CA DOJ Leak of CCW and Firearm Purchaser PII

[Dvrjon]

Originally Posted by Ishooter

Are $350M on the table for the ccw breach?
https://www.foxla.com/news/tmobile-d...uit-settlement

80 million were affected by that. The DOJ leak is trivial (by volume) in comparison. And, the lawyers get paid first.

[ar15barrels]

Originally Posted by Ishooter

Are $350M on the table for the ccw breach?
https://www.foxla.com/news/tmobile-d...uit-settlement

It's only our tax money.
They can spend as much of it as they like.
We will just make more.

[ugimports]

Did anyone that requested their records get them? I got some generic email that basically said "nah not right now, we're busy with the leak"..

[SamsDX]

Originally Posted by ugimports

Did anyone that requested their records get them? I got some generic email that basically said "nah not right now, we're busy with the leak"..

Are you sure that's all they said? Because this is what I just got back just a moment ago (after their initial extension) - I already got their first response saying they need more time.

In response to a PRA request, the Department may withhold information that state law exempts or prohibits from disclosure. (Gov. Code, § 6254, subd. (k).) California law exempts or prohibits the disclosure of the type of information you request. Release of information about an individual whose personal data may have been exposed implicates the right to privacy under Article 1, section 1 of the California Constitution and thus in response to a PRA request, the Department cannot release the personal information you requested. (Gov. Code, § 6254, subd. (k), incorporating Cal. Const., Art 1, § 1.)

Yeah, that would have been a nice consideration when they publicly posted this information on their stupid portal website. I had calmed down for a while, but this pisses me off all over again. Anyone want to file a lawsuit under the PRA to get the DOJ to disclose this information?

I wonder if this means individual CCW licensee information, which some here have claimed to be "public records," are now being treated with higher sensitivity by the DOJ? (E.g., will they tell a liberal journalist to go pound sand if they request information on all CCW holders in a county so that they can be "outed"?)

This was a mostly predictable response, because any further disclosure is bound to get them into more trouble.

[ugimports]

Originally Posted by SamsDX

Are you sure that's all they said? Because this is what I just got back just a moment ago (after their initial extension) - I already got their first response saying they need more time.

Well the section I was referring to was:

At this time, as the investigation is ongoing, the public interest in disclosure of the records you requested is clearly outweighed by the public interest in facilitating an accurate and thorough investigation.

The other section you quoted I think is funny that they can't release information about me to me and are now basically saying it's not "public" information....

[SamsDX]

As you know, on June 27, 2022, the California Department of Justice learned that personal information was disclosed in connection with the June 27th release of the Department’s Firearms Dashboard Portal. The Department has retained outside counsel and an outside forensic cyber expert to conduct an investigation and determine how this occurred. Outside counsel and the forensic cyber expert are reviewing documents, analyzing data, and conducting interviews of relevant personnel. When the investigation is complete, the Department will report the investigative findings to the public. We anticipate these findings will cover how the incident occurred and the steps the Department is taking to ensure that something like this does not happen again. We expect the investigation to be complete in the coming months. In response to a PRA request, the Department may withhold certain records when the public interest served by not disclosing the records clearly outweighs the public interest served by disclosure of the record. (Gov. Code, § 6255.) At this time, as the investigation is ongoing, the public interest in disclosure of the records you requested is clearly outweighed by the public interest in facilitating an accurate and thorough
investigation. (Id.)

They made it personal, so am I. I hope these "relevant personnel" are having the worst months of their pathetic little careers, and they're getting grilled up and down by this outside law firm as they are subject to deposition-style questioning on their every action, every motive, every supposed competency inspected under a microscope. I hope they wake up multiple times throughout the night in sheer panic, worrying about whether they're going to get canned or not. I hope the probe that goes up their rectum is so thorough and overwhelming, they'll be begging for a colonoscopy. And I hope you're reading this, "relevant personnel," and realize how badly you screwed up. May you face the abject embarrassments of your epic failure daily for the rest of your lives, you contemptible rat.

[The Gleam]

Originally Posted by SamsDX

They made it personal, so am I. I hope these "relevant personnel" are having the worst months of their pathetic little careers, and they're getting grilled up and down by this outside law firm as they are subject to deposition-style questioning on their every action, every motive, every supposed competency inspected under a microscope. I hope they wake up multiple times throughout the night in sheer panic, worrying about whether they're going to get canned or not. I hope the probe that goes up their rectum is so thorough and overwhelming, they'll be begging for a colonoscopy. And I hope you're reading this, "relevant personnel," and realize how badly you screwed up. May you face the abject embarrassments of your epic failure daily for the rest of your lives, you contemptible rat.

Hope was the only thing left in Pandora's box when all the other 7 deadly sins got out.

With that in mind, your hopes are likely facing counterbalance opposition by way of high-fives, bonuses, and 'employee of the month' awards behind Bonta's closed doors.

Hell, Bonta's probably personally congratulating them with free blow-jobs.

---

[socal m1 shooter]

Originally Posted by ugimports

Did anyone that requested their records get them? I got some generic email that basically said "nah not right now, we're busy with the leak"..

I got the form letter too. I used @Dvrjon's thing in this post, more or less, and part of their response is quoted below.

Originally Posted by SamsDX

Are you sure that's all they said? Because this is what I just got back just a moment ago (after their initial extension) - I already got their first response saying they need more time.

[...]

This was a mostly predictable response, because any further disclosure is bound to get them into more trouble.

Near the end of their form letter reply, it reads:

Originally Posted by worthless people working for RB

[...]

In response to a PRA request, the Department may withhold information that state law
exempts or prohibits from disclosure. (Gov. Code, § 6254, subd. (k).) California law exempts or
prohibits the disclosure of the type of information you request. Release of information about an
individual whose personal data may have been exposed implicates the right to privacy under Article
1, section 1 of the California Constitution and thus in response to a PRA request, the Department
cannot release the personal information you requested. (Gov. Code, § 6254, subd. (k),
incorporating Cal. Const., Art 1, § 1.)

The Department has sent letters to individuals who may have been impacted to provide
additional information and complimentary identity monitoring resources. If you have not yet
received such a letter from the Department, you can contact our call center to determine if you were
impacted: 1-833-909-4419 (Monday-Friday, 6 a.m. - 6 p.m. PT).

@Dvrjon posted a richer-in-legalese/code citations version about 40 posts after the above-linked first draft. Maybe I'll give that a whirl.

[EM2]

Originally Posted by ugimports

Well the section I was referring to was:

The other section you quoted I think is funny that they can't release information about me to me and are now basically saying it's not "public" information....

I got the same letter in an email, I too used Dvrjon's template.

I don't see how releasing information about ME to ME would be an issue for the public.
Unless of course it exposes the DOJ's incompetence, then in that case god forbid the public find out.

I will ponder my response to them.

[socal m1 shooter]

Originally Posted by The Gleam

[...] 'employee of the month' awards behind Bonta's closed doors. [...] Hell, Bonta's probably personally congratulating them with free blow-jobs.

LOL'd at that, will admit.

Whatever they say/write to peons and little people like myself is probably less than half-true, if not outright obfuscation and lies. What would be shocking is if they actually spoke/wrote truthfully and apologetically with heartfelt sincerity.

The legalese posted upthread regarding how one waives rights by accepting their most generous credit monitoring deal speaks very clearly on their behalf: in their eyes, they are the masters, we are the servants.

[bv141]

I got the form letter today also. Refuse to inform you if we leaked your data.

[squeeze]

Originally Posted by Motos&Guns

There are two names in SF county that aren't reserve officers. One born in 1984, the other in 1942. I'll leave their names out, but they're in there if anyone wants to dig.

Those two names are there because??? Website down now or i'd check.

[Jimi Jah]

No consenquences for those that leaked this. This is California, they make up their own rules.
They also decide what laws to follow.

[mk2dave]

2 things re: the DOJ response to my request for their records on me:
Magically, there's an independent investigator? In the "we published all your business" letter, the DOJ said the DOJ was investigating.
What info they have collected on me is a very different question than why and how they disclosed some information to the world.

[VRWC]

Originally Posted by EM2

I got the same letter in an email, I too used Dvrjon's template.

I don't see how releasing information about ME to ME would be an issue for the public.
Unless of course it exposes the DOJ's incompetence, then in that case god forbid the public find out.

I will ponder my response to them.

Pondering mine as well. I hope the delay in receiving this is because they are SLAMMED and wading in letters and emails.

Response to my request:

[I][I]On June 27, 2022, the California Department of Justice learned that personal information was disclosed in connection with the June 27th release of the Department’s Firearms Dashboard Portal. The Department has retained outside counsel and an outside forensic cyber expert to conduct an investigation and determine how this occurred. Outside counsel and the forensic cyber expert are reviewing documents, analyzing data, and conducting interviews of relevant personnel. When the investigation is complete, the Department will report the investigative findings to the public. We anticipate these findings will cover how the incident occurred and the steps the Department is taking to ensure that something like this does not happen again.
The Department is in the process of notifying every individual whose personal information was exposed as part of this incident. California law requires a business or state agency to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person. The Department asks that anyone who accessed such information respect the privacy of the individuals involved and not share or disseminate any of the personal information. In addition, possession of or use of personal identifying information for an unlawful purpose may be a crime. (See Pen. Code, § 530.5.)
Additional information and resources are currently available to individuals who believe they may be impacted by this incident. You can access those details at: www.oag.ca.gov/DataExposure
Agencies are permitted to extend the date for responding to a public records request for fourteen days beyond the original ten-day deadline for responding under specified circumstances. (Gov. Code, § 6253, subd. (c).) As your request was received by this office on July, 2022 a, the time established for the original response is July 2022. Fourteen days beyond this date is August, 2022.
Agencies may invoke the extension for several reasons, which may be summarized as follows:
1. The need to search for and collect records from field offices or other facilities that are separate from the office processing the request.
2. The need to search for, collect, and appropriately examine a voluminous amount of separate and distinct records which are demanded in a single request.
3. The need for consultation, which shall be conducted with all practicable speed, with another agency having a substantial interest in the determination of the request or among two or more components of the agency having substantial subject matter interest therein.
(Gov. Code, § 6253, subd. (c).).
In this instance, an extension is needed to consult with multiple components of the Department with substantial interest in the records requested. We will provide a further response (within 2 weeks).
Sincerely,
/s/ Public Records Coordinator
Public Records Coordinator
For ROB BONTA
Attorney General

[CessnaDriver]

So what litigation are the cool kids joining in the most at this point?

[mk2dave]

Originally Posted by CessnaDriver

So what litigation are the cool kids joining in the most at this point?

Seems like the popular route is through the CRPA. https://crpa.org/ca-doj-dox-gate/ , scroll down to Potential Plaintiff Form and the two email addys toward the bottom the of the page.

[The Gleam]

Originally Posted by CessnaDriver

So what litigation are the cool kids joining in the most at this point?

---

[RLM690]

I received the same answer to my Private Information Request. Seems to me by releasing my private information and records that they have, to me, they consider it a privacy issue if they were to release it to me... My Head is starting to ache.

In response to a PRA request, the Department may withhold information that state law
exempts or prohibits from disclosure. (Gov. Code, § 6254, subd. (k).) California law exempts or
prohibits the disclosure of the type of information you request. Release of information about an
individual whose personal data may have been exposed implicates the right to privacy under Article
1, section 1 of the California Constitution and thus in response to a PRA request, the Department
cannot release the personal information you requested. (Gov. Code, § 6254, subd. (k),
incorporating Cal. Const., Art 1, § 1.)

The Department has sent letters to individuals who may have been impacted to provide
additional information and complimentary identity monitoring resources. If you have not yet
received such a letter from the Department, you can contact our call center to determine if you were
impacted: 1-833-909-4419 (Monday-Friday, 6 a.m. - 6 p.m. PT).

[Aragorn]

And, FWIW, I received exactly the same response to my PIR as RLM690 above. Am consulting a lawyer as to what response, if any, would be both wise and effective.

But yes, I am angry ...

[GetMeCoffee]

There had been mention that Michel & Associates was working on a template lawsuit and how pleasing it would be to see 10,000 individual suits directed at Bonta's office.

I'm all in for that - even if it's in Superior Court as opposed to Small Claims. What is it, a $500 filing fee? I'd spend that on a half day shooting between gas and ammo.

Seriously though, if any of you are talking to Michel & Associates or any other attorney, let's get a template. Maybe one for Small Claims and a more comprehensive one for Superior Court. I'm not sure what the Small Claims cases would look like since those are limited to actual damages.

Perhaps the template would include filing a PRA, getting denied and then using that as the cause of action? Doesn't PRA allow for attys fees (which would go back to Michel or whoever did the template)

[92E2]

Originally Posted by GetMeCoffee

There had been mention that Michel & Associates was working on a template lawsuit and how pleasing it would be to see 10,000 individual suits directed at Bonta's office.

...

If memory serves, small claims court damages are limited to pocket change awards. Not something the PRK would lose any sleep over.

[EM2]

Originally Posted by 92E2

If memory serves, small claims court damages are limited to pocket change awards. Not something the PRK would lose any sleep over.

That depends on how one sees pocket change.
However, thousands of suits at the same time might have some impact.


https://www.dca.ca.gov/publications/...alendar%20year.

Small claims courts have an upper limit on the amount of money that a party can claim. You can sue for up to $10,000, if you are an individual...

[mk2dave]

I'd love to respond to their denial for PIR. I don't understand why investigating the release of identification information to everyone has to do with my request for any and all information they have on me. Denying the latter due to the former just seems like an excuse to deny my request which I have a legal right to.

Open to guidance on how we can address this.

[GetMeCoffee]

Originally Posted by 92E2

If memory serves, small claims court damages are limited to pocket change awards. Not something the PRK would lose any sleep over.

Originally Posted by EM2

That depends on how one sees pocket change.
However, thousands of suits at the same time might have some impact

Well, yes and no. For Small Claims, damages are limited to actual damages (i.e. no indirect or punitive damages) and $10k or $12k or something like that. Having to deal with 10,000 individual suits (which would start as 10,000 administrative clams - have to exhaust admin remedies you know) would pretty much shut that office down. Probably no one would actually see any money, but we'd know we got pounds of flesh.

I suppose it's the same for action in Superior Court, except that we'd have to pony up the filing fee. Maybe everyone would get that back and maybe there's some indirect or punitive damages to be had (in addition to that same pound of flesh from the office)

[92E2]

Originally Posted by EM2

That depends on how one sees pocket change.
However, thousands of suits at the same time might have some impact.


https://www.dca.ca.gov/publications/...alendar%20year.

$10K is nothing to recover from identity theft. There is a reason why it is called "small claims".

"... You can sue for up to $10,000, if you are an individual or a sole proprietor. Corporations and other entities are limited to $5,000. In addition, a party (individuals or corporations) can file no more than two claims exceeding $2,500 in any court throughout the State of California during a calendar year. ..."

[TheSierraDrifter]

Has anyone received a notification letter from DOJ yet? I thought they started mailing them out at least a couple of weeks ago...

[NorCalBusa]

About a week or 10 days ago.

[Dvrjon]

Originally Posted by TheSierraDrifter

Has anyone received a notification letter from DOJ yet? I thought they started mailing them out at least a couple of weeks ago...

I already cashed the check they sent me.

[NorCalBusa]

Originally Posted by Dvrjon

I already cashed the check they sent me.

What? How much?

All I got was three DOJ vouchers for purchasing any off-roster firearm in California, good for 5 years.

[Scalgun]

Originally Posted by TheSierraDrifter

Has anyone received a notification letter from DOJ yet? I thought they started mailing them out at least a couple of weeks ago...

I called CA DOJ call center for the leak at 1-833-909-4419 and confirmed that they have old information and sent the notice to an address that I have not lived at for over 3 years. If you've moved over the last several years, it's likely the same thing happened. When I called, they confirmed that my data was released and offered to enroll me in ID theft protection service.

[Squatch]

Originally Posted by TheSierraDrifter

Has anyone received a notification letter from DOJ yet? I thought they started mailing them out at least a couple of weeks ago...

Got mine about 2 weeks ago.

Sent from my SM-G950U using Tapatalk

[ugimports]

Originally Posted by Scalgun

I called CA DOJ call center for the leak at 1-833-909-4419 and confirmed that they have old information and sent the notice to an address that I have not lived at for over 3 years. If you've moved over the last several years, it's likely the same thing happened. When I called, they confirmed that my data was released and offered to enroll me in ID theft protection service.

That's not a CA DOJ call center....it's the ID theft provider.

I called and the person I spoke to could not confirm whether or not I was on the list..interesting.. guess it depends who you get..

[VRWC]

Originally Posted by ugimports

Well the section I was referring to was:


The other section you quoted I think is funny that they can't release information about me to me and are now basically saying it's not "public" information....

Based on the ongoing investigation, the incident exposed some personal information of
individuals who were granted or denied a permit to carry a concealed weapon between 2012-2021.
Additionally, the investigation is reviewing the extent to which any additional personally
identifiable information could have been exposed from the following dashboards: Assault Weapon
Registry, Dealer Record of Sale, Firearm Certification System, and Gun Violence Restraining Order
dashboards.
In response to a PRA request, the Department may withhold information that state law
exempts or prohibits from disclosure. (Gov. Code, § 6254, subd. (k).) California law exempts or prohibits the disclosure of the type of information you request. Release of information about an individual whose personal data may have been exposed implicates the right to privacy under Article 1, section 1 of the California Constitution and thus in response to a PRA request, the Department cannot release the personal information you requested. (Gov. Code, § 6254, subd. (k), incorporating Cal. Const., Art 1, § 1.)
The Department has sent letters to individuals who may have been impacted to provide
additional information and complimentary identity monitoring resources. If you have not yet received such a letter from the Department, you can contact our call center to determine if you were impacted: 1-833-909-4419 (Monday-Friday, 6 a.m. - 6 p.m. PT)

This is bull*hit, "The Department has sent letters to individuals who may have been impacted to provide additional information and complimentary identity monitoring resources." COMPLEMENTARY identity monitoring resources." BFD. Not good enough. Not what I requested. So, here we go again. I've formulated another response. Once I edit the expletives out, in the mail it goes.

[magwa1]

Originally Posted by Charlie50

Likely Bonta does not give a flying F.... This is some raw meat for his supporters and knows he cannot be held personally/ financially responsible for the damage done. Heads need to roll on this as it has put some of the most law abiding people in the state at great risk.

But, I haven't drilled too deep on this one.

Except to know all my data was compromised and I had to take the "offered" evasive action. Which was (and is) a PIA, time consuming, "roadblocking",
and likely not even fully effective.

If I have to think about the faux pas (to put the release modestly) and the response thereto, it seems one more element proving lack of accountability in the cracks in our system(s).

[Capybara]

I never received the letter but a helpful CGer did verify that I was in the leak. Maybe I can sue Bonta and the state for even failing to notify that they doxxed me?

[michigander]

Originally Posted by Capybara

I never received the letter but a helpful CGer did verify that I was in the leak. Maybe I can sue Bonta and the state for even failing to notify that they doxxed me?

I also never received a letter. Who helped you?

[Aragorn]

I too, never received any letter from CA DOJ. And got the same bs response to my Personal information Request that others did.

It's beyond outrageous. All of what's going on.

[NorCalBusa]

Word is Bonta contacted IA's of folks DOJ didn't' have a street address for (no PO boxes), asking the IA's to try to broker getting them the letter.

[EM2]

Interesting, I had a member check and came back negative, my initial application was pre-2012.
However, I still got the DOJ letter in the mail.