State Bar of California addresses breach of confidential data (opens in new tab)

Let me guess... judyrecords.com collected these by iterating over some chronological id that didn't properly check if someone has read rights.

edit: would love to check, but[0]

> The State Bar Court Portal will be unavailable from February 25th to February 28th due to maintenance activities. During this time the Case Search and Court Calendar functionality will not be available.

[0] https://apps.statebarcourt.ca.gov/dockets.aspx via https://www.statebarcourt.ca.gov/Public-Records-Information

I thought something was off about that site. I doesn't seem fair or legal to just publish that data like that.

I think in the era of go in and get things things should be "public".

Now in the search engine age and data available at your fingertips we need to entirely change our public records laws... Immediately.

edit: In fact a HN User said this with NO REPLY from the author of that Show HN: I have some records that are sealed, but show up in this database. So there are records that were once ‘public’ but are no more, but this database makes them public again.

I think that website should be taken offline immediately.

> Why is it so impossible for these people/organizations to accept that they made a mistake and own up to it?

Maybe they accept it, but just don't admit to their mistake. Seems to be a growing trend, unfortunately. Perhaps the result of a society who more and more punishes people for admitting to their mistakes, rather than rewarding them for admitting to it and learning from it.

It's very sad to me, that this seems to be getting so much more common.

Agreed.

Closing with "Law enforcement has been notified" doubles-down on "we published everything but maybe if we can get somebody charged for a bogus crime then we won't look so stupid."

>Why is it so impossible for these people/organizations to accept that they made a mistake and own up to it?

Its the bar. Of all the organizations to respond like lawyers covering their own asses as hard as possible, you have to expect this one.

They did, see the update: https://www.calbar.ca.gov/About-Us/News/Data-Breach-Updates

They have nothing but praise for the judyrecords owner, actually!

There may be liability attached. But this reads more like "a lot of data that we assumed to be private, and legally must be kept private appeared on a website. Here's everything we know and the steps we have taken." Essentially what happens when there's a screw up and lawyers get consulted about how to disclose it.

My sense that is that any written record (especially publicly posted records), an admittance of guilt can later be used as evidence in court. That is, if the bar needs to defend itself in court later, admitting guilt now would make that a lot harder.

And they're a bunch of lawyers -- they likely know that.

They are lawyers. „Pathetic“ is the after-shave they use. “Liability” is the nickname for the kid they secretly loath. “Blame” is a verb.

It wasn’t a breach. Those records were publicly available. It’s a shame the site’s operator complied with the takedown request. Unfortunately that’s what happens when you use a US hosting provider and domain. In the interest of transparency, site operator should consider migrating the site to a provider outside of US jurisdiction and/or making torrents of the record data that can’t be simply taken down.

It can be legal for you to scrape something yet very illegal to reproduce it.

This applies even more when the site you scraped didn't have permission to show the data in the first place. Their mistake does not rise to be your permission; if it was my data, I would have as much a claim against you as them. "The software did it" is not an excuse.

Is displaying those records in public the violation of the statute? Or was it merely allowing the documents out of their control? Such that.. now they're out, does the website actually have any obligation to follow the "Business and Professions Code?"

Just spitballing, it's just a dump of records. They might have records for your arrest, arraignment, charge, plead, whatever (not sure what's in your state). When I was looking through it, it didn't seem like a comprehensive or organized set of documents by case.

You might want to check with a more thorough source, like a criminal background check agency.

I noticed this too while trying to renew my bar dues. Its so devious. It degrades the whole profession when the gatekeeper is obviously trying to scam you.

I've seen similar, but it's rare because it is such a dark pattern, and on a more high-profile site that nail would get hammered down pretty quickly.

I was going to joke that you're a lawyer, you should sue them, but they're not doing anything illegal, just very shady.

No. Once confidential information is leaked, it is no longer confidential. The person who leaked the data can be in trouble. But the person who received it isn't... Assuming they didn't break any laws receiving it. In your particular example, the Bar employee shouldn't have been talking about confidential stuff in public, where it can be overheard. There is no expectation of privacy in a bar, so the eavesdropper is most likely on the clear.

You could encrypt it with the user’s password instead (rather than hashing it). This is also the approach taken by e.g. password managers, they use your password as a seed for encrypting all your data.

The problem is that this would make the database entirely inaccessible unless you have access to the password. That creates quite a lot of friction in the user experience, the user would have to provide his password on every interaction (ie not just when logging in).

The data is read by more than one person, so this likely wouldn't work.

Also, I'm not sure this is an actual breach. I think they accidentally published the data themselves, that's the vibe I'm getting from reading between the lines. It's like the code maybe missed checking a flag that would exclude private records from showing.

That would seem to only work if the user would only be interested in records created by themselves or that were explicitly shared with them. When sharing both users passwords would have to be stored somewhere, either that or the raw content so that it could be reencrypted.

Private key cryptography would be better, maybe encrypt a private key with a password and store that along with the public?

The reason we can store and use password hashes is because the user provides their password every time they login. So we hash the password they provided at login and compare that to the hash that was stored.

We can't determine what their password is based on the hash alone, which is why we couldn't hash all the user data in the DB with their password and store that.

There's concept similar to what you're describing called crypto-shredding[1]. Hashing isn't a good way ensure the confidentiality of data--just the authenticity--you really want to prefer a solid cryptographic algorithm if your goal is to ensure data remains confidential.

The idea behind crypto shredding is that you have a cryptographic key for each entity in your system and you use that key encrypt all fields for a given record. When it comes time to delete that data, you simply discard the key used to encrypt it. Assuming you've used reasonably good cryptography, this data is now effectively gone.

This is useful in cases where:

* You need to support the right to be forgotten (as defined in the CCPA[2] or GDPR[3]), since all you need to do to "delete" a user's data is to delete the key used to encrypt.

* The data you need to delete exists across multiple data stores/applications/environments and ensuring consistency for the deletion across all these places is difficult. For example: You may have DB backups, long-lived caches, or 3rd party services/vendors that may have copies of this data.

* You want to discard some, but not all, of a user's data. This is important in cases you're required by law to retain specific kinds of information even after a person has required it's deletion. For example, banking and finance companies are required to keep specific records about who they sent money to or performed services for.

1. https://en.wikipedia.org/wiki/Crypto-shredding

2. https://www.oag.ca.gov/privacy/ccpa

3. https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

Hashing would make the content irretrievable; something like XORing with the password would make the password recoverable if you know the content.

Most systems store data to which more than one user needs access.

Most systems will restore access for a user who forgot their password.