I-TEAM INVESTIGATION: Social Security Numbers Posted on Local Au - NBC Right Now/KNDO/KNDU Tri-Cities, Yakima, WA |

I-TEAM INVESTIGATION: Social Security Numbers Posted on Local Auditor's Websites

Posted: Updated:

NBC RIGHT NOW I-TEAM REPORT -- We have a special I-Team report that will leave you wondering if your private information is safe.

It's a story we bring to you cautiously. It's our job to keep you informed but we don't want this information to fall into the wrong hands. 

Over the past couple months we've been looking into local county auditor websites. What we found is scary. It's very important we all pay close attention, because your information could be compromised.

Keeping your private information away from prying eyes, could be the most important and difficult thing you do. 

A viewer tip led us on an investigation that will make you question how secure your information is. 

That tip was very simple; look closely at the Benton County Auditor's website. What we found were thousands of one specific type of document, posted online, that contain people's names, dates of birth and social security numbers. That information could basically hand over everything a criminal needs to steal thousands of identities.

And it wasn't just in Benton County either. Thousands more of the same type of documents are online, un-edited, on the Lewis and Walla Walla County Auditor's websites as well.

We will not tell you how to find these specific documents, in order to keep that information as safe as possible. But we will tell you how to protect yourself. 

We took what we found online and brought it to a cyber security expert. 

Dr. Jackson Muhirwe is a professor at Central Washington University. He has a Ph.D. in computer science and has one of the highest certifications in the world, in information security, making him a systems security professional. He was very troubled with what we showed him. 

Dr. Muhirwe: "I was disappointed to say the least." 

Reporter Chris Luther: "If this falls into the wrong hands, what could people do with this information?" 

Dr. Muhirwe: "What the criminals will do would be to sell this information. That's the first thing they will do. So what can they use this information for? When they go for treatment they can use this information get medical services, financial services, whatever you wanted to do or will do with your life, now they can do it claiming to be you."

Luther: "How easy would it be for them to take all the information?" 

Dr. Muhirwe: "Within a day they would be able to take it. Within a day. Now, we don't know whether anybody has stolen this information or not. So you don't know whether anybody has got their hands on this and actually are selling it."

Luther: "So it could already be out there?"

Dr. Muhirwe: "It could be."

Dr. Muhirwe says what makes matters worse, the auditor's website isn't encrypted or secure at all. No password or user name is needed to access the info. It's open for anyone with a computer to see.

Luther: "What would this mean to someone who's identity is stolen because of this?" 

Dr. Muhirwe: "It's going to affect their entire life henceforth because getting out of an identity theft is really very difficult. Getting a new social security number is not anything that you're going to say is going to be easy."

Luther: "What do you think of the auditor's actions putting these documents online?"

Dr. Muhirwe: "This being part of the auditor's office, I think they should have a done, maybe a better job. Because they are auditor. They're supposed to audit. It is to some extent careless, it is to some extent done out of naivety."

How and why did this information get posted so freely online? After weeks of talking to Benton County Auditor Brenda Chilton about the problem, she agreed to meet with us in our KNDU studios. 

Luther: "Do you feel sorry that potentially this could have harmed people?" 

Benton County Auditor Brenda Chilton: "I do, it does bother me. There's always the possibility of that in other situations as well of course, and we want to do everything that we can to be able to minimize that, and encourage people that if they know that information is out there, let us know and we'll redact it."

Luther: "How did this happen?" 

Chilton: "You know it's a real quandary that the auditors throughout the state have faced. It was not uncommon a couple decades ago for mortgage companies or state agencies to include more personal information in documents before it was recorded. Those became public records and will continue to be public records for the end of time." 

Luther: "When did you first know about this particular series of documents?" 

Chilton: "Well when you contacted us. That was the first time that we realized that this series of documents was a problem. Right now, the only documents that are available online are back to 1984. Unfortunately, I think the farther that you get back the worse the problem will be."

Luther: "Why is a good thing to have these documents online at all?" 

Chilton: "You know because the public they want, on a regular basis, copies of documents that apply to them either personally or they're doing genealogy research."

Luther: "With this series that we have uncovered, what is happening?" 

Chilton: "So we have a part time person that comes in after school that works on other projects for us and we've assigned that to them. She's doing it year by year backwards. She's actually physically reviewing each one of those documents and the software has a tool in it that allows you to black out that, just on the image." 

Luther: "Is there any way to know if anyone has accessed this information en mass to have all this info?" 

Chilton: "No. We aren't able to track those types of records." 

Luther: "So you don't know if this stuff has gotten into the wrong hands?"

Chilton: "No. No."

Whether its through an auditors website or a hacked private company,  Dr. Muhirwe says our information can easily fall into the wrong hands. It's time all of us do what we can to protect ourselves. 

Dr. Muhirwe: "So what people should do is to inform the authorities about it. So that's IRS, local law enforcement agents and FBI regional offices. In addition to that, they should also let the auditor's office know that their information is available in the open and it's not good and they're not happy about it and it should be removed with immediate effect."

Chilton says they should be finished redacting all the documents in the next month. Lewis County is going through the same process as well. We called the Walla Walla County Auditor's office many times, but never got a call back. 

Chilton also told me this problem isn't just happening in Washington state. The problem is appearing all over the country. 

We know it may be frustrating for you sitting at home, wondering if your information has been posted online. The best advice we can give you, is to contact the auditors office if you have any questions.