Slashdot Mirror
State Cannot Force Removal of SSNs From Privacy Advocate's Site
jvatcw brings us a story about Betty Ostergren, who operates a website dedicated to pointing out the social security numbers visible in public records. The purpose of the site is to raise awareness of privacy concerns regarding the personal information shared in Virginia's governmental websites. Legislation was introduced in Virginia to combat Ostergren's website, but last Friday a judge shot down the attempt to censor her, writing, "It is difficult to imagine a more archetypal instance of the press informing the public of government operations through government records than Ostergren's posting of public records to demonstrate the lack of care being taken by government to protect the private information of individuals."
Can the states force the credit reporting agencies to allow citizens to lock their credit reports? The whole idea of identity theft is crazy - it could be trivially fixed with one-time passwords that people give out only when they need to.
But then we couldn't make money on credit monitoring services, now, could we?
More
I wonder, if it was a newspaper or CNN doing this, if this would have ever gotten that far.
How refreshing it is to see judges finally waking up to the abuses our government is making. In the past year the judicial branch has made me want to stand up and cheer, with the pushback against the Bush administration and now--here--trying to stop legislatures from hiding their mistakes.
In other news, the IRS reports that they are finally cracking down on long-time tax evader Betty Ostergren for failure to report as income the $10 her grandmother gave her in a birthday card in 2005. Ms. Ostergren faces up to 10 years in prison and a fine of $300,000.
I'm a big tall mofo.
Can the states force the credit reporting agencies to allow citizens to lock their credit reports?
http://www.google.com/search?hl=en&q=how+to+freeze+credit+report
This is already available, and it's free. Just like opting out of marketing offers.
I'm a big tall mofo.
demonstrate the lack of care being taken by government to protect the private information of individuals."
Why is a social security number, a number that helps the social security administration track payments, 'private information'?
Isn't that the bigger problem? Instead of spending more and more money to hide this number (or blame companies who lose such data), intelligent people should be asking why this number should be private.
Yes, the judge is right about this one. Censorship of this type is the classic way that government can sweep the bad things it does under the rug. We have to always keep in mind that "the government" is not some sort of ethereal force out there. It's a bunch of guys (and women) who happen to have been placed in a position of power, whether it's someone elected to office or that clerk at the local [insert government office here] who likes to be a jerk and inconvenience people because it gives him a power trip to feel like he's the king of some tiny kingdom. We always have to remember that. Just because someone is in "the government" does not make that person special or give that person any special rights whatsoever. Thus, the judge should not do anything about that website, but should force the government to fix its problems.
McCain/Palin '08. Now THAT's hope and change!
The problem is that we tend to assume that SS# is "private". It isn't.
We (collectively everyone) ought to just assume that our SS# and lives are being tracked, because we are.
I live my life as if I'm being tracked. I don't own a Credit Card because of it. I don't want my purchases being tracked and traced. I pay cash, which is getting harder and harder to do.
And that stupid VISA commercial where everything stops when a person uses cash, is not helping.
And the loss of community has really pushed the anonymity movement. In days of old, you had to have a "relationship" with the people who bought and sold. Somewhere along the way, that was lost in favor of cheaper prices. We have, collectively, started to see the repercussions of this throughout society.
Now, to buy big ticket items, all you need is a fake ID, a Good SS#, and be gone, and nobody seems to care that we've lost the humanity in the process.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
You apparently missed the whole point. This information is already out there because the government is mishandling it. The reason the judge isn't forcing them off the web is because it's the perfect way to show the government is incompetent so that it can be FIXED. It won't be fixed if it gets buried.
Good idea - as long as they waive their sovereign immunity, and that of their employees, in the same law. Otherwise all it does is censor the critics and allow business as usual.
I'm aging rapidly, I bought a new game and had no idea if my machine was good for it.
Uh, that's the whole point. The state is providing the numbers online already. She's just drawing attention to it.
Instead of playing whack-a-mole-legislation with reporters and privacy advocates that point out problems, wouldn't our lawmakers efforts be better directed to fixing the privacy holes?
Someone has blown the whistle and turned on the flashing yellow klaxons to alert Virginia citizens and lawmakers to shoddy privacy practices. She's not trying to profit, she's probably not even trying to benefit from this work (except, perhaps in a very professional way). This woman is doing her civic and professional duty to solve what she sees as a problem.
Because she has no direct method for solving this problem, her only recourse is to alert her lawmakers and hope they fix the gigantic hole. Instead of whacking her with legislation, they should be carefully crafting legislation that provides guidelines and most importantly REAL FUNDING to help secure personal informaiton.
This one's tricky. You have to use imaginary numbers, like eleventeen... --Hobbes
To take a simple example: until 5-10 years ago, it was common to list SSNs in divorce filings. Get divorced and your SSN was listed in the filings, which are public records and can be looked at by anyone. Even today, in some states, you have to file a motion to have the SSN suppressed from the public version (routinely granted, but still it illustrates how common SSN publication is).
Publishing SSNs found in public certainly advertises the problem, but it also creates problems for innocent, even cautious people who have no way of fixing them.
Of course, the real problem is why we have tied so much personal information to a single government-issued number...perhaps because it's the only nationally unique identification number issued by the Federal government...
Advice: on VPS providers
I have seen folks who had credit opened in their name WITHOUT the crook using the SSN!
And, I attended a seminar with someone from Equifax. It is VERY common for another person's debt to be on your credit history - even though the SSNs are completely different. How? It happens the most to folks with very common names: example, Smith, Johnson, Andrews, etc....
Our credit system is a huge inaccurate mess. That's why it is extremely important to monitor your credit or, even better, freeze it.
Cute, but completely impossible scenario.
I bet you're a sack of laughs at the movies.
"Exhilarating, but the laws of physics make such a maneuver impossible."
"Attractive, but you can clearly see airbrushing on the frames."
"Funny, but technically soda doesn't follow that trajectory when coming out one's nose."
That horse is well out of the barn. They're widely available anyway. The real problem is that people accept "knowledge of SSN" as authentication, not that SSNs get disclosed. Fundamentally, your SSN is your (disambiguated) name, and we don't expect names to be kept off public records.
What should be done is legislation to require better authentication.
So to combat the stupidity of the State of Virginia, She goes on a tear of Stupidity of her own?
The next law the State of Virginia should pass in this vein is one that makes it a felony to post SSN's in public.
That's kind of the point: Ms. Ostergren got the numbers from publicly available, online state records in the first place, so the State of Virginia would, in fact, not be complying with its own law. She's doing this to ... wait for it ... attract enough attention to get a law passed so all SSNs would automatically be redacted at the document level so there would be no SSN information to reproduce downstream in the first place.
The government should redefine the word "privacy". Either reduce the power of the SSN or restrict the use of SSN in instances where it could lead to problems with public use.
And oh, make it illegal for programmers to include SSNs in SQL statements like "select * from records where ssn='xxx-xxx-xxxx'" and pass it through the URL.
We already have a LifeLock guy who goes around trumpeting his SSN and in spite of all his yak and promises, it gets abused. We don't need more people abusing SSNs this way, especially when its not theirs.
slashdot rocks
It's not so simple as that...
People file their SSN in Public Records all the time.
For example, I have seen numerous PUBLIC tax records on file in the County Clerk's Office (as well as the County and District Court Clerk's Offices in my state (Oklahoma).
The same is true for numerous Oil & Gas Leases filed publicly.
A better approach is the one Texas took a few years back, requiring anyone accessing the public documents to sign an sworn and notarized affidavit stating that any and all SSN that may be present in the course of their review of Texas public records will not be mis-used. This process was a temporary one where then entire body of records was reviewed for SSN content and numbers of living persons were "blacked out" from the public record documents. Also, if anyone file documents with SSN information they were asked to black it out before filing if the person was not deceased.
It is better to sat up a tax ID with the IRS and use that number for public records. (That way, people legitimately requiring the individual's SSN data must contact the IRS (or the individual) to gain access to said individual's SSN.
Making it a felony would would immediately shut down many county government record departments for years (not to mention the costs to purge the offending data from million sof pages of official public records in every county) and it would otherwise and make felons out of many people who freely file their SSN in the public record.
Also, Todd Davis better hope he does not live in Virginia when your law makes all of his commercials felonious...
I don't think that's quite the way to go about it, but I think it would be good to start by outlawing (with penalties this time) its use for anything other than, you know, Social Security.
But we're just getting started here. Once the SSN has returned to the single use for which it was created, we need a vastly more secure system to replace it. Not a national ID number, but a transparent, authenticated system of personal financial metadata kept in a vault maintained by a consortium of Experian, TransUnion, and Equifax, under tight regulation by the feds.
Users would always be able to securely check the entirety of their personal data to ensure its correctness, would have a federally-mandated path of action to contest errors, and would have a simple method of offering disposable keys to financial institutions to verify their credit history.
Your mind is clear / The things that you fear / Will fade with how much you / Believe what you hear
OK, so he properly ruled that she can list records that are already publicly available. Good for him. Then I read this amazing piece of idiocy:
He noted that the ruling may have been "very different" if Ostergren only listed Social Security numbers copied from records rather than the records themselves.
What?!?!? It's OK to show the whole record, but not part of the record? What the hell is the difference? The record already has the SSN in it.
I didn't pay any credit cards for a year, now I have an old fashioned credit freeze.
Er, I'd really like to retract this post. It's not insightful, it's me not being awake and not RTFA. So this will probably be a /. first, but I would request someone to mod my own post (the one above) "overrated." She's not doing this to private citizens, the SSNs are already online, this doesn't seem like a bid for attention now that I have the facts straight.
I'm not sure why you can't delete your own post, but there should at least be a "mod my own comment down to '-1: redacted'" option.
It's high time the government simply published all SSNs. We are constantly forced to hand our SSNs over to banks, employers, phone companies, doctors, insurers, etc, and we have no way of knowing how many people have access to them. SSN is just an account number, but it's being used both as a unique identifier for individuals and as an authenticator, mostly because financial institutions are too lazy to develop their own authentication system. What's more, substantial parts of SSN are predictable with decent confidence given knowledge of a person's approximate place and time of birth. Meanwhile, SSN is next to impossible to change, so once it's compromised you're permanently screwed. It should be obvious that using SSN as an authenticator of any kind is pathologically stupid. It lacks every property good authenticators should have.
SSNs are not secret. Let's stop pretending that they are.
>"It is difficult to imagine a more archetypal instance of the press informing the public of government operations through government records than Ostergren's posting of public records to demonstrate the lack of care being taken by government to protect the private information of individuals."
A ****ing men. This is a judge that knows what's up.
I love what Betty Ostergren is doing. I've been a fan of hers since a few years ago when she was on 20/20 (I think) and they went over what she is doing. Arizona and Florida immediately started programs to black out people's SSN's on their public records when they saw her site. I guess Virginia would rather expose it's citizens to ID theft and try to squelch Betty than fix the problem.
This is probably the biggest source of SSN's used for ID theft, and Betty is doing something about it.
BRAVO!!!! I'm glad nobody has shut her down yet.
-Viz
Don't kid yourself. It's the size of the regexp AND how you use it that counts.
* A concerned citizen found SSN Numbers in public that the goons government didn't care to protect.
* Government goons ignored her when she brought this to their attention (over several years).
* She then created a website to expose this act of government incompetence to the public. She posted SSN number of people like Colin Powell and Jeb Bush.
* The Government goons intended to crack down on her and make the act of exposing their incompetence illegal. Essentially saying that it was illegal for her to do exactly the same thing they were already doing, and were undoubtedly going to continue to do.
That is insane
No longer is government concerned with addressing problems it has, now it wants to shut people up who air their dirty laundry. This is *exactly* like the MIT Subway hacker case. This lady is a hero, Government MUST be accountable for its actions when they are operating in error.
Bringing liberty to the masses. - http://freetalklive.com/