|
October 13, 2026 Via Email & Docket Upload
Ms. Nelda Z. Smith,
Principal Assistant Inspector General for Auditing and Evaluation
United States Department of Transportation Office of Inspector General
1200 New Jersey Ave SE, West Building, 7th Floor
Washington, D.C. 20590
Re: SBTCs Request to OIG for FMCSA Data Release & Security Audit of UCR.gov
Dear Ms. Smith,
The Small Business in Transportation Coalition (SBTC) hereby files this complaint with the USDOT’s Office of the Inspector General and requests a formal audit of the FMCSAs pattern and practice of releasing, through daily download, independent truckers personally-identifiable-information (PII) without their knowledge and consent to the so-called UCR Plan and its Seikosoft vendor in terms of compliance with the Privacy Act.
Under FMCSAs attached 2007 UCR data release policy, which FMCSA’s FOIA office recently advised the SBTC has never been amended by FMCSA, FMCSA is to release truckers PII only to bona fide UCR-participating state governments. Up until 2018, truckers’ data were properly released by FMCSA to the state of Indiana, which is a state that participates in the “UCR Agreement,” and operated the UCR platform under MOU with the UCR Board of Directors, copied here via email. In 2018, the UCR Plan ceased contracting with Indiana and instead contracted with a private IT company called Seikosoft, which now receives daily data downloads as the technical platform agent of the UCR Plan. However, as we recently brought to the attention of the U.S. Court of Appeals for the D.C. Circuit (Case No. 25-1290), neither the UCR Plan nor its technical platform vendor is a bona fide state government eligible to receive truckers’ PII under the 2007-stated FMCSA data release policy or as a matter of the “routine use” exemption to the Privacy Act.
We believe Seikosoft is engaged in the practice of “data mining” in furtherance of its debt collection software marketed through www.seikosoft.com/simplicity/ and that having unfettered access to truckers’ PII, including social security numbers, is a serious conflict of interest and poses significant risk for abuse of truckers’ privacy rights under Federal law.
1750 H. Street NW, Ste 360, Washington, DC 20006 (202) 587-2751
Ms. Nelda Z. Smith
October 13, 2026
As a result of this unauthorized release and mishandling of PII data, SBTC discovered and reported to FMCSA in 2019 a UCR.gov data breach, which is reported by the UCR Plan to the public through its plan.ucr.gov website (see attached UCR press release).
Comes now, the SBTC to respectfully request an OIG audit of the security controls for the UCR.gov information technology infrastructure. Specifically, we request you please audit FMCSAs compliance with the Privacy Act and determine whether UCR.gov is (1) secure from further compromise; and (2) if security weaknesses currently exist within UCR.gov.
The UCR.gov site should be operated in accordance with the National Institute of Standards and Technology’s (NIST) guidance on information security and DOT’s cybersecurity policy since the UCR System Plan amp; Agreement is supposed to be a component of FMCSA under 49 U.S.C § 13908.[1] The public has the right to know whether FMCSAs UCR.gov management practices[2] create security weaknesses that make its IT infrastructure vulnerable to compromise and whether FMCSA’s UCR.gov oversight practices (or lack thereof) for the network space UCR Plan contracts out creates risks for compromise. SBTC seeks to understand if UCR.gov maintains a complete inventory of its network devices because NIST’s guidance and DOT’s policy require Operating Administrations to maintain up-to-date inventories of systems’ components and devices.
Thank you for your consideration.
Sincerely,
/s/ JAMES LAMB
SBTC Executive Director
cc:
Hon. Secretary Duffy via email
Hon. Derek Barrs, FMCSA Administrator via email
FMCSA Staff, UCR Staff & Board Members et al
Laurence Socci, Esq. via email
[1] https://www.fmcsa.dot.gov/ucr
[2] According to the Federal Register, UCR Plan is an FMCSA agency filer: https://www.federalregister.gov/agencies/unified-carrier-registration-plan
| 
