Georgia motorists are being advised to monitor their credit reports after a government computer programmer was charged with downloading state driver's license information to his home computers.
The Georgia Technology Authority said Friday that Asif Siddiqui, a 43-year-old Pakistani who worked for GTA, could have downloaded information on "hundreds of thousands" of drivers before he was arrested and fired late last month.
No fraud has been reported as a result of the breach.
Authorities said they do not know what Siddiqui might have done or planned to do with the names, addresses and driver's license numbers, some of which could be drivers' Social Security numbers.
The GBI, Attorney General's Office and GTA are trying to answer those questions as well as determine how many files were downloaded, said GTA Executive Director Tom Wade.
Checking personal credit reports can help determine whether a person's identity has been stolen and, for example, a credit card account opened without someone's knowledge or a bank account fraudulently accessed.
If authorities determine that drivers' information was distributed, they will be notified, said GTA spokewoman Joyce Goldberg.
A new state law requires data collection companies to notify the public if there is a likelihood that sensitive information has been compromised. The General Assembly approved the measure earlier this year after Alpharetta-based ChoicePoint acknowledged that scammers had gained access to 145,000 consumer records in its databases.
Red flags raised
Siddiqui, 43, of Acworth, was arrested April 28 and fired the next day, Goldberg said. He has been charged with two counts of computer trespass and one count of computer theft. All three charges are felonies, each punishable by up to 15 years and a $50,000 fine, said Russ Willard, spokesman for Attorney General Thurbert Baker.
Siddiqui, who was at home out on bail Friday, referred a reporter seeking comment to Atlanta defense lawyer Ed Garland.
Garland said he expects authorities to conclude there is no "criminal case.
"He (Siddiqui) was totally authorized [to access the computer files], and nothing has been done to damage or destroy what was on it," he said.
Siddiqui had worked for GTA for four years and in state government for nine years.
GTA officials first became suspicious in early April when another employee said Siddiqui had logged onto a computer server that contained drivers' information, Wade said. "It raised some red flags" since Siddiqui had not been in a job that required him to access that data server for at least six months, Wade said.
An investigation showed Siddiqui had been downloading data from the server at night and on weekends several times beginning in March, Wade said. The server included some information on hundreds of thousands of Georgia's 6 million drivers, Goldberg said.
The GBI, which was called in April 21, searched Siddiqui's home and seized several computers, said spokeswoman Vicki Metz-Vickery.
Joel Gooch, who lives across the street from Siddiqui in a Cobb County subdivision, said about a dozen agents "got here about dark and were here until midnight." Siddiqui is reclusive, Gooch said.
No background check
In March 2004, Siddiqui filed a lawsuit against Homeland Security chief Tom Ridge and others accusing them of dragging their feet on his petition to become a U.S. citizen. The lawsuit said he had applied for citizenship in May 2003 and could not understand the hold-up. He later dropped the lawsuit without explanation.
Goldberg said Siddiqui told GTA officials when he was hired in 2001 that he is a Pakistani citizen. She said he was not required to submit to a pre-hiring background check.
"It's policy now, but, when he came on board ... it may not have been policy," Goldberg said.
She said officials also may not have felt the need to do a background check since he worked previously for the state Department of Human Resources and Department of Natural Resources as a computer programmer.
His employee performance reviews at GTA have all been positive, Goldberg said.
Wade said GTA officials are taking steps to tighten internal security and to make access to sensitive data available on a "need-to-know" basis.
"We don't want this to tarnish the reputation of our employees," said Wade. "This is a bad apple — apparently, allegedly."
- Staff writer Clint Williams contributed to this report.