Ride On officials investigate potential passenger privacy breach

A Montgomery County Ride On bus. (WJLA)

FRIENDSHIP HEIGHTS, Md. (WJLA) - Is Montgomery County safely storing your child's confidential information? A local mother says, "No."

Bethesda resident Kathy Gambrell became troubled while signing up her 12-year-old son, Dakota, for a discounted bus card. The pass, called the Youth Cruiser SmarTrip card, provides unlimited Ride On bus service to Montgomery County residents 18 and younger for a nominal monthly fee.

In effort to prevent adults from illegally registering, the Montgomery County Department of Transportation requires applicants show proof of age and county residency. Birth certificates, passports and State of Maryland IDs are among the list of accepted documents.

In April, Gambrell and her son visited the TRiPS commuter store in Friendship Heights to apply for the pass. During their visit, Gambrell says a county employee insisted she needed to make a photocopy of Dakota’s birth certificate. Gambrell, a single mother who is currently unemployed, says she reluctantly agreed to the request out of desperation.

"They told me they were placing [the birth certificate] in a folder on a desk in the back room,” Gambrell remarked. “My concern [was], who then has access to that desk, and to that folder? And what happens to this information over time if it's being stored for some 19 years?”

Gambrell, who began to worry about the potential for identity theft, emailed Montgomery County Council Vice President George Leventhal (D) asking his office to investigate.

“Is the county willing to wait until it has a data breach from these paper copies, similar to the problem[s] Target and the University of Maryland have had?” Gambrell rhetorically asked the at-large councilman.

Leventhal, a Takoma Park resident serving his third term on the council, responded hours later, saying:

“I'm copying Carolyn Biggins, Chief of the Transit Division of the Montgomery County Department of Transportation, with a request that she consider this matter seriously and respond to us both.”

The following day, a top-level MCDOT manager replied to Gambrell and Leventhal’s inquiries, admitting changes could be made.

“The Youth Cruiser SmarTrip card program is very new – it began March 1st. Like many new programs, there are probably elements of the program that will need to be adjusted in response to things we learn as implementation proceeds – and the registration form may be one of those. The concerns you have raised are helpful in that regard and we want to address them in a thorough way,” Sandra Brecher, chief of MCDOT’s commuter services section, wrote in an email.

More than four months have passed since Brecher vowed to make modifications, yet Gambrell says she's received no update from MCDOT. She assumes her son's confidential information remains on file, alongside countless other minors’ private paperwork.

"They have the parent names, they have the names of children, they have their birth certificates, and they have where the children go to school … It's an identity thief’s dream,” Gambrell added.

A Ride On spokeswoman tells ABC 7 News although staff members are required to verify age and residency status when processing Youth Cruiser SmarTrip cards, department policy strictly prohibits employees from copying personal documents, such as birth certificates. The public transit agency has since launched an investigation into Gambrell’s allegations.

"I brought up the issue and the response was silence. I’m glad to see they’re finally paying attention,” Gambrell concluded.