ACLU files lawsuit on behalf of Virginia privacy advocate + My personal correspondence with her

I just received a very interesting email from none other than BJ Ostergren, the Virginia-based privacy advocate who has been fighting to stop county and state governments from posting public records containing Social Security numbers on their Web sites.

I posted about her situation on March 19th of this year. The "good" news is that she, with the help of the ACLU, is preparing to do battle (as in sue the government) against an amendment to a Virginia law that bars individuals from disseminating any of those SSN numbers, even if they obtain them legally from public records.

For a brief refresher: In recent years, Ms. Ostergren has chronicled dozens of cases in which local governments have inadvertently exposed Social Security numbers and other personal data through their Web sites. As part of her strategy to highlight the seriousness of the issue, she started posting the Social Security numbers of public figures that she accessed via government sites on her Web site.

You know, people like Jeb Bush and Colin Powell for instance. As one might surmise, this didn't make "the government" too happy. One reason being they were being exposed for gross negligence by their putting at risk the identities of tens of thousands of American citizens, but also that they were being made to look even more foolish by Ms. Ostergren's posting of THEIR "private" information (which remember, is already accessible to everyone...hence the problem...its NOT private).

So what was the courageous reaction of Virginia government officials? As one might expect, they immediately went after the critic rather than the problem. So they passed a law banning the posting of such data by a private citizen, rather than oh, BANNING THE GOVERNMENT from doing the very same thing!

Ms. Ostergren and the ACLU are now contending, and which I wholeheartedly agree, that this new law violates her free-speech rights and does nothing to stop county governments in the state from posting documents without first redacting Social Security numbers and other sensitive data. More than that, the measure really seems to have been specifically designed to curtail her campaign to publicize and end that practice!

Ostergren and other privacy advocates have since shown that this problem goes far beyond the borders of Virginia, and in fact, county government around the U.S. have become veritable treasure troves of sensitive data for identity thieves and fraudsters.

So now let's get back to my recent correspondence with this privacy rights hero. Apparently, months ago she wrote me a message (that was mistakenly sent to my junkmail) saying that in my celebration of the passage of AB 1168 (Jones), which requires state and local government agencies, as well as all colleges and universities in California, to honor consumer expectations of personal privacy by safeguarding Social Security numbers, I was giving people a false sense of security.

The reason? As she noted in her first email to me (I made sure it was okay with her that I share her comments):

"There is no law that requires COURTS in CA to remove SSNS off records. I have been fighting with the Riverside Superior Court in CA to no avail to get them to remove SSNs off that site where there are still 10s of thousands of SSNs in court documents. Go to the Riverside Court site.

http://public-access.riverside.courts.ca.gov/OpenAccess/logon.asp?forcelogon=Y&mcnmgotopage=Default.asp&mcnmcourtcode=&mcnmcasenumber=&mcnmcasetype=&system=CIVIL

Type in the word GUEST nothing else and then on next page hunt up case by this CASE NUMBER 405018 Find the first “complaint” filed and then open it. There will be 12 pages and go to page 7. SSN etc. showing. Think that person knows their SSN is online? NOPE! And there are 10s of thousands more SSNs on that site.

Go to my NEWS ARTICLES link on my website www.TheVirginiaWatchdog.com


And find the April and May articles about the Riverside mess. They are NOT the only ones doing this in CA. There are more websites spoon feeding criminals as I call it in CA. At least in LA County Superior Court’s website they are charging per search which will slow down an identity thief.

The VA legislature thinks apparently that it is okay for PUBLIC BODIES as defined under Code of VA 2.2-3701 to be able to put SSNs on the internet but not ME.

As our correspondence went back and forth, she also noted her role in the Jones bill, saying:

I played apart in that and I am the one who got Jones involved to the point he got the SOS to shut the site down. I spoke to his aide back then and gave him a "tour" of sites and then he showed Jones. The aide got me to read the legislation before he put it in. If you read it I think you find it mainly applies to RECORDERS....not Judges and courts.

I did not see court records like the ones on the Riverside Superior Court site mentioned. I'd like to show you and take you on a "tour". Once you see what I see, you'll be astounded and also shocked. That Riverside site is literally spoon feeding SSNs to the world...The Superior Court Judge in Riverside says it would be a shame to shut that site down and hasn't. But they could put online a SUMMARY if you will and that would definitely help. They don't have to show the actual filings in cases.

I am currently dealing with Little Rock AR's Pulaski County where there are hundreds of thousands of SSNs on that site. I am trying to get them to shut down...Too much to be gotten off a home computer...or an internet cafe computer in Nigeria or Pakistan or in another state.

The point in all this is, as Computerworld reported just two weeks ago, Ms. Ostergren and the ACLU's lawsuit is now underway, and we should be watching its development very closely. In the meantime, Ostergren has offered to "take me on a tour" in the next few days to see firsthand just how vulnerable our identities are to thieves. I'm afraid what I'll find out already...

Read Computerworld's report on the lawsuit:

The American Civil Liberties Union (ACLU) of Virginia this week filed a federal lawsuit (download PDF) challenging a recently amended state law that prohibits individuals from disseminating public records containing Social Security numbers, even if the records are publicly available to anyone on county government Web sites.

The lawsuit was filed on behalf of Betty "BJ" Ostergren, a Virginia-based privacy advocate who has been fighting to stop county and state government offices from posting public records containing Social Security numbers and other personal records on their sites. As part of her campaign to publicize the issue, Ostergren has routinely downloaded documents containing Social Security numbers from county Web sites and reposted them on her own site.

...

Rebecca Glenburg, legal director for the ACLU of Virginia, said the Virginia law violates the First Amendment right to free speech.

"Under the First Amendment, people have the right to publish truthful information that is publicly available," she said. "The Supreme Court has held over and over again that when the government chooses to make information public, it can't then punish other people who obtain that information legally and distribute it to others," Glenburg said.

...

The statute challenged by the ACLU was signed by Gov. Timothy Kaine in March and prohibits the spreading of Social Security numbers obtained from public records. It expands on a previous restriction that only applies to numbers contained in private documents.

The law is scheduled to go into effect July 1, the same date on which county clerks across Virginia are required to make all land records -- such as deeds and mortgage information -- available online. The lawsuit is seeking an injunction preventing the statute from going into effect, Ostergren said.

As I wrote in my original post on this issue on March 19th, "I don't know what's the most disturbing aspect of this story":

• that social security numbers are this easily available to would be identity thieves...on our own government's websites no less!;
• that this proposed law now being challenged is so utterly useless in dealing with the stated problem, but instead targets the critic of that problem;
• that the Virginia state legislature and Governor appear to be targeting Ms. Ostergren because of her efforts to draw attention to the privacy rights being jeopardized by the government...not her;
• or that this law might have had something to do with the fact she's posting Social Security numbers of powerful people like Jeb Bush and Colin Powell...versus say, doing something to stop fraudsters from stealing the identities of everyday people?!

Click here to go to Ms. Ostergren's "The Virginia Watchdog".