California court posting SSNs and other personal data, privacy advocates charge

Social Security numbers, other sensitive info said to be available on county court's Web site

Privacy advocates claim that Social Security numbers, medical histories, tax records, bank account data and other sensitive personal data are freely available online via the Web site of the Superior Court in California's Riverside County.

Searches done on the court's Web site by Computerworld, using case numbers provided by Virginia-based privacy advocate Betty "BJ" Ostergren, turned up various documents related to civil cases that contained sensitive information. Included were complete tax filings, medical reports pertaining to cases handled by the court, and images of checks complete with signatures as well as account and bank-routing numbers.

But the court's IT director defended the practices, saying that documents are being posted on the Web site in accordance with California laws and that finding data such as Social Security numbers is akin to "finding a needle in a haystack."

Ostergren, who for several years has been waging a campaign to convince county and state governments to remove personal data from public records posted on the Web, said yesterday that she was tipped off to the situation in Riverside County by an anonymous individual who goes by the name of "Privacy Pete." That person claims to have tried for the past two months to get Superior Court officials to agree to remove online documents containing sensitive data or to redact the information so it can't be viewed, according to a message attributed to Privacy Pete that was posted April 22 on a forum for members of the California Highway Patrol (CHP).

Among the records that Ostergren said she has been able to access and view on the Superior Court Web site are documents containing the Social Security numbers of several elected officials in Riverside County, plus another one that included the Social Security numbers of nearly 1,000 CHP officers. Altogether, the Web site potentially holds "thousands and thousands" of documents with personally identifiable information, contended Ostergren, who runs a Web site called The Virginia Watchdog.

It wasn't possible to verify that claim, nor was it immediately clear how easily accessible the personal data is. Ostergren pointed Computerworld to documents such as a tax return containing the Social Security numbers of the filer, her four minor children and the tax preparer, and the medical records of an 18-year-old college student who had been involved in a motor vehicle accident. But in all instances, a specific case number was entered in the records search field on the court's Web site to access the documents.

Ostergren said it's also possible to search for and retrieve similar documents by entering popular last names at random. "Once you get the gist of it, it's very easy for anyone with half a brain [to find such records]," she said. "I can tell you what I have seen on this Web site really aggravates me. I have downloaded tons of medical records, [Social Security numbers], dates of birth, attempted suicide records with restricted police information. This site is worse than most I've been into."

Gary Whitehead, director of IT at the superior court, said today that court officials currently are aware of only five online records containing sensitive personal data. Those records were pointed out by Privacy Pete, Whitehead said. Court officials were also informed of the alleged availability of the document with the Social Security numbers of CHP officers, but Whitehead said his staff hasn't been able to find it on the Web site thus far. He added that he was unaware of any documents containing the protected data of elected officials.

"We have probably 20 million pages that are available on the Internet," Whitehead said. "[Privacy Pete] was able to point to five that had attachments containing personally identifiable information. So those are available, but to find them is like finding a needle in a haystack."

Whitehead also said that the documents posted online by the court were put on the Web site in compliance with all relevant California laws. "Those rules indicate that if the court has the capability, they should post all documents related to civil cases," he said. "What is happening is that these documents have been filed along with civil cases without having the [personal data] redacted from them. They get scanned and posted along with every other document."

Ostergren said she contacted court officials in Riverside County this morning and questioned the need for posting such documents online, while also requesting that all links to them be broken. But she added that she didn't identify all of the documents she found in her own searches or tell court officials exactly where she found them on the site. Such a disclosure is likely to result in the court taking down only those specific documents while continuing to leave thousands of others exposed on its Web site, she claimed.

If the need arises, Ostergren indicated, she will start contacting residents of Riverside County whose personal information she was able to access via the court's Web site. In the past, Ostergren has also posted the Social Security numbers of politicians and other high-profile individuals — or threatened to do so — in order to pressure government officials to redact the information from Web sites. Ostergren's home state of Virginia recently enacted a law that prohibits people from disseminating Social Security numbers found in public records — a measure that Ostergren thinks was designed to force her to stop publicizing the numbers of prominent people.

In the message posted on the CHPForums Web site last week, Privacy Pete called on CHP officers to demand that the Riverside County court block online access to documents until Social Security numbers are removed from them.

The forum's administrator — identified only as "DW" — posted a response on April 23 saying that the issue was "being seriously addressed within our ranks." That followed an update by Privacy Pete saying that both the CHP and the California Association of Highway Patrolmen appeared to be "aggressively investigating" the claims about the posting of the Social Security numbers of officers on the court's Web site.

Copyright © 2008 IDG Communications, Inc.

  
Shop Tech Products at Amazon