Secretary of state's office removes public forms from its website amid concerns about privacy violations
Kansas Secretary of State Kris Kobach's office has removed information from its website about the business and financial holdings of public officials in response to concerns that the information could be used as a tool for identity theft.
The information in question is contained in forms called "Statements of Substantial Interest," or SSIs, a form that many officials, including elected ones, must file annually and disclose what other ownership interests they have in outside businesses and organizations, including nonprofit organizations.
But the forms also contain other personal information, including the last four digits the filer's Social Security number.
State law requires thousands of people connected with state government to file those forms annually. Besides elected officials and candidates for office, the forms are also required from anyone whose job is subject to Senate confirmation, general counsels of state agencies, consultants who work on contract with the state, and virtually all employees of state colleges and universities.
Brian Caskey, who heads the elections division in the secretary of state's office, said in an interview that he removed all links to that information on the agency's website immediately after receiving a complaint Thursday from Rep. John Carmichael, D-Wichita, who said he looked up his own name on the website and discovered that the form online displayed the last four digits of his Social Security number.
That action means the public currently does not have online access to information on those forms.
Carmichael told the Journal-World that he sent a letter to Kobach on Friday, demanding that his information be removed from the website. He also filed a Kansas Open Records Act request seeking the "names, addresses, occupation, and date of access of each person or entity" who has viewed his information, a move he said would help him in mitigating any damage that may have been caused by the disclosure of sensitive personal information.
Disclosing the last four digits of someone's Social Security number is considered inherently dangerous because people with knowledge of how those numbers are generated can sometimes guess what the other numbers are, especially if they know when and where the person was born. That, then, could give hackers access to all kinds of personal information such as credit histories and medical information.
Caskey said he is working with the Kansas Governmental Ethics Commission to find a solution that will allow public access to the information on those forms without disclosing sensitive personal data.
Caskey said the forms are typically submitted in one of two ways, either by paper filings that people fill out by hand or through electronic filing, which has become more popular in recent years. He said the paper forms are optically scanned into image files, making it hard technologically to redact any information. But he said redaction would be easier with forms submitted electronically.
In a statement issued Thursday afternoon, Kobach said the information contained in the forms is prescribed by the Kansas Governmental Ethics Commission, and state law requires the secretary of state's office to receive those forms and make all of the information contained in them available to the public.
But he said he does not believe a person's partial Social Security number is necessary, and he is asking the ethics commission to consider amending the form, an issue the commission plans to take up at its next meeting on Jan. 31.
Kobach said the practice of making the forms available online through the secretary of state's website began in 2005 under then-Secretary of State Ron Thornburgh.