Greetings. I have previously offered some thoughts on Benefits and Risks in Google's Public Records Access Project. This project aims to make government public record databases more easily searchable via Google. There are significant potential benefits and notable negative aspects to this approach.

As an example, below is text from today's RISKS-Forum Digest that discusses privacy issues relating to online property assessment databases. It notes how in such cases, an inability to search through this data from Google is apparently viewed by the text's author as an important privacy-enhancing condition that significantly reduces the abuse risk potential of this data. Worth thinking about. Discussion welcome in the PFIR Forums Google Topics Area.

--Lauren--

- - - - - -

Date: Sun, 09 Sep 2007 02:10:02 -0400
From: Jonathan Kamens <jik@kamens.brookline.ma.us>
Subject: On-line property assessment databases a bit too accessible

While engaged recently in a discussion with a parent at our children's school whom I felt was being overly paranoid about sharing her home address with other parents, I googled her name, suspecting that I would be able to illustrate to her that the information she was trying to protect was already available on-line.

I succeeded far more than I'd expected to. One of the first matches returned by google was her home's property listing in the on-line property assessment database for the town of Arlington, Massachusetts, where she lives. Her name, her husband's name, their address, a picture of the house, a floor-plan sketch, the date they bought the house, their purchase price, and all of the information used by the town to calculate the assessed value of the house were instantly available.

Arlington's webmaster is guilty of two offenses: (1) providing an interface for searching the assessment database by name (i.e., if you go to <http://arlserver.town.arlington.ma.us/property/>, you can search not only by address, but also by the owner's name); and (2) allowing its assessment database to be fully indexed by public search engines.

This is not a small thing. Consider a domestic abuse victim who moves to a new house in a new town to get away from her abuser. She takes precautions to avoid being tracked down, e.g., ordering telephone service in a fake name and paying the telephone company extra for an unlisted number. Unfortunately, however, the town she has moved to is Arlington, which proceeds to publish her name and address on its Web site for the world to see and search.

The discovery of Arlington's carelessness with its residents' privacy prompted me to check on Boston, where I live. Boston, too, allows its assessment database to be searched by name, but at least its database isn't indexed in Google. Someone with nefarious intent trying to locate a Boston resident must already know that s/he owns a house in Boston. That's bad, but not as bad as Arlington.

I decided to check some other towns and cities in Massachusetts to see how they stack up.

I checked 61 towns and cities, of which only 9 had their data sufficiently secured (i.e., not easy to view the entire assessment database, not searchable by name, not searchable in Google). I found one town besides Arlington, Ashburnham, whose records were searchable in Google, and four towns (including Ashburnham) where it was easy to view the entire assessment database without needing to perform individual searches. In addition, I discovered that independent of town and city records, the registries of deeds of most Massachusetts counties allow their land records to be searched by name, most of them from a single, convenient Web site. See below for the details.

When assessment and land records were kept only on paper, they were organized by street name and number, not by owner name. When Massachusetts communities began to put these records on-line for public access, did they stop to think of the privacy, security and safety implications of allowing them to be searched by name? Apparently, only 9 of the 62 communities I looked at did, and most of them are probably in counties which didn't.

Is Massachusetts typical?

Jonathan Kamens

For those who are curious, here are the details of what I found:

[ Please see the original RISKS item for his detailed data availability breakdown (including Google search capability information) and the remainder of his message text. --Lauren ]