help request will no longer be able to see replies to previous questions, said Don Thomas, district administrator for District 13. A DCF security officer from Tallahassee will examine Kids Central's Web site "to make sure there isn't a way to breach the system again," Thomas said Thursday. Bill Harrigan, president of the Citrus County Foster Parent Association, is counting on the consortium to keep that promise. "I'm really surprised that they let their guard down and let something like that happen," he said. "That's like the major, major no-no." _________________________________________ Donate online for the Ron Santo Walk to Cure Diabetes - http://www.c4i.org/ethan.html
This archive was generated by hypermail 2.1.3 : Fri Oct 01 2004 - 03:48:10 PDT