Counties Post Personal Data in Documents
Online records put Social Security numbers, other sensitive info in open
Computerworld - Broward County, Fla., Fort Bend County, Texas, and Maricopa County, Ariz., have something in common: In recent years, they have made sensitive personal information about their residents, such as Social Security, driver's license and bank account numbers, available to anyone in the world with Internet access.
And they aren't alone by any means. The failure to remove sensitive data from images of land records and other public documents posted online has made county government Web sites across the U.S. a veritable treasure trove of information for identity thieves and other criminals, several privacy advocates claimed last week.
"These sites are just spoon-feeding criminals the information they need," said BJ Ostergren, a Virginia resident who runs a privacy-related Web site called The Virginia Watchdog.
The pieces of personally identifiable information found on county Web sites and made available to Computerworld by Ostergren and other privacy advocates included the Social Security number of Rep. Tom Delay (R-Texas) on a tax lien document; the Social Security numbers of Florida Gov. Jeb Bush and his wife on a quitclaim deed from 1999; the driver's license numbers, vehicle registration information, height, race and addresses of people arrested for traffic violations; the names and birth dates of minors from divorce decrees; and complete copies of death certificates.
"All of this information is available to anyone sitting in a cafe in Nigeria or anywhere else in the world," said David Bloys, a retired private investigator who publishes a newsletter called "News for County Officials" in Shallowater, Texas. "It's a real security threat."
Scope of Threat Unknown
It's hard to say exactly how many of the 3,600 county governments around the country are posting sensitive data on the Web, said Mark Monacelli, president of the Property Records Industry Association, a Durham, N.C.-based industry group set up to facilitate the recording of and access to public property information.
But it's safe to assume that a large number of them are, said Darity Wesley, CEO of La Mesa, Calif.-based Privacy Solutions Inc., which offers consulting services to the real estate industry. "I think a lot of [county] recorders have been putting public land records on the Internet without any concern about who has access to them," Wesley said.
Sue Baldwin, director of the Broward County Records Division in Florida, said all of the state's counties are subject to a law requiring them to maintain Web sites for public records, many of which contain sensitive data.
A new Florida statute requires counties by the start of next year to black out Social Security, bank account, and credit and debit card numbers from document images that are already posted online. Also starting on Jan. 1, county recorders will be given the authority to black out the same numbers from new documents. For now, recorders have "no statutory authority to automatically remove" such information from documents, Baldwin said. She added that Broward County residents who want sensitive data immediately excised from public records must file written requests.
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Ponemon 2014 SSH Security Vulnerability Report According to research by the Ponemon Institute, 3 out of 4 enterprises have no security controls in place for SSH which leaves organizations...
- Live Webcast How to serve up a Grand Slam with a scalable IT Infrastructure for cloud, big data and advanced analytics Register today to attend this webcast, and see examples of how The U.S. Tennis Association, Wimbledon and U.S. Golf Association are using the...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Live Webcast IBM FlashSystem V840: Leveraging Software-Defined Flash to Drive Your Business With end-to-end, tightly integrated functionality and super-fast flash technology, products like IBM FlashSystem V840 Enterprise Performance Solution empower businesses to leverage the efficiency...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your...