the upcoming IDentiWall is the silver bullet of the Identity Theft fight

Texas counties illegally posting Social Security numbers online, AG says

Jaikumar Vijayan

 

March 05, 2007 (Computerworld) Like dozens of county governments around the country, Fort Bend County in Texas has for the past several years been posting public records containing Social Security numbers on its Web site. The records are accessible to anyone in the world with an Internet connection and are routinely sold to list brokers, real estate companies and mortgage firms.

On Feb. 23, Texas Attorney General Greg Abbot ruled that such disclosure of Social Security numbers in public documents is a violation of both state and federal privacy laws and is a criminal offense punishable by jail time and fines. The ruling followed an inquiry by Fort Bend's district attorney in 2005 about how its county clerk was expected to deal with Social Security numbers when they were present in public records.

Abbot's ruling has caused an uproar among county and district clerks in the state who are panicked by the prospect of being held criminally liable for actions they say were carried out as part of their normal business. Many have shut down or severely restricted public access to court records and are seeking help from state legislators who have hastily introduced a House bill seeking to absolve clerks of criminal and civil liabilities for disclosing confidential information.

The bill, sponsored by Texas Rep. Jim Keffer, also seeks to allow county and district clerks to continue disclosing such information in the future "notwithstanding" existing federal and state privacy laws.

"When we first saw the [attorney general's] opinion, we were just panicked. We were like, 'This couldn't be happening,'" said Janice Gray, district clerk at Coryell County and vice president of the County and District Clerks Association of Texas.

In response, Abbot said he would abate his opinion for 60 days while state legislators deliberate the issues raised by the ruling. "Immediately after the opinion was issued, legislative leaders contacted this office with serious concerns about logistical implications surrounding the rapid implementation of statutorily-mandated [Social Security number] confidentiality," he wrote in a Feb 28 note to Fort Bend county attorney Roy Cordes. "The real-world consequence [of the opinion] was a virtual halt to a tremendous amount of business and commerce in Texas," he said.

At issue is the controversial practice by many county governments of posting public records containing confidential personal information on the Internet without first redacting sensitive data.

The list of documents posted on county Web sites as part of the public record includes copies of property and tax records, motor vehicle information, and court files. In some cases, documents relating to military discharges, family court decisions, juvenile court records, probate law documents and death certificates are also available. Many of these documents include Social Security and driver's license numbers, bank account details and sometimes even protected health information.

Outraged privacy advocates have argued that putting the records online has greatly broadened access to the information and heightened the risk of misuse. They claim that the trend has made county Web sites a veritable treasure trove of information for identity thieves and other fraudsters.

County clerks such as Dianne Wilson of Fort Bend County, however, argue that much of the information has been freely available for public purchase and inspection at county offices for a very long time. "What we have always held is that we are the repository of the public record," Wilson said. "The public has the right to view and copy and purchase any public record. They have free access to it."

County clerks can't reject a document just because it contains confidential information, she said. Neither are they allowed under law to alter a public record. "We cannot tell you what to put in a document and what not to," she said. "We don't read the documents; we don't know if there is an [Social Security number] in it or not. We are not the ones that put it in there."

Abbot's ruling requires Texas counties to now redact Social Security numbers from public records before making them publicly available -- a monumental task, Gray said. It means having to go through millions of pages to first identify records containing the numbers, making copies of the pages and then blocking out the numbers on each copy. "You are talking about extra paper, extra storage and extra manpower" to do it, she said.

Until some sort of a compromise is reached, Abbot's opinion could seriously hinder public access to court records, both Gray and Wilson said. Others, however, dismissed those concerns. They said that such redactions have been already made elsewhere and that the technology for blocking sensitive information is available. They pointed to states such as Florida, where county governments are already redacting public records as mandated by a state law. Florida's Orange County in February 2006 completed an 18-month project in which it reviewed more than 30 million pages in more than 12 million public records for items such as Social Security numbers, bank account information and credit card numbers. In the end, 777,635 pages -- 2.6% of the total reviewed -- were found to have personal data that needed to be redacted.

"Right now, what you have is a lot of these counties [in Texas] running down to the state legislature and trying to scare them," said Peter MacKoul, president of HIPAA Solutions LC, a Sugar Land, Texas-based consultancy. "They want legislators to write a law running against the [attorney general's] opinion. What they are saying is that it is too difficult to comply with the AG's ruling."

According to MacKoul, at least some of the pressure on the legislators is coming from businesses that have a vested interest in keeping public records online. "Fort Bend sold 20 million un-redacted documents to a Florida list broker for about $2,500," MacKoul said. The same documents would have cost $1 apiece at the courthouse. "There are some business interests who don't want privacy rules," McKoul said.

MacKoul's company was hired by Fort Bend County in 2005 to perform a Health Insurance Portability and Accountability Act audit of its Web site and discovered numerous violations of the law. In some cases, records containing detailed health information were easily accessible from the county's public Web site, he said.

The fact that Fort Bend county has become a focus in the latest controversy is because it failed to act on some of the issues mentioned in MacKoul's report, said David Bloys a retired private investigator who publishes a newsletter called "News for Public Officials" in Shallowater, Texas.

Bloys has been chronicling privacy breaches at county government Web sites in Texas and other states and has been critical of the way Fort Bend handled the issue. "It appears that if the county clerk had taken some of the recommendations in the report seriously, much of the current problem would not exist. Instead, she ignored the recommendations," he said.

Fort Bend County Commissioner Andy Meyers said that he has opposed the county's practice of posting confidential information. "People do not know that their personal information is included in a document that is posted on the Internet," he said. They have not been given any notification in the past that their Social Security numbers and other confidential information would be posted in public records on the Internet and therefore have a reasonable expectation that it will be kept private, Meyers said.

So far though, he has been unable to stop the clerk from posting the information, he said. "The county clerk disagreed with me. She said she had the authority to do so," Meyers said. "I still have been unable to find under state law where she has the authority to post anything on the Internet."

With Abbot's ruling still set to take effect in 60 days, a vote by by two-thirds of both the House and the Senate is needed for Keffer's bill to become effective immediately, he said. "I don't know if they have the two-third votes," he said. "The question is whether [legislators] are going to want to vote on making it legal to post Social Security numbers and other confidential information to the public Web," he said, "I am not sure they are going to vote for that."