The Threat You Never See Coming
Most people worry about hackers sitting in foreign countries breaking into computer systems from thousands of miles away. But some of the most damaging cybercrimes happen much closer to home, carried out not by shadowy outsiders but by trusted insiders who already have the keys to the kingdom.
On July 28, 2026, the South Carolina Law Enforcement Division charged a former employee of the South Carolina Department of Motor Vehicles with crimes that strike at the heart of that insider threat. The case is a reminder that your personal information is only as safe as the people who have been given access to it.
What Happened
According to SLED’s press release and the arrest warrants attached to it, Keshawn Aude Milling, 27, of Florence, South Carolina, was charged with three felony counts: Criminal Conspiracy, Forgery valued at $10,000 or more, and Computer Crime in the First Degree valued in excess of $10,000. He was booked into the Florence County Detention Center on July 28, 2026, and the case will be prosecuted by the 12th Circuit Solicitor’s Office. The investigation was requested by the South Carolina Department of Motor Vehicles and conducted by SLED.
The arrest warrants, which Dr. Tom has reviewed in full, lay out a detailed picture of what Milling is accused of doing.
What the Warrants Say
According to the affidavit sworn by SLED Investigator Christopher P. Cestare, the alleged crimes took place between October 1, 2025, and July 20, 2026, in Florence County. During that period, Milling was working as a clerk at the Florence SCDMV office. According to the warrants, he used that position of trust to allegedly carry out three distinct but connected crimes.
On the conspiracy charge, the warrants allege that Milling committed the crime of conspiracy to obtain goods under false pretenses. Specifically, during the execution of his official duties as a clerk, he allegedly knowingly completed fraudulent transactions for customers at the Florence SCDMV office, including lien releases, duplicate titles, and title transfers. These transactions resulted in property in excess of $10,000 being defrauded from the original lien holders and diverted to his co-conspirators.
On the forgery charge, the warrants allege that Milling knowingly and willfully caused counterfeit documents to be made. Those documents were then used to aid his co-conspirators in conducting the fraudulent transactions, including fraudulent lien releases, duplicate titles, and title transfers, again resulting in more than $10,000 being defrauded from the original lien holders.
On the computer crime charge, the warrants allege that Milling willfully accessed the SCDMV computer system and knowingly conducted fraudulent lien release transactions with the intent to defraud victims of their property. The transactions resulted in property being defrauded from the original lien holders to his co-conspirators. This charge is classified as Computer Crime in the First Degree under South Carolina law, which applies when the value involved exceeds $10,000.
Taken together, the warrants paint a picture of an alleged scheme in which a trusted government employee used his access to a state computer system to fabricate documents and process fraudulent transactions, stripping lien holders of their legal interests in vehicles and funneling the proceeds to a network of co-conspirators.
What Is a Lien Release and Why Does It Matter
For readers who may not be familiar with how vehicle titles and liens work, a brief explanation is helpful here.
When you finance a car, the lender places a lien on the vehicle title. That lien means the lender has a legal interest in the car until the loan is paid off. A lien release is the official document that removes that claim once the loan is satisfied. A duplicate title is a replacement copy of the vehicle’s ownership document.
If someone with access to the DMV’s computer system can fraudulently process lien releases and duplicate titles, they can effectively erase a lender’s legal claim to a vehicle on paper, making it appear that the vehicle is free and clear when it is not. That fraudulent documentation can then be used to sell, transfer, or otherwise exploit vehicles that the seller has no legitimate right to fully control. The victims in this case are the original lien holders who held legitimate legal interests in those vehicles and found those interests fraudulently wiped away.
The Insider Threat: The Cybercrime Risk Nobody Talks About Enough
Most public attention in cybersecurity goes to external hackers, phishing emails, ransomware gangs, and foreign adversaries. But according to the FBI, insider threats consistently account for some of the most costly and damaging breaches in both the public and private sectors.
An insider threat is exactly what it sounds like: a current or former employee, contractor, or trusted individual who uses their legitimate access to systems, data, or facilities to cause harm, whether for personal gain, on behalf of outside co-conspirators, or for other reasons. What makes insider threats so dangerous is precisely what the Milling case illustrates. The access was legitimate. The credentials were real. The transactions looked, on the surface, like normal DMV business. There was no external intrusion to detect because the person doing the damage was already inside.
This is why background checks, access controls, audit logs, and behavioral monitoring matter in government agencies that handle sensitive public records. And it is why the SCDMV’s decision to refer this case to SLED for investigation is exactly the right response when internal anomalies are detected.
What South Carolinians Should Know
The Milling case involves lien holders as the direct financial victims, meaning the immediate harm falls on lenders and financial institutions rather than individual drivers in most instances. However, the case raises broader questions worth considering.
If you have recently conducted any DMV business in Florence County involving a lien release, duplicate title, or title transfer, it may be worth verifying that your transaction was properly processed by checking your title status directly with the SCDMV. You can check vehicle title records online at scdmvonline.com.
If you are a lien holder, whether a bank, credit union, or private lender, and you have vehicles with liens recorded in Florence County, a review of recent lien release activity on those accounts is a prudent step given the scope of what the warrants allege.
More broadly, this case is a reminder that the security of government databases depends not just on firewalls and encryption but on the integrity of the people who sit at those keyboards every day. When that trust is violated, the consequences ripple outward to ordinary citizens who never imagined that a routine DMV transaction could be weaponized against them.
Milling is presumed innocent unless and until proven guilty. The case will be prosecuted by the 12th Circuit Solicitor’s Office.
Stay safe out there, and I will see you next week!
Feeling lost in the digital world? Dr. Tom is here to help!
Sign up here to receive the Tega Cay Sun "day" Spectator every Sunday morning with all the news from the week directly to your inbox
Thomas Hyslip lives in Tega Cay with his wife and daughter. After 27 years in the U.S. Army and Federal Law Enforcement, he retired to pursue his passion for teaching. Tom is now an Assistant Professor of Instruction at the University of South Florida. In 2 short years he has won 10 awards from the South Carolina Press Association, including first place in column writing, education beat reporting and best podcast.
