ID thieves mine for gold on jail sites

ID thieves mine for gold on jail sites

Online public records give Social Security numbers and more By Bob Sullivan MSNBC

May 12 — If keeping Social Security numbers off the Internet is a bit like trying to plug holes in a leaky dam, the U.S. justice system has left a floodgate open. Dozens of law enforcement Web pages list names, addresses, dates of birth, Social Security numbers, heights and weights — everything an identity thief needs to impersonate a victim. Sometimes there’s even a photo.

The dossiers belong to prison inmates and wanted criminals; the sites that list them have become user-friendly shopping malls for identity thieves.

A SOCIAL SECURITY NUMBER

is the key to a person’s financial kingdom. In some cases, all you need to get a credit card or a car loan is a Social Security number and a date of birth.

There’s thousands of such matched pairs for the taking on the Internet, thanks to efforts made by government agencies and the justice system to publicize information about convicted criminals. Orange County, Fla., for example, publishes the Social Security number of every inmate only moments after her or she is jailed, some 57,000 people in the past year.

Indiana’s Sex and Violent Offender Registry also offers up such data, even including driver’s license numbers. And the U.S. Marshals Service “Most Wanted” Web site lists Social Security numbers along with photographs. Prospective identity thieves using the site can be sure to pick someone with similar looks.

But who would want to impersonate a jailed criminal? Or worse yet, an alleged felon wanted by federal authorities? Anyone who wants a disposable identity. As long as the thief is reasonably sure a criminal background check won’t be conducted immediately, the risks are low, experts say.

“Basically they’re offering up all the data you need to make a driver license,” said Rob Douglas, CEO of American Privacy Consultants. But what about being mistaken for the real criminal? “That stuff doesn’t really matter. As a privacy thief, I’m just looking to create an ID to get a credit card or pass myself off as somebody else for a while.”

Meanwhile, the ID thief knows exactly how long it will be before the victim is released from prison, and therefore how much time they have before suspicious account behavior is likely to be recognized.

“If I wanted to become someone else, I’d probably look for some middle-class white male arrested for narcotics, preferably with intent to distribute,” said John C. Hennessy, a programmer who alerted MSNBC.com to the online prisoner databases.

PUBLIC RECORDS LAWS AT ISSUE

Assuming the identity of a wanted criminal apparently isn’t as crazy as it sounds. “Identity theft, it actually is a problem for us,” said Nikki Credic, spokesperson for the U.S. Marshals Service. “People do go on our Web site and they obtain information there and open up fraudulent accounts.”

The problem is a Catch-22 for the U.S. Marshals, she said. One the one hand, they want to publish any available information which could lead to the capture of a fugitive. It’s possible a Social Security number could be recognized by a car dealership about to offer a car loan, for example. On the other hand, identity thieves can actually obscure the hunt for a criminal by creating a string of false leads.

”(U.S. Marshal officials) know it’s a problem, but at this point they have not made a decision about it,” Credic said. For agencies publishing inmate data, aggressive public records laws are at the heart of the problem. Most agencies in Florida publish inmates’ Social Security numbers because they are required by law to do so, and publication on the Internet simply magnifies an old problem. But that’s likely to change soon — both houses of Florida’s legislature recently passed a law excluding Social Security numbers from public records, and the governor is expected to sign the bill by a May 16 deadline.

Still, privacy experts are worried that criminals’ financial information will continue to leak out onto the Net, in part because it won’t arouse much public outrage or inspire quick calls to action. After all, said Douglas, who would step forward to defend criminals’ privacy rights? “There is nobody who’s going to be real sympathetic to the fact that their information is out there,” said Douglas. “So then the question becomes, ‘What’s the purpose?’ ”

Richard Smith, former chief technology officer for the Privacy Foundation, says there probably isn’t a purpose — some agencies are likely publishing the data simply because they can.

“There probably is no reason to publish Social Security numbers. An age would probably be more useful than a birth date,” Smith said. “I suspect that the states are simply copying data from someone’s record without thinking through all of the implications.”

IT’S NOT JUST CRIMINALS

Convicted criminals who may leave jail only to suffer fallout from identity theft might not evoke sympathy, but the problem of balancing open public records with financial privacy is far more widespread. In fact, court documents of every kind are among the most popular target for identity thieves.

Hennessy said he can find the Social Security number of anyone who has ever filed for bankruptcy using the Public Access to Court Electronic Records system, also called PACER.

“The trend seems to be that many people aged 18 to 30 will file bankruptcy at least once in those years,” Hennessy said.

The Judicial Conference of the United States, which sets policies for federal courts, has been trying to plug some some of the holes that turn public records — and specifically PACER — into havens for identity thieves. Until last year, personal financial data, including bank account information, regularly made its way into the PACER system in documents that are part of a variety of federal lawsuits.

Last year, the Judicial Conference recognized the problem and instituted a policy that requires redaction of data such as Social Security numbers. But the burden of removal lies with the parties involved, so the data sometimes slips into the system anyway. And removing the information, generally by obscuring part of the account numbers, is a time-consuming process.

In fact, the burden is so high that when the Judicial Conference asked for public comments on its plans, a bankruptcy court official in New Mexico offered these alarming observations: “Efforts to curb the publication of these numbers is futile. They are too widespread, and too necessary to identification. ... Such proposals would significantly increase processing time in every case.” Such efforts will become even more involved soon, as the Judicial Conference last week agreed to begin a pilot program in 11 states that will expand PACER to include federal criminal case records.

Financial data is supposed to be redacted from those files, also. LEGISLATORS TRY TO PLUG HOLES The Judicial Conference policy mimics sentiments expressed by legislators in Florida, Nebraska, and even the U.S.

Senate toward striking Social Security numbers from public records. A federal law proposed by Sens. Diane Feinstein, D-Calif., and Judd Gregg, R-N.H., would make display of a Social Security number illegal. But even the bill’s supporters concede it would take two to three years to get government agencies to stop publishing the data as part of public records, said Chris Hoofsnagle, an attorney with the Electronic Privacy Information Center. And still, the data would live in a mountain of documentation that’s already public.

“There’s no talk of going backwards,” he said. Even marriage licenses in some states are public, and can be mined for Social Security numbers, Hoofsnagle said.

PUBLIC ACCESS ADVOCATES OBJECT

Not everyone is for striking the data. Information brokers, journalists, and other researchers are worried any weakening of open records laws would make their job much more difficult. Organizations like EPIC, always a staunch supporter of open records laws, find themselves straddling the fence on this topic.

“We strongly support public access to records. But we’ve argued there should be use limitations, so the data is used consistently with their purposes,” Hoofsnagle said. “The problem you see between Pacer and other public records sites is they are mined by commercial entities. The data can be used for any purpose — proper purposes and improper purposes.”

But while government agencies and lawmakers labor over the fate of the public record laws, identity thieves are having a field day browsing through records provided today by Web sites like the Orange County Government Services Online.

“As for risk,

it’s on the high end of the scale,” Douglas said. “It’s ridiculous that (Social Security numbers) are out there. There is no law enforcement or protection function served by putting all of that data out there. It’s just a red flag inviting abuse, whether that is vengeful abuse or just run-of-the-mill identity theft.”

Show all stories by   Author:  21132 ( Click here )