MINOT, N.D. — Back in 2018, the North Dakota University System suffered a data breach, which resulted in the online exposure of personal information for thousands of people, including students and NDUS employees.
In response, the NDUS took steps to contact those impacted by the breach to alert them to the fact their information was exposed. They also offered free identity theft protection services for those affected.
That's not exactly how the North Dakota court system is handling the potential exposure of private information in its new online records system, implemented under the guidance of incoming Chief Justice Jon Jensen, which launched just days ago.
According to state court administrator Sally Holewa, if your private information is exposed in this new records system, it's up to you to find it and report it to the clerk of the district court holding the file.
As I noted in my previous column about this new records system, which has also made things like graphic crime scene photos available on the internet, I found that the Ward County District Court had inadvertently published a document which had my Social Security Number, driver's license number, home address, home phone number, and vehicle license plate number.
I asked Holewa what recourse people like me have when our private, not-at-all public information is published like that.
"The recourse is people have to make a request," she told me.
In other words, you have to find that your data has been exposed, and you have to contact the court to get it hidden again.
"Part of it is the sheer volume," Holewa told me by way of explaining why the courts can't verify the online disclosures in their system are prudent. "We're talking about 160,000 cases per year. There's no way to find a lot of that stuff."
That's fair, I suppose, but if the courts can't guarantee that this new system isn't exposing sensitive, non-public information, then why did they launch it? And why haven't they taken it down?
"We're working on an expedited method" for requesting that information be taken down, but is that enough? Especially when data aggregators could scoop this online data? At which point it may be impossible ever to get it off the internet?
My explorations of this new system have revealed another disturbing problem. Many counties in the state — including places like Burleigh County (Bismarck), Grand Forks County, and Cass County (Fargo) — use a sort of default case number for administrative filings in matters which haven't yet been assigned a case file of their own.
Like, say, a criminal case where no charges have been brought yet.
If you know this default case number, you can see all the filings, and those filings in the counties I checked were mostly search warrants.
That's deeply troubling.
The information included in some of these search warrants is very, very detailed. I spent this morning reading a warrant executed on Snap Inc. (the company which operates Snapchat), which was filed just a few days ago. It is related to a child pornography case. What's alleged is that the target of the search warrant was trading graphic videos and pictures of children through the service.
I was able to read transcripts of some of this person's Snapchat conversations (and I wish I hadn't because they were awful). I was also able to see URL's where child pornography had apparently been uploaded (I certainly didn't visit the link to see), not to mention long lists of usernames for other Snapchat accounts also involved in the case.
At one point in the warrant, a law enforcement officer involved with it writes that "disclosure of [the search warrant request] must not be made at any time as it may jeopardize an ongoing criminal investigation." Yet I was sitting at home, in my office, reading the search warrant.
Which, again, had been filed just a few days ago.
I asked Holewa about this. She wasn't familiar with the specific case, but she said if a judge didn't seal the warrant, it's a public record, but that if it was sealed and disclosed anyway, it was "probably a mistake of the clerk."
I have long been a staunch proponent of open records, but I'm not sure I should be able to look up the Snapchat transcripts in a child pornography case that has not yet concluded.
Also, what if the cops executive a search warrant on an innocent person? What if they go looking for stolen goods or child pornography, and they find nothing? And ultimately bring no charges?
Is it fair to the person who was a target of that warrant to have its existence readily accessible on the internet?
I'm afraid our courts have done a genuinely shoddy job of implementing this records system. Not only can they not guarantee that sensitive information like financial information or Social Security numbers is being kept private, but I'm not sure they have thought through the ramifications of making detailed search warrant filings and crime scene photos readily available on the internet.
As I said in my previous column, this new database needs to come down until a) the courts can ensure that all sensitive, non-public information is protected and b) the Legislature has a chance to debate what in these criminal and civil filings should be public going forward with internet access.
To comment on this article, visit www.sayanythingblog.com
Rob Port, founder of SayAnythingBlog.com, a North Dakota political blog, is a Forum Communications commentator. Listen to his Plain Talk Podcast and follow him on Twitter at @RobPort.