Jeb Bush's Group Posts Emails Containing Social Security Numbers

By posting online all of his personal email from his eight years as Florida's governor, Jeb Bush sought to show himself as a tech-savvy executive, in touch with constituents and an active administrator.

But tucked away in a small percentage of those 332,999 messages were the names, birthdates and Social Security numbers - the three pieces of information key to identity theft - of more than 12,000 people.

Bush's attempt to demonstrate transparency prompted criticism from privacy advocates, making for the second technology-related bump this week for his young campaign-in-waiting.

"This was obviously very innocent," said Todd Feinman, the chief executive of data security firm Identity Finder. "But now we have more than 12,000 individuals who are exposed to the risks of identity fraud."

By Thursday, Bush's team had removed the private information from all but a few hundred of the emails posted to a website Tuesday by his political action committee, Right to Rise.

"We have redacted every account that we have found," Bush spokeswoman Kristy Campbell said.

Earlier this week, Right to Rise's technology chief, hired in January, apologized and then resigned after intemperate comments he made several years earlier about women, gay men and African-Americans were found on Twitter and elsewhere online.

Florida's public records law is among the nation's strongest, and the state's archive kept copies of every email sent to and from Bush's personal email address while he served as governor from 1999 to 2007.

Bush had taken some steps to keep some of the sensitive information in the emails out of the public's view. His team asked the Florida Department of State for the emails in order to set up the website. When doing so last May, his attorney specified "Social Security numbers of Florida citizens who contacted Gov. Bush for assistance" should be redacted.

A spokesman for the Florida Department of State did not reply Thursday to phone and email messages from The Associated Press.

Social Security numbers are confidential under Florida law, except under certain circumstances, including allowing such information to be shared between agencies. The vast majority of those included in Bush's emails were part of a spreadsheet tracking the number of people on a state family service waiting list, which was included in a PowerPoint presentation sent to Bush ahead of a 2003 meeting.

"This is the wake-up call to organizations, because they forget that hidden data is still there for the stealing," Feinman said.

The Social Security Administration, Internal Revenue Service and Federal Trade Commission, among other federal agencies, all warn consumers not to share such information, which in combination can allow thieves to open bank accounts, apply for tax returns and even apply for jobs.

It's a message that's been well received by the public. According to a November survey by the Pew Research Center, 90 percent of Americans consider Social Security numbers "very sensitive" - nearly twice the number of those who characterize their health care information that way.

While Bush's team was scrubbing what they posted, there were still other ways to access the emails online as late as Thursday afternoon. Weeks before Bush posted the emails, others had also obtained them from the Florida state archive and made them available on the Internet.

One such group was the Democratic opposition research group American Bridge, which posted the emails to its website in December. Spokesman Ben Ray said Thursday that the group was in the process of removing the data.

"We want to be responsive to the privacy concerns," Ray said.

American Bridge took the page down late Thursday and was no longer linking to the files publicly, but the files could still be reached online via cached versions of the webpages.