Basic Internet Safety Measures Overlooked
A Wirth Law Office investigation has revealed that Oklahoma district courts routinely include Social Security numbers, drivers license numbers and birth dates in court records posted online.
We launched the investigation after members of the public contacted our office with concerns about how courts use sensitive personal data. The investigation exposed a systematic practice that goes far beyond incidental inclusion of Social Security numbers, drivers license numbers and birth dates on back pages of some Tulsa County court filings.
Our review of online court records revealed that a majority of Oklahoma county district attorneys routinely include such highly sensitive personal information as part of case headings — or styles — at the front of every criminal case. A growing number of local courts provide access to those records on a statewide, court-operated Website.
Even in counties where court documents are not posted online, when Social Security numbers are included in case files the sensitive personal information is available to anyone who visits the local courthouse and asks to see the file.
A handful of Oklahoma courts have adopted local rules to prohibit use of full Social Security numbers in court filings. Muskogee County court records, for example, include only the last four digits of a Social Security number on initial criminal filings. Yet even where local courts have implemented reasonable privacy rules, statewide criminal-court rules still require some case documents to include Social Security numbers.
Online Privacy vs. Public Rights
A collision between privacy interests and a long-standing American principle of open courts is nothing new. Even before the Internet created new opportunities for court records to be misused, courts found good reasons to seal at least parts of some case files such as guardianships, adoptions and juvenile cases.
As Internet access proliferated, some states’ courts and the federal court system adopted rules that limited access to sensitive personal information — including Social Security numbers. Some states require separate cover sheets with personal information to be kept in sealed files. Others simply restrict use of Social Security numbers and drivers license numbers in court filings.
In Oklahoma, one side of the state’s unusual bifurcated court system adopted privacy rules. While Oklahoma Supreme Court rules allow filers to redact personal information in civil cases, the Oklahoma Court of Criminal Appeals promulgated no privacy rules regarding Social Security numbers. The state Supreme Court in 2011 declined to require further restrictions on publication of private data in public court documents.
Instead, Oklahoma’s highest criminal court requires all lower courts to use standardized pleading and sentencing forms with Social Security numbers at the top of each filing. In some cases, those forms undermine privacy protections embodied in local court rules that otherwise limit how much personal information is included in court files.
Absent a statewide privacy policy that protects the innocent and guilty alike from systematic exposure to potential identity theft, Oklahoma has nonetheless moved ahead in providing online access to criminal court records. Court records are currently presented in two separate Web sites. One site — oscn.net — is operated by the court system, and another — odcr.com — operated under contract with the court system.
Until recently, residents of 64 counties served by the privately run Website — odcr.com — enjoyed at least some protection against online exposure of their sensitive personal information. Anybody may search the site and read case dockets, but only Oklahoma attorneys can view documents, which as often as not include Social Security numbers.
That modicum of privacy may soon evaporate. In an ongoing e-filing and Web consolidation initiative, records from those 64 counties on odcr.com are being moved to the state court systems’ fully public Website.
Gold Mine for an Identity Thief
As Oklahoma courts continue an ongoing move toward automated filing and consolidated Websites, sensitive personal information previously available online only to attorneys is becoming available to the public on oscn.net — the official statewide court site. With no access restrictions, the Oklahoma courts’ Website provides an identity thief a virtual gold mine of personal information.
Seven of 13 counties that participated in the state-court Website in early 2014 included Social Security numbers, birthdays and sometimes drivers license numbers in case headings — on the first page of every criminal allegation.
Tulsa County was among those that did not include personal information on the front page. They put it on the back page.
Until Dec. 5, 2014, the Tulsa District Attorney’s office included a back page with most criminal case filings that exposed drivers license numbers, Social Security numbers, full birthday and home address of the accused. For some reason, the office stopped including those pages in early December, but an inspection of January filings revealed at least one case where the personal identifiers were included.
By late January, 2015 four more counties were listed on the consolidated state site. Some of those counties have so far provided access to docket information but no access to court documents on the state Website — not for attorneys nor for members of the public.
However, one of the newly listed counties — Logan County — does provide documents on the public site. Logan County criminal filings include the basic information an identity thief needs to forge credit applications — full name, address, date of birth, drivers license number and Social Security number.
Restricting access to court Websites and restricting access to public documents on public Websites creates little more than a speed bump for identify thieves when the information is otherwise available in public records when full Social Security numbers are included in case files.
As Oklahoma courts move forward with e-filing initiatives and Website consolidation, it is likely that whatever information is included in any county’s case files will become available on the public state court Web site. The Wirth Law Office examination of both the private site and the state Web site discovered that records in a majority of Oklahoma counties systematically include personal information.
Identity Theft is Big Money
Make no mistake, identity theft is big business. About 7 percent of Americans above the age of 16 suffered some form of identity theft in 2012, according to the Bureau of Justice Statistics.
Among identity theft victims, some tend to suffer more than others. Those whose personal information was used to open a new account or for other fraudulent purposes were more likely to experience severe emotional distress, financial problems or even damage to personal relationships, as compared to those who had credit cards stolen, the Bureau reported.
For an identity thief, stolen Social Security numbers can have multiple uses. They data can be used for mundane tax-evasion schemes — such as attributing taxable work to someone else’s Social Security number — or for more insidious purposes. Financial crimes committed using a stolen identity can result in the identity theft victim being charged with the thief’s crimes.
An identity thief can also use stolen Social Security numbers to mislead police — and courts — after an arrest. Or an identity thief might use stolen Social Security numbers to open new financial accounts — leaving the victim holding the bill.
The National Center for State Courts notes that in 2003 a team of identity thieves used the federal online court records system to target 34 individuals and 20 financial institutions by opening false accounts. Since then, federal courts have adopted more stringent policies for disclosure of personal information online.
After federal courts began instructing filers to redact personal information from case files, a 2010 survey found only 2,899 documents with unredacted Social Security numbers among some 10 million documents filed during a two-month period.
Open Courts Mean Open Records
As inconvenient as it may be for someone charged with a crime to have their court records available online, the prevailing opinion seems to be that court records should be available online. Oklahoma courts, like those of most states and like federal courts, have implemented court automation initiatives with an eye toward Internet access.
Online access to court records reduces costs of representation when attorneys can review documents online before obtaining official copies. Parties involved can more readily keep up with the progress of a case, as can the media. Employers or anyone interested in a person’s criminal history can readily examine case files — which can as well serve to show an accused person was later exonerated.
“The best practice is to allow all users of court records to access all public information online — both for viewing and for downloading,” the Access to Justice Board of the Washington State Bar Association concluded.
Federal courts were already examining information security policies when Congress’ E-Government Act of 2002 required federal courts to develop a Website that provides public access to court dockets and case documents. The Act required the U.S. Supreme Court to adopt rules that protect sensitive personal information from exposure in online court documents.
Piecemeal Privacy Protections
Privacy protection provisions of the 2002 E-Government Act were typical of the piecemeal approach lawmakers have taken to protecting sensitive personal information. Despite several failed attempts to get bills passed, no federal law prohibits bulk sale of Social Security numbers by private companies.
Most states have some form of law restricting or prohibiting unauthorized use or display of Social Security numbers. Oklahoma’s legislature is among those that have tried in some way to shield sensitive personal information from online exposure by state agencies.
As early as 1974, Oklahoma lawmakers prohibited any part of the state government from using Social Security numbers for any purpose — with a few exceptions. Those exceptions included state business related to Social Security benefits, tax collection, school testing programs, drivers license applications. Okla. Stat. tit. 74 § 3111.
The 1974 law also included a grandfather clause. Lawmakers authorized continued use of Social Security numbers where they were already in use. Oklahoma lawmakers have since added more protections related to state use of sensitive personal information.
Oklahoma agencies that collect personal information such as Social Security numbers are required in a 2006 law to notify state residents when that information is compromised by a system security breach. Okla. Stat. tit. 74 § 3113.1. The National Center for State Courts Future Trends survey in 2006 said such security breach laws could pressure state court systems to “conform record access policies with state security breach laws.”
Oklahoma employers are prohibited from publicly displaying employees Social Security numbers — unless the employer is the State of Oklahoma. Okla. Stat. tit. 40 § 173.1. Federal law prohibits state motor vehicle departments from releasing “highly restricted personal information” — including Social Security numbers — except for narrowly defined uses. U.S. Code 18 § 2721.
The Social Security Administration itself limits circumstances under which it will release Social Security numbers. The agency systematically provides information about Social Security accounts to law enforcement agencies investigating serious crimes, but does not systematically authorize release for investigation of non-violent crimes.
The Social Security Administration only complies with subpoenas and court orders on a case-by-case basis. The federal agency has no explicit obligation to answer state courts’ requests — or orders — to release information. The agency does, however, allow systematic data exchange for verification of information provided to state motor vehicle agencies.
Carelessness is Counterproductive
Along with birth dates and drivers license numbers, Social Security numbers’ singular status as a unique identifier of all U.S. citizens provides courts a somewhat reliable means of verifying the identity of persons named in court files. At the same time, courts’ careless handling of Social Security numbers undermines their value as identifying information.
Careless handling of sensitive personal information — by the individual who owns the Social Security number, by the local district attorney, or by the state’s highest criminal court — is similar to leaving a door unlocked at an unattended residence.
Oklahoma courts, legislators, District Attorneys and citizens alike can take steps to stop systematic careless handling of sensitive personal information by the state’s criminal courts.
- The Oklahoma Court of Criminal Appeals can adopt rules similar to those of other states that require sensitive personal information to be submitted as attachments not to be released in public court files.
- The Oklahoma Court of Criminal Appeals can adopt rules similar to those of the Fifteenth Judicial District (Muskogee, Wagoner and Cherokee Counties) that limit sensitive information in public files to only the last four digits of a Social Security number and the year of birth.
- If Oklahoma Criminal Courts refuse to adopt sensible privacy rules, the Oklahoma legislature could further codify privacy protections — as Congress did in regard to federal courts.
- District Attorneys can voluntarily redact sensitive personal information from case documents, unless otherwise required by law.
- District Attorneys could ask the Court of Appeals to modify mandatory pleading and sentencing forms so Social Security numbers are redacted to the last four digits.
- Courts, legislators and county court clerks can cooperatively develop methods to allow those with sensitive personal information exposed in existing court records to have it removed. Oakland County, MI offers a workable model.
- Citizens can ask legislators to adopt common sense measures to bring Oklahoma’s online court information privacy policies up to date.
Wirth Law Office Communications Director David Collins contributed to this report.
