WASHINGTON A federal audit has found that many state motor vehicle departments are still experiencing delays in posting traffic convictions in the commercial driver history database and arent adequately protecting driver data.

Both problems are key shortcomings in a system thats intended to pinpoint drivers who perhaps shouldnt be on the road.

Among the 500,000 commercial drivers with out-of-state convictions, about 20 percent or 99,000 drivers, did not have their convictions posted on the Commercial Driver's License Information System in a timely way, the audit found.

The problems were highlighted in the audit by the Office of Inspector General of the Federal Motor Carrier Safety Administration, which oversees the Commercial Drivers License Information System.

The FMCSA says it will correct the CDL database shortcomings, including recommendations that it improve the database so unqualified drivers will be less able to obtain CDLs or renewals, and drivers information will be better protected against computer hackers.

While the FMCSA oversees the Commercial Drivers License Information System, it is administered by the American Association of Motor Vehicle Administrators.

The system does not contain driver histories but directs inquiries to the state of record. Completeness of driver conviction data depends on the courts providing state departments of motor vehicles with timely information and on department officials updating driver histories promptly.

Since 2005, notification to another state of traffic violations has been required within 30 days of conviction. States must post convictions within 10 days of the conviction if it occurred within that state, or within 10 days of notification of conviction if it is from another state.

The FMCSA Inspector General also found agency officials have not enforced requirements that systems be accredited as adequately secure.

Federal regulations require systems be inventoried and authorized or accredited as secure before beginning or significantly changing system processing, and reauthorized every three years.

But the contractor managing the system apparently was unaware of this requirement and it was not required in the contract.

The auditors found weaknesses in the system that could have been identified in an accreditation process. User names and passwords were being transmitted without encryption and the website was vulnerable to hacker attacks.

Finally, the audit also found there was a contingency plan but it has never conducted a disaster recovery exercise for the system.

The FMCSA presented plans with timelines for correcting the issues, including dealing with the certification and accreditation issues.