Outdoor Adventure USA

Net in the Works

We are working out the details for this net. Stay tuned.

Thanks for early KF6KOC Randy & KF6RGR Becky.

DaveK wrote: ↑Tue Nov 29, 2022 1:53 pm Net in the Works

We are working out the details for this net. Stay tuned.

On the FLY!!! Good job!!!

Check in please - Thanks - Bernie

Early check in please. KM6UWI Ed, Thanks.

Please check me in tonight.

I'm up for a tee hunt!

Please check me in: WY6R -- Bob

Early check in for KK6CTT for the 12/01/22 net please.

The Official Finding from an independent reviewer, Morrison & Foerster LLP, as of 11/30/22; California Department of Justice "Open Dashboard" June 27-28, 2022 Exposure of Confidential Personal Data: https://oag.ca.gov/system/files/attachm ... 6I6-uKJhn4

From CalMatters:

Bonta called for an independent third-party investigation, and now we finally have the findings. Though the report found no evidence of "any nefarious purpose," it's pretty damning stuff.

The Morrison Foerster report reads: "The data exposure was due to a lack of DOJ personnel training, requisite technical expertise, and professional rigor; insufficiently documented and implemented DOJ policies and procedures; and inadequate oversight by certain supervisors."

According to the investigation, a single data analyst built the dashboard and failed to set the proper security settings. Though the data was available to the public for less than 24 hours, it was downloaded by more than 500 people. Most of those downloads occurred after the DOJ had been notified of the breach.

Bonta's press office declined to identify the analyst who built the dashboard. But an unnamed spokesperson said by email that the department is "evaluating personnel matters and other remedial actions."

The report put forth six recommendations for the DOJ, including providing enhanced training on data handling and developing a "data incident action plan." In a press release, Bonta committed to implementing all of them.

Bonta: "While the report found no ill intent, this incident was unacceptable, and DOJ must be held to the highest standard."
That wasn't enough for Chuck Michel, president of the California Rifle & Pistol Association.

Michel: "This isn't the end of it. There are still a lot of unanswered questions and there are still a lot of people who want more transparency and damages for what the state has done to them by doxxing them this way."

Some specific answers to the questions asked during the net from the Morrison and Foester report (page 53):

• The underlying dataset for the Firearms Dashboard that was publicly accessible contained confidential personal data associated with CCW [Concealed Carry Weapon], FSC [Firearm Safety Certificate], DROS [Dealer Record of Sale], and AWR [Assualt-Weapon Registration]-related data; confidential personal data was not included in the underlying GVRO [Gun Violence Restraining Orders]-related data and was never part of the Roster of Certified Handguns data.

• Within the underlying dataset for the Firearms Dashboard, only CCW-related data could be used to independently identify individuals (because the fields exposed included associated names); analysis revealed that none of the other data in the underlying dataset contained information that could be used to independently identify individuals. In total, drawing from the CCW-related data, confidential personal data was exposed on the Firearms Dashboard for approximately 192,000 individuals.

• Even though confidential personal data was exposed in the FSC, DROS, and AWR-related data, the risk from such exposure is limited because the data cannot be used to independently identify individuals (because the fields exposed did not have an associated individual name or other identifier). Further, crosscorrelation analysis identified only one possible means of enriching the data that presented limited additional risk; other enrichment of the data required unverifiable assumptions.

• Confidential personal data was available for a period of time that was less than 24 hours: from when the Firearms Dashboard first went live on June 27 until the Tableau server was down and, again, after the Tableau server was restored until it was taken offline on June 28.

• The exposed underlying dataset with confidential personal data was viewed by members of the public and downloaded, in full or in part, approximately 2,734 times across 507 unique IP addresses.

• The decision by the CJIS Chief to go live again with the Firearms Dashboard the night of June 27 after the Tableau server was restored proved to be a compounding error. The vast majority of public downloads of confidential personal data occurred during this latter period of time until the Firearms Dashboard was taken down the next morning at the CDAG’s direction.

On page 54:

• Within the underlying dataset that contained confidential personal data and was exposed on the Firearms Dashboard, only the CCW-related data could be used to independently identify individuals. Specifically, the CCW-related data included data for the years 2012 to 2021 and included the following fields: name, date of birth, street address associated with the permit, gender, race, county, CCW License Number, status of CCW applications, and California’s Criminal Identification and Information/State Identification number (also referred to as “CII”).46 The CCW-related data contained approximately 192,000 unique CII numbers, which corresponds generally to the number of individuals for whom CCW-related data (including confidential personal data) was exposed.

As stated by MS Paula, KK6LWW, "Which wine would go well with this?"

Please check me in KM6OJB
Thanks Joe

Please check me in KE6PLA