Several public websites designed to allow courts across the United States and Canada to manage the personal information of potential jurors had a simple security flaw that easily exposed their sensitive data, including names and home addresses, TechCrunch has exclusively learned.
A security researcher, who asked not to be named for this story, contacted TechCrunch with details of the easy-to-exploit vulnerability, and identified at least a dozen juror websites made by government software maker Tyler Technologies that appear to be vulnerable, given that they run on the same platform.
The sites are all over the country, including California, Illinois, Michigan, Nevada, Ohio, Pennsylvania, Texas, and Virginia.
Tyler told TechCrunch that it is fixing the flaw after we alerted the company to the information exposures.
The bug meant it was possible for anyone to obtain the information about jurors who are selected for service. To log into these platforms, a juror is provided a unique numerical identifier assigned to them, which could be brute-forced since the number was sequentially incremental. The platform also did not have any mechanism to prevent anyone from flooding the login pages with a large number of guesses, a feature known as “rate-limiting.”
In early November, the security researcher told TechCrunch that they identified at least one jury management portal for a county in Texas as vulnerable. Inside that portal, TechCrunch saw full names, dates of birth, occupation, email addresses, cell phone numbers, and home and mailing addresses.
Other exposed data included information shared in the questionnaires that potential jurors are required to fill out to see if they are qualified to serve on a jury.
In the portal seen by TechCrunch, the questions asked about the person’s gender, ethnicity, education level, employer, marital status, children, if the person was a citizen, whether they were older than 18, and whether they have been convicted …