Pat Crick is like many of the foot soldiers in the nation's war against identity theft.
The recorder of Allen County, Ind., has marching orders to remove all Social Security numbers from county records. What she doesn't yet know is how that task will be executed or how much it will cost.
In 2005, the Indiana Legislature passed a law requiring counties to cease accepting documents containing Social Security numbers, and were given until the end of 2011 to redact them from stored computer records.
Starting in 2008, it will be an infraction for recorders' offices to disclose any documents containing Social Security numbers. The legislation also requires counties to assess a $2 fee for each new document submitted to help pay for redaction technology.
Crick said prior to the Legislature tackling the issue, employees in her office were brainstorming on how to expunge Social Security numbers from files because they heard civil complaints about numbers appearing on public documents -- especially veterans concerned about their discharge forms.
"People can come in here and pull up the information if they want to," she said. "The Social Security numbers are right there on mortgages and deeds."
Indiana is one of seven states that have passed or are considering privacy rights legislation, forcing government officials like Crick to cope with the technological challenge of redacting all Social Security numbers from public records.
According to a November 2004 study by the U.S. Government Accountability Office (GAO), public-sector agencies in 41 states reported having visible Social Security numbers in at least one type of record, and a few states have them in as many as 10 or more different records. More than three-quarters of U.S. counties hold at least one type of record that displays them.
Overall, the GAO found that "the risk of exposure for Social Security numbers in public records at the state and local levels is highly variable and difficult for any one individual to anticipate or prevent."
Although Allen County officials have no knowledge of Social Security numbers being accessed through its computers for fraudulent purposes, county staff doesn't have to look far to find vulnerabilities.
In May 2005, Purdue University in West Lafayette, Ind., a little more than 100 miles from Fort Wayne, reported in a press release that the Social Security numbers of 11,360 current and former employees might have been illegally accessed from campus computer workstations. Although the university is moving away from using them, switching to a new identification system is a slow and expensive process.
The university is investing more than $73 million in its OnePurdue project, which will combine and modernize student information and human resources databases, as well as business processes.
Allen County does not use Social Security numbers to identify individuals, so removing them from documents will not hamper the Recorder's Office's ability to locate documents, Crick said.
Marla Irving, an Allen County commissioner, said local governments recognize identity theft as a huge problem, but added that counties see the new law as just another unfunded mandate.
Unlike many government agencies, the recorder's office can assess user fees to help offset the cost. But what will happen if the fees don't cover the cost of the redaction software?
"I don't even want to think about it," Crick said.
A Technological Challenge
Irving said county officials realized the state mandate was going to require a software solution.
"We recognized this immediately as a technological challenge, and we did not want it to be a huge burden to the Recorder's Office, because they process thousands of documents a year, so we need it to be an automated task."
One software vendor that sees a market opportunity in