[Dataloss] Georgia: Social Security Numbers Posted Online

[David Bloys]

This is much more than just a statewide issue for Georgia. Any county,
anywhere in the country that puts a federal tax lien online is exposing the
Social Security number. The clerk in this case gives the same canned answer
that he cannot alter the document, which is true in most states, however the
breach occurs when the clerk makes the decision to publish the record
online. Ms. Baker's claim that she cannot alter the document is a
diversionary tactic often used by Clerk's when reporters question them as to
why they have published the records online.

Most states do not mandate that the clerk publish the records online or
prohibit them from doing so. The decision is one of convenience. These
records have always been public but could only be seen at the local
repository (courhouse). Publishing them online makes them PUBLIC to everyone
in the world with an internet connection. 

Finally, paying off the lien will not remove it from the record. Actually,
it creates another breach as the tax lien release can also contain the
Social Security number. This is the case for Tom Delay. The Fort Bend
County, Texas website is displaying his SSN on the original lien and again,
on the release that was filed two months later. 

The IRS has agreed to stop putting the whole numbers on the forms. Instead
they will only be showing the last four digits. In affect, they are removing
only that portion of the Social that an identity thief does not need. Try
calling your credit card company. They will only ask for the last four
digits to identify you AS you.



David Bloys
News For Public Officials
Important news for elected officials and the citizens they serve.
Get the newsletter - Its Free!




-----Original Message-----
From: dataloss-bounces at attrition.org [mailto:dataloss-bounces at attrition.org]
On Behalf Of lyger
Sent: Monday, October 30, 2006 5:30 PM
To: dataloss at attrition.org
Subject: [Dataloss] Georgia: Social Security Numbers Posted Online



(Posting with this question for discussion:  if this is a state-wide issue 
but has only been reported for one county, how should (or can) the overall 
impact be measured for data breach lists or databases?)

http://www.wsbtv.com/news/10193623/detail.html

A simple online search of a Cherokee County government web site revealed 
social security numbers posted for all to see . and it turns out, this is 
happening across the state.

Channel 2's Tom Regan logged on to the Cherokee County web site, entered a 
few common names and within a few clicks was able to obtain social 
security numbers for complete strangers, courtesy of the IRS and the 
county court web site.

"I'm required by law not to alter the document and by law I cannot alter 
the document," said Cherokee County Clerk of Courts, Patty Baker.

It applies to all county courts in Georgia - not just Cherokee. The 
result? People who have federal tax liens against them - sometimes for 
years as they dispute unpaid taxes - have their entire social security 
sitting out on the world wide web for anyone to see.

[...]
_______________________________________________
Dataloss Mailing List (dataloss at attrition.org) http://attrition.org/dataloss
Tracking more than 139 million compromised records in 447 incidents over 6
years.