A fight by the Virginia government to stop a privacy advocate from republishing Social Security numbers obtained legally from public records on government sites on her Web site is attracting the attention of some privacy heavyweights.
The Electronic Privacy Information Center filed a friend of the court brief asking the U.S. Court of Appeals for the Fourth Circuit to uphold privacy advocate Betty Ostergren’s First Amendment right to publish the numbers.
In its brief, EPIC noted that Ostegren’s advocacy work is focused on getting state and local governments around the country to stop posting unredacted public records containing Social Security numbers and other private data on their Web sites. As part of an effort to highlight the problem, Ostergren has taken the Social Security numbers of prominent people she has found in public records and republished them on her Web site.
When a person publishes lawfully obtained and truthful information, that action is “pure free speech,” said John Verdi, senior counsel at the Washington-based EPIC. “It is exactly the type of speech that is protected by the First Amendment.”
Ostergren runs the Virginia Watchdog Web site, which she has used to highlight identity theft risks that can result from the posting of unredacted public documents, such as land and tax-lien records posted on government Web sites. Over the past seven years, she has chronicled dozens of cases where local and state governments have inadvertently exposed thousands of Social Security numbers and other personal data on their Web sites, making them attractive targets for identity thieves.
As part of the campaign, Ostergren routinely posted the Social Security numbers of high-profile individuals that she obtained from county and state government Web sites. The list includes former Florida Gov. Jeb Bush, former U.S. Secretary of State Colin Powell, former U.S. House Majority Leader Tom DeLay, former Missouri Sen. Jean Carnahan and several county clerks in Virginia.
Over the years, her campaign has succeeded in forcing state and county governments to revise images of public records that were posted online or to break online links to document images containing Social Security numbers. In August, Ostergren provided links to an image of a mortgage document containing the Social Security number of Iowa Secretary of State Mike Mauro. She removed the link only after Mauro agreed to take down images of corporate documents that contained Social Security numbers from the state’s Web site.
Largely in response to her campaign, Virginia lawmakers passed legislation in 2008 that prohibits the dissemination of any records that contain Social Security numbers, no matter how the records were obtained. Violators are subject to fines of up to $2,500 plus $1,000 in court costs for each Social Security number posted. Lawmakers said the law was needed to prevent even wider dissemination of the numbers obtained from public records.
The law would have required Ostergren to remove Social Security numbers from her Web site or face punitive fines. The Virginia chapter of the American Civil Liberites Union promptly filed a lawsuit on behalf of Ostergren challenging the constitutionality of the law.
Last August, the U.S. District Court for the Eastern District of Virginia ruled that it would be unconstitutional for the commonwealth of Virginia to force Ostergren to remove the numbers from her site. While the court did not say the law itself was unconstitutional, it ruled that it would be an unconstitutional application of the law in Ostergren’s case.
That ruling in turn was appealed to the Fourth Circuit court by Virginia’s attorney general. In it, the government said that the case raised the issue of “crime facilitating speech.” The Social Security numbers posted by Ostergren on her Web site exposed the individuals assigned those numbers to a serious risk of identity theft, the appeal claimed. First Amendment rights do not protect speech that exposes public officials to “the very real prospect of devastating criminal predation,” the appeal read.
EPIC’s Verdi, however, said that Ostergren was simply republishing information that was already made public by the state, and even then, only in a highly targeted manner.
Meanwhile, Ostergren, who has temporarily removed documents containing the Social Security numbers of Virginia public figures from her Web site, plans to put the documents back up after she removes any data that might belong to the individuals’ spouses or children.
Speaking with Computerworld today, Ostergren said that local governments in Virginia and elsewhere are continuing to post documents containing sensitive data on their Web sites. Any time she finds such documents, she will post them, she said.
“It’s amazing that I still have to be at this after seven years,” she said.