And they aren't alone by any means. The failure to remove sensitive data from images of land records and other public documents posted online has made county government Web sites across the U.S. a veritable treasure trove of information for identity thieves and other criminals, several privacy advocates claimed last week.
"These sites are just spoon-feeding criminals the information they need," said BJ Ostergren, a Virginia resident who runs a privacy-related Web site called The Virginia Watchdog.
The pieces of personally identifiable information found on county Web sites and made available to Computerworld by Ostergren and other privacy advocates included the Social Security number of Rep. Tom Delay (R-Texas) on a tax lien document; the Social Security numbers of Florida Gov. Jeb Bush and his wife on a quitclaim deed from 1999; the driver's license numbers, vehicle registration information, height, race and addresses of people arrested for traffic violations; the names and birth dates of minors from divorce decrees; and complete copies of death certificates.
"All of this information is available to anyone sitting in a cafe in Nigeria or anywhere else in the world," said David Bloys, a retired private investigator who publishes a newsletter called "News for County Officials" in Shallowater, Texas. "It's a real security threat."
Scope of Threat Unknown
It's hard to say exactly how many of the 3,600 county governments around the country are posting sensitive data on the Web, said Mark Monacelli, president of the Property Records Industry Association, a Durham, N.C.-based industry group set up to facilitate the recording of and access to public property information.
But it's safe to assume that a large number of them are, said Darity Wesley, CEO of La Mesa, Calif.-based Privacy Solutions Inc., which offers consulting services to the real estate industry. "I think a lot of [county] recorders have been putting public land records on the Internet without any concern about who has access to them," Wesley said.
Sue Baldwin, director of the Broward County Records Division in Florida, said all of the state's counties are subject to a law requiring them to maintain Web sites for public records, many of which contain sensitive data.
A new Florida statute requires counties by the start of next year to black out Social Security, bank account, and credit and debit card numbers from document images that are already posted online. Also starting on Jan. 1, county recorders will be given the authority to black out the same numbers from new documents. For now, recorders have "no statutory authority to automatically remove" such information from documents, Baldwin said. She added that Broward County residents who want sensitive data immediately excised from public records must file written requests.
Baldwin and Carol Fogelsong, the assistant comptroller for Florida's Orange County, both downplayed the privacy and security issues of making full images of records available online, noting that anyone can view the actual documents at county offices.
"I understand people's concerns, but a lot of this information has been freely available for public inspection since Plymouth Rock," Fogelsong said.
"This is not a new situation," Baldwin said, pointing out that Broward County began posting documents online in 1999. And because records have been publicly available "since the beginning of time," concerns about posting them on the Internet amount to "a tempest in a teapot," she said.
Wesley and Monacelli acknowledged that the availability of personal information online raises justifiable privacy concerns. But those worries need to be tempered by an understanding of the benefits, such as easier access to land records, they said.
"This whole topic of access to information is an issue that we as a nation are facing," Monacelli said. "We have real estate professionals, title companies, attorneys and lenders who need this information for commerce purposes."
There is also little evidence to show that the public availability of personal information on government sites has contributed to an increase in identity theft, Wesley said. For most identity thieves, the chore of sifting through millions of public records for useful data simply isn't worth the effort, she added.
Instead of wrapping "a lot of fear and sensationalism" around the issue, Wesley said, what is needed is an informed discussion among legislators, privacy advocates and business representatives. She has organized a working group, with 20 members from the private and public sectors, to create model legislation governing the redaction of Social Security numbers and other personal data from records.
The number of public documents that contain sensitive information may be far lower than people assume, according to Fogelsong. Orange County is using an outside company to inspect about 30 million pages dating back to 1970 for the data that needs to be removed under Florida's new statute.
Fogelsong said that 119,000 of the 7 million pages inspected thus far have needed to have data hidden from view, or redacted.
The number of redacted pages amounts to just 1.63 percent of the total that have been inspected, Fogelsong noted. However, she added, the percentage is expected to go up to about 5 percent in the case of older documents because many more of them are likely to contain sensitive information.
Baldwin said there is also less sensitive data than meets the eye on Broward County's Web site. "Most people's documents don't have [that kind of] stuff in them," she said.
However, critics such as Bloys and Ostergren dismissed arguments that public records have long been available in paper form as specious.
"The simple truth is these records were safe in the courthouse for 160 years," Bloys said. Now all it takes is Internet access and a rudimentary idea of how to look for sensitive data to find all sorts of information, he added.
Ostergren claimed that simply by "messing around" on county Web sites over the past three and a half years, she has found hundreds of thousands of pages containing sensitive information. She has printed out more than 17,000 records containing people's Social Security numbers, the maiden names of their mothers (often used to verify identities) and the names of minors.
Among the countless nuggets that Bloys said he has found online was the complete medical history of a terminally ill government official in the Texas county of Fort Bend.
Buying Data in Bulk
It isn't always necessary to search through Web sites, because online records can often be purchased in bulk for a fraction of what it would cost to buy them at a courthouse, Bloys said. For example, he said, officials in Fort Bend County last year sold a Florida company online copies of every document ever filed with the county clerk's office. The cost for the estimated 20 million documents was about US$2,500, said Bloys, who wrote an article about the transaction in his newsletter.
A call seeking comment on the matter from the Fort Bend County recorder's office hadn't been returned as of Computerworld's publication deadline.
The company that bought the information is among a large number of businesses -- including some in India, China and the Philippines -- that routinely download records directly from county Web sites, Bloys claimed.
Bruce Hogman, a Broward County county resident who recently raised concerns about the posting of personally identifiable information with Baldwin's office, said real estate professionals and other business users don't need all of the information included in documents posted online.
For real estate transactions, Hogman said, "they need nothing more than the names of the parties, the date of the transaction, the consideration, the book and page in which the data is recorded, together with the legal description -- and not the actual image of the documents themselves."
Ostergren said efforts to stop Virginia's Hanover County, where she lives, from posting images of public records online have succeeded so far. But 14 of the state's 121 cities and counties do make records available online, she said, adding that the same thing is being done by counties in states such as Pennsylvania, North and South Carolina, Ohio, Georgia, Arizona, Texas and New York. That includes all five boroughs in New York City, according to Ostergren.
Fogelsong noted that Orange County residents who want information removed from documents can request that it be redacted. "I would love if people would check their records on their own" to ensure that no private data is publicly disclosed, she said.
But Ostergren dismissed such advice, saying Florida and North Carolina are currently the only states that allow residents to ask for their Social Security numbers to be removed from online records that were already posted.
On the other hand, many states have given county clerks the power to refuse to record new documents containing personally identifiable data, Ostergren said. Overall, though, "this online records mess has been the best-kept secret," she added. "Ninety-nine percent of citizens haven't a clue that the records are online in the first place."
Computerworld's Ken Mingis contributed to this story.