|
 Redaction
Failed - Travis County Puts Sensitive Records Back Online
David Bloys - News
for Public Officials
Dec-10-06
Six months ago,
Travis County (Texas) Clerk Dana DeBeauvoir
pulled the county's
huge collection of digitized documents from the county Website. At the
time, she said, "my obligation as an elected official is to respond to
legitimate public concern and to do everything within my authority to
protect people now.”
It was an act of courage and
dedication to her citizens that was applauded by privacy advocates
nationwide. It seems she has since abandoned her obligation to her
constituents in favor of appeasing those outside the jurisdiction who want
to profit from Travis County records.
Just one month after the November
elections, the Travis County Democrat has once again exposed sensitive
information about thousands of her constituents online.
Last week, DeBeauvoir told KXAN
News, "Today I am happy to report that we are able to make available
approximately 10 million images for the use of our online customers."
The documents include property
deeds, marriage licenses, probate records and more. DeBeauvoir said that her
decision to put the records online comes after an extensive project to
remove individual personal information like
Social Security numbers and
birthdates the county had previously published online.
DeBeauvoir's announcement was
good news for data miners and aggregators worldwide who exploit the
sensitive information provided by U.S. counties websites. It is very bad
news for the citizens of Travis county.
DeBeauvoir thanked the anonymous
"online customers" for their patience and understanding during the six
months period when they were unable to access her constituents' records
online.
"I thank the many regular online
users who were both understanding and patient during this redaction
process," DeBeauvoir said.
"The commitment to provide
excellent customer service is a fundamental goal of the County Clerk's
office, but the need to protect individual privacy outweighs the convenience
of accessing records online," DeBeauvoir said.
These are noble words but they
are inconsistent with the records DeBeauvoir has returned to the Internet.
The County Clerk's effort to redact sensitive information so that the
records would be appropriate for online publication has failed. While some
Social Security numbers and driver's license numbers have been obscured from
the online images, the clerk's website is once again exposing the personal
information of thousands of citizens to anyone with a computer connection.
Everything a criminal needs.
News for Public Officials
examined a few of the documents that have been processed through the
DeBeauvoir's redaction process. What we found doesn't bode well for
thousands of citizens whose sensitive information remains on the ten million
documents the County has made available to criminals anywhere in the world.
After locating
Travis County's new website, we were only two quick and convenient
clicks away from the first of many financial, medical, and personal
records the county failed to find or redact. Take DB's records, for example.
DB is a sixty one-year-old
long-time resident of Travis county. His full name, address, Social
Security number, and date of birth were clearly visible on the
first page of the first document we examined on the DeBeauvoir's website. In
subsequent pages, the document goes into detail about his financial, family
and medical information. In spite of the clerk's redaction efforts,
everything a criminal might want to know about DB can be found in this one
document
According to the document, DB has
three brothers and a sister who live in Indiana, Florida, Georgia, Arizona
and Oklahoma. While he has been separated from his wife, Lilly, for
many years, he may still be married to her.
The document explains that DB
currently receives Social Security disability payments but may soon come
into a large sum of money from the Texas Department of Transportation (TXDOT),
the Texas Turnpike Authority (TTA) or an unnamed state agency. According to
the document, DB may be entitled to collect "more than $75,000" from the TTA.
Highway expansion took his home and now the county website is taking his
privacy.
The document includes a synopsis
of DB's medical information which states he has suffered a series of strokes
that one doctor has diagnosed as resulting in moderate dementia
consistent with Alzheimer's disease.
DB's single document isn't the
only one to offer a gross breach of personal privacy. DeBeauvoir's redaction
efforts appears to have missed this document entirely. According to her
website, the database contains documents of this type on at least 27,446
current and former residents. We found some documents where the Social
Security number had been obscured, but the medical, financial and family
information remains clearly visible. This was true of almost every document
type we examined. In a very short time we were able to extract dozens of
Social Security numbers, bank account numbers, dates of birth, financial
numbers and medical data from the county's supposedly redacted
images.
We looked at several document
types to learn what the redaction effort had removed and what had been
missed. We found several examples of redacted Social Security numbers and
almost as easily found examples where they were clearly exposed. In some
documents we found Social Security numbers that were redacted from part of
the document but were clearly visible elsewhere in the same document.
We found incidents where
financial account numbers had been removed from one part of the document but
were shown in other parts of the same record. Throughout the records we
examined, we found abundant medical and financial information as well
as home addresses.
Redaction was partially
successful in some records. In the case of one document belonging to a
prominent District Judge the redaction efforts found and obscured a family
member's Social Security number and driver's license number but left intact
many sensitive details about the couple's life including their home address
and financial information.
Signatures and notary seals were
found on almost every document. Images of signatures and notary seals are
all that identity thieves in need to steal your home. The online
images make it a simple matter for criminals to clip legitimate seals and
signatures from county websites and electronically paste them on bogus
deeds. The criminals are then able to sell the stolen home or take out new
mortgages. Signatures found on the bogus deeds in Florida were from people
who had died years earlier. Belgium authorities began their own
investigation when their seals turned up on Florida's bogus deeds and the
FBI has called mortgage and deed fraud the fastest growing white collar
crime in America.
Researchers and security experts
across the country who have examined Travis County's new and improved
website are stunned by the DeBeauvoir's hit and miss approach to protecting
the sensitive information.
B.J. Ostergren with
The Virginia Watchdog
commented, "I see that in some divorce decrees that certain financial
information - credit card numbers and bank account numbers - and VIN numbers
are redacted sometimes but then not other times. There is no rhyme or reason
to their redaction scheme but they are certainly not protecting their
citizens personal information."
Janice Forster, a paralegal with
FindMyID.com commented, "It just made me
sick. I saw the documents of one man who the state is trying to declare
incompetent. So they publish his most personal information online? The
information of a man who they say is without wit enough to safeguard it or
even know to check for it? If he's incompetent he has a lot of company."
Forster helps potential identity
theft victims identify county breaches of personal data. Her work, aimed at
helping citizens when the county fails them was recently featured in U.S.A.
Today's
Can Watchful Cybercitizens Curb ID Theft?
"Redaction software has little to
do with redaction and, as we've seen across the nation, nothing to do with
security" Forster said. "It is simply Phase II Salesmanship by software
companies trying to undo the damage they've created, a false show of concern
by our own registries, and a disgraceful waste of taxpayer funds."
According to Forster, "One has to question the relationship between our
land registries and these software companies when the registries
continue to spend thousands of dollars on software rather than taking a
sure, immediate, and cost-free stance on behalf of their communities by
simply unplugging from the internet. County budgets beg to be
examined. There will be surprises."
Texas law does not require
elected officials to post these records online in any form. The law requires
County Clerks to preserve the records at the local courthouse. The demand to
post the records online comes from people outside the jurisdiction who may
find it inconvenient or impossible to exploit the records without
online access.
Counties which place their
citizens' documents online turn their constituents into easy targets
foreign data miners or anyone who might otherwise find it impossible to
exploit records while they are kept within the four walls of the courthouse.
For example, Infinity Data, one of the largest KPO organizations in India,
boasts that they use the online records to produce 60,000 reports on
Americans and their assets every month. According to Infinity's
website, the data mining company accesses 400 U.S. counties online and
shares the information they find with their partners in China and the
Philippines.
Protecting Citizens Can Be
Simple, Cheap, and Effective
How can elected officials live up
to what Clerk DeBeauvoir calls an "obligation as an elected official to
respond to legitimate public concern and to do everything within my
authority to protect people now?" The answer is simple, cheap and effective.
She had the answer when she pulled the plug on the Travis County website
last June. Her redaction alternative is ineffective, expensive and
dangerous.
Protecting their constituents
should be more important to local officials than the profit and convenience
of people outside the jurisdiction.
Footnote:
In 2005, DeBeauvoir testified before the Texas Legislature against
requiring Texas Counties to redact sensitive information House Bill 3278.
While the proposed legislation did not require redaction, it would have
required Texas counties to remove the documents completely from the
Internet. She told the Judicial Committee that the task of redacting
sensitive information would be arduous if not impossible and that in any
case, she was not allowed to alter official Public Records.
For more information please
read:
|
.jpg)
