Privacy advocate has ally in Social Security numbers fight

A fight by the Virginia government to stop a privacy advocate from republishing Social Security numbers obtained legally from public records on government sites on her Web site is attracting the attention of some privacy heavyweights. In its brief, EPIC noted that Ostegren's advocacy work is focused on getting state and local governments around the country to stop posting unredacted public records containing Social Security numbers and other private data on their Web sites. The Electronic Privacy Information Center filed a friend of the court brief asking the U.S. Court of Appeals for the Fourth Circuit to uphold privacy advocate Betty Ostergren's First Amendment right to publish the numbers.

As part of an effort to highlight the problem, Ostergren has taken the Social Security numbers of prominent people she has found in public records and republished them on her Web site. Over the past seven years, she has chronicled dozens of cases where local and state governments have inadvertently exposed thousands of Social Security numbers and other personal data on their Web sites, making them attractive targets for identity thieves. When a person publishes lawfully obtained and truthful information, that action is "pure free speech," said John Verdi, senior counsel at the Washington-based EPIC. "It is exactly the type of speech that is protected by the First Amendment." Ostergren runs the Virginia Watchdog Web site, which she has used to highlight identity theft risks that can result from the posting of unredacted public documents, such as land and tax-lien records posted on government Web sites. As part of the campaign, Ostergren routinely posted the Social Security numbers of high-profile individuals that she obtained from county and state government Web sites. Jeb Bush, former U.S. Secretary of State Colin Powell, former U.S. House Majority Leader Tom DeLay, former Missouri Sen.

The list includes former Florida Gov. Jean Carnahan and several county clerks in Virginia. In August, Ostergren provided links to an image of a mortgage document containing the Social Security number of Iowa Secretary of State Mike Mauro. Over the years, her campaign has succeeded in forcing state and county governments to revise images of public records that were posted online or to break online links to document images containing Social Security numbers. She removed the link only after Mauro agreed to take down images of corporate documents that contained Social Security numbers from the state's Web site. Violators are subject to fines of up to $2,500 plus $1,000 in court costs for each Social Security number posted.

Largely in response to her campaign, Virginia lawmakers passed legislation in 2008 that prohibits the dissemination of any records that contain Social Security numbers, no matter how the records were obtained. Lawmakers said the law was needed to prevent even wider dissemination of the numbers obtained from public records. The Virginia chapter of the American Civil Liberites Union promptly filed a lawsuit on behalf of Ostergren challenging the constitutionality of the law. The law would have required Ostergren to remove Social Security numbers from her Web site or face punitive fines. Last August, the U.S. District Court for the Eastern District of Virginia ruled that it would be unconstitutional for the commonwealth of Virginia to force Ostergren to remove the numbers from her site.

That ruling in turn was appealed to the Fourth Circuit court by Virginia's attorney general. While the court did not say the law itself was unconstitutional, it ruled that it would be an unconstitutional application of the law in Ostergren's case. In it, the government said that the case raised the issue of "crime facilitating speech." The Social Security numbers posted by Ostergren on her Web site exposed the individuals assigned those numbers to a serious risk of identity theft, the appeal claimed. EPIC's Verdi, however, said that Ostergren was simply republishing information that was already made public by the state, and even then, only in a highly targeted manner. First Amendment rights do not protect speech that exposes public officials to the "the very real prospect of devastating criminal predation," the appeal read.

Meanwhile, Ostergren, who has temporarily removed documents containing the Social Security numbers of Virginia public figures from her Web site, plans to put the documents back up after she removes any data that might belong to the individuals' spouses or children. Any time she finds such documents, she will post them, she said. "It's amazing that I still have to be at this after seven years," she said. Speaking with Computerworld today, Ostergren said that local governments in Virginia and elsewhere are continuing to post documents containing sensitive data on their Web sites.