The Social Security numbers, driver’s licence information and bank account details belonging to, potentially, millions of current and former residents of Florida’s Broward County are available to anyone on the internet because sensitive information has not been removed from public records being posted on the county’s website.
A county official says the information available on the web is in full compliance with state statutes that require counties to post public documents on the internet.
The information has been available on the internet for several years and poses a serious risk of identity theft and fraud, says Bruce Hogman, a county resident who informed the Broward County Records Division of the problem recently. The breach stems from the county’s failure to redact or remove sensitive data from images of public documents such as property records and family court documents, Hogman says. Included in the documents that are publicly available are dates of birth and social security numbers of minors, images of signatures, passport numbers, immigration details and bank account information.
“Here is the latest treasure trove available to identity thieves, and it is free to the public, courtesy of the Florida state legislature in its great internet savvy,” Hogman says. The easy availability of such sensitive data also poses a security threat at a time of heightened terrorist concerns, he says.
Sue Baldwin, director of the Broward County Records Division, says the county is aware of Hogman’s concerns but says her office is in compliance with state laws requiring all state recorders to maintain a website for official records.
As part of its statutory requirements, the public records search section of www.broward.org contains images of public records dating back to 1978, many of which are likely to contain sensitive information such as social security numbers, she says.
According to Baldwin, certain documents recorded after June 5, 2002, such as military discharges, family, juvenile and probate law documents, and death certificates are automatically blocked from the public record under current Florida law. But the same information recorded prior to the June 2002 cut-off data has been posted on the county site, she says.
Up to now, “recorders have no statutory authority to automatically remove social security, bank account and driver’s licence numbers,” from public records, she says.
A new statute, set to take effect from January 2007 will require county recorders to remove social security numbers, bank account numbers, credit card and debit card numbers from public documents before posting documents online, she says. To ensure compliance with the requirement, Broward County issued a “Request for Letters of Interest” from vendors of redaction software in February 2005 and has already selected Aptitude Solutions for the work.
“The software will be used to redact information from all images displayed on the county records website,” including those already posted, Baldwin says. “ I do not know how long the actual process will take, but we intend to comply with the statutory requirements, including deadline.”
Until that time, individuals who want sensitive information removed can individually request that in writing, she says.
“We have provided information pertaining to requesting redaction of protected information on our website ... since 2002,” Baldwin says. Following the concerns expressed by Hogman, the county is making the redaction request information more prominent on its site and is also working on creating a special email box for handling redaction requests.
“Aside from making the redaction request process as user-friendly and speedy as possible, I do not have the independent authority to take any additional action regarding removing material from the public records,” she says.
Baldwin adds that the information available on the web is also freely available for public purchase and inspection at the county offices. “Professional list-making companies have always purchased copies of records and data from recorders to use in the creation of specialised marketing lists which they sell,” she says. So too have title insurance underwriters and credit reporting agencies.
Hogman, who wants the records taken down until a solution is found, says he has contacted several people — including state legislators, both state senators, the FBI and the US Federal Trade Commission.