Arkansas Blog

Lord Max you act like this is a permanent thing or something. What the hell is wrong with pulling the records till the SSN's can be covered?

Do you have any idea how many identity thieves are on the internet??? It's bad enough to have SSN's on the records at the courthouse, but at least that can be monitored. Anyone in the world could apply for credit based on the information O'Brien had on the county site.

And if you think it is such a trivial matter, I see no reason why you won't share with us your SSN right here and now? If you aren't willing to do that, then you need to stop your bitching. Put up or shut up.

Again, widely read state blogs have potency.
Good work.

Click on my name for a GAO report on the us of SSN's for non Social Security purposes. It contains various state laws. Here are the two it lists from Arkansas. Obviously Arkansas needs to follow the example of some other states.

Arkansas (2005)
Ark. Code Ann. § 4-86-107 Generally prohibits any person or entity from (1) publicly posting or displaying an individual's SSN in any manner; (2) printing an individual's SSN on any card required to receive products or services; (3) printing an individual's SSN on a postcard or in any other manner by which the SSN is visible from the outside; and (4) requiring an individual to transmit his or her SSN over the Internet unless the number is encrypted or the connection is secure.

Arkansas (2005)
Ark. Code Ann. § 6-18-208 Generally prohibits schools and school districts from using, displaying,
releasing, or printing a student's SSN or any part thereof on any report, ID card or badge, or any document that will be made available to the public, a student, or a student's parent or guardian without the express written consent of the parent, if the student is a minor, or the student if the student is 18 years of age or older.

Click on my name to see Ark. Code Ann. § 4-86-107.
==================================================================
I'm no lawyer like Mr. O'Brien but it seems clear to me that he broke the law. I assume "Attorney General Six-gun McDaniel" as you call him was letting O'Brien know that he was violating Arkansas law.
==================================================================

Wut the funk? You say some nuts disagree with this?!? Any right thinking citizen of this country should feel somethings wrong with posting SS #'s, whether your liberal, conservative or sane. That's the most problematic thing about being a liberal: you have to be continually be disappointed by other liberals. Damn, man. Respond with something that doesn't make this blog look so damn foolish.

Meet John Doe,

That's a band-aid law that probably does more harm than good in the long run.

The problem with social security numbers is that institutions use them to prove that you are who you say you are. That's convenient and cheap, if you're a business that likes to push your costs off onto others, and it's also bad security and bad public policy. All this law does is slap a band-aid on that gaping wound of a security problem. It just makes a social security number harder to find, but doesn't do anything to make it harder to commit fraud with once you get one.

"And not much of a problem until some nuts on the subject decided to make a point of publicizing it to the point of posting on-line specific Social Security numbers."

Darn. I wish I could have been one of the nuts. It is amazing though what kind of change of heart occurs when those who have some power become the subject of publicity. Just ask Stacy Hurst.

On another note, I wish I had thought to check McDaniel's records before they were pulled. I wonder if he had something out in the public domain that he preferred was redacted or was just conveniently not put back on line due to some clerical "oversight."

There's a state regulation that prohibits disclosure of SSN except on a need-to-know basis. It's in the "Data Classification Guide" published by the Department of Information Systems. Here's the relevant part:

LEVEL C - VERY SENSITIVE
Data classified as being very sensitive is only available to internal authorized users and may be
protected by federal and state regulations. Very sensitive data is intended for use only by individuals who require the information in the course of performing job functions.
These data elements include those protected by federal and state statute or regulation.
Access to these data elements is restricted to authenticated and authorized individuals who require
access to that information in the course of performing their duties. These are the data elements
removed from responses to information requests for reasons of privacy.
Security threats to this data include violation of privacy statutes and regulations in addition to
unauthorized alteration or destruction. If this data were accessed by unauthorized persons, it could cause financial loss or allow identity theft. Unauthorized disclosure could provide significant gain to a vendor's competitors.
Examples:
Social Security numbers
Most home addresses
Attorneys' files
Comprehensive law enforcement data
Domestic abuse data
Educational records
Foster care data
Health and medical data
Library borrower's records
Signature imaging data
Welfare records/data
Credit card numbers
Competitive bids
Civil investigative data
Criminal history data
Economic development assistance data
Food assistance programs data
Head Start data
Juvenile delinquent data
Counselors' data
Trade secrets data

I think the headline on this article accidentally left out a couple of words.

"O'Brien caves on S.S. numbers" should have read "O'Brien caves to reason on S.S. numbers" or "O'Brien caves to the law on S.S. numbers".

It is accepted practice that SSNs are redacted from public records which have been made the subject of a FOIA request. It would seem that these public records should be treated no differently.

Now that the records are temporarily available for public review only at the courthouse, armchair investigators will have to get to the bottom of the extremely important issue of who owns a piece of property the old fashioned way (meaning the way they did it just a few years ago)--by leaving said armchair to visit our beautiful county courthouse.

Whatever else we may disagree upon, we can all be certain that this is the beginning of the end times in Pulaski County.

===================================
So what's the penalty for the law O'Brien has broken?
===================================

I have to ask, what verified evidence is there that SSN which have been in public records for years are being used for ID theft? I thought ID Theft was happening more from the following:

1) Theft of or Knowledge of personal information from family or friend
2) Theft (often by meth addicts) of credit card offers or new checks from the bank delivered or payments with checks sent which have account info on them awaiting pickup from the mail carrier.
3) Social engineering on the phone or fooling people to fill out forms online or on paper with information that can be misused.
4) Mass theft online of databases, backup tapes

Lastly what is the tipping point in which damage is likely?

SSN and Name only or do you need DOB and Address, or even more like Place of Work or Birth location or Account numbers of current accounts?

Since SSN can be used to more uniquely identify people than name, would it be better to allow future research/analysis of related records if the name was redacted in records rather than SSN?

I know reporters often need DOB or SSN with a name to identify the unique person (address helps too but that changes often).

Is leaving SSN on records that have always had them on them now an unwarranted invasion of privacy at the same level as private medical information always has been?