The disclosure of Ohio residents' Social Security numbers on the state government's website highlights what many privacy experts - and criminals - already know: Such information is readily available to anyone with an Internet connection.

It is common for the websites of the USA's secretaries of state to contain personal information, including Social Security numbers (SSNs) and home addresses, in business statements. Besides Ohio, the data is available in New York, Florida and at least seven other states, say privacy experts who provided USA TODAY with links to public websites.

"When you have state agencies putting this stuff online, you are spoon feeding criminals valuable information," says Betty Ostergren, a privacy activist whose husband was a victim of identity theft in 1987 and 1989. "And they can be anywhere in the world - an Internet cafe in Pakistan or a library in Mexico."

Ohio Secretary of State Ken Blackwell is under fire after The Cincinnati Enquirer reported this week that an unknown number of business filings posted on the state's website include the SSNs of filers.

Most of the numbers appear on a lien form used from July 2001 to May 2002. As many as 150,000 of those forms are processed each year. SSNs are optional, says Sherri Dembinski, chief of staff for Blackwell.

She said Thursday that state law requires the filings be processed within 48 hours and made available to individuals and lending institutions by the third day. "We did not violate any law," she said.

Still, Blackwell spokesman James Lee said the office is considering options including removing the SSNs.

Similar information can be obtained through the websites of other states by viewing publicly available business filings. Such data could open the door for ID thieves to the credit histories and medical records of individuals, security experts say.

"The Social Security number is the Holy Grail," says John Pironti, a security consultant at tech company Unisys who works with financial institutions, hospitals and insurance companies. "It's the one piece of information about a person that can be used to unlock all other pieces of their personal information."

So far, most security breaches have centered on mishaps at high-profile companies. Last year, an estimated 55 million personal identifying numbers may have been compromised in more than 130 reported cases.

The disclosure in Ohio comes amid a growing reluctance by companies and universities to use SSNs to log into employee accounts such as retirement plans.

Now, only 20% to 25% of companies use SSNs in their log-in authentication sequence, compared with 60% in 2000, estimates Mike Cornetto, a senior consultant at Watson Wyatt Worldwide, which tracks human resource issues. Most businesses and colleges now use randomly generated unique IDs, he says.

to post a reply: login - or - register