The Truth About Redaction

David Bloys - News for Public Officials

For over a decade county and state agencies have published whole collections of sensitive personal records online while ignoring urgent pleas from concerned citizens to keep their sensitive personal information off the internet. Some government agencies discounted their concerns when data mining vendors promised to develop redaction software capable of automatically removing sensitive personal information from public records even after the images were published online.

It's ironic that government agencies turned to data mining vendors for answers to an identity theft crises the vendors themselves helped create. These are the same companies that provided government agencies the software to scan, mine and publish billions of paper records online. Today, the companies want millions of tax dollars for expensive redaction software that is inefficient only partially effective at best.

In many counties local officials are claiming they have the technology to retroactively "redact" the Social Security numbers they have previously published to cyberspace. Do they? Or is this just another misleading statement from vendors designed to sell expensive redaction software?

In 2005 Hart Intercivic won a $500,000 contract to redact the Social Security number's from document's displayed in Orange County, Florida. The software was found to be only partially effective at identifying and redacting some Social Security numbers. Social Security numbers of thousands of Floridians. were were missed entirely. For the people whose sensitive information remains, the program was a 100% failure.

Redaction Software Doesn't Work

Software developers lack both the technology and the courage to take full responsibility for what their software can and cannot do. News for Public Officials was unable to identify any vendor willing to take legal responsibility for missed redactions or any ability to automatically redact hand written numbers at all. In fact, most contracts between county government and redaction software vendors disclaim all legal responsibility for sensitive data the software can neither find nor redact.

Many, if not most, Social Security numbers appear in the online records in handwritten form. News for Public Officials found a single page from one document on the Fort Bend County, Texas website containing twenty-two signatures and Social Security numbers. Eighteen of the numbers are handwritten and virtually invisible to redaction software but easily discernible by any identity thief, terrorist or stalker from anywhere in the world.

In June 2006 Travis County (Texas) Clerk Dana DeBeauvoir, facing complaints from concerned citizens, pulled the county's huge collection of digitized documents from the county website. At the time, she said, "my obligation as an elected official is to respond to legitimate public concern and to do everything within my authority to protect people now.”

Six months later, after an extensive effort to remove sensitive information using expensive redaction software and teams of "trained" experts DeBeauvoir once again published the images online. It took only a few minutes for researchers to find Social Security numbers, driver's license numbers, medical and financial information and other private information in virtually every type of document displayed.

The attached copy of a document found online illustrates why corporate attorneys are not likely to allow technology vendors to assume legal  responsibility for removing even Social Security numbers from the online record.

In order to protect the people whose names and numbers appear on this single page we have done what software programs and county clerks are unable to do for the millions of documents displayed on county websites. We have altered the document by hand to obscure the Social Security numbers that were displayed on the Fort Bend County Website. However, this document, and millions like it, remain visible with on state sponsored websites across the country even after redaction efforts.

You Can't Get It Back

Once the document images have been published online there simply is no way they can be returned to the county repositories. Once online, the images are mined, copied and redistributed almost instantly to websites all over the world. Take Jeb Bush's Social Security number for example.

Jeb Bush's Social Security Number

When former Florida Governor Jeb Bush was notified that his Social Security number was appearing on the Dade County Website, he signed a law allowing Florida residents to request their  numbers be redacted from official sites.  Dade County was quick to comply with the Governor's request and both his and his wife's numbers were redacted by hand from a Quit Claim Deed.

It was too little, too late.  A simple Google search reveals the governor's number  on seven websites including two websites that originate in foreign countries. It is impossible to determine how many more sites around the world are displaying sensitive information previously downloaded from the Dade County Website.

While some companies work to develop software to redact the sensitive information, others provide services that mine and extract the online information. From this data, they compile background reports and dossiers on American citizens. One such "back office" company claims, as their "unique selling point",  a local office in the U.S. and offshore hubs in India, The Philippines and China. This data miner reportedly provides 60,000 reports on US citizens per month from information extracted from databases published in over 400 county websites.

Data miners have been using "redaction" software for years to extract information and compile it into virtual dossiers on American citizens. Enter former Florida  Governor Bush's  "redacted" Social Security number as the search criteria at a data miner's website and you will be presented with a screen telling you the site is searching billions of records contained in the "public" records of online agencies to extract and compile your free report. Wait four seconds and the site tells you the Governor's previous addresses. For an additional $50 you can buy an eleven page  report on the Governor, his neighbors, friends and family members - all extracted from the all too public online "public" records.

If the goal of redaction is to protect local citizens from outside criminals, redacting nine numbers from online documents will do little to protect anyone. It is the whole document that must be removed from the Internet and returned to the secure confines of the courthouse.

The Constitution promises all citizens that we will be secure in our  papers not just a few bits of information that might be extracted from the papers. Their is no security in papers published over the Internet where they are easily searched and seized by anyone on the other side of the world. Removing a Security Number does nothing to protect the either the document or the people. Extracting this number from the documents while publishing the rest of the document is like hiding the key to an unlocked box.

Partial Redaction of Social Security Numbers

Some redaction schemes call for removal of only the first five numbers in the series and leave the last four numbers intact. These schemes only succeed in removing the numbers that identity thieves do not need. See for yourself. Call your credit card company and request a change of address. You'll need your name, current address and ONLY the last four digits of your Social Security number. Anyone who can give these four numbers to the person on other end of the line can do anything they want with your account.

Contrary to popular belief, a Social Security number is not necessary for many types of identity fraud. A SSN (or the last 4 digits) can help criminals commit credit card fraud but identity fraud often does not involve credit cards. The Federal Trade Commission reports that credit card fraud is only 32% of reported cases. In Texas credit card fraud is only 21% of reported cases.

Deed Fraud

The Federal Bureau of Investigation calls deed fraud the fastest growing white collar crime in America.  An authorized signature and notary seal extracted from a County Website is all the 21st century criminal needs to take your home.

Check Forgery

An identity thief can draw a draft on your bank account with any merchant that accepts "checks by phone". All that is needed is a a check that displays the account number and bank routing number. Thousands of these images can be found on any County Website that displays the imaged documents.

Stalkers

All a stalker needs is the home address of his victim. Last year, over one hundred judges cited the murder of  a federal judge's family in their Chicago home when they petitioned the Allegheny County Clerk (PA) to remove their names and addresses from the county website. Some state laws allow judges and police officers to block some government agencies from displaying their home addresses in cyberspace. But these laws often do not apply to County Clerks providing remote access to the same information on county websites.

Even the secret locations of women's protective shelters are no longer secret in counties that put their deed records online.

Redaction's Greatest Success

For software companies, redaction software's greatest success to date may lie not in any ability to redact but rather an incredible ability to extract billions of taxpayer dollars from County offices throughout America.

The Solution

The answer  is neither complicated or expensive. It doesn't require redaction software,  technology or money. The answer that was established by our forefathers is still valid today.  It is a system that protected Americans and our documents for more than 200 years. It is as simple as keeping the documents accessible only within the jurisdiction where they were filed.

County officials who consider the safety of their constituents more important than the convenience of those outside the jurisdiction should take the people's documents offline immediately.