Counties Work to Hide Data

Records pulled offline; info blacked out

On Oct. 10, the Orange County comptroller’s office in Florida completed an 18-month project to remove sensitive personal information from images of official public records posted on its Web site.

The $750,000 effort involved a review of over 30 million pages in more than 12 million documents to look for data such as Social Security, bank account, and credit and debit card numbers. In the end, 777,635 pages — 2.6% of the total reviewed — were found to contain personal data and were redacted.

“There’s going to be something we missed,” acknowledged Carol Foglesong, the county’s assistant comptroller. “But I think we got 99%” of the items that needed to be removed.

Orange County’s efforts are being replicated in dozens of counties nationwide as local governments scramble to pull documents from their Web sites or black out personal data from images of title deeds, tax liens, court papers and other public records.

As reported by Computerworld earlier this year, such images often contain personal identifiers and usually are accessible to anyone with Internet access. That has made county Web sites a veritable treasure-trove of information for identity thieves, according to privacy advocates.

Many county governments still haven’t begun to address the prevalence of personal data, despite heightened public concerns about identity theft, said B.J. Ostergren, a privacy advocate in Richmond, Va. But a growing number appear to be attempting to fix the problem, she added. “I think a lot of people are beginning to put the skids on this sort of stuff,” Ostergren said.

In October, for example, the council that oversees Washington’s King County, which includes Seattle, passed an ordinance requiring that the county recorder’s office remove online access to all title deed documents. The vote followed a council member’s discovery of more than 200 Social Security numbers, including those of several public officials and professional athletes, in title deeds on the county’s Web site.

Fears that the ordinance would hurt the county’s business interactions with mortgage companies and others prompted some initial resistance from the recorder’s office, said a spokesman for Reagan Dunn, the council member who sponsored the bill. But the title deeds have been pulled from the site and won’t be restored until the Social Security numbers are somehow blocked from public view, the spokesman said.

In another example, the recorder’s office in Grant County, Ind., pulled all of its document images from the Internet in July after a lawsuit related to identity theft was filed against the county. “There are no definite plans to put them back up on the Internet, although Social Security numbers will be redacted starting next year,” said county recorder Dixi Fischer Conner.

Laws in several states, including Florida, New York and Washington, require recorders to redact personal data from online records. But removing such information can be a huge challenge because of the sheer number of documents that need to be examined.

Dual Approach

Foglesong said that in Orange County, each image was reviewed by redaction software from Mentis Technology LLC and then manually checked by workers. “We learned that software combined with a human review is much more dependable than human eyes searching page after page,” she said.

Software-only approaches are also unreliable, said Dana DeBeauvoir, clerk of Travis County in Texas. “It’s definitely not the automated process that software vendors will have you believe,” she said, adding that workers have to double-check documents to verify that proper redactions have taken place. The wide range of document formats and the fact that some documents are handwritten can pose problems for redaction software, DeBeauvoir said.

Lessons Learned

Statistics from the document redaction project in Orange County, Fla.:

•  Land-ownership documents accounted for 39% of the pages that required redaction the largest percentage by type of document.•  Court papers, judgments and orders were second on the list, accounting for 25% of the pages that had to be redacted.•  Of 60,359 death certificates on the countys Web site, 55,313, or 92%, had to have data blacked out.

Source: Carol Foglesong, assistant comptroller, Orange County

Travis County removed all document images from its Web site in June because of identity theft concerns and just started putting them back online last week after redacting sensitive information. DeBeauvoir said that about 11million documents had been redacted and restored and that another 5 million newer records should go back online soon. “I would give the quality of the work an A+,” she said.

But the success of redaction efforts remains in question, said David Bloys, a retired private investigator who publishes a newsletter called “News for Public Officials” in Shallowater, Texas.

Bloys said he checked Travis County’s Web site last week, “and the very first document I found contained Social Security numbers, driver’s license information and a home address on the first page.” Subsequent pages provided financial, family and medical information, he added. What’s worse is that the Web site had numerous pages like that, Bloys claimed.

“Redaction just doesn’t work,” he said. “I think the only way to really protect these documents is to make sure they stay within the four walls of the courthouse.”

First look: Office 2019’s likeliest new features
  
Shop Tech Products at Amazon