City of Portland Credit Card Transactions Don’t Comply with Security Standards

Tuesday, November 18, 2014

GoLocalPDX News Team

Payments people make to the City of Portland using a credit card are not secure by industry standards, according to a recent report released by the City of Portland’s auditor.

That includes credit card transactions residents and businesses made to pay taxes, license fees, inspection and permit fees, parks and recreation programs, water and sewer bills, parking garages and parking meters and more, according to city officials.

In 2013, 9 million payments were processed by the City of Portland through credit cards, and the City Auditor LaVonne Griffin-Valade said those transactions did not comply with industry security standards.

“We found that since 2009, the City has remained out of compliance with the payment card industry data security standard,” Griffin-Valade said. “The City has never complied with all of the standard’s requirements, and the City has not fully implemented recommendations or remediation steps to secure payment card processing.”

Spokesman for the Mayor of Portland Dana Haynes said he had seen the finding but could not comment on the details, except to say that credit card data given to the city was secure.

“This is not about a data breach,” Haynes said. “It should not be equated as the same thing.”

Director of Audit Services Drummond Kahn, agreed that there was no data breaches that he had seen.

"But the standards are there for a reason," Kahn said. "The city is required by law to comply."

Kahn said the Bureau of Technology Services has been issuing budget reports since 2009 stating that it was in compliance with all standards. However, that was not the case and that the city was now vulnerable to fines imposed by banks and credit card companies that could be as high as $500,000 each.

Jen Clodius, senior management analysis with the city's Office of Management and Finance said that the industry standards are a grouping with 275 conditions.

"If you miss one, you are out of compliance," Clodius said. "It's all or nothing."

Clodius said that independent audits had reported for years that the city was out of compliance. She said the city has been working on the problem for a while now and that there was nothing in the auditor's report that was surprising.

"I don't think anyone [at the city] was surprised," Clodius said. “The city has been gradually getting better, BTS has been working on it."