|
News For Public Officials . . . . Get the Newsletter - It's FREE |
||||
| NFPO Home | Strategic Campaign News | Campaign Tool Chest | Our Readers Write | |
|
|
||||
|
David Bloys - News for Public Officials
It is a story that is playing out across America as county agencies that have published whole collections of community records online respond to criticism from citizens and legislators.
Agencies turn to their technology vendors for answers to problems the vendors helped to creat. The companies promise that, for a price, they can remove the information that identity thieves might use. But the expensive redaction software the vendors offer as a solution is proving to be expensive, inefficient and only partially effective.
Records in Suffolk County, New York, for example, show the legislation was warned that sensitive information contained in the records on the County Clerk's Website could be accessed by identity thieves, terrorists and stalkers. But lawmakers expanded the system after being assured the county clerk's office was creating a way to protect private information.
Those assurances, however, did not apply to the records already available, a point some lawmakers now claim they did not grasp at the time. The system for accessing records in Suffolk County, such as mortgages and deeds was taken off the Internet indefinitely until the problem -- the exposure of thousands of personal identities -- can be resolved.
Many of these records have already been mined, aggregated and sold in bulk form. They are being sold all over the world. These records will never be redacted.
Story continues below . . .
During a legislative hearing in November, 2004 former New Jersey County Clerk Edward Romaine, who is now a legislator, and his director of information technology, Peter Schlussler, testified they had developed software that would protect the citizens of Suffolk County.
Sounding like an ad for a software company, Romaine testified: "We think this is going to be a tremendous benefit in terms of protecting people against identity theft, because we will, and we have developed a tool, and my ID director can talk to that, that will block out signatures and Social Security numbers on the subscription service."
He didn't mention that the clerk's website made the records equally available to anyone in an Internet cafe in Bombay, Tehran or Bucharest.
In other counties across the country, clerks are claiming they have the technology to retroactively "redact" the Social Security numbers they have published to cyberspace. Do they? Or is this just another misleading statement from the vendors designed to sell expensive software?
In 2005 Hart Intercivic won a $500.000 contract to redact the Social Security number's from document's displayed in Orange County, Florida. The software was found to be only partially effective at identifying and redacting some Social Security numbers. The Social Security numbers of thousands of Floridians remains online. For these people, the program was a 100% failure.
News for Public Officials was unable to identify any vendor willing to take legal responsibility for missed redactions or any ability to automatically redact hand written numbers at all.
Many, if not most Social Security numbers appear in the online records in handwritten form. News for Public Officials found a single page from one document on the Fort Bend County, Texas website containing twenty-two signatures and Social Security numbers. Eighteen of the numbers are handwritten and easily discernible by identity thieves, terrorists and stalkers from anywhere in the world but virtually invisible to redaction software.
In June 2006 Travis County (Texas) Clerk Dana DeBeauvoir pulled the county's huge collection of digitized documents from the county website. At the time, she said, "my obligation as an elected official is to respond to legitimate public concern and to do everything within my authority to protect people now.”
Six months later, after an extensive effort to remove sensitive information using expensive redaction software and teams of "trained" experts she once again published the images online. It only took a few minutes for researchers to find Social Security numbers, driver's license numbers, medical and financial information and other private information in virtually every type of document displayed.
The
In order to protect the people whose names and numbers appear on this single page we have done what software programs and county clerks can not do for the millions of documents displayed on county websites. We have altered the document by hand to obscure the Social Security numbers that were displayed on the Fort Bend County Website. However, this document, and millions like it, remain visible with the numbers intact on state sponsored websites across the country even after redaction efforts.
You Can't Get It Back Once the document images have been published online there simply is no way they can be returned to the county repositories. The images are mined, copied and redistributed almost instantly to websites all over the world. Take Jeb Bush's Social Security number for example.
The Governor's Social Security Number When Florida Governor Jeb Bush was notified his Social Security number was appearing on the Dade County Website, he signed a law allowing Florida residents to request their numbers be redacted from official sites. Dade County was quick to comply with the Governor's request and both his and his wife's numbers were redacted from a Quit Claim Deed.
It was too little, too late. A simple Google search reveals the governor's number on seven websites including two websites that originate in foreign countries. It is impossible to determine how many more sites around the world are displaying sensitive information previously downloaded from the Dade County Website.
Foreign and Domestic Data Miners While some companies work to develop software to redact the sensitive information, others provide services that mine and extract the online information to create background reports and dossiers on American citizens. One "back office" company claims their unique selling point is a local office in the U.S. and offshore hubs in India, The Philippines and China. They supply 60,000 reports a month from information extracted from databases published in over 400 county websites.
Data miners have been using "redaction" software for years to extract information and compile it into virtual dossiers on American citizens. Use Florida Governor Bush's "redacted" Social Security number as the search criteria at a data miner's website and you will be presented with a screen telling you the site is searching billions of records contained in the "public" records of online agencies to extract and compile your free report. Wait four seconds and the site tells you the Governor's previous addresses. For an additional $50 you can buy an eleven page report on the Governor, his neighbors, friends and family members - all extracted from the all too public online "public" records.
The Goal If the goal of redaction is to protect local citizens from outside criminals, redacting nine numbers from online documents will do little to protect anyone. It is the whole document that must be removed from the Internet.
The Constitution promises citizens that we will be secure in our papers not just a few bits of information that might be extracted from the papers. Their is no security in papers published over the Internet where they can be searched and seized by anyone on the other side of the world. Removing a Security Number does nothing to protect the document or the people. Extracting this number from the documents while publishing the rest of the document is like taking away the key to an unlocked box.
Partial Redaction Some redaction schemes call for removal of only the first five numbers in the series and leave the last four numbers intact. These schemes only succeed in removing the numbers that identity thieves do not need. See for yourself. Call your credit card company and request a change of address. You'll need your name, current address and ONLY the last four digits of your SSN.a Anyone who can give these four numbers to the person on other end of the line can do anything they want with your account.
No SSN needed Contrary to popular belief, a Social Security number is not necessary for most types of identity fraud. A SSN (or the last 4 digits) can help criminals commit credit card fraud but most identity fraud does not involve credit cards. The Federal Trade Commission reports that victim's information is used nationally for credit card fraud in only 32% of reported cases. In Texas the information is used for credit card fraud in only 21% of reported cases.
Deed Fraud The Federal Bureau of Investigation calls deed fraud the fastest growing white collar crime in America. An authorized signature and notary seal extracted from a County Website is all the 21st century criminal needs to take your home.
Check Forgery An identity thief can draw a draft on your bank account with any merchant that accepts "checks by phone". All that is needed is a copy of a check that displays the account number and bank routing number. Thousands of these images can be found on any County Website that displays the imaged documents.
Stalkers All a stalker needs is the home address of his victim. Last year, over one hundred judges cited the murder of a federal judge's family in their Chicago home when they petitioned the Allegheny County Clerk (PA) to remove their names and addresses from the county website. Some state laws allow judges and police officers to block some government agencies from displaying their home addresses in cyberspace. But these laws often do not apply to County Clerks providing remote access to the same information on county websites.
Even the secret locations of women's protective shelters are no longer secret in online counties and these locations are easily accessible by abusive ex-spouses.
Redaction's Greatest Success There are approximately twenty two of the two hundred fifty four counties in Texas that face the impossible task of redacting personal information from documents they have already released over the Internet. There are thousands more in other states where county government rushed to embrace a technology they did not fully understand. Some agencies are turning to their vendors for solutions to a problem the vendors helped create. Vendors respond with promises of software that will remove the information but the companies will not accept legal responsibility for any information the software fails to identify or remove. Redaction software's greatest success may be in extracting taxpayer dollars from the County Treasury.
Redaction software is an expensive non-answer to the question of how county government will protect the citizens once the sensitive papers are published online to everyone in the world.
The Solution The answer is neither complicated or expensive. It doesn't require redaction software, technology or money. The answer that was established by our forefathers is still valid today. It is a system that protected Americans and our documents for more than 200 years. Keep the documents accessible only within the jurisdiction where they were filed.
County officials who consider the safety of their constituents more important than the convenience of those outside the jurisdiction should take the people's documents offline immediately.
Get the Newsletter - It's FREE
Learn how LifeLock works to protect you when your confidential information is compromised online.
|
The Truth About
Redaction 
|
|