Judge lets privacy advocate keep Social Security numbers on Web site

Top Stories

Related

• Microsoft releases Vista SP2 beta
• Obama's DHS pick may find support for raising H-1B cap at confirmation hearing
• IBM wants info from Apple execs in Papermaster case
• Report: Former AOL chief exec tries to raise funds to buy Yahoo
• U.S. Report: Major terror attack by 2013
• 10 Microsoft research projects

• Identity theft victim wins right to sue county clerk over online posting of personal data
• Billions needed for proper IT security, expert says
• Corporate IT council to look at governance to help safeguard data
• Privacy watchdog ratchets up effort to get Riverside County court to block document access
• Privacy advocate, ACLU hit new Virginia privacy law as misguided

Zone

The Security Zone With the mobility of employees and the ease with which external devices can be brought in and out of a network, continuing to build your security plan for network servers and clients is a must. Fortunately, there is much that organizations can do to protect themselves from attacks - internal and external. Having the right policies, procedures and server configurations is critical... Learn more in The Security Zone See All Zones

August 27, 2008 (Computerworld) Can a state government prohibit an individual from posting Social Security numbers online that were easily and legally obtained from government Web sites?

The answer, a federal judge in Virginia ruled last week, is a definite 'No,' at least for Betty "BJ" Ostergren, a privacy advocate who operates a Web site that posts Social Security numbers obtained from public records. Ostergren's postings are part of a campaign to show how easy it is to access very personal information on the Web.

In a memorandum issued last Friday (download PDF), Judge Robert Payne of the U.S. District Court for the Eastern District of Virginia ruled that it would be unconstitutional for the state of Virginia to force Ostergren to remove from her site Social Security numbers that she legally obtained from public records. A memorandum opinion does not create a legal precedent.

The Virginia chapter of the American Civil Liberties Union (ACLU) in June filed a lawsuit on behalf of Ostergren in Virginia's Hanover County. The lawsuit challenged the constitutionality of an amendment to Virginia's Personal Information Act, which forbids the dissemination of any records that contain Social Security numbers, no matter how the records were obtained. Violators are subject to fines of up to $2,500 plus $1,000 in court costs for each Social Security number posted.

Ostergen, who has been working for several years to force Virginia county governments to redact Social Security numbers and other personal data from records posted online, contended in the suit that the law was passed specifically to curtail her campaign.

Ostergren's Web site, The Virginia Watchdog.com, highlights privacy problems that can result from the posting of unredacted public documents such as land and tax-lien records posted on government Web sites. In recent years, she has chronicled dozens of cases in which local governments have inadvertently exposed Social Security numbers and other personal data on their Web sites, making them attractive targets for identity thieves.

As part of a campaign to draw attention to the issue, Ostergren routinely posts the Social Security numbers of high-profile individuals that she claims to have easily obtained from county and state government Web sites. The list includes former Florida Gov. Jeb Bush, former U.S. Secretary of State Colin Powell, former U.S. House Majority Leader Tom DeLay, former Missouri Sen. Jean Carnahan and several county clerks in Virginia.

Ostergren contended that the amendment to the state's Personal Information Act would have forced her to stop posting the personal information, while doing nothing to stop county governments from posting the same data.

She claimed that applying the amended statute to her Web site violated her First Amendment right to free speech.