From...

March 29, 1999
Web posted at: 8:58 a.m. EST (1358 GMT)

by Ann Harrison

(IDG) -- Some top corporate executives' Social Security numbers are freely available on a government Web site -- another example of the continuing battle over privacy rights in the Internet age.

Although it has stopped requesting Social Security numbers on certain documents for privacy reasons, the Securities and Exchange Commission (SEC) nevertheless refuses to remove the numbers, including that of Microsoft Corp. Chairman and CEO Bill Gates, from old documents on its Web site.

Although the SEC posted the numbers in the first place, a spokesman argued that the agency doesn't have the authority to remove them. Meanwhile, information pointing to the location of the identifiers is circulating on the Internet, underscoring one of the biggest risks of online data.

Stolen Social Security numbers can be used to forge false identities and commit fraud. But the Social Security numbers of Gates and other titans of industry, including Microsoft co-founder and venture capitalist Paul Allen, Intel Corp. co-founder and Chairman Emeritus Gordon Moore and Gateway Chairman and CEO Theodore Waitt, are currently available online in the searchable archives of the SEC's Electronic Data Gathering, Analysis and Retrieval (EDGAR) database at www.sec.gov (link below).

MORE COMPUTING INTELLIGENCE
	IDG.net home page
Computerworld's home page
Computerworld Year 2000 resource center
Computerworld's online subscription center
Reviews & in-depth info at IDG.net
IDG.net's personal news page
Questions about computers? Let IDG.net's editors help you
Subscribe to IDG.net's free daily newsletter for IT leaders
Search IDG.net in 12 languages
News Radio
	Computerworld Minute
	Fusion audio primers

Oracle Corp. CEO Larry Ellison has privacy-enhanced his documents on the SEC Web site.

"We don't comment on matters related to Mr. Gates' personal life," said a Microsoft spokeswoman when asked about the accessibility of Gates' Social Security number.

The EDGAR database was created in 1995 when the SEC began to require domestic, publicly held companies with SEC filing requirements to submit disclosure documents electronically.

Until 1997, Social Security numbers could be voluntarily added to several publicly available SEC statements such as 13D and 13G forms, which parties acquiring more than 5% of the voting stock of a publicly traded company are required to file.

According to John Heine, deputy director of the SEC's public affairs office, the agency has been collecting Social Security numbers on paper since 1934 to help establish irrefutable identity of the filers.

"It was initially offered so that people could be identified as the Bill Gates in Seattle, Wash., as opposed to the Bill Gates from down the street," Heine said.

Heine said prior to the rise of the Internet, interested parties would need to come to Washington to view the documents. When the EDGAR database was created, Heine said, "people here at the commission pretty quickly got sensitive to the issue."

John Trollinger, deputy press officer at the Social Security Administration, said such availability of Social Security numbers could lead to "all sorts of credit problems" and fraud.

Alex Fowler, director of public affairs at the Electronic Frontier Foundation, an online civil liberties organization in San Francisco, said Internet technology has outpaced the ability of government bureaucracies to prevent misuse of data.

"We have to reassess the reasons for providing these databases and the reasons for providing the information that goes into them," Fowler said.

Indeed, the Social Security Administration's Office of the Inspector General said its investigations of identity theft jumped from 305 in 1996 to 1,153 in 1997. And in the first three quarters of 1997, the Internal Revenue Service investigated 2,470 schemes to use fraudulent Social Security numbers to claim tax refunds. The U.S. Secret Service, which made 9,455 arrests involving identity fraud in 1997, said the number of complaints doubled last year.

In July 1997, the SEC changed its electronic filing forms to eliminate the entering of Social Security numbers. But numbers entered on forms prior to 1997 are still online. "We don't have any plans at the moment to do a wholesale removal of numbers on old forms," Heine said.

Heine said people whose Social Security numbers are exposed on EDGAR can contact the SEC to replace the filings with forms that don't contain the information. But he said the SEC doesn't have the authority to refile the document minus Social Security numbers without consent of the filers.

Fowler protested that it shouldn't be incumbent on filers to protect their data.

"That's the classic opt-out in its ugliest form and another example of the problems of government-sponsored and -run databases," he said.

Filers who want to replace their electronic SEC documents with new documents that don't include Social Security numbers must fax the SEC at (202) 942-9542 and include the EDGAR accession number of the document to be replaced. The SEC said it will then contact those filers to remove their Social Security numbers.

Stewart Deck contributed to this report.