California court posting SSNs and other personal data, privacy advocates charge

Computerworld - Privacy advocates claim that Social Security numbers, medical histories, tax records, bank account data and other sensitive personal data are freely available online via the Web site of the Superior Court in California's Riverside County.

Searches done on the court's Web site by Computerworld, using case numbers provided by Virginia-based privacy advocate Betty "BJ" Ostergren, turned up various documents related to civil cases that contained sensitive information. Included were complete tax filings, medical reports pertaining to cases handled by the court, and images of checks complete with signatures as well as account and bank-routing numbers.

But the court's IT director defended the practices, saying that documents are being posted on the Web site in accordance with California laws and that finding data such as Social Security numbers is akin to "finding a needle in a haystack."

Ostergren, who for several years has been waging a campaign to convince county and state governments to remove personal data from public records posted on the Web, said yesterday that she was tipped off to the situation in Riverside County by an anonymous individual who goes by the name of "Privacy Pete." That person claims to have tried for the past two months to get Superior Court officials to agree to remove online documents containing sensitive data or to redact the information so it can't be viewed, according to a message attributed to Privacy Pete that was posted April 22 on a forum for members of the California Highway Patrol (CHP).

Among the records that Ostergren said she has been able to access and view on the Superior Court Web site are documents containing the Social Security numbers of several elected officials in Riverside County, plus another one that included the Social Security numbers of nearly 1,000 CHP officers. Altogether, the Web site potentially holds "thousands and thousands" of documents with personally identifiable information, contended Ostergren, who runs a Web site called The Virginia Watchdog.

It wasn't possible to verify that claim, nor was it immediately clear how easily accessible the personal data is. Ostergren pointed Computerworld to documents such as a tax return containing the Social Security numbers of the filer, her four minor children and the tax preparer, and the medical records of an 18-year-old college student who had been involved in a motor vehicle accident. But in all instances, a specific case number was entered in the records search field on the court's Web site to access the documents.

Ostergren said it's also possible to search for and retrieve similar documents by entering popular last names at random. "Once you get the gist of it, it's very easy for anyone with half a brain [to find such records]," she said. "I can tell you what I have seen on this Web site really aggravates me. I have downloaded tons of medical records, [Social Security numbers], dates of birth, attempted suicide records with restricted police information. This site is worse than most I've been into."