Critical Vulnerabilities in GovQA Platform Expose Sensitive Government Records

In a significant cybersecurity revelation, critical vulnerabilities were discovered in the GovQA platform, a tool extensively used by state and local governments across the U.S. to manage public records requests. 

Independent researcher Jason Parker uncovered flaws that, if exploited, could have allowed hackers to access and download troves of unsecured files connected to public records inquiries. These files often contain highly sensitive personal information, including IDs, fingerprints, child welfare documentation, and medical reports. 

The vulnerabilities in the GovQA platform, designed by IT services provider Granicus, have since been addressed with a patch deployed on Monday. However, the potential consequences of these flaws were severe. If exploited, hackers could have gained access to personally identifiable information submitted by individuals making public records requests. 

This information, often including driver’s licenses and other verification documents, could be linked to the subjects of the requests, posing a significant privacy and security risk.

Granicus, responding to the findings, emphasized that the vulnerabilities did not constitute a breach of Granicus systems, GovQA, or any other part of applications or infrastructure. 

The company classified the vulnerabilities as “low severity” but acknowledged the need to work with customers to minimize the information collected and disclosed. However, cybersecurity experts who reviewed the findings disputed this classification, considering the flaws to be more severe than labeled.

The GovQA platform is a crucial tool used by hundreds of government management centers in at least 37 states and the District of Columbia.

Its purpose is to assist offices in sorting and delivering records to requesters through official public access channels. The flaws in the platform, discovered by Parker, could have allowed bad actors not only to access sensitive personal information but also to trick the system into letting individuals edit or change the metadata of records requests without detection by administrators. 

By modifying the webpage’s code, a skilled hacker could have accessed more information than intended, potentially leading to the exposure of highly sensitive data.
The GovQA platform, used for managing records requests, often involves individuals submitting personal information for verification purposes. This information is stored alongside the requested files and could be exposed in the event of a cyberattack. 

The vulnerabilities were particularly concerning as they could be exploited to access records tied to both the requestor and the subject of their request, even in cases where requests were denied.

The findings by Jason Parker underscore the broader challenges faced by state and local governments in safeguarding sensitive information. With cyber incidents targeting government entities becoming more common, the need for robust security measures and a culture of responsibility around code security is paramount. 

As President Joe Biden recently signed an executive order focused on preventing sensitive data from falling into the hands of foreign adversaries, the vulnerabilities in the GovQA platform highlight the urgency of addressing security risks in widely used records systems. The incident serves as a reminder of the potential consequences when cybersecurity vulnerabilities are present in critical tools that manage sensitive government data.