turbodata.com

TICKET ISSUED: How Turbo Data Systems Built a Dossier on Half of California From a Slip of Paper Under Your Windshield Wiper

PROLOGUE: THE SLIP OF PAPER UNDER YOUR WIPER

A parking ticket is the most trivial document that can enter your life. A scrap of paper under the windshield wiper. Forty dollars. Most people pay and forget about it.

Behind that scrap of paper stands a private company that knows more about you than your bank does. It knows your license plate number. It knows who the vehicle is registered to — it has a direct online interface to the DMV database and access to the national NLETS network, which returns vehicle owner records from all fifty states. It knows your home address. And if you didn't pay on time — it purchases your Social Security number from a third-party data broker so it can intercept your state income tax refund through the Franchise Tax Board. Or your lottery winnings. At the same time, your debt gets reported to a credit bureau, and your car gets flagged for a registration hold.

That company is Turbo Data Systems, Inc. Over more than forty years, it has become the invisible operator of the ticketing machine for more than 130 cities, police departments, universities, and hospitals across California . Through it flows the issuance of citations, the collection of payments, the placement of vehicles on registration holds, and the referral of debtors to the state tax authority, collection agencies, and credit bureaus. All of that work has accumulated in one digital archive: names, addresses, license plates, VINs, Social Security numbers of motorists, banking details for 130 municipal accounts, tax forms and medical records belonging to the company's own employees, and confidential pricing documents from competitors. We have over a quarter of a terabyte of data — more than 230 gigabytes.

This article contains only a portion of the data we have chosen to disclose. Everything else will be available to download and review independently once the full archive is released.

Part I. Who Is Turbo Data Systems

Turbo Data Systems, Inc. (TDS) is a California-based private company, a certified small business that is 100% woman-owned , operating in the citation processing market for more than 40 years . Two offices:

1551 N Tustin Ave, Suite 950, Santa Ana, CA 92705 (tel. 714.573.5757);

210 N. 4th Street, Suite 150, San Jose, CA 95112 — Northern California operations center: processing, call center, payment office, technical support.

Leadership:

Roberta J. Rosen — President ( roberta@turbodata.com , 714-368-4808);

Elie M. Sleiman — VP/CIO and corporate secretary, signatory on contracts;

Business development — Greg Fox ; client services for tax intercepts — Denise Ortega .

From a bid proposal dated May 29, 2026 — in the company's own words:

For more than 40 years, TDS has supported municipalities and agencies… Clients utilizing our services consistently achieve collection rates between 85% and 95% through integrated access to California DMV records, NLETS out-of-state vehicle data, Franchise Tax Board collection services, and ICS collection notices."

What the company does:

Issues citations. Its proprietary product ticketPRO (Magic, Mobile, ticketPRO Traffic for iOS) — hardened Samsung Xcover smartphones and Zebra/TSC printers that allow an officer to print a citation on the spot, with photo documentation, an "electronic chalk" feature, and license plate recognition. This is TDS intellectual property, and every contract requires the client city to keep the system confidential.

Processes citations. Data entry for citations, dispositions, returned checks, payment plans; the web portal [Link entfernt], card and IVR payments; appeals through eAppealsPRO ; permits through getaPERMIT / [Link entfernt] .

Enforces. DMV registration holds, maintaining a "scofflaw" file for boot and tow operators, referring accounts to the collection agency (ICS) and the state tax authority (FTB), reporting delinquent accounts to credit bureaus.

Collects money. Daily courier pickup of checks, remote scanning and deposit to the city's account, daily and monthly reconciliation.

A city hands TDS its entire citation operation from end to end — from printing the receipt to intercepting the tax refund. Dozens of municipalities do exactly this.

Part II. The Money: 130 City Budgets Through One Private Pipeline

The Price List of Enforcement

TDS's budget proposal for the City of Indio (July 2024) breaks the machine down by fee — verbatim:

Service Rate Basic processing, electronic citation $3.00 per citation Basic processing, hand-written citation $5.00 per citation Notice mailings $0.95 per letter Collection agency (ICS) 25% of amount collected FTB tax intercept referral $2 per letter + 15% of amount paid Card payment convenience fee (paid by the motorist) $4 or 4% — whichever is greater

The last line is the key one: the "convenience" fee is paid not by the city but by the person receiving the citation — a minimum of four dollars or four percent on every card payment. The city pays TDS almost nothing. The company earns its revenue from the citizens themselves. Where the contracts run large, the scale is visible: the service contract with the City of Fresno is valued at $508,640 .

The processing log is a table of more than one million rows , with daily batches through June 2026: date, agency, operator, number of citations in the batch, dollar amount, deposit date, bank bag number. On certain days, a single batch for a single city runs to nearly two thousand citations: Compton — 2,103 in one day, Newport Beach — 1,906. Agencies in the log include Azusa, Brea, Compton, Lancaster, Malibu, La Mirada, Carlsbad, CSUN, RCCD, and dozens of others. This is an assembly line that runs every day.

Every City's Bank Account — In a Single Form

To deposit collected funds, TDS maintains the banking details of every client. The archive contains ACH Authorization Forms with explicit fields:

Bank Name / Bank Routing Number / Bank Account Number… If you change banks or accounts, please provide at least thirty (30) days written notice."

We have the routing numbers and account numbers for municipal treasuries — the very accounts into which TDS deposits citation payments by remote scanning. The company also holds "FBO" (for the benefit of) accounts: for example, a checking account statement opened for Santa Clara University "C/O Turbo Data Systems Inc." TDS's own financial reference is Wells Fargo Bank .

Cards, Billing, and the Company's Own Compliance Failures

Citizen payments flow through card acquirer TSYS (with a separate merchant registration (VAR) under TDS for each city) and gateways including CyberSource → Paymentech , [Link entfernt], Converge, and PayArc. The archive contains the company's own merchant IDs ("Turbo MIDS," 2025–2026), monthly postlogs (for example, for the Alameda agency through CyberSource: thousands of transactions per day), and raw gateway data: daily Credit Card Payments and Surcharges reports for 2024, authorization logs marked "CARD EXPIRED" and "INVALID ACCOUNT NUMBER" . All of this feeds into a daily consolidated reconciliation — net sales, deposits, postlogs, and chargebacks across all agencies and all processors in a single table for each day. The financial scale is visible directly in those records: one reconciliation from 2025 (bearing the president's initials, RJR) shows that the citation payment portal alone processed $4,536,688 in a single month — March 2025 — approximately $150,000 per day, with a single-day peak of $256,220 . And that covers only card payments through the website and phone — not checks by mail, ACH transfers, collection agency recoveries, or tax intercepts. Also in the archive are the documents that are supposed to protect all of this: PCI compliance certifications , VISA Self-Assessment Questionnaires including ones as recent as November 2025 (Palo Alto, Santa Monica). The document designed to protect cardholder data is sitting in the same unprotected dump as the cardholder data itself. A separate folder contains materials related to a class action lawsuit by Discover cardholders against merchants (2026) — in which TDS itself appears as a named merchant defendant.

The company also holds citizen funds "on hold": registers and continuous unclaimed property and refund reports for 2024–2026 with the names and amounts owed to people by their city.

Part III. What We Have

A Machine for Accessing Other People's Data

TDS describes its own service directly — this is its own specification, not an outside assessment:

DMV online interface for retrieval of registered owner names/addresses; DMV online interface for placing and releasing registration holds; DMV Payment Tape processed monthly."

And this is not a figure of speech: we have a signed TDS application for a commercial DMV requester account . It establishes that the company has direct computer-to-computer online access to the DMV database (status: Special Permit Holder, one-time fee of $10,000 ). The application was signed by president Roberta J. Rosen ; the designated Access Control Administrator is Elie M. Sleiman, VP & Chief Information Officer . This is further confirmed by the DMV itself: we have a letter from the DMV dated January 10, 2022, in which it approved Turbo Data Systems' online access to its database through the California Department of Technology and incorporated the company's "network topology and security description" into the account agreement. In other words, a private firm based in Santa Ana can in real time pull names and addresses of vehicle owners from DMV records and place and release registration holds on vehicles itself — without any additional step from the government. Beyond that, the company has access to NLETS (National Law Enforcement Telecommunications System) to retrieve vehicle owner data from all 50 states, along with a NLETS audit certificate and a non-disclosure agreement with NLETS signed by Roberta J. Rosen .

Access to driver personal data in the United States is governed by the federal Driver's Privacy Protection Act (DPPA, 18 U.S.C. §§ 2721–2725) and in California by the Vehicle Code. The archive also contains a DMV training guide that TDS is required to comply with: unauthorized use of the data carries a civil penalty of up to $100,000 and revocation of the requester code for up to five years; intentional disclosure carries criminal liability; "each transaction record is maintained electronically." There is also an explicit requirement: when records are no longer needed, they must be "destroyed so as to make them unreadable and irrecoverable." Instead of being destroyed, over a quarter of a terabyte of those records ended up outside the company — along with court data tables and SQL exports.

Addresses the Law Protects — Inside the Same System

The DMV has a Confidential Home Address Program (CHAP) — a program that by law conceals the home addresses of people whose safety is at risk: active and former law enforcement officers, judges, prosecutors, inspectors, correctional employees — and their spouses and children . In the DMV record, the real address of such a person is masked, replaced by the name of their agency. To enroll in this protection, the system requires exactly the data it is designed to hide: driver's license number, full date of birth, current home address, and license plate numbers for the protected person and family members (up to 10 people and 10 vehicles per application).

And Turbo Data Systems is inside that perimeter. As the operator of direct DMV access on behalf of its client agencies — which include the San Mateo County Sheriff, the California Highway Patrol (CHP), school police, and dozens of municipal police departments — the company is included in DMV communications about CHAP and operates within its process. We have department notices regarding the automation of the program, with personal review notations: president Roberta Rosen (May 2024), Tanya Nguyen (May 2025). The company that ended up holding the levers of a system built to hide the home addresses of police officers and judges from people who might want to find them — failed to protect its own data.

The Citation Database: A Separate File on Every Person

The archive contains individual motorist records — tens of thousands of citation cases identified by last name, and DMV messages with complete data sets, for example:

LANCASTR 24008458 5MMF506 GRANT KEVIN L 1G3AL54N5N6397076 DMV"

Name, citation number, license plate, VIN — all in one line. Records like this exist in the archive for Brea, Riverside, Lancaster, and dozens of other cities. Behind each one is a specific person, their vehicle, their address.

Residents and Homes Under Observation

A separate layer: residential parking permits — named lists of residents with home addresses and personal email addresses, tenant verification forms. The addresses are not just text — they come with precise GPS coordinates : in the San Jose residential zone files, every home is a row containing "street, number, unit" alongside latitude and longitude to six decimal places. TDS also administers residential alarm permits — we have addresses of homes equipped with security alarms and their associated registries. These are not violators. These are simply people who applied for a parking zone permit or registered a home alarm system — whose data ended up in this archive.

Other Companies' Trade Secrets

As a long-time participant in government procurement bids, TDS accumulated extensive intelligence on its competitors. The archive contains confidential bid proposals, price lists, and technical compliance matrices from Data Ticket, Passport (Passport Labs), Conduent, AIMS, IPS Group, Quest Solution, and Comsonics — for specific RFPs; internal chat logs documenting rate negotiations; and even a spreadsheet tracking who downloaded documents from a TDS competitor's public bid. Much of this was obtained through California Public Records Act requests that TDS filed with cities to obtain invoices and pricing from its competitor Data Ticket.

And on TDS's own proposals — this disclaimer:

This proposal contains certain confidential and valuable information in the form of ideas, know-how, concepts, processes, plans and trade secrets that belong to Turbo Data Systems, Inc. … Serious and irreparable competitive disadvantage… could result from the release of any confidential information."

The company understood the cost of its own secrets leaking. The same concern for the citizens' data it collected and purchased is not visible in the archive.

Part IV. The Suppression System

TDS is structured so that information flows toward it — and not back out. Every channel is sealed by a separate legal mechanism.

Confidentiality Instead of Accountability

TDS shields its own pricing proposals from public disclosure by invoking the very California Public Records Act that exists to allow citizens to find out what their city is doing. Its DMV access is similarly wrapped in paperwork — confidentiality forms across multiple agencies (Bellflower, San Fernando, Stanton, and others).

Indemnification: All Risk on the Contractor, but Silence Is Mutual

From the service contract with the City of Fresno — verbatim:

Contractor shall indemnify, hold harmless and defend City and each of its officers, officials, employees, agents and volunteers from any and all loss, liability, fines, penalties, forfeitures, costs and damages… arising or alleged to have arisen directly or indirectly out of performance of this Contract."

TDS assumes full liability before the city. But the same structure also functions as a gag order: every incident is resolved within the "city–contractor" relationship and the history stays out of public view.

Equipment Under NDA

Every ticketPRO deployment agreement contains a prohibition on showing anyone even a screenshot of the system:

ticketPRO is the intellectual property of TDS. CUSTOMER will be responsible for maintaining confidentiality… This includes discussing or exposing features, concepts and screen shots to anyone not associated with the CUSTOMER."

A Confidentiality Notice on Every Email

The standard signature on every TDS employee email declares all content confidential and prohibits its disclosure. The silence machine was built. Protecting the data, however, was another matter.

Part V. Data That Will Destroy Real People's Lives

This is not a figure of speech. We have information sufficient to steal the identities of specific individuals. And these are not company executives. These are ordinary drivers whose only offense was an unpaid parking ticket.

A Social Security Number — For a Forty-Dollar Fine

Here is how TDS, by its own description, pursues non-payers — verbatim from a 2024 proposal:

TDS pursues otherwise uncollectible accounts by retrieving social security numbers from a third party, mailing required pre-intercept letters, and then sending the accounts to the FTB to intercept any state tax refunds or lottery winnings."

In plain terms: you didn't pay your ticket. TDS purchases your Social Security number from a data broker — by name. The broker is named directly: it is TransUnion TLOxp (the TruLookup service, billed under "Schedule: Collections," price list marked "revised May 2025"), which for cents per "hit" returns SSNs matched by name and address. The company then combines your citations under that SSN and sends your account to the Franchise Tax Board , which seizes your state tax refund or lottery winnings to cover your parking balance.

This is not a one-off procedure — it is an assembly line. The archive contains entire SSN databases organized by city — meaning the mass extraction of SSNs is ongoing. The practice is current: correspondence from Denise Ortega with the City of Newport Beach about submitting forms to the FTB Intercept Collection Program for 2024 and 2025 , in which TDS explicitly identifies itself as the city's agent:

As your agent for the FTB process, we need to be listed so we can communicate on your behalf with FTB… FTB collection notification letters will start mailing very soon."

And here is the structure of the output — a table: full nine-digit Social Security number , citation number, license plate, full name, full home address. Multiple citations are merged under a single SSN (the "Combining accounts by SSN" process), and some rows even trace a vehicle's chain of sale ("SOLD TO: …").

SSN Citation Plate Owner Address XXX-XX-XXXX DC017xxx 4KPR3xx M. A. G. Daly City, CA XXX-XX-XXXX 02028xxx 3RJS8xx A. G. San Lorenzo, CA XXX-XX-XXXX 07031xxx 5HAR4xx R. A. G. Daly City, CA

These are not three rows. These are full databases: a single city file contains hundreds of such records, with multiple citations per person, full home addresses included.

The bitter logic: the government gave a private company the power to reach your SSN and your tax refund over a fine the size of a dinner out. That company failed to protect that SSN.

Employees: SSNs, Bank Accounts, Medical Records

Those affected are not only on the outside. Inside the company, TDS's own staff is equally exposed. The archive contains:

Payroll processed through ADP ;

W-4 forms with Social Security numbers for specific employees, direct deposit authorization forms with bank and account details, payroll reports;

Medical and benefits documents : Medicaid denial letters, a Social Security/Medicare application with a re-entry number, an EDD benefits audit, a medical certificate for an employee, an IRS wage garnishment notice for an employee, Blue Shield insurance plan summaries;

Disciplinary records with names (formal warnings, written reprimands), emergency contacts, employee photographs, and a separate folder labeled "Former Employees."

Part VI. A Statewide Network: How One Company Runs California's Citation Machine

TDS is not a single-city operation. The archive contains approximately 140 signed contracts with agencies across California, many of them ac