Privacy: Agencies Struggle to Redact Personal Data from Online Public Documents

Rise of identity theft sparks drive to block Social Security numbers and other data.

by / July 8, 2008 0

Most IT workers in state and local government know the cliché that asserts citizens should be "online" rather than "in line" when attaining government services. But many of them contend citizens should be "in line" when accessing some types of public information. Numerous states offer Web access to public records, such as uniform commercial code (UCC) documents, tax liens, divorce decrees, death certificates and many others. These documents frequently contain Social Security numbers (SSNs), mothers' maiden names, signatures, minors' names and other red meat for identity thieves and stalkers.

The Internet is forcing state and local governments to re-evaluate how they handle public information. Agencies are attempting to balance privacy concerns with the convenience and efficiency of online public documents. Public and private organizations increasingly rely on Web-based public document services. For instance, title companies say they would need to raise prices if their employees were forced to stand in line to research land records, and circuit court offices would need to hire legions of workers to search the records for citizens requesting them in-person.

Most governments expect to address the problem through software designed to remove SSNs from online documents. But the process - known as redacting - isn't foolproof; the technology options remain rather crude. Furthermore, state and local agencies struggle to fund redaction projects, which can include a huge number of online documents.

At this point, several governments have completed redaction projects, but many still lack concrete starting plans.


Social Security Number Surprise
Circuit courts and secretaries of state nationwide offer online public document databases that publish SSNs. You can often find them in UCC documents, tax liens and other property records. Most states began offering these documents online between 1999 and 2001. Title companies research them to verify ownership and collect other information necessary for real estate transactions.

In 2002, Virginia resident Betty Ostergren learned that her local circuit court clerk was about to put her mortgage documents online, which included her signature. Ostergren's documents didn't contain her SSN because they were filed prior to the 1990s - when nearby lenders began requiring SSNs. However, the thought of an identity thief lifting her signature from the Internet infuriated her.

She created the Virginia Watchdog Web site aimed at exposing state and local government agencies publishing SSNs, signatures and other personal information online. To draw attention to her crusade, Ostergren found the SSNs of public figures and agency leaders and posted them on her Web site. The strategy motivated several local agencies to redact SSNs.

She posted the SSNs of public figures, such as former Florida Gov. Jeb Bush, former Secretary of State Colin Powell, and celebrities Kelly Ripa, Joe Namath and Troy Aikman.

Numerous national media outlets publicized Ostergren's efforts. Public outcry followed and prompted promises from agencies to redact SSNs.


Redaction Blackhole
To redact SSNs, states use software to black out the section of the document where the number appears. Redaction software vendors typically guarantee 98 percent accuracy, but SSNs tend to crop up everywhere in documents, increasing the difficulty of redacting them. For example, some lenders required borrowers to write their SSNs beneath their signatures. Other lenders organized the documents by SSN within their office filing systems. To do that, they wrote the SSNs on the upper right corners of the documents.

Some documents have multiple pages, providing numerous spots for SSNs. Software can't always predict all the additional places lenders might have written those numbers.

The Florida Secretary of State's Office was among the first agencies to redact SSNs from online UCC documents. Jay Kassees, director of the Division of Corporations in the Florida Secretary of State's Office, was one of the public officials who had his

SSN posted on Ostergren's site. He said Ostergren still calls him to report SSNs remaining on the site.

"She doesn't tell you where it is because she figures you'll just go in and remove that one and won't look at the rest of the database," Kassees said. "You're stuck going through 5 million records to try to find it. It's like a needle in a haystack."

Agencies can't expect 100 percent accuracy with the current redaction technology, he said.

"It's one of those things that I'm probably never going to be finished with," Kassees said. "We're asking the public to help us. Our database is public, and most folks look at their stuff more frequently than we look at it. We're hoping they'll spot it and help us remove it. We've gotten a couple of calls, but since 2005, I've probably fielded four or five calls."


Unfunded Mandates
Governments also struggle to fund redaction initiatives. For instance, the Virginia Legislature authorized county clerks to redact SSNs in 2007, but didn't offer counties funding. The Legislature set up a program allowing counties to use $4 of the revenue from each civil filing made in circuit courts for the redaction process. However, that won't provide nearly enough revenue to cover the cost, according to Paul Ferguson, circuit court clerk of Arlington County, Va. He said the county agreed to make up the difference, but many smaller localities likely can't afford that.

"Since the Legislature mandated this, maybe they'll come up with the extra funds as the deadline of 2010 approaches," Ferguson said.

Fairfax County, Va., Circuit Court Clerk John Frey will soon begrudgingly redact SSNs from the county's Web site. Frey defends current state practices requiring users to subscribe to an account with a username, password and monthly fee to access court documents, like UCCs. The user must submit signed, notarized documents before getting an account. Fairfax's monthly charge is $25, but amounts vary by county. Frey argues that process is sufficient to deter identity theft.

Frey said redacting SSNs from public documents would do little to reduce identity theft. He insists easier ways of stealing identities already exist.

"The odds are that you are more likely to have your identity stolen by using your credit card at lunch than by somebody who is going to take the time to find SSNs on public documents. It takes less than a second [for a restaurant worker] to swipe your card through a second machine that grabs your information off the strip on the back," Frey said.

John Pescatore, vice president of Gartner, disputes that reasoning. He likens it to someone giving up hope of reducing carbon emissions and buying a Hummer.

"[Online SSNs] are making identity theft easier, and the game is to make it harder. Nothing is going to make it impossible," Pescatore said.

Frey said he knew of no identity theft case involving SSNs in Fairfax's online database. The county's system can track the documents each user account accesses, if necessary. Frey argues those user accounts could help police if an incident occurred.

Current redaction practices typically run the documents through a software-based automated process, and then each document is searched manually for additional SSNs. Maryland began its redaction process in March 2008 and expects to finish in five months. The project will cost $140,000, according to Robert Young, associate director of the Maryland Department of Assessments and Taxation.

The Fairfax County Board of Supervisors voted against directly funding Frey's redaction project in Virginia. However, they allowed him to increase the charge users pay to access public documents and use the extra money to fund the project.

"I've gone to the board, and they're not really sympathetic toward giving me money for an unfunded state mandate," Frey said. "

The state wants to do something, but they don't pay for it. That's quite common, at least in Virginia."

He predicts it will cost the county more than $2 million to process its 38 million records.

"In government, you hate to throw good money after something bad, but this country has spent millions of dollars on a local, state and national level for the pandemic bird flu that hasn't come," Frey said. "We spent the same amount on Y2K, and the end of the world that was going to happen on Y2K. Government almost is forced to deal with these issues, whether they are real or not, if they are perceived by the public. If you don't deal with them and something does happen, you're going to be held to blame."

 

Enabling Researchers
The obvious question is why agencies didn't redact SSNs from online public documents in the first place. Starting in the '90s, lenders often required borrowers to include SSNs on UCC forms, said Young. UCC researchers argued SSNs ensured research accuracy and timeliness. For example, if a researcher looked up a man named Kevin Stone and found 10 people with that name, narrowing by SSN would have been easier than searching with other pieces of information.

Agencies wanted those researchers to use the online databases, rather than visiting offices in person, so they kept the numbers in the online documents.

Before the California Secretary of State's Office awarded its redaction contract, it redacted by hand all but the last four digits of SSNs to appease UCC researchers. Then the winning redaction vendor redacted all of the digits. If an identity thief has the birth date, he or she could use an algorithm to reconstruct the entire number using only the last four digits, said Carol Foglesong, assistant comptroller of Orange County, Fla., and president of the Property Records Industry Association.

According to Mark Mishoe, chief deputy of the Oklahoma County, Okla., Clerk's Office, the oil and gas industry pleaded with the office to keep SSNs online. He said oil and gas mineral interest records contained less information than normal land records. Researchers of these records claimed SSNs were often the only information enabling them to verify interest ownership. Nevertheless, the Clerk's Office redacted the SSNs in 2007.

Pescatore rejects the notion that publishing SSNs to accommodate researchers was ever a reasonable policy.

"Should we really endanger the citizens' information to make it easier for the researchers?" said Pescatore.

By 2005, SSNs nearly vanished from incoming UCC documents in Maryland, according to Young. He said Maryland typically gets 40,000 to 50,000 UCCs annually, and roughly 40 percent of them came with SSNs before 2005. After 2005, privacy concerns caused a dramatic shift among lenders away from requiring SSNs on those documents. Now Maryland receives about 50 UCC documents with SSNs per year from "old-time lenders," said Young.

He contends that lenders nationwide rarely require SSNs. The California Secretary of State's Office urges people to make sure their UCC documents don't have SSNs before submitting them to the state.


Online Death Certificates
Concerns about personal information in online public documents don't end with SSNs. Death certificates aren't automatically public records, but they become that when citizens submit them to county recorders' offices. Some states, such as Florida forbid online birth certificate images due to privacy concerns.

"It varies dramatically across the United States," Foglesong said.

Other states, such as Arizona, Nevada and Colorado, allow those images online.

The Maricopa County, Ariz., Recorder's Office publishes death certificates with SSNs redacted, but a lot of information attractive to identity thieves remains.

A person's death certificate is his or her personal history in a nutshell. It contains a spouse's name, a mother's

maiden name and the person's spouse's maiden name. The certificate will report one's residence, place of birth and describe one's career. It will also contain the person's signature, which especially angers Ostergren.

"My husband is a professional engineer. Why in the world would we want our signatures on the Internet? We do banking with those signatures, and he writes his on his seal when he does drawings," Ostergren said. She said lifting signatures from online public documents is easy if they're in PDF files.

Pescatore said online death certificates were a bad idea.

"There are certain things, like birth certificates and death certificates, that are such aids to identity theft that the negative side of making them easily accessible outweighs the positive side," he said.

What is the positive side of making death certificates available online? People use death certificates to prove themselves sole owners of properties they once co-owned with people now deceased, usually spouses. A homeowner doesn't get a new deed when his or her spouse dies. How would a bank know that a spouse was really dead without a county-recorded death certificate? It's the only document lenders accept from the surviving spouse as proof of sole ownership.

Maricopa County provides death certificates online to help citizens accelerate that process, said LeeAnn Wade, office manager of the Maricopa County Recorder's Office. She said forcing citizens to visit government offices or attain this information through the mail would impede commerce.

"We strive for customer service, and that's why we have our records out there so we can make it as easy as we can for the public to obtain this information," Wade said.

She acknowledged death certificates are packed with information that identity thieves could use, although she had never heard of it happening with information from the Recorder's Office. She said the agency wasn't willing to take the records offline given that numerous opportunities for identity thieves would remain elsewhere.

The Recorder's Office is currently shopping for a more flexible redaction software package that would enable it to remove other information new laws might aim to redact. Wade is concerned that if the state goes redaction-crazy, the online versions of the documents will become useless.

"If you're trying to prove somebody died, how do you do that? Some of that personal information has to still be there," Wade said. "The death certificate has to have an original signature. Is that going to be the next thing that has to go out? Other people review our records whether via the Internet or whether they purchase CDs from our office.

Title companies do that; they update their title plans. If I've got everything redacted, where does commerce proceed?"

Andy Opsahl

Andy Opsahl is a former writer and features editor for Government Technology magazine.