The Price of Privacy
Like many counties nationwide, Allen County, Ind., is coping with a legislative mandate to remove Social Security numbers from public records.
Pat Crick is like many of the foot soldiers in the nation's war against identity theft.
The recorder of Allen County, Ind., has marching orders to remove all Social Security numbers from county records. What she doesn't yet know is how that task will be executed or how much it will cost.
In 2005, the Indiana Legislature passed a law requiring counties to cease accepting documents containing Social Security numbers, and were given until the end of 2011 to redact them from stored computer records.
Starting in 2008, it will be an infraction for recorders' offices to disclose any documents containing Social Security numbers. The legislation also requires counties to assess a $2 fee for each new document submitted to help pay for redaction technology.
Crick said prior to the Legislature tackling the issue, employees in her office were brainstorming on how to expunge Social Security numbers from files because they heard civil complaints about numbers appearing on public documents -- especially veterans concerned about their discharge forms.
"People can come in here and pull up the information if they want to," she said. "The Social Security numbers are right there on mortgages and deeds."
Indiana is one of seven states that have passed or are considering privacy rights legislation, forcing government officials like Crick to cope with the technological challenge of redacting all Social Security numbers from public records.
According to a November 2004 study by the U.S. Government Accountability Office (GAO), public-sector agencies in 41 states reported having visible Social Security numbers in at least one type of record, and a few states have them in as many as 10 or more different records. More than three-quarters of U.S. counties hold at least one type of record that displays them.
Overall, the GAO found that "the risk of exposure for Social Security numbers in public records at the state and local levels is highly variable and difficult for any one individual to anticipate or prevent."
Although Allen County officials have no knowledge of Social Security numbers being accessed through its computers for fraudulent purposes, county staff doesn't have to look far to find vulnerabilities.
In May 2005, Purdue University in West Lafayette, Ind., a little more than 100 miles from Fort Wayne, reported in a press release that the Social Security numbers of 11,360 current and former employees might have been illegally accessed from campus computer workstations. Although the university is moving away from using them, switching to a new identification system is a slow and expensive process.
The university is investing more than $73 million in its OnePurdue project, which will combine and modernize student information and human resources databases, as well as business processes.
Allen County does not use Social Security numbers to identify individuals, so removing them from documents will not hamper the Recorder's Office's ability to locate documents, Crick said.
Marla Irving, an Allen County commissioner, said local governments recognize identity theft as a huge problem, but added that counties see the new law as just another unfunded mandate.
Unlike many government agencies, the recorder's office can assess user fees to help offset the cost. But what will happen if the fees don't cover the cost of the redaction software?
"I don't even want to think about it," Crick said.
A Technological Challenge
Irving said county officials realized the state mandate was going to require a software solution.
"We recognized this immediately as a technological challenge, and we did not want it to be a huge burden to the Recorder's Office, because they process thousands of documents a year, so we need it to be an automated task."
One software vendor that sees a market opportunity in the state mandates to remove Social Security numbers from government records is Computing System Innovations (CSI) of Orlando, Fla. The company developed a product called IntelliDact, which provides automated redaction and indexing for both official records and court documents.
CSI's pricing is based on the number of scanned images to be processed and the estimated number of new documents that will be scanned each year going forward.
"We have finished several counties in Florida and are now marketing the product throughout the United States," said CSI President Henry Sal. "This is a large and growing market."
Under Florida's current public records law, citizens must request that private information be deleted or redacted from public documents. But in 2007, the responsibility will shift to the offices of the court clerk. In preparation for that change, Florida's Marion County recently completed its redaction project using IntelliDact to process and delete private information from 7 million pages of official records -- a process that CSI said took less than seven weeks.
Over the past few years, Allen County invested in scanning technology to create digital versions of thousands of paper records; digitization will help speed the removal process.
However, Ed Steenman, information technology services coordinator of Allen County, said the redaction process will be a significant challenge for the county.
"This is a big-ticket item for us to comply," he said.
"It's not just a matter of masking a field in a database; it's a matter of redacting digital images. It's no small task." Steenman said there are several software options on the market that address redaction, and the county will do an RFP. "We'll have to see which one gives us the most bang for the buck," he added.
With more than 9.2 million documents dating back to 1996, Crick estimates the redaction will cost the county about $180,000, but she admitted that was just a guess. For the period before 1996, the records are on microfilm, and the county is not going to attempt to address those documents.
The governor's office has chosen four other Indiana counties to research software vendors and their solutions.
Later this year, those counties will share their findings with all 92 counties in the state. Despite the disparity in technological sophistication among large and small counties, Crick said all the recorders statewide will eventually get on board.
"They need to do this, and they will do it. It's a step forward as far as identity theft protection goes. Eventually we'll have 92 counties doing the same thing."