Officials: No Jacksonville residents affected in FEMA data lapse

March 25-- Mar. 25--Jacksonville residents have nothing to fear from an error that exposed the personal data of 2.3 million disaster victims over the past two years, federal officials say.

"The program in question hasn't been used in Alabama in the past ten years," said Abigail Dennis, a spokeswoman for the Federal Emergency Management Agency.

The inspector general for the U.S. Department of Homeland Security last week released a report alerting FEMA leaders that they violated federal privacy rules by sharing with a private contractor too much of the personal information provided by people seeking federal disaster aid after hurricanes Harvey, Irma and Maria. All those storms hit in 2017 -- but according to the report, the oversharing of data went on, unchanged, until March 2019.

Residents of Jacksonville are familiar with the application process. After an EF-3 tornado hit the town on March 19, 2018, state and federal officials repeatedly encouraged local residents to apply for FEMA assistance. By the end of May, 646 residents of the town had filled out some form of application, according to Michael Barton, director of the Calhoun County EMA.

Barton said none of those 646 residents would be affected by the FEMA data lapse. That's because it only affected the Transitional Shelter Assistance program, a program that puts disaster victims into rental units or hotels at FEMA expense.

"No one affected by the March 19, 2018, (storm) in Calhoun County was eligible nor participated in the TSA program," Barton said.

Local hotels were filled with Jacksonville residents after the storm, rooms that were often paid for by homeowner's insurance. According to the FEMA website, the TSA program is for people whose entire communities were uninhabitable or inaccessible because of a disaster.

For those storm victims, the privacy concerns were real, one group of privacy advocates says.

"It's not just one piece of information that's important," said Paul Stephens, director of advocacy for the Privacy Rights Clearinghouse, a nonprofit that monitors data breaches. "It's the context."

According to the report, FEMA collected and shared information items -- including partial Social Security numbers, bank names and numbers needed for funds transfers -- with a contractor when that information didn't need to be released, which is a violation of privacy rules. The name of the contractor is redacted in the inspector general's report.

Dennis, the FEMA official, said the release didn't amount to a data breach. FEMA overshared the data, she said, but there's no evidence to suggest the contractor was broken into.

"There has been no information to suggest that survivor data has been compromised," she said.

Stephens, the privacy advocate, said data thieves can use even partial data like the last four digits of a Social Security number, in combination with information gleaned from other sources, to gain access to bank accounts.

Stephens said he couldn't see why the contractor's name was deleted from the FEMA report.

"It's rather strange," he said. He said the report doesn't present the impression that the contractor is at fault for the data lapse, though he noted that a name might be withheld if there's an investigation still ongoing.

Capitol & statewide reporter Tim Lockette: 256-294-4193. On Twitter @TLockette_Star.

___

(c)2019 The Anniston Star (Anniston, Ala.)

Visit The Anniston Star (Anniston, Ala.) at www.annistonstar.com

Distributed by Tribune Content Agency, LLC.