Slashdot Mirror
State Cannot Force Removal of SSNs From Privacy Advocate's Site
jvatcw brings us a story about Betty Ostergren, who operates a website dedicated to pointing out the social security numbers visible in public records. The purpose of the site is to raise awareness of privacy concerns regarding the personal information shared in Virginia's governmental websites. Legislation was introduced in Virginia to combat Ostergren's website, but last Friday a judge shot down the attempt to censor her, writing, "It is difficult to imagine a more archetypal instance of the press informing the public of government operations through government records than Ostergren's posting of public records to demonstrate the lack of care being taken by government to protect the private information of individuals."
I wonder whether "identity theft" is not just an utterly brilliant public relations tactic used by the credit card companies to deflect responsibility away from themselves.
In "identity theft" the thief is the bad guy and the credit card company's responsibility is ignored.
Instead of playing whack-a-mole-legislation with reporters and privacy advocates that point out problems, wouldn't our lawmakers efforts be better directed to fixing the privacy holes?
Someone has blown the whistle and turned on the flashing yellow klaxons to alert Virginia citizens and lawmakers to shoddy privacy practices. She's not trying to profit, she's probably not even trying to benefit from this work (except, perhaps in a very professional way). This woman is doing her civic and professional duty to solve what she sees as a problem.
Because she has no direct method for solving this problem, her only recourse is to alert her lawmakers and hope they fix the gigantic hole. Instead of whacking her with legislation, they should be carefully crafting legislation that provides guidelines and most importantly REAL FUNDING to help secure personal informaiton.
This one's tricky. You have to use imaginary numbers, like eleventeen... --Hobbes
Isn't that the bigger problem? Instead of spending more and more money to hide this number (or blame companies who lose such data), intelligent people should be asking why this number should be private.
Exactly. I wish the govt would just announce that on January 1, 2009 they will put up a website that publicly reveals everyone's SSN. Banks and other institutions have until then to work out some other means of authentication.
Being willing and able to monitor your own credit still isn't enough.
Not being willing to accept or use "credit" isn't sufficient either.
All it takes is one abusive merchant to initiate a "collection" against
you. It won't matter if it's a genuine billing dispute or not. That
"black mark" will end up in your report. The relevant parties will be
unwilling to remove it, and everyone else will use it against you.
A Pirate and a Puritan look the same on a balance sheet.
I have seen folks who had credit opened in their name WITHOUT the crook using the SSN!
And, I attended a seminar with someone from Equifax. It is VERY common for another person's debt to be on your credit history - even though the SSNs are completely different. How? It happens the most to folks with very common names: example, Smith, Johnson, Andrews, etc....
Our credit system is a huge inaccurate mess. That's why it is extremely important to monitor your credit or, even better, freeze it.
"betamax" under your definition is also "judicial activism".
rulings like that are a common function of the judicial system, and if congress finds it objectionable they can specifically address it with legislation.
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
IF I don't use credit, then a "black mark" is meaningless.
And, with all those "black marks" on my credit, then anyone accepting my SS# and credit history, gets what they deserve.
But you raise an interesting point, though it is obscured. If I don't use credit, and someone issues credit in my name to someone other than me, how would I prove it? How would I even know it?
In that case, the credit companies have broken system (yeah, we all know it too). In this case, I'd sue everyone involved ruining my reputation.
I'm wondering why nobody has gone after them for slander or libel (which ever applies), in a civil tort?
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Another problem is that they're not even unique. They get reused all the time.
AND, there aren't even the full billion possible numbers because some of the digits encode location information. And our estimated population is 1/3 of that billion. Identity thieves could just pick numbers at random to research and ruin.
Can you be Even More Awesome?!
The government should redefine the word "privacy". Either reduce the power of the SSN or restrict the use of SSN in instances where it could lead to problems with public use.
And oh, make it illegal for programmers to include SSNs in SQL statements like "select * from records where ssn='xxx-xxx-xxxx'" and pass it through the URL.
We already have a LifeLock guy who goes around trumpeting his SSN and in spite of all his yak and promises, it gets abused. We don't need more people abusing SSNs this way, especially when its not theirs.
slashdot rocks
You assume too much.
I own my cars, paid cash for each of them. I own my house, never had a loan on it.
Just because 99.99999% of the population does it one way, doesn't mean everyone does.
I'll tell you the next hardest thing to do without credit (cards) is rent a car. It can be done, but not easily.
And no, I don't own a tin foil hat.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
It's not so simple as that...
People file their SSN in Public Records all the time.
For example, I have seen numerous PUBLIC tax records on file in the County Clerk's Office (as well as the County and District Court Clerk's Offices in my state (Oklahoma).
The same is true for numerous Oil & Gas Leases filed publicly.
A better approach is the one Texas took a few years back, requiring anyone accessing the public documents to sign an sworn and notarized affidavit stating that any and all SSN that may be present in the course of their review of Texas public records will not be mis-used. This process was a temporary one where then entire body of records was reviewed for SSN content and numbers of living persons were "blacked out" from the public record documents. Also, if anyone file documents with SSN information they were asked to black it out before filing if the person was not deceased.
It is better to sat up a tax ID with the IRS and use that number for public records. (That way, people legitimately requiring the individual's SSN data must contact the IRS (or the individual) to gain access to said individual's SSN.
Making it a felony would would immediately shut down many county government record departments for years (not to mention the costs to purge the offending data from million sof pages of official public records in every county) and it would otherwise and make felons out of many people who freely file their SSN in the public record.
Also, Todd Davis better hope he does not live in Virginia when your law makes all of his commercials felonious...
Trying to get thru life in the US without "credit" today is near impossible. Cars, mortgage, college loans, etc Regarding the abusive merchant, I went thru 14 years (yes years) of fighting Amex to get them to stop billing me for an ISP bill out of Australia, on a card that had been cancelled 3 years prior to them accepting the ISP charges. This made it all the way to a collection agency even though Amex readily admitted they were not my charges. After submitting complaints thru the Better Business Bureau, FDIC, and any other agency they finally stopped. The down side is that the black mark made it into one of the three major credit reporting agencies. Getting it off has been another round of headaches. The best part of the whole adventure was when I spoke with Amex on the phone and they told me it was too small of an amount for them to waste time on resolving it...
I don't think that's quite the way to go about it, but I think it would be good to start by outlawing (with penalties this time) its use for anything other than, you know, Social Security.
But we're just getting started here. Once the SSN has returned to the single use for which it was created, we need a vastly more secure system to replace it. Not a national ID number, but a transparent, authenticated system of personal financial metadata kept in a vault maintained by a consortium of Experian, TransUnion, and Equifax, under tight regulation by the feds.
Users would always be able to securely check the entirety of their personal data to ensure its correctness, would have a federally-mandated path of action to contest errors, and would have a simple method of offering disposable keys to financial institutions to verify their credit history.
Your mind is clear / The things that you fear / Will fade with how much you / Believe what you hear
OK, so he properly ruled that she can list records that are already publicly available. Good for him. Then I read this amazing piece of idiocy:
He noted that the ruling may have been "very different" if Ostergren only listed Social Security numbers copied from records rather than the records themselves.
What?!?!? It's OK to show the whole record, but not part of the record? What the hell is the difference? The record already has the SSN in it.
Er, I'd really like to retract this post. It's not insightful, it's me not being awake and not RTFA. So this will probably be a /. first, but I would request someone to mod my own post (the one above) "overrated." She's not doing this to private citizens, the SSNs are already online, this doesn't seem like a bid for attention now that I have the facts straight.
I'm not sure why you can't delete your own post, but there should at least be a "mod my own comment down to '-1: redacted'" option.
And the loss of community has really pushed the anonymity movement. In days of old, you had to have a "relationship" with the people who bought and sold. Somewhere along the way, that was lost in favor of cheaper prices. We have, collectively, started to see the repercussions of this throughout society.
Now, to buy big ticket items, all you need is a fake ID, a Good SS#, and be gone, and nobody seems to care that we've lost the humanity in the process.
Define "big ticket items." I'd define it as cars, houses or more expensive than that. For that, the normal person takes out a loan with a bank. There is a lot of paper work involved and communications with sales people and folks at the bank. If your idea of "big ticket items" is between $500-3000, then it doesn't take anyone at a bank to stop or question the payment if you are in the habit of spending that kinda of money or the store that sells the item does normal business with the bank. If you bought a stove at sears or an ID theft did with your ID, then the bank or CC wouldn't question it much. If you bought 2+ stoves at sears or mom and pop we've never heard of store, the bank/CC may flag it and question if the store was trying to over charge/double charge their customer.
In the name of preventing ID theft, CC and banks are looking at your buying habits to see if you purchase anything odd. This should ring alarm bells, but doesn't for some reason. Oh well, its not like the CC or banks do well at verifying you are who you claim to be. The banks/CC should just run their own biometric ID network that requires everyone that wants to use said network to submit finger prints, retina scans, DNA, foot prints, and thermal face scans to the issuing agency. The banks/CC could use all that crap to ID you and in the name of ID theft prevention to not give your resources to anyone else.
In the days of yore, the stores ID'd and monitored all their customers and knew exactly where they all worked/how much they made and if they were good for the credit that the store extended them. How is that much different today rather than the min. wage sales person not knowing all that crap about you? The CC and the store in general most likely does know it, it just takes more effort on the stores part to find out the info as long as they get paid by a CC/bank they don't care if it was you or an ID theif though.
It's high time the government simply published all SSNs. We are constantly forced to hand our SSNs over to banks, employers, phone companies, doctors, insurers, etc, and we have no way of knowing how many people have access to them. SSN is just an account number, but it's being used both as a unique identifier for individuals and as an authenticator, mostly because financial institutions are too lazy to develop their own authentication system. What's more, substantial parts of SSN are predictable with decent confidence given knowledge of a person's approximate place and time of birth. Meanwhile, SSN is next to impossible to change, so once it's compromised you're permanently screwed. It should be obvious that using SSN as an authenticator of any kind is pathologically stupid. It lacks every property good authenticators should have.
SSNs are not secret. Let's stop pretending that they are.
(Not to drift too far OT, but....)
This was just the argument I was making to a friend of mine during a discussion of anti-terrorism laws. He was of the opinion that we shouldn't disallow warrantless surveillance just because it "might" be abused "someday" since it would definitely (in his opinion) help us catch terrorists. He thought that doing otherwise was shackling the hands of law enforcement. I countered that, while law enforcement might like to conduct surveillance without a warrant, it was too ripe for abuse. Our Founding Fathers knew what it was like to live under a government that didn't listen to the people and abused its power. That's why our government is designed with checks and balances. Any law/policy that removes the checks and balances from a governmental agency (say, no warrants required) is highly dangerous and likely unconstitutional.
Of course, my friend chose not to see the danger and just assumed that: 1) he and I wouldn't be targeted, 2) if we were we would have recourse, and 3) the government would give up the powers after the fight was won. I pointed out the flaws in these arguments, but either I didn't do a good enough job or his mind was closed to all debate (probably the latter) because he remains convinced that giving the government unlimited power to "stop the terrorists" is a good idea. In fact, he went so far as to say that he wouldn't forgive me if I supported removal of those governmental powers and we got hit with another terrorist attack.
Then again, this friend also thinks that the fact that Obama's middle name is "Hussein" and his first name rhymes with "Osama" is just too coincidental to not mean something. It's really sad that the future of this country may be decided by people who think that being Conservative means unlimited Federal government power and wanting to curtail the Federal government is a sign of dangerous liberalism.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
what about negligence. If you ask for something to be removed that gets replaced in an automated fashion the next month, then there is a proveable disregard for accuracy. It isnt libel, but taking the cheap and easy way can provide known incorrect information.
>"It is difficult to imagine a more archetypal instance of the press informing the public of government operations through government records than Ostergren's posting of public records to demonstrate the lack of care being taken by government to protect the private information of individuals."
A ****ing men. This is a judge that knows what's up.
I love what Betty Ostergren is doing. I've been a fan of hers since a few years ago when she was on 20/20 (I think) and they went over what she is doing. Arizona and Florida immediately started programs to black out people's SSN's on their public records when they saw her site. I guess Virginia would rather expose it's citizens to ID theft and try to squelch Betty than fix the problem.
This is probably the biggest source of SSN's used for ID theft, and Betty is doing something about it.
BRAVO!!!! I'm glad nobody has shut her down yet.
-Viz
Don't kid yourself. It's the size of the regexp AND how you use it that counts.
Yes, but you can't really expect a large group of people to consider the edge case.
The fact that you are in a rare position to ahve enough money to pay cash for houses and cars it really irrelevant to the conversation as a whole.
The Kruger Dunning explains most post on
I was in horrible credit card debt hell post-Katrina. But, I got good settlements on my lost car and other things...and along with some other good fortune that came out of all that mess...I"m virtually debt free. All cards paid off, only a car and motorcycle note right now. I never intend to go into hard debt again. For 99% of all purchases I do, I pay cash.
But, I do have credit cards. I keep them mostly for emergencies, and for buying gas at places like Sam's that don't take cash at the pumps. What I do charge, I pay off in full each month, so that is basically like using cash.
I'm actually wanting to trade a card or so in for ones that earn cash back or airline mileage...which actually pay you to use them.
I'm curious how you go totally without credit. I have mine, and use it sparingly, and responsibly...I'm not sure I could go completely off them. I'd always want one around, just for an emergency....say like the coming hurricane. Last time for Katrina, I rode out with friends. After a period, I had to rent a car, and that is virtually impossible to do these days w/o a credit card.
I'd be interested in hearing the details of how you go completely without them....
Thanks...
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
The fridge went on the fritz last week, and I fixed it myself. I wouldn't be much of a geek if I couldn't fix things that break. Somethings aren't worth fixing, and I have a slush fund for such things, or I miss my next vacation. Or, I'll do a couple extra side jobs to pay for the nicer things in life.
I don't do without. I do without things I don't "need".
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.