Social Security numbers online? Not that uncommon.

I read this article and I just laughed out loud, even though this is not a laughing matter. This is more common than you think.  Texas counties illegally posting Social Security numbers online, AG says.  Our social security numbers have been compromised so many times that I vote for getting rid of them altogether.

In state and county government, there exists a myriad of public records and up until recently, these records contained social security numbers.  Most states have passed laws that forbid the practice of using social security numbers on public records.  I think the way this evolved, and I'm only guessing, there was a mad rush to make information available to the public.  Agencies began putting information on their websites and security was an afterthought.

As the Information Security Officer of a state agency, I recently sat in a state wide security committee meeting and broached this very topic with the Chief Information Security Officer.  I asked him when the state was going to audit all of its agency public websites for privacy violations.  In our agency, we have been in process of pulling data off our public websites, rewriting applications, and safely securing data in backend databases (behind the firewalls) with encryption. 

One of the problems in state government is that agencies are fairly autonomous and generally run their own websites.  Most state agencies don't have security expertise on staff.  It is incumbent upon the state level security team (if one exists) to manage the security of all external facing websites.  It's a problem of resources and knowledge and it's a big problem.  Privacy breach laws have been enacted in most states and the penalties are getting stiffer.  It's no longer acceptable to ignore this problem.