Calif.
Jaikumar Vijayan
March 27, 2007 (Computerworld) Three years after it first made available certain documents containing Social Security numbers and other sensitive data on its Web site, the
In a statement (download PDF), Secretary of State Debra Bowen said her office was also freezing bulk electronic sales of its Uniform Commercial Code (UCC) database until all but the last four digits of Social Security numbers were removed from documents. There are approximately 2 million UCC filings on record with the secretary of state's office; about a third contain Social Security numbers.
Bowen said her office is considering using redaction technology to block out the first five digits of the Social Security numbers from UCC documents. And it has posted a warning online urging UCC filers not to include the numbers in their documents. Bowen also announced support for legislation sponsored by state Assembly member Dave Jones (D-Sacramento) that would require no more than four digits from an individual's Social Security number on public records -- both at the state and county levels.
Officials in Bowen's office could not be reached for comment.
UCC documents are financial statement filed with the state by banks and other creditors when an individual takes out certain types of loans. The documents are considered public records and are available for purchase by the public. Over the past few years, several states have been posting images of such records on their Web sites without redacting any of the sensitive information -- much to the outrage of privacy advocates.
"This is yet another place where our laws haven't kept pace with advances in technology," Bowen said in the statement. "To make the agency more business-friendly, previous Secretaries of State have made these records available on the Internet. However, until we find a way to remove all but the last four digits of people's Social Security numbers from the records in the electronic database, I've decided to pull the plug on the system."
Bowen's decision came just weeks after her office was notified by Jones about the easy availability of Social Security numbers on its Web site, and the danger that poses for potential identity theft.
An aide to Jones today described how he purchased about 20 UCC records from the site at $6 per record and discovered that 14 of them contained Social Security numbers, full names, addresses and even images of signatures. "It was totally easy to get those records," said the aide, who asked his name not be used. All it involved was clicking through as a nonsubscriber, entering some basic contact information and credit card details and searching for records using common last names, he said. One record contained Social Security numbers for seven people.
"Californians like to fancy ourselves about being so good on privacy," the aide said. "But what we saw on the site was mind-boggling." Because state laws prohibit the posting of such information in public records at the county level, "it was surprising to see this happening at the state level."
But California is not the only state to post UCC documents on the Web, nor is it the first one to take the postings down, said B.J. Ostergren, a privacy advocate in Richmond, Va., who has been pressing state and county governments to remove such data from their Web sites.
Ostergren runs The Virginia Watchdog, which has for the past several years documented cases where county governments and secretary of state offices around the country have routinely posted sensitive data online. Many are moving to block online access to the information because of heightened privacy concerns, she said. Some, such as the
Among the states that have pulled down images of UCC documents with Social Security numbers are
