[Dataloss] Florida county posts residents' sensitive data on public Web site

[Richard Forno]

http://www.computerworld.com/printthis/2006/0,4814,110389,00.html


Florida county posts residents' sensitive data on public Web site
Social Security numbers, bank info on current, former residents exposed


News Story by Jaikumar Vijayan

APRIL 10, 2006 (COMPUTERWORLD) - The Social Security numbers, driver's
license information and bank account details belonging to potentially
millions of current and former residents in Florida's Broward County are
available to anyone on the Internet because sensitive information has not
been redacted from public records being posted on the county¹s Web site.

A county official said the information available on the Web is in full
compliance with state statutes that require counties to post public
documents on the Internet.

The information has been available on the Internet for several years and
poses a serious risk of identity theft and fraud, said Bruce Hogman, a
county resident who informed the Broward County Records Division of the
problem about two weeks ago.

[View more Data Security Breaches coverage] The breach stems from the
county¹s failure to redact, or remove, sensitive data from images of public
documents such as property records and family court documents, Hogman said.
Included in the documents that are publicly available are dates of birth and
Social Security numbers of minors, images of signatures, passport numbers,
green card details and bank account information.

³Here is the latest treasure trove available to identity thieves, and it is
free to the public, courtesy of the Florida state legislature in its great
Internet savvy,² Hogman said. The easy availability of such sensitive data
also poses a security threat at a time of heightened terrorist concerns, he
said.

Sue Baldwin, director of the Broward Count Records Division, said the county
is aware of Hogman¹s concerns but said that her office is in compliance with
state laws requiring all state recorders to maintain a Web site for official
records. As part of its statutory requirements, the public records search
section of www.broward.org contains images of public records dating back to
1978, many of which are likely to contain sensitive information such as
Social Security numbers, she said. According to Baldwin, certain documents
recorded after June 5, 2002, such as military discharges, family court
records, juvenile court records, probate law documents and death
certificates are automatically blocked from the public record under current
Florida law. But the same information recorded prior to the June 2002 cutoff
has been posted on the county site, she said.

Up to now ³recorders have no statutory authority to automatically remove
Social Security, bank account and driver's license numbers,² from public
records, she said.

A new statute set to take effect Jan. 1, 2007, will require county recorders
to remove Social Security numbers, bank account numbers and credit card and
debit card numbers from public documents before posting documents online,
she said. To ensure compliance with the requirement, Broward County issued a
Request for Letters of Interest from vendors of redaction software in
February 2005 and has already selected Aptitude Solutions Inc. for the work,
Baldwin said.

³The software will be used to redact information from all images displayed
on the county records Web site,² including those already posted, Baldwin
said. ³ I do not know how long the actual process will take, but we intend
to comply with the statutory requirements, including deadline.²

Until that time, individuals who want sensitive information removed from an
image or a copy of a public record can individually request that in writing,
she said. Such a request must specify the identification page number that
contains the Social Security number or other sensitive information, she
said.

³We have provided information pertaining to requesting redaction of
protected information on our Web site at www.broward.org/records, since
2002,² Baldwin said. Since Hogman expressed his concerns, the county has
made the redaction request information more prominent on its Web site and is
also working on creating a special e-mail box for handling redaction
requests.

³Aside from making the redaction request process as user-friendly and speedy
as possible, I do not have the independent authority to take any additional
action regarding removing material from the public records,² she said.

Baldwin added that the information available on the Web is also freely
available for public purchase and inspection at the county offices.
³Professional list-making companies have always purchased copies of records
and data from recorders to use in the creation of specialized marketing
lists, which they sell,² she said. So too have title insurance underwriters
and credit reporting agencies.

Hogman, who wants the records taken down until a solution is found, said he
has contacted several people -- including state legislators, both of the
state's U.S. senators, the FBI and the U.S. Federal Trade Commission. So
far, he has not heard back from anyone except Baldwin.

³In my estimation, Œdo nothing¹ is not a good solution because it leaves the
information out there for public viewing ² he said.