Is your fleet data safe with FMCSA?

After the attempted hack of the Federal Motor Carrier Safety Administration’s (FMCSA) medical database just over three years ago, the agency has been working to build its digital defenses surrounding its databases. But, after the Office of Inspector General (IG) for the Department of Transportation completed an audit of the administration’s information technology, it seems there are still major security flaws in FMCSA’s data-banking systems.

On Oct. 20, IG released a report detailing its recent audit of FMCSA’s 13 web-based applications that bank inspection, compliance, vehicle registration, and other activities’ respective data. The stated objective of the IG audit was “to determine whether FMCSA’s IT infrastructure contains security weaknesses that could compromise the Agency’s systems and data.”

The IG audit came back with some serious red flags which pointed to weak spots in FMCSA’s data banks, concluding that the information stored in the FMCSA’s IT infrastructure is at serious risk of being compromised in the future. Several agency web servers that house information were breached by the audit team, including unauthorized access to FMCSA’s network. FMCSA did not detect the breach or the unauthorized activity within their own servers. The audit report stated, “FMCSA has not established adequate protections against malicious code and does not have effective detection controls in place to alert its administrators when malicious code is detected.”

Perhaps the most unsettling information in the audit report was the specific data that was so easily accessed. The audit team was able to access 13.6 million unencrypted records containing personally identifiable information (PII), including data that allows the identity of an individual to be reasonably inferred directly or indirectly. PII is often defined as including information such as Social Security numbers, driver’s license numbers, financial and medical records, or a criminal history. If this data had been procured by malicious hackers, it could have cost the FMCSA as much as $570 million dollars in credit monitoring fees.