Government-Aided Phishing

Anonymous writes "A Florida county is posting the Social Security numbers, bank account info and other sensitive data of hundreds of thousands of current and former residents on its public Web site, Computerworld is reporting. A county official says there's no problem, since the postings are in compliance with state law requiring public availability of records." From the article: "The breach stems from the county's failure to redact or remove sensitive data from images of public documents such as property records and family court documents, Hogman said. Included in the documents that are publicly available are dates of birth and Social Security numbers of minors, images of signatures. passport numbers, green card details and bank account information."

Comments

FLORIDA

[dteichman2]

From the same people who brought you Indecision 2000... here comes Identity Theft-O-Rama. 3 days in the future: 10:00 News: "For what seems to be no reason, thousands of individuals in Florida seem to be buying things online in mass. Oddly enough, none of the orders are being delivered to Florida. We'll have a video for you after the break. Over to you, Bob."

bad year for boward

[tehwebguy]

this is the same county who's police intimidated, threatened, and were just plain jerks to an undercover journalist attempting to find a "police officer complaint form":
http://cbs4.com/topstories/local_story_033170755.h tml (watch part 1 and 2, videos on the right)

and then retaliated against the journalist after the piece aired:
http://cbs4.com/local/local_story_086232143.html

Why am I not surprised.

[Sir Unimaginative]

Yeah, hello, Spain? You can have it back now.

Attacking the wrong people

[GigsVT]

Virginia has your SSN and a lot of information up too, in the virginia courts database that has everyone's criminal record, including traffic.

Most states have this.

Don't attack the wrong people, the blame lies squarely with the credit card companies for using your SSN as identification and trusted authentication.

These are all public records and always were public records. It just saves you a drive to the court house of the respective county (or paying a PI network to do same) to have them online.

Yeah, I admit Florida is one fucked up state in so many ways, but don't blow this out of proportion.

Re:let's open some bank accounts

[tomhudson]

It's still working fine. What's worse, if you don't give a first name, it gives you by last name only, so you can just do a dictionary attack on last names,

I just randomly picked a last name, and a couple of clicks later I know that (I've removed the names) L.A.P and A.J.P got a mortgage for 141,999.00 on 5/14/2004 from the CITY FEDERAL SAVINGS BANK.

So, if I were a phisher, I now have two names, and a dollar amount. I already know approximately where, and by clicking on the other records I know that they've been there for about 20 years, and that they also had some legal problems back in 1991, again, I'm leaving out the details.

W.T.F ?!?!?!?!

I would be humongously upset that this sort of stuff is available just by clicking.

Worse, by searching on the same two names + broward county plus a good guess as to another term, I found a link to a dump of 756k from google's cache. http://www.google.com/search?num=20&hl=en&lr=&safe =off&q=www.co.broward.fl.us%2Fdatabase%2Frecords%2 F03-24nme.txt&btnG=Search

If I were a phisher, a few minutes with perl would give me a decent dictionary with which to start ...

Re:Nope

[The Snowman]

Funny thing, they are public docments. Altering then to hide the information is illegal.

Funny thing is, you are wrong. The Privacy Act of 1974 covers what to do with private data in government records at the federal level, and many states have similar provisions. Essentially the documents are public property, but specific personal details are not. For example, citing a court case, evidence, its outcome, etc. is public record. Giving the SSN of the person found guilty and the bank account number used to pay the fine is NOT public record.

Another example is declassified documents. Yes, they are public, but usually redacted. For example, giving information on an old military operation while redacting information that identifies the specific people involved. People that may very well still be in the military performing similar operations.

Altering public documents to the extent of redacting personal information, which is what this article is about, most certainly is legal and often required. However, you are an anonymous coward -- obviously someone redacted your user account so I don't know who you are.