US Courts And Government Public Records Systems Filled With Vulnerabilities!

In the age of digitalization, it’s not just businesses and professionals who are adapting to software applications and digital platforms. Even government agencies and public services are turning to such systems to enhance their productivity and streamline processes.

However, one cyber security researcher found that many of these platforms contain vulnerabilities that could enable bad actors to gain access to private data and sensitive information or edit statuses.

What Did The Cyber Security Researcher Find?

 

• According to a blog post by Jason Parker, a software developer turned security researcher, US public records platforms used by courts and the government are filled with vulnerabilities.

• These platforms, which are used to manage sensitive public records and legal documents, possess “critical security weaknesses” that could enable bad actors to access confidential information, manipulate legal filings and compromise personal data across several key systems.

• Furthermore, bad actors can falsify registration databases and add, delete or modify official documents.

• Overall, critical vulnerabilities were found in at least 19 commercial platforms, which are used by hundreds of courts, government agencies and police departments in the United States.

• Platforms crucial to the judicial process are particularly at risk, as attackers with minimal technical skills could exploit vulnerabilities to breach security.

• Multiple government agencies managing vital services are affected, with security flaws being more common than exceptional.

• A notable example includes Georgia’s voter registration cancellation portal, where basic public information could be used to cancel voter registrations.

• Key problems involve weak permission controls and poor validation of user inputs, allowing attackers to gain unauthorized access.

• Predictable user IDs and manipulable data fields enable attackers to escalate access levels and compromise confidential records, including legal filings.

• Georgia's voter portal flaw highlights how easily accessible personal information, like names and birthdates, can bypass authentication steps, jeopardizing citizens' rights and personal data.

What Platforms Were Affected?

These platforms and vendors include:
 

• Inmate Management (BluHorse)

• Court Case Management Plus (Tyler Technologies)

• CMS360 (Catalis)

• CaseLook (Henschen)

• Brevard County’s in-house platform (Florida)

• Hillsborough County’s in-house platform (Florida)

• Lee County’s in-house platform (Florida)

• Monroe County’s in-house platform (Florida)

• Sarasota County’s in-house platform (Florida)

• EFiling (Granicus)

• GovQA (Granicus)

• EZ-Filing v3 (Catalis)

• EZ-Filing v4 (Catalis)

• Maricopa County’s eFiling platform (Arizona)

• Officer Profile Portal (NYPD)

• eFiling (Granicus)

• C-Track (Thomson Reuters)

• GovQA (Granicus)

• Voter Cancellation (Georgia Secretary of State)

What Did Jason Parker Say?

 

• Through the blog post, Jason Parker said, “These systems play a critical role in the judicial process, managing everything from legal cases to public records on behalf of government agencies.”

• “However, beneath their essential functions, these platforms harbor vulnerabilities that could be exploited with ease — even by attackers with minimal technical expertise, thus underscoring the fragility of systems meant to safeguard our most sensitive public records.”

• “These platforms are supposed to ensure transparency and fairness but are failing at the most fundamental level of cybersecurity.”

• “If a voter’s registration can be canceled with little effort and confidential legal filings can be accessed by unauthorized users, what does it mean for the integrity of these systems?”

• “Fixing these issues requires more than just patching a few bugs. It calls for a complete overhaul of how security is handled in court and public record systems.”

• “Regular security audits and penetration testing should be standard practice, not an afterthought.”

• “For now, the responsibility lies with the agencies and vendors behind these platforms to take immediate action, to shore up their defenses and to restore trust in the systems that so many people depend on.”

Do you think government systems and databases should be held to higher standards when it comes to protecting sensitive information and user data?

Let us know in the comments below!