Some of the names belonged to young adults who were sleeping in their cars. Others were pregnant high schoolers. Some became homeless after fleeing domestic violence, or being kicked out of their homes.
Nearly every name logged into the datasets came with a wealth of sensitive, deeply private information: Full name. Birthdate. Current housing status. Gender identity and sexual orientation. Sometimes the data included health information about pregnancy, mental health, addiction.
Until earlier this month, all of this information and then some was publicly accessible.
A few clicks through online data dashboards run by A Way Home Washington, one of the state’s most prominent homeless youth advocacy and support organizations, allowed unrestricted access to dozens of different fields of private information on hundreds of young clients who were homeless or close to becoming so.
Julie Patiño, A Way Home Washington’s executive director, said in an interview that the data exposure had resulted from human error. She added that the mistake was neither malicious nor intentional. Crosscut discovered the problem during separate reporting and notified A Way Home Washington. Within a half hour of that notification, both dashboards required passwords for access.
A Way Home Washington and the Washington Department of Commerce, whose Office of Homeless Youth works closely with A Way Home Washington, are now investigating what happened. Key questions remain unanswered, including the source of the raw data and whether A Way Home Washington will notify those whose private information was exposed.
Complicating matters is A Way Home Washington’s structure not as an independent nonprofit but as a fiscally sponsored organization of a massive Boston-based nonprofit. Intentionally or not, this arrangement, unique to the nonprofit world, limits transparency into A Way Home Washington’s operations.
Real-time metrics
A Way Home Washington’s stated mission is to prevent and end youth homelessness. It touts real-time data as key to reaching that ambitious goal and to ending rampant inequities in youth homelessness, where youth of color and LGBTQ+ youth are overrepresented.
That’s why A Way Home Washington had that data online in the first place. Through colorful data visualizations, two dashboards tracked metrics on who received help, including by race, and where funding had been spent — rent, security deposits, utilities or other necessities to find or keep housing.
But A Way Home Washington revealed much more than the organization intended to, Crosscut found. Dashboard icons turned out to be portals to the raw data behind the visualizations — the names, birthdates and other private information.
“We are confident that this situation inadvertently occurred with a very recent transfer of encrypted platforms,” Patiño wrote in response to written follow-up questions. She did not specify how long the raw data had been accessible.
Patiño added that so far A Way Home Washington had found no evidence that anyone unauthorized, other than Crosscut, had accessed the information, although it is still investigating.
Both dashboards were hosted by Tableau, the Seattle-based data-visualization software company, which has donated nearly $1.5 million to A Way Home Washington. A spokesperson for Tableau acknowledged receipt of initial queries from Crosscut but did not respond to a list of questions.
“Tableau is simply a platform,” Patiño wrote. “We were provided use of this platform through a grant from them. They do not have access to any of our dashboards nor have they had any role in their creation or use.”
One dashboard, for the Homelessness Prevention and Diversion Fund, seems to be a few years old; the program launched in August 2020 and the actual dashboard is mentioned online as far back as July 2021. The Youth Diversion Infrastructure Project, for which the other dashboard was created, started this year.
“Systems have always been in place to maximize the security of data,” Patiño wrote. “We have implemented additional safeguards since being informed of the recent situation by Crosscut, and we will take additional actions as needed to maximize security based on the results of our investigation into the matter.”
Although the two dashboards were not featured on A Way Home Washington’s website, they were easy to find online through search engines, whose results pointed users to a different website, also run by A Way Home Washington, that led to both dashboards.
It was also possible that in the future the dashboards might have become far more readily available. In an interview at the end of June, Patiño shared that A Way Home Washington was redoing its main website and that, once it was finished, the dashboards would “absolutely” be easier to find through that website.
In that interview she described the dashboards’ real-time data, a featured element in A Way Home Washington’s work, as critical to tracking what she called its success in reducing homelessness and inequities.
Last fall The Seattle Times examined another data-driven initiative — distinct from the programs whose dashboards exposed data — that A Way Home Washington rolled out in four communities. That story found that while youth and young adult homelessness had declined in one (Walla Walla), it had risen in the other three. A Way Home Washington contended that youth homelessness was not necessarily increasing but “being elucidated,” and the Times did find that the initiative had helped bring more funding to those communities.
If found by the wrong people, the exposed data could have put vulnerable people in more danger, especially those fleeing domestic violence or sex trafficking. In most cases, if a person was designated as such, only their first and last initials were listed, but in three instances in one database, full names were listed.
In some cases, where a person was living was also potentially accessible, because the dataset showed where or to whom program administrators had sent money to pay a young person’s expenses, including rent payments or security deposits.
Each dataset also contained a column with brief but sometimes detailed narratives of personal history, including abuse and other trauma. The dataset for the Youth Diversion Infrastructure Project, a program focused on youth involved in state-run systems, also listed involvement in systems like juvenile detention, foster care, and substance use and behavioral health treatment facilities.
That dataset contained 152 entries. The Homelessness Prevention and Diversion Fund dataset contained 1,811 entries. The actual number of people covered is smaller, because a name could be listed multiple times.
Ages ranged from just a few months old to 25 years.
What is A Way Home Washington?
The state has invested millions of dollars in projects run by A Way Home Washington. Since 2022 alone, it has granted nearly $2 million to Third Sector New England, a nonprofit in Boston with more than $1 billion in assets that since 2016 has been the fiscal sponsor of A Way Home Washington.
Scholars have noted that fiscal sponsorship, a creation of the nonprofit world, lacks a clear legal definition. Third Sector New England, which has taken dozens of fiscally sponsored organizations under its wing, explains that fiscal sponsors are registered charitable corporations that can grant an unincorporated initiative with an “aligned” mission “a tax-exempt home” and take on its administrative work (for a fee), allowing the initiative to focus on its mission and avoid bureaucratic hassles.
Sponsored programs are legally part of their sponsoring organization, which is why a nonprofit-consulting nonprofit in New England is part of this story. That means, too, that there is less transparency into A Way Home Washington than there would be if it were its own registered entity with incorporation records and tax filings. Third Sector New England declined to share with Crosscut a copy of the fiscal sponsorship agreement it holds with A Way Home Washington, saying it was confidential.
A Way Home Washington’s own materials, notably, describe itself as a “movement” or a “campaign.” A list of FAQs does not mention its fiscal sponsor. Nor does an About Us page on its website, which names First Spouse Trudi Inslee as a co-chair and champion of the group. That page also highlights philanthropists and charities, like the Raikes Foundation, the Campion Foundation and others, that have donated to it.
(Disclosure: The Raikes Foundation has provided funding for previous and ongoing reporting projects via Crosscut’s partnership with Youth Today. Crosscut and Youth Today maintain complete editorial control over this and any related stories.)
In response to a request for comment, a spokesperson for Inslee said, “Mrs. Inslee is confident A Way Home Washington will continue to successfully reduce youth homelessness through its preventative and supportive programs.”
Third Sector New England and A Way Home Washington are investigating what happened, a lawyer representing both organizations wrote in a July 14 letter to the state Department of Commerce. Whether A Way Home Washington and its sponsor will notify youth and young adults whose information was available remains to be determined, according to that letter and to A Way Home Washington.
In response to a request for comment, Third Sector New England said that it believed in A Way Home Washington’s mission, adding, “We continue to support them and their movement to write a new future for young people across the state of Washington.”
The Department of Commerce is also investigating. Part of its probe includes “determining the source of the data,” a spokesperson for the department said. “At this time we do not know if it is from the [Homeless Management Information System] or how it came to be placed in publicly available dashboards.”
A Homeless Management Information System is an electronic record system, managed either locally or by the state, that contains information, including extremely private data, about homeless people. It is gathered by organizations providing services to them. Both of A Way Home Washington’s databases that exposed private information contained individuals’ Homeless Management Information System ID numbers.
Organizations are required to collect this data in order to receive federal dollars, although according to Washington’s Release of Information and Informed Consent form, clients can be, but are not necessarily, required to share personal information in order to receive services. State law on HMIS mandates that “safeguards consistent with federal requirements on data collection must be in place to protect homeless individuals’ rights regarding their personally identifying information.”
In an interview, Patiño declined to answer a question about the source of the data. In subsequent responses to written questions, she avoided directly answering that same question, instead stating that A Way Home Washington did not receive HMIS data from the Department of Commerce. “Data is received directly from providers that AWHWA certified to be able to make requests to fund,” she wrote.
She declined to respond to follow-up questions seeking clarification, including on whether A Way Home Washington had access to HMIS data from sources that are not Commerce.
The right to privacy
Patiño said that A Way Home Washington understood “the gravity of the situation” but called the exposure “minimal.”
“I personally just feel like this is going to do so much more harm than good,” Patiño said of this story. “I wish you were reporting on all the things we do right and no one else has done right and no one else has been able to move the dial on. It’s antithetical to what I would think Crosscut is about.”
Crosscut has previously reported on a variety of efforts to address youth homelessness across the state, including stories on A Way Home Washington’s work.
So far, A Way Home Washington said, it has notified the Department of Commerce and the agencies, coordinators and fiscal administrators that are part of the Homelessness Prevention and Diversion Fund and the Youth Diversion Infrastructure Project.
Those notifications did not include the people whose private information was publicly accessible. Third Sector New England and A Way Home Washington’s lawyer wrote in the letter to Commerce that “TSNE’s investigation has not yet determined that notification is required to any Washington resident(s), consumer(s), or customer(s).”
Experts say that even if exposure was minimal, harm was done.
“Unhoused people have the same right to privacy as anyone else,” Jennifer Lee, technology policy program director with the American Civil Liberties Union of Washington, said in an interview. “These organizations that are collecting data about vulnerable individuals have a real obligation to safeguard that information to the highest degree.”
Once the information is online, she added, it’s difficult to know how it is used.
“Just because the intent [of gathering data] seems innocuous or helpful doesn’t mean there’s not the potential for a lot of harm,” Lee said.
Emails obtained through a public records request show that Patiño lobbied this past spring for access to Homeless Management Information System client-level data to guide A Way Home Washington’s Anchor Community Initiative (ACI) — an effort distinct from the Homelessness Prevention and Diversion Fund and the Youth Diversion Infrastructure Project.
“The cornerstone of the ACI model is the establishment and use of real time quality data at the community level, which enables ACI communities to take strategic, immediate, actionable efforts to reduce and prevent homelessness for young people,” read the proposal, which A Way Home Washington later withdrew.
The data “shall include demographic information such as race, ethnicity, gender and sexual orientation for use in coaching Anchor Communities and helping those communities build data literacy [and] structural data capacity,” the request stated. The data would feed “AWHWA created dashboards which allow for the synthesis of data for purposes of reducing homelessness” and addressing inequities.
“AWHWA will hold client level data confidentially and not publish it,” it concluded.
window.addEventListener('DOMContentLoaded',()=>{fetch(`https://www.google-analytics.com/mp/collect?measurement_id=G-QCJDXX4VFK&api_secret=KQLK8PlFTqKTOwqBrlj21w`,{method:'POST',body:JSON.stringify({client_id:'555',events:[{name:'pageview',params:{'page_location':"httpsu003A//crosscut.com/investigations/2023/07/wau002Dhomelessnessu002Dgroupu002Dexposedu002Dsensitiveu002Ddatau002Dkidsu002Dyoungu002Dadults",'page_referrer':window.location.href,'page_title':"WAu0020homelessnessu0020groupu0020exposedu0020sensitiveu0020datau0020onu0020kids,u0020youngu0020adults",},}]})});});