I'm amazed by this news story about a serious Colorado government security loophole, with no plans to fix:
Internet security loophole? Like "dog bites man", I guess that's not news. But leaving a gross loophole, because they don't have the budget to hire 5 employees? I wonder if Colorado businesses can sue their government for negligence.
So far, at least 35 businesses in [Colorado] have had their corporate identities misused to open fraudulent credit accounts at retailers ...
The corporate identity thefts itself were possible because of what appears to have been a surprisingly wide open business registration system at the Colorado Secretary of State's Office. As with every other state, Colorado requires companies doing business in the state to register details of their business. Like other states, the business registration details, which include the name of the registered agent of the company, its full local address and other information, are a public record that can be viewed by anyone.
In Colorado's case, however, not only does the state allow anyone to view the record -- it also allows just about anyone to alter or update it. The state site requires no username or password for access to a company's registration information, which means that anyone with access to the site can make changes.
... For now, there are no plans to implement a username and password to control access to the data because the budget for that has yet to be approved. That will be discussed when Colorado's legislative session resumes in January. Coolidge estimated that the state will need to hire between five and seven additional employees to handle password help issues if tighter access controls are added.
Internet security loophole? Like "dog bites man", I guess that's not news. But leaving a gross loophole, because they don't have the budget to hire 5 employees? I wonder if Colorado businesses can sue their government for negligence.