Jeb Bush dumps emails including social security numbers of Florida residents online – The Verge

jeb bush, a rumored 2016 republican presidential candidate, has just decided to publish hundreds of thousands of emails sent to him during his time as governor of florida. At first glance, it seems like a great idea in the name of transparency, but there’s a big problem: Neither Bush nor those who facilitated the release of the records, including the state government, chose to remove potentially sensitive personal information from them.

“For the sake of transparency, I’m posting my gubernatorial emails here,” reads a note on Bush’s website. “some are funny, some are serious, some I wrote in frustration.” some also contain email addresses, home addresses, phone numbers, and social security numbers of florida residents. Emails are available in outlook format and are web searchable on the bush website.

the edge received no response from mr. bush or the office of the political action committee of him at the time of publication.

“for the sake of transparency, I publish the emails of my position as governor.”

We reviewed many of bush’s published emails and found a wide variety of communications, from religious parables to praise of the governor’s support for creationism and routine bureaucratic correspondence. but some of the emails appear to be very confidential or personal. many, like the one excerpted below, share stories of personal struggle or sadness.

this is just to share… today… i feel defeated… … i want to help many and i hope to be able to do it one day…. through my empowerment it will be a testimony of my message and the ability to share my future resources…it’s a lonely road…so many seem to be actively against you…your back is against the wall…you have plenty of another two months of business survival…

p.s. this is just to share with a friend… please no action or follow up or any communication or help sought of any kind… its my struggle to work through and find a way… just feeling ‘beaten’ today. …at 37 I feel like 60 today :)…..and tomorrow will be better.

confidential communications intended only for the intended recipient

other emails include potentially sensitive details about government operations. An email reviewed by The Verge discussed the firing of a Florida Lottery employee; the email revealed the reasons for his dismissal, including “conduct unbecoming of a public employee, insubordination, and dereliction of duty.” The employee had emailed then Governor Bush to request his reinstatement. Bush followed up with a lottery official to see if his request could be granted.

some include personal appeals from citizens with medical or employment problems. and a subset of these messages contain sensitive data such as social security numbers, as in the email below. (the redactions are ours).

Another email, sent on behalf of a healthcare representative and shown below, contains information about a child with a life-threatening medical condition. The email exposes the child and mother’s name, the mother’s home state and phone number, her social security number, and her healthcare identification number.

Florida’s freedom of information laws are very broad. As Bush notes in the signature of many of his emails, “Florida has a very broad public records law,” and “your email communications may therefore be subject to public disclosure.” However, social security numbers in particular are protected. As Florida private attorney Richard A. Harrison tells The Verge, social security numbers are “both confidential and exempt” from public disclosure under state law. “They can be released only for the limited purposes specified in that section, of which this is not one,” Harrison says. “It doesn’t matter how an agency or official obtained the information; once obtained it is a public record and the SSNs are confidential and exempt under the law.” But that doesn’t mean the former governor is legally responsible for the data leak. Harrison says the state’s legal custodian of records is charged with ensuring no confidential or exempt information is released.

Under Florida law, that custodian could get away with just a scratch. violation of the public records statute in this circumstance is considered a “non-criminal violation” punishable by a fine “not to exceed $500.” someone who knowingly or willfully violates the privacy law is subject to more severe penalties, but could be fairly easy to avoid given the sheer size of the records.

jeb bush camp was quick to blame the state. Bush spokeswoman Kristy Campbell told buzzfeed news that the posting is “an exact replica of public records on file with the florida department of state and is available upon request to anyone under chapter 119 of the sunlight laws.” Of course, that statement is not entirely true, since Social Security numbers are definitely exempt (and confidential) under that same chapter of the law.

Social Security numbers are confidential and exempt from disclosure under Florida law

Many of the same emails Bush published today may have already been available online in December 2014, thanks to a request by Central Florida for Investigative Reporting. Some publications, including the washington post and the hill, checked email logs for policy information, but did not appear to stumble upon any sensitive personal information.

Obviously, one of the lessons here is that you shouldn’t email information to public officials that you want to keep private, at least not in Florida. But even if most of these emails are widely subject to disclosure under the state’s sunlight law, it’s concerning that such a large and indiscriminate data dump could include so much personal information. “Emails that relate to public decisions should be made public, but certainly emails with social security numbers or private medical information are not relevant to that,” Bruce Jacob, a law professor, told the verge. “It’s hard to imagine a court convicting someone of a crime if it was a mistake, but it’s certainly not good for private information like that to be divulged.”

At the very least, the data dump shows a gross ignorance of the volume of sensitive information in the logs and carelessness about its disclosure. And while a Florida bureaucrat may ultimately be the culprit, it’s not a good look for Jeb Bush, someone who called himself the first “egobernor” and a man who may want to sit in the White House.

See Also:  How Late Does USPS Deliver? | Simpl Fulfillment

Update, 3:10 PM: This story has been updated to include additional emails from the archive, as well as prior reports on the archive from December, 2014.

update, 3:22 PM m.: Updated with a statement from a Jeb Bush spokesperson.

update, 3:53 PM m.: timereporter zeke miller, reporting from a question and answer session with jeb bush, reported on twitter that bush is now aware of personal information in the email dump and that will be removed. miller reports that bush’s pac published only what is already on the public record, echoing the statement given by bush’s spokesman to news buzzfeed. We’re not sure how long that will take, or if the bush pac will delete emails temporarily in the meantime (it will presumably take a while to scan hundreds of thousands of emails), but we’ll keep you posted.

jeb on private information in emails: “let’s take it down”

jeb says his pac only posted what was on the public record, but says they will delete the personal info

update, 5:35 PM. m.: Investigators are now thoroughly examining the email dump for personal information. It looks like the Bush team, and perhaps the Florida state government, will have a lot of work to do if they want to remove the data from the records, and some explanation as to how this happened. it’s more than a few bits of personal information.

ran some tools on jeb bush’s emails. and yes. ssns, dobs, ccns pages on output. pic.twitter.com/7cxpwlhdum

update, 23:00: the raw .pst files have now been removed from the jeb bush site. “We were informed that some personal information was available in the raw data, so we deleted these files,” reads an error message. “You can still read these emails at the email calendar link, where we have removed any personal information that we were able to locate.”