Ostergren Prevails In US District Court

Betty Ostergren has prevailed in the US District Court in Richmond. Ostergren sued the Attorney General of Virginia (Robert McDonnell) to block the new Virginia law that had been specifically crafted to prevent her from re-posting social security numbers on her website. She had been doing this to bring attention to the fact that the Virginia government was aiding identity thieves and was burying their head in the sand when the problem was pointed out to them.

I haven't had time to read the opinion (Link to PDF) in its entirety, but it appears the court agreed with her First Amendment argument that the state could not prevent her from republishing "public" information.

Will there be an appeal? Hopefully Virginia will just fix the problem that got us here in the first place: Posting SSNs on government websites.

"Ostergren's Law " Heads To Federal Court

The Virginia Law that was crafted to prevent Privacy advocate B.J. Ostergren from pointing out the gaping security hole in Virginia's public (i.e. government) websites is now moving to federal court.

Ostergren's lawyers filed a lawsuit to stop the new law before it goes into effect 7/1/2008. The new law will prohibit the dissemination of any SSNs posted on public websites. Ostergren's lawyers claim that if the government disseminates the information in a public forum, they cannot stop it's re-publication by citizens under the First Amendment.

Keep in mind, the SSN's are posted on public websites (usually tax websites, or court websites), because the state is too lazy to redact them. Ostergren is trying to force the state to either redact them or remove them from the web. Instead, in their infinite wisdom, the Virginia Legislature passed a law (now at issue) making it illegal to re-post the SSNs on another website which is what Ostergren had been doing to bring attention to this huge problem.

So rather than fix the problem, the legislature passed a law saying no one can talk about the problem. Brilliant.

Of course, as Virginia law is irrelevant outside the United States, the Russian mafia is still free to pull your SSN from a Virginia website (oh yes, the 'tubes' run all the way to Russia) and engage in massive identity theft. But the Virginia Legislature thinks if we all cover our eyes, nothing bad will happen. And you Virginia residents pay this think tank's salary. Now get back to work.

Bad Problem Solving Skills: The Virginia Legislature Presents Example #3

If you were the Virginia Legislature, what would you do in this situation?

You pass a law in 2002 requiring all local courts to post their land records on the Internet by July 2008. Then, a concerned citizen alerts you to the fact that many of those documents contain people's social security numbers and are now published on the net for the world to see (and identity thieves to use).

Do you:

1. Immediately shut down the document websites until the SSNs can be redacted.
2. Force the localities to handle (and pay for) the fix as they see fit, with a strict deadline.
   
3. Make it illegal for any citizen to point out that there are SSNs posted on the web, but do nothing about the fact that there are now SSNs posted on the web.

If you said #3, amazingly you'd be right. The concerned citizen in this case is Betty Ostergren who runs The Virginia Watchdog website. The law the legislature passed was know colloquially as "The BJ Ostergren Law" but is officially an amendment to The Personal Information Privacy Act. How does this act protect your privacy? Well, in a nutshell, it protects you from criminals who might want to post your SSN on a website. Of course, the fact that they already have criminal intent clouds that logic, but hey, why be a buzz-kill with the whole "logic" thing?

What Betty was doing that got her noticed, was posting the SSN's of famous/political people on her website in order to draw attention to the fact that those very SSNs were available on a government website. So rather than fix the privacy problem, Virginia has opted to pretend like there is no problem. And anyone who says there is a problem, is a fool, a Communist (to paraphrase Bill Hicks) and now, a criminal. Betty's method may not have been the most subtle way of getting attention, but clearly it worked. However, the legislature can't seem to think their way out of a paper bag long enough to see that REMOVING the SSNs is the ONLY solution to this problem

So now, we're left with this uniquely 'Virginia' legislative solution. The state publishes public information (many with SSNs) on a public website, but the public is not allowed to use that information in any way that might be construed as 'communicating' it, lest they be convicted of breaking this new law. So the Virginia Freedom of Information Act has essentially been 'amended' to say "Here's the public information, you can't talk to anyone about it". Nice.

And as if the irony wasn't thick enough, the patron of the bill was Sen. R. Edward Houck, (D-Spotsylvania), who is also chairman of the Virginia Freedom of Information Advisory Council. Sen Houck offered this very anemic analogy of Ms. Ostergren's attention getting tactics:

"That would be like trying to make it illegal to shoot someone with a firearm and the way you do that is to go out an get an AK-47 and mow down a bunch of people in a parking lot."

Allow me to offer a better analogy.

Sen. Houck's bill is like trying to prevent house fires by disabling smoke alarms. Because if there's no alarm, there's no fire!

Genius! Now I know why we pay these people!

Oh, and Senator Houck? You do know the Internet is global right? So what happens if a Russian organized crime group gets the SSNs?