TAMPA — The last time state auditors looked, Tampa police got a passing grade for preventing employees from exploiting Florida's drivers license database as a hunting ground for identity theft.
"Complies with these requirements," the state Department of Highway Safety and Motor Vehicles reported in mid May.
But by then, a Tampa police detective had raised alarms about a co-worker, homicide Detective Eric Houston.
Police turned the information over to federal prosecutors, and the resulting investigation is exploring whether Houston and two other department employees ransacked the Driver and Vehicle Information Database, known as DAVID, violating the privacy of thousands of Floridians.
"This case shows us that the department needs a more thorough review," police spokeswoman Laura McElroy told the Tampa Bay Times this week.
So now police Chief Jane Castor is ordering the department's newly created Professional Standards Bureau to do its own, more detailed audit of DAVID and to propose more internal controls.
Scrutiny might not end there.
Mayor Bob Buckhorn has not asked the city's Internal Audit Department, which is separate from the Police Department, to do its own review, but "in light of what has taken place, I may."
"That was a flagrant abuse," Buckhorn said. "Everyone recognizes it. … We want to do whatever we can to ensure that data is safe."
Buckhorn said he was shocked by allegations outlined last week in a sworn statement from Tampa police Detective Sharla Canfield, who serves on an IRS-Criminal Investigation task force. According to her investigation:
• From 2010 to 2012, Houston ran thousands of searches on DAVID or a similar FBI database. An IRS analysis found that about 4,600 of the people he looked up appeared to have had fraudulent federal income tax returns filed in their names.
• Houston's wife, then-Tampa police Sgt. La Joyce Houston, in 2012 used DAVID to look up a woman who weeks later had a false tax return filed in her name. A $9,615 tax refund was paid to a debit card issued in the name of Rita Girven, a Tampa woman with close ties to the Houstons.
• Tonia Bright, a Police Department civilian employee who recently resigned, searched DAVID and the FBI database 13,000 times in one year. That's "far more" than her job required, Canfield wrote. Bright and Girven were friends, and Girven often visited Bright at work. Over two years, someone used 120 of the names Bright ran to file fraudulent returns.
• About 21 people whose names were searched by Bright or Eric Houston not only had fake tax returns filed in their names, but were victims, witnesses or defendants in cases investigated by Houston or his squad.
One of those people was a dead person, identified by the initials D.A., whose fraudulent tax refund was loaded onto a debit card in Girven's name, according to the affidavit. Moreover, D.A.'s tax return was filed on the same computer used to file 97 other returns seeking refunds totaling more than $894,000.
The Houstons were fired: she in October, when she also was arrested on state charges of food stamp fraud and grand theft, and he in April. A federal grand jury investigation is expected to last at least through Labor Day.
Buckhorn said he thinks any Police Department problems with DAVID are the result of a few bad actors.
"I don't think it's systematic," he said, adding that hundreds of officers use DAVID to do good. "To find one, two, three bad apples in the mix as a percentage of the whole is probably pretty small."
At the Tampa Police Department, 932 employees have access to the database, a smorgasbord of personal data, including full names, dates of birth, addresses, photos, Social Security numbers, vehicle information and telephone numbers for a driver's next of kin. (Some government agencies don't have access to photos and certain other data.)
With hundreds of Florida agencies using DAVID, usage varies, with spikes during spring break or holidays with lots of DUIs. Still, in April the DAVID system processed an average of 155,000 requests per day statewide, according to Department of Highway Safety and Motor Vehicles spokesman John Lucas.
The Florida Department of Law Enforcement historically has authorized access, but a new version of DAVID now being put in place shifts that responsibility to administrators at each law enforcement agency. Each user has to take a video training course and score 80 percent or better on a qualifying exam to get a password.
As part of the move to the new DAVID system, Tampa police administrators began revising their policies in April and added more changes this week.
The new system allows each agency's administrator to tailor what information is available based on an employee's job, "so that the people who are accessing (DAVID) are only accessing it for the information they need to get," Lucas said.
Four times a year, Tampa police administrators randomly select 10 users' names and check their searches. Eric Houston's name never came up in those spot checks, McElroy said.
Unconnected to the Houston investigation, a department attorney has twice warned employees in the last year not to use DAVID for anything but official police business. The federal Driver's Privacy Protection Act allows people whose data has been breached to sue the officers responsible and collect up to $2,500 for each violation.
Last year, the Florida Criminal Justice Standards & Training Commission opened 73 cases related to allegations of misuse of DAVID by sworn officers.
"Officers need a tool like DAVID to do their jobs," McElroy said. "They are expected to use the system appropriately. When they don't, we take swift action as we've done in the Houston case."
Times staff writer Peter Jamison and researcher John Martin contributed to this report.