Ohio Becomes a Battleground State in the Arena of Identity Theft

October 2006

Local Political Races and Government Policies in Ohio
Spotlight the Mishandling of Official Records

As he crisscrossed Ohio in a giant blue bus, trying to revive his failing campaign for governor, Secretary of State Ken Blackwell couldn't afford to make another mistake. Running 15 points behind his Democratic opponent, U.S. Representative Ted Strickland, Blackwell already had suffered a series of embarrassing gaffes.

The trouble began in March, when Blackwell settled a federal class-action lawsuit claiming that 1.2 million business documents posted on his web site—thousands of which were estimated to contain social security numbers—posed an urgent risk of identity theft. Blackwell's office agreed to prevent the numbers from appearing on newly posted documents and to work "with due haste" to retroactively remove numbers from documents already filed, the Dayton Daily News reported.   

At the end of April, employees in Blackwell's office provided political interest groups with 20 computer disks containing the Social Security numbers of millions of registered Ohio voters.
Political columnists around the state began to wonder whether the biggest threat to Blackwell was Blackwell, not his opponent.

Then, in mid-September, with the election less than two months away, a Columbus television station broke news that, nearly seven months after Blackwell promised to begin removing the Social Security numbers from his site, some numbers remained available to anyone with an Internet connection.

Handling of Official Records Becomes Political Fodder

News of the ongoing security lapse made easy campaign fodder for Blackwell's opponent Strickland, who referred to the gaffe on his campaign website as a "gross potential violation of the privacy of Ohioans."

The report prompted a terse response from Blackwell's office. "We don't ask for this information," said Blackwell spokesman James Lee in a recent interview. "Banks continue to give it to us, against our wishes and our advice. We are removing it from the website as quickly as we can."

Public releases of personal data have become an issue both in Blackwell's race for governor and in the contest to replace him as Secretary of State, where Jennifer Brunner, a former county judge and board of elections member is squaring off against Greg Hartmann, currently the Hamilton County Clerk of Courts. Personal data security is a hot topic in courthouses in many of Ohio's 88 counties, as county clerks, judges, the attorney general and the Supreme Court spar over who is ultimately responsible for keeping private information private.

"Nobody knows what the rules are," says Hamilton County probate judge and former Clerk of Courts Jim Cissell. "Right now it's just a big mess."

Cissell's successor, Hartmann, had some trouble of his own this year with Social Security numbers. Just as the Republican court administrator was launching his campaign for Secretary of State, the U.S. Attorney for the Southern District of Ohio announced an indictment of eight people for using Social Security numbers cribbed from the clerk's website to create 100 fake identities and steal nearly $500,000 across three states. The group's ringleader, 37-year-old Traci Southerland, was sentenced to 13 years in a federal prison for fraud and conspiracy.

According to a Cincinnati Post story in December, 2004, a lawsuit filed by a Cincinnati woman who had been the victim of identity theft prompted Hartmann to remove 320,000 public documents from the Hamilton County Clerk of Courts web site, a site that gets over 60 million hits a year. Hartmann had received multiple warnings that posting Social Security numbers on his website could pose security risks. In April 2005, Hartmann agreed to prohibit online access to yet another batch of sensitive documents—this time it was domestic relations court files.

"It's unfortunate he ignored early warning signs and put innocent citizens at risk," said Jennifer Brunner, Hartmann's opponent for Secretary of State, in a September 22 press release. "It's apparent that Greg finally realizes that identity theft is an issue the people of Ohio care about."

Hartmann had already been taking shots of his own, creating an entire campaign website, www.BrunnerBlunders.com, dedicated to documenting cases where former Judge Brunner was allegedly soft on identity thieves. "Why as a Columbus judge was Jennifer Brunner notorious for giving light sentences to felons convicted of forgery and other forms of identity theft?" Hartmann said in a press release.

Voters Starting to See Identity Theft as a Public Safety Issue

The growing rhetorical battle may reflect increasing anxiety among Americans over identity theft.  On September 19, AARP released results from a poll that found 83 percent of likely voters aged 42 and older would support candidates who vote for laws cracking down on the crime. The response suggested that Americans are starting to view identity theft in the same category as other public safety issues that typically make their way into campaigns.

Stronger laws and stiffer penalties, however, won't answer the fundamental question: How should public officials balance citizens' right to privacy against the public's right to know? "It's a real quandary," says Cissell, who advises the Ohio Supreme Court on privacy issues as a member of the court's technology committee.

Cissell tells the story of a man who used Cissell's Clerk of Courts website to glean a relative's Social Security number from a traffic ticket. On the one hand, the victim of the theft wanted Cissell to change the website so that this couldn't happen again. "But then he told me please don't change anything, because he was also using my system to check out his own employees," Cissell says. "See how hard this is?"

Making life harder for court clerks across Ohio are conflicting messages from local judges and state officials about how to handle private information. Courts use personal identifying data, such as home addresses, eye color, driver's license numbers, and mother's maiden name, to make sure they have the right person in custody.

"I know for a fact that there's more than one Tim Rudd in the world," says the Tim Rudd who is clerk of the Clermont County Municipal Court in Ohio. "If this court issues a warrant for Tim Rudd, I want to make sure it's the other guy and not me."

Legislating Smarter Handling of Records: No Slam Dunk

State law also requires court clerks to record Social Security numbers in many cases, says Lynne Mazeika, Lake County Clerk of Courts. In a divorce case, for example, judges need to have records of both parties' finances. When the case is complete, judges must forward the records to institutions such as pension funds and insurance companies, which use Social Security numbers as identifiers.

"The court clerk is like a librarian," Mazeika says. "Just like the librarian doesn't have time to read every book they put on the shelves, we don't have time to read all these cases. We don't want to be the ones trying to figure out what's public and what's private."

But in March of this year, Ohio Attorney General Jim Petro decided that court clerks must do exactly that. He instructed them to redact private records from every page they receive, but he never defined what a private record is. In the same decision, Petro also instructed them to assume that public documents are in fact public, and to follow state sunshine laws closely.

"The Attorney General didn't really understand what was going on," Mazeika says.
    
Meanwhile, court clerks around the state have been waiting for years for the Ohio Supreme Court to announce its official policy on how and whether to shield private information contained in public documents. Since the Attorney General's decision is non-binding, each county has developed its own rules. The result is wholesale confusion.

In Butler County, the Clerk of Courts stopped placing digitally scanned court documents on the website. But anyone can walk into the office and use the clerk's internal computer system to see scans of every document, including millions of pages containing all the information needed to steal peoples' identities.

Instead of just removing private information from the Web, the county's domestic relations judges wanted to go a step further and asked the clerk to redact personal information from court filings before providing copies to the public, including inside the office. The clerk refused. Like many in the position, the Butler County Clerk of Courts believes Social Security numbers and other private data should never be allowed in court documents in the first place.

"Judges and lawyers are the best gatekeepers to determine what goes into those documents," says Jerome Cook, administrator for the clerk. "They should be the ones who keep this information from getting in there in the first place. We don't have the legal right to alter public documents."

Other Clerks of Courts do exactly that. Before anyone receives a court document in Clermont County, Tim Rudd makes a photocopy of the entire file. He blacks out all personal information with a marker. Then he makes another photocopy and gives that second print to the public, since giving the marked-up version would allow people to read the numbers through the ink. "It takes literally forever," Rudd says.

Even though he's now a judge, Cissell still manages his own documents. Anytime someone wants to see a court document, even one on microfilm, Cissell assigns a staff member to look over the person's shoulder to make sure he or she isn't stealing Social Security numbers. "We don't have any choice," Cissell says. "Otherwise we get sued."

At the opposite end of the state, Mazeika believes she's found a better way. She convinced her county's judges to decree that all personal information be filed on a separate form, automatically sealed, and placed in a separate white envelope. When someone requests a case file, all Mazeika's staff has to do is remove the envelope from the file and let the person see the rest of the documents.

As an active member of the Ohio Clerks of Courts Association, Mazeika is lobbying the state supreme court to institute her practice statewide. "Courts need this information to operate," Mazeika says. "That's fine. But your neighbor doesn't need to be sitting there in his underwear reading your private information on the internet at two in the morning."

But now that court documents have been available over the Internet for almost a decade, people have begun using those documents in new ways, clerks say. "If my daughter comes home from Dayton with a new boyfriend, I want to be able to check this guy out on the domestic relations court website." Jerome Cook says. "But now I can't do that unless I go down to the office myself and look it up. Personally, that's upsetting to me."

For those public officials not looking to pry into their daughters' dating lives, however, the only obvious rule in Ohio for handling private records embedded in public documents is that candidates for statewide office should probably remove those documents from their websites before they officially announce their campaign. For everyone else, there really are no rules.

"Maybe in a few years we'll have all this figured out," Cissell says. "But right now, we don't even know what we want."