The Department of Transportation's Inspector General released a report on Wednesday documenting problems with the National Driver Register, a federal database of driving convictions used by state departments to motor vehicles. The $4 million registry maintains files on motorists across the country that contain names, dates of birth, sex, heights, weights, eye colors and the details of any tickets received. About one out of five drivers -- 42 million -- is listed in the database.

The audit found the national driver's license database was filled with security holes, foremost among which was that the network through which state DMVs connect to access this information does not use any form of encryption to prevent unauthorized parties from intercepting the data.

"When transmitted or stored outside the mainframe computer, (personal information) was exposed to potential unauthorized access or unapproved use," the audit found.

The data were also open to old-fashioned theft. Personnel with access to this sensitive information did not undergo a proper level of background screening. Anyone wanting access to the database could simply apply for a job working for the registry help desk or the state DMV network without any checks at all. At the transportation department's headquarters, paper records from the registry were left in an unattended room in file cabinets whose keys were left in the locks.

"This security weakness could allow unauthorized personnel to view and obtain an individual's personally identifiable information without being noticed," the audit found.

Intercepted information might not have even been accurate. The audit found convictions could take a year or, in fifteen percent of cases, longer, before being recorded in the database. About eighteen million records were incomplete and 161,000 duplicate social security numbers were uncovered.

Updating this database has become a priority as the Real ID Act becomes effective in May 2008. This law mandates that all states link individual driver's licenses with social security numbers. This will create a de facto national identification card issued by individual states following uniform federal requirements.

A full copy of the audit is available in a 130k PDF file at the source link below.