News

Actions

Thousands potentially exposed to identity theft after county published sensitive information online

Denver7 investigation spurs sweeping changes
Posted at 6:09 PM, May 08, 2017
and last updated 2017-05-09 00:27:49-04

FORT COLLINS, Colo. -- The Larimer County Clerk and Recorder's office made sweeping changes to how it conducts business amid a Denver7 investigation, which revealed how officials had published sensitive information belonging to thousands of people online for months.

Among the records were child support liens, death certificates, and commercial lending filings. Many of them contained a variation of social security numbers and dates of birth -- the types of information that would be valuable to identity thieves.

Early last week, the county clerk was hesitant to redact or remove the information from the online portal, but finalized changes on Friday. Though the sensitive records are no longer available online, the risk could remain for the people whose identities were exposed.

Will McDonough called the Denver7 Investigates tip line to bring the issue to light after discovering his social security number on the Larimer County website. 

"It came to light that there were some documents out on the Larimer County site...that had my personal, identifiable information on it," McDonough said. "Absolutely irresponsible, yes."

He said he learned of the issue during closing on his purchase of a self-sufficient farm with his family.

Denver7 found his social security number prominently displayed on records after conducting a search of the county records portal.

"The most important thing is to protect your social security number and your date of birth," former Secret Service agent Dale Drew told Denver7. He is currently the Chief Security Officer of Level 3 Communications.

Drew specializes in cybersecurity. Anymore, he said every part of someone's identity -- even those belonging to the deceased -- is a commodity on the 'dark web' among identity thieves.
 
"Your date of birth is worth like three dollars," he said. "Your social security number is worth 20 dollars."
 
What happened in Larimer County?
 
Denver7 Investigator Ryan Luby spoke with Larimer County Clerk and Recorder Angela Myers last Monday.
 
Luby: "[Critics] argue that this county is setting them up for identity theft.  What do you say to that?"
 
Angela: "Well, I would say while it's unfortunate that that information is there, my job, in serving the citizens of Larimer County, is to create a public record...and, so, I do not take it upon myself to manipulate those documents in any way. I think that is what creates the integrity in the system that we have."
 
Myers's team officially launched the online portal, called Easy Access, in December -- complete with a ribbon cutting. Records that previously required someone to visit the clerk's office to view are now available to anyone who has internet access.
 
"For me, that's an efficiency question," she said. "That's me being as transparent with the public as I can -- making that public record more accessible to the public, right? If they need it, they should have every opportunity to get it and that's my job."
 
But in doing so, Myers and her staff opted not to redact or protect the most sensitive records they uploaded to Easy Access even though they could have.
 
Luby: "That software, that you all use, has redaction features to it. It's one of the selling points from the company's website."
 
Angela: "Sure does."
 
Luby: "Why not use it?"
 
Angela: "Because the law does not require me to do so and I don't make those calls about the content of the documents and I don't manipulate public record."

Other clerks across Colorado, however, do make those judgment calls -- at least in what's published online.

Douglas and Mesa Counties use the exact same software as Larimer County. In Douglas County, records like death certificates are not viewable online. In Mesa County, the most sensitive information on records like death certificates and liens is blacked out.

The Mesa County Clerk and Recorder, Sheila Reiner, told the Denver7 Investigates team that her office has redacted sensitive information from online records for nearly a decade -- largely to prevent people from misusing the information.

Denver7 contacted Larimer County Commissioner and gubernatorial candidate Lew Gaiter on Thursday outside of a public meeting in Denver to make him aware of the concerns.

Gaiter's social security number was exposed in documents on the Larimer County site.

"It absolutely is concerning to me that we're exposing private information that can be used for identity theft," he said.

He supported the idea of redacting sensitive information from the online version of records recorded with the county.

Drew would not speak to specifically what Larimer County should or should not have been publicizing online, but said government leaders should be smart in handling sensitive information.

"I think there is an ability to provide transparency in government without exposing personal information of individuals," he said.

McDonough said he questioned the Larimer County Clerk and Recorder's office directly and was first told it would be up to him to request his records be redacted. Regardless of what the county has now done to account for the concerns, he's still worried.

"I know I'm at risk because of what they've displayed and I know that I will have to watch my identity for identity theft for the rest of my life because of Larimer County's choice to put all of my data out, viewable to the public," he said.

Larimer County makes changes

On Friday, the Larimer County Clerk and Recorder's office finalized changes to the Easy Access records portal because of Denver7's questions. Records that were previously available online are no longer there.

A "splash page" now appears in place of records that had the most sensitive information. It says records such as death certificates, child support liens and older commercial lending filings are not viewable online.

Myers said original versions of those records will remain unredacted at the clerk's office itself because state law prevents her -- and any records clerk -- from altering documents in their original form. That being said, she acknowledged that the changes made online provide a significant barrier for identity thieves trolling for their next victims online.

What should you do if your records were exposed?

Dale Drew at Level 3 helped Denver7 compile tips for anyone who may have concerns about identity theft -- whether they're in Larimer County or not.

Beyond the tips mentioned below, people can request to have portions of their records redacted via a county clerk's office. In Larimer County, the most sensitive records should now be protected. But you can register for the site and search it just to be sure.

Basic

  • Always be careful when disclosing your SSN and DOB
  • Hover before you click; be aware of phishing attacks (emails that contain links to malicious sites)
  • Be careful what you post about yourself on social media – birth dates, away messages, etc.
  • Search for yourself online to see if your identity is available

Advanced

  • Use a credit lock service to lock your credit profile to prevent someone from opening lines of credit on your behalf
  • Call the credit bureaus to put a lock on your credit profiles
  • Ask the IRS for “identity protection” for your tax returns; put a PIN number on your tax returns to prevent identity theft and financial theft
  • Put call-in passwords on all of your critical accounts to ensure customer service will ask for that password when you call in, such as with credit cards, the power company, the phone company, bank accounts, etc.
  • Never put your registration that includes your address in your car (you are always mailed TWO registrations, one with an address and one without)
  • Tug before you swipe! Tug on the credit card swipers before you swipe your credit card to prevent you from using an unauthorized swiper
  • If you are the executor of an estate, lock the SSN of those whom have passed to prevent identity theft

Other General Tips

  • Back up your documents and other critical data to an external USB drive to prevent you from being a ransomware victim
  • Never use your debit card - it’s much easier to recoup money from any unauthorized purchases via a credit card