[IRP] Computerworld on EPIC Filing in SSN Case

[Katitza Rodriguez]

http://www.computerworld.com/s/article/9139739/Privacy_advocate_gains_support_in_fight_to_keep_Social_Security_numbers_on_Web_site?taxonomyId=84

Privacy advocate gains support in fight to keep Social Security
numbers on Web site

Virginia wants Ostergren to stop publishing the sensitive data

Jaikumar Vijayan


October 21, 2009 (Computerworld) A fight by the Virginia government
to stop a privacy advocate from republishing Social Security numbers
obtained legally from public records on government sites on her Web
site is attracting the attention of some privacy heavyweights.

The Electronic Privacy Information Center filed a friend of the
court brief asking the U.S. Court of Appeals for the Fourth Circuit
to uphold privacy advocate Betty Ostergren's First Amendment right
to publish the numbers.

In its brief, EPIC noted that Ostegren's advocacy work is focused on
getting state and local governments around the country to stop
posting unredacted public records containing Social Security numbers
and other private data on their Web sites. As part of an effort to
highlight the problem, Ostergren has taken the Social Security
numbers of prominent people she has found in public records and
republished them on her Web site.

When a person publishes lawfully obtained and truthful information,
that action is "pure free speech," said John Verdi, senior counsel
at the Washington-based EPIC. "It is exactly the type of speech that
is protected by the First Amendment."

Ostergren runs the Virginia Watchdog Web site, which she has used to
highlight identity theft risks that can result from the posting of
unredacted public documents, such as land and tax-lien records
posted on government Web sites. Over the past seven years, she has
chronicled dozens of cases where local and state governments have
inadvertently exposed thousands of Social Security numbers and other
personal data on their Web sites, making them attractive targets for
identity thieves.

As part of the campaign, Ostergren routinely posted the Social
Security numbers of high-profile individuals that she obtained from
county and state government Web sites. The list includes former
Florida Gov. Jeb Bush, former U.S. Secretary of State Colin Powell,
former U.S. House Majority Leader Tom DeLay, former Missouri Sen.
Jean Carnahan and several county clerks in Virginia.

Over the years, her campaign has succeeded in forcing state and
county governments to revise images of public records that were
posted online or to break online links to document images containing
Social Security numbers. In August, Ostergren provided links to an
image of a mortgage document containing the Social Security number
of Iowa Secretary of State Mike Mauro. She removed the link only
after Mauro agreed to take down images of corporate documents that
contained Social Security numbers from the state's Web site.

Largely in response to her campaign, Virginia lawmakers passed
legislation in 2008 that prohibits the dissemination of any records
that contain Social Security numbers, no matter how the records were
obtained. Violators are subject to fines of up to $2,500 plus $1,000
in court costs for each Social Security number posted. Lawmakers
said the law was needed to prevent even wider dissemination of the
numbers obtained from public records.

The law would have required Ostergren to remove Social Security
numbers from her Web site or face punitive fines. The Virginia
chapter of the American Civil Liberites Union promptly filed a
lawsuit on behalf of Ostergren challenging the constitutionality of
the law.

Last August, the U.S. District Court for the Eastern District of
Virginia ruled that it would be unconstitutional for the
commonwealth of Virginia to force Ostergren to remove the numbers
from her site. While the court did not say the law itself was
unconstitutional, it ruled that it would be an unconstitutional
application of the law in Ostergren's case.

That ruling in turn was appealed to the Fourth Circuit court by
Virginia's attorney general. In it, the government said that the
case raised the issue of "crime facilitating speech." The Social
Security numbers posted by Ostergren on her Web site exposed the
individuals assigned those numbers to a serious risk of identity
theft, the appeal claimed. First Amendment rights do not protect
speech that exposes public officials to the "the very real prospect
of devastating criminal predation," the appeal read.

EPIC's Verdi, however, said that Ostergren was simply republishing
information that was already made public by the state, and even
then, only in a highly targeted manner.

Meanwhile, Ostergren, who has temporarily removed documents
containing the Social Security numbers of Virginia public figures
from her Web site, plans to put the documents back up after she
removes any data that might belong to the individuals' spouses or
children.

Speaking with Computerworld today, Ostergren said that local
governments in Virginia and elsewhere are continuing to post
documents containing sensitive data on their Web sites. Any time she
finds such documents, she will post them, she said.

"It's amazing that I still have to be at this after seven years,"
she said.