State's online records pose risk

Hackers uploaded a virus to siphon off credit card information from CardSystems Solutions Inc. Thieves posed as legitimate businesses to purchase personal information from ChoicePoint Inc. But a search of state records posted online and easily accessible by the public reveals that thieves would not have to go through nearly that much trouble to steal the identities of many Massachusetts residents.

Tax liens, mortgage papers, deeds, and other real estate-related documents are publicly available in online databases run by registries of deeds across the state. The Globe found documents in free databases of all but three Massachusetts counties containing the names and Social Security numbers of Massachusetts residents.

Public documents that sometimes contain names and Social Security numbers include state and federal tax liens, Massachusetts Health liens, child support liens, and, less frequently, mortgages, said registers of deeds.

Although registers of deeds said that they are unaware of cases in which criminals used information from their databases maliciously, the information contained in the documents would be more than enough to steal an identity and open new lines of credit, said Eric Bourassa, a consumer advocate with the Massachusetts Public Interest Research Group who deals with identity theft issues.

''Once you get someone's name, address, and Social Security number you can really create a fake identity," said Bourassa. ''This is really bad."

A series of widely publicized security breaches of major data collectors has spurred legislation across the country, including in Massachusetts, to better protect personal financial information. Most recently, data thieves compromised information for 40 million credit card holders whose credit card companies processed purchases through CardSystems Solutions. The Federal Trade Commission also recently settled a case against BJ's Wholesale Club Inc. for failing to adequately protect the credit card information of many of its customers. In neither case did the information contain Social Security numbers.

State lawmakers are attempting to address the issue, said Senator Jarrett T. Barrios, Democrat of Cambridge. Today, there will be a hearing on identity theft legislation, including a bill cosponsored by Barrios that includes language that would prevent government agencies from putting Social Security numbers online, he said.

''This is an example of the convenience that technology provides us getting ahead of the privacy protection that we as consumers need," he said. ''They're making Social Security numbers easily accessible to those with malicious intent and putting those people in harm's way."

Registers of deeds said that the databases are normally used by real estate professionals, commercial users such as mortgage lenders, and members of the general public who want to ensure that certain documents have been filed.

Officials at registry of deeds offices said that they can't control what information ends up on documents that they file.

''We can't tell government agencies what to file and what not to file," said Dan Matthews, executive assistant for the Norfolk County Registry of Deeds. ''We actively discourage people from putting Social Security numbers on anything filed, but government agencies are not as good as you would hope they would be."

The databases of Nantucket and Plymouth counties can be accessed only for a fee, and the database of Dukes County is not remotely accessible. In Bristol County, the databases in the Bristol Northern and Fall River districts can be accessed only for a fee, but the database of the Bristol Southern district can be accessed for no charge.

Tim Connolly, a spokesman for the Massachusetts Department of Revenue, said that Social Security numbers are put on documents such as liens so that the department, private lenders, and real estate brokers can pinpoint the individuals with liens against them. Although he acknowledged the identity theft issues of having the numbers available on the Internet, Connolly said that to his knowledge, the department had not considered removing the Social Security number from liens.

Alan Cote, the supervisor of public records for the secretary of state's office, said that Social Security numbers are necessary information that must appear on any lien to differentiate people with the same name. The public documents containing Social Security numbers have been available in registry of deeds offices for decades, but were made available online only in recent years, he said.

''I don't think it was a big problem then, and I don't think it's one now," he said.

Cote said that he met with Department of Revenue officials a month ago to discuss how they might better secure Social Security numbers and has another meeting scheduled. He said the department is considering listing only the last four digits of Social Security numbers on the documents.

Allan, a Massachusetts insurance agent who had a tax lien filed against him in 1996, would disagree. He was stunned when shown his Social Security number was available in a registry database. He asked that his last name not be used to keep him from being a target of identity theft.

''Not only do they have my name and address up there, they have my Social Security number," he said. ''They're supposed to watch out for fraud, and here they just plaster my number all over the Internet. Anybody could find this."

Although an identity thief might have had a problem obtaining a credit card with Allan's number seven years ago, now the would-be criminal would have no problem opening an account, Allan said. Most clerks' databases contain records dating to the mid-1970s.

Joe Light can be reached at jlight@globe.com.