A months-long investigation once again found the City of Houston selling private, personal information through online auctions of used government equipment.
This time it involved used computers bought by KHOU 11 Investigates.
We purchased the computers, then took them to the digital forensic experts at eInvestigations in Houston.
“On one of the computers, we found a database containing over 100,000 medical records,” explained computer expert Gary Huestis.
But the potentially damaging data left behind didn’t stop there. Huestis and his team found photos of driver's licenses, checks, documents with social security numbers, personal pictures and videos, as well thousands of hours of audio recordings and emails detailing city security procedures.
“It looks like there weren’t any steps taken to try to delete or hide anything,” Huestis said.
“How tough would it be for someone who had bad intentions get one of these computers and get valuable information off them?” KHOU 11 Investigates asked.
“It would be very easy,” Huestis said.
Of the 38 computers Huestis examined, 23 still had hard drives inside. He found information stored on all but one of them.
“It’s not hidden, not encrypted, not formatted, it’s just there to be able to view,” Huestis said.
The only computer that had its memory erased was a laptop purchased from Harris Health System. Only one of the four computers purchased from Harris County contained data, but Huestis was not able to find any personal information stored on it.
By far, the biggest problems came with 21 computers bought from Houston Airport System. A quick scan discovered 11,000 hours of audio recordings stored on the machines along with a variety of personal information.
KHOU 11 Investigates confirmed the information matched at least three past or present airport system employees.
“It’s the city,” explained Kim Keel, a worker whose information was found on one of the computers. “I’m sure someone didn’t do what they needed to do.”
It appears she was right.
Bill Begley, spokesman for Houston Airport System, says all of the computers sold at auction should have had the hard drives removed, and workers should have double-checked the machines to make sure it happened.
“Obviously, if we're supposed to remove the hard drives, and hard drives are still in computers, it means we didn't follow all the steps we put in place,” Begley said.
But should the computers have been sold at all?
Last May, the City of Houston changed its policies after KHOU 11 Investigates discovered the city mistakenly sold a file cabinet filled with computer disks containing employees’ personal information at auction.
According to the new policy, all electronic devices are supposed to be “submitted to the City’s electronics recycling vendor for disposal.”
But the city’s Administration and Regulatory Affairs Division which handles asset disposition says that not all city departments, including the airport and public works, have to follow that policy.
“We were offered one of three choices which was donate, sell or destroy (the computers),” Begley said. “That’s up to the different departments.
But City Councilman Michael Kubosh believes it doesn’t make sense to have different procedures for different city departments.
“It shouldn’t be that way,” Kubosh said. “It’s deplorable to see what I saw, what you showed me printed off of those computers…people’s personal information, their phone numbers, their dates of birth -- that’s deplorable. It should never happen.”
“What’s it going to take for the city to get the message?” KHOU 11 Investigates asked the council member.
“It’s going to take a strong message from a reporter like you to get the word out, and a council member like me that’s willing to go on camera to tell the city, we’ve got to change this,” Kubosh said. “We can’t let this happen again. This has got to stop.”
Already the airport system is making changes. Begley says after learning of what KHOU 11 Investigates discovered, the airports will no longer sell used computers.
The department is also reminding all workers to only put information on their computers that’s absolutely needed for work purposes.