Hack exposed license plate, traveler images

Customs and Border Protection said that photos of travelers and license plates collected at a single U.S. border point have been exposed in a malicious cyberattack in what a congressman called a “major privacy breach.”

The federal agency did not name the subcontractor whose computer network was hacked, but the announcement Monday followed news that a Tennessee-based company that bills itself as the sole provider of stationary license plate readers at U.S. borders had been compromised.

A Customs spokesman said initial reports indicated that the images involved fewer than 100,000 people; photographs were taken of travelers in vehicles entering and exiting the United States at a single landborder port of entry over one and a half months.

Automated license plate readers are used for “detecting, identifying, apprehending, and removing individuals illegally entering the United States at and between ports of entry or otherwise violating U.S. law,” the Department of Homeland Security says in a December 2017 privacy document. Recorded license plates are checked in real time against DHS databases to which 13 federal agencies have access.

The U.K. computer security website the Register, which said the hacker responsible alerted it to the breach in late May, identified the company as Perceptics. A spokesman for the company did not immediately respond to an email seeking comment.

Customs and Border Protection said none of the data had surfaced on the internet or Dark Web. The Register said the hacker provided it with a list of files exfiltrated from the Perceptics corporate network and said a company spokesperson had confirmed the hack.

“Initial information indicates that the subcontractor violated mandatory security and privacy protocols outlined in their contract,” Customs and Border Protection said.

The agency said it learned of the data breach May 31. It said the subcontractor had transferred copies of the images to its company network in violation of government policies and without the agency’s authorization.

No Customs networks or databases were breached, the agency spokesman said.

The chairman of the House Homeland Security Committee, Rep. Bennie Thompson of Mississippi, noted with alarm that this is the “second major privacy breach at DHS this year.”

“We must ensure we are not expanding the use of biometrics at the expense of the privacy of the American public,” he said in a statement.

Gerald Herbert / Associated Press Vehicles line up to enter the U.S. from Mexico at a border crossing in El Paso, Texas, in March. Federal authorities say data from an unidentified border point were hacked last month.