Sorting the personal from the public

A man in Ohio filed a lawsuit against the secretary of state, claiming that personal information posted on the state’s Web sites violated his right to privacy. An opinion issued by the Texas attorney general found that disclosure of Social Security numbers on the Web is a criminal offense in violation of state and federal privacy laws. In Virginia, a self-proclaimed government watchdog incited fellow citizens to rally against county Web sites that post private information. And in Florida, the legislature passed a law requiring county clerks to scrub Web sites of any personally identifiable information — then twice extended the deadline for compliance. In the Internet era, the line between the public’s right to know and individuals’ right to privacy is as fine as a dulcimer string — and twice as tense. States, counties and municipalities in the past decade have posted to the Web tens of millions of electronic documents, some of which contain Social Security numbers, credit card numbers and other personal data. Agency Web sites were intended to make the machinery of government more efficient and more transparent. But whatever benefit has accrued to government and law-abiding citizens, the proliferation of personal information online has also been a boon to criminals engaged in identity theft, credit and real-estate fraud, and similarly nefarious activities, privacy activists say. “In the last 12 months, 200 million personal records were exposed on the Internet,” said Steven Domenikos, founder and CEO at IdentityTruth, a company that crawls billions of records. “That is a gold mine for identity thieves.” Debugging the online records of 50 states, more than 3,000 counties, approximately 36,000 municipalities and townships, and more than 48,000 special and independent school districts is an arduous task. “It’s a very complicated issue with lots of layers of local governments, and I think it’s going to take quite a long time to sift through it and solve it,” said Peter Vogel, a lawyer who has served as chairman of the Texas Supreme Court Judicial Committee on Information Technology. “We really don’t have a clue where the hell we’re going.” In the era following the Vietnam War and Watergate, interpretation of the country’s open-record laws has tended to err on the side of disclosing more rather than less. With the advent of the Internet, many government officials viewed the new technology as a natural extension of the public domain and rushed to put information online. Documents that had languished in dusty file cabinets — property deeds, licenses, divorce and bankruptcy proceedings — suddenly were accessible to anyone with a computer modem. “Everything from dog licenses to death certificates,” said Anne Wallace, executive director of the Identity Theft Assistance Center, which has helped 22,000 victims of identity theft since its creation by the financial services industry three years ago. Court clerks and other officials who put records online typically don’t have an obligation to screen for sensitive data or the resources to do so. Customers of government services like the convenience of electronic records, and certain industries have come to rely on easily accessible public information — and governments have been willing to provide it. “The cost of collecting, storing, indexing, cross-referencing and disseminating information has fallen almost to zero,” said Paul Kocher, president at Cryptography Research. Now, governments are seeking to clean up those files. But retroactively redacting records to hide sensitive data that has appeared online or been sold to third parties, including large credit bureaus and foreign governments, amounts to “ putting the genie back in the bottle,” Kocher said. Perhaps no one has done more to draw attention to the issue of personal information on government Web sites than B.J. Ostergren, who describes herself as being “like a pit bull on steroids.” She began her crusade to keep public records off-line in 2002, when she learned that Hanover County, Va., was planning to put public documents on the Internet. Ostergren waged a letter-writing campaign that marshaled enough resistance to stop the county’s initiative in its tracks. Emboldened by that success, she has waged other battles, at times prevailing on local governments to remove online records and take down entire Web sites. Public officials who cross Ostergren run the risk of having their personal information posted on her Web site. She recently took Federal Computer Week on a guided tour of government Web sites, such as one maintained by Escambia County, Fla., that post personal information. Pointing and clicking, Ostergren pulled up warranty deeds, marriage records, court judgments, tax liens, deeds of trust and dissolution-of-marriage documents containing Social Security numbers, financial and personal information, even fingerprints. Since beginning her crusade, she has found John Travolta’s marriage license and Colin Powell’s Social Security number. The most egregious thing she has found online was a name-change document filed by a woman who had been stalked and feared for her life. The public record disclosed the woman’s Social Security number, current address, telephone number, her mother’s maiden name and other identifying information. The site was shut down within 24 hours. “We are really a stupid country to let this happen,” Ostergren said. States have struggled at times to implement legislative solutions for disseminating public records via the Internet while protecting privacy. The Florida Legislature passed a law several years ago that requires localities to scrub Web sites of personally identifiable information in public records. Lack of funds and other impediments have resulted in two extensions of the compliance deadline. Localities now have until 2011 to abide by the law. In Texas, the attorney general issued an opinion earlier this year that made county and court clerks liable for the distribution of credit information. Panicked clerks shut down Web sites, a move that disrupted commercial data firms like LexisNexis and credit and title companies that rely on the information. In the end, the attorney general retracted his opinion, and Texas lawmakers passed a bill that essentially relieves clerks from liability associated with the posting of personal information. “Technology always outpaces our legal system,” said Mike Osbourn, planning coordinator of Cumberland County, N.C. By linking various databases, Cumberland provides one-stop, online availability of information that in the past was scattered in several physical locations. Despite the challenges, some localities have nonetheless succeeded in filtering out sensitive information. David Ellspermann, clerk of the Circuit Court for Marion County, Fla., removed Social Security, credit card and bank numbers from more than seven million records. The good news is that less than 3 percent of the documents contained a Social Security number. But “if you were that person, that didn’t matter,” he said.