Maribeth Madonna got the phone call from the Capital One credit card company just before Christmas in 2005. It wanted to verify that she had, in fact, applied for a new account.

"I was startled," Madonna recalled in an interview.

Madonna had not applied for a new credit card. But a 37-year-old Fayette County mother of three named Kelly Daniels had — using only the Manheim Township woman's name, birth date and stolen Social Security number.

Where in the world did the identity thief get that information? Madonna wondered.

Police found the answer when they made the arrest: In the glove box of Daniels' car was a copy of Madonna's marriage license application — a public record available to anyone who knows where to look.

The case illustrates a sobering fact about our privacy — or lack of it — these days.

You can buy a document shredder and guard your personal information with your life.

But you might be wasting your time.

Information such as Social Security numbers, addresses, birthplaces, birth dates and maiden names can easily be found on public records in courthouses across the country and, in some cases, posted on the Internet by your county or state government, an investigation by this newspaper found.

What we found

To illustrate how easy it is to obtain such sensitive information, we chose five prominent county residents — a superintendent, a television personality, a playwright, a corporate executive and a clergyman — and sought their Social Security numbers in public records.

It turned out that the task was so simple — most of the numbers were online at the county Web site — we expanded the list to 50 people.

And we succeeded.

It took only a matter of hours to find Social Security numbers for:

• A state Supreme Court justice.

• Lancaster County's president judge and most other members of the local judiciary.

• Three current lawmakers and one former state lawmaker.

• A member of a successful rock band.

• The editor of this newspaper.

• Two high-profile local television personalities.

• A high-ranking NASA official.

• Several top executives at the county's largest employers.

• County and local law-enforcement detectives.

In many cases, the Social Security numbers of their spouses were online as well.

This newspaper chose to publish this story to illustrate the ease with which Social Security numbers can be gleaned from public records. More importantly, it wanted to raise awareness about identity theft and instruct consumers how to take preventative and corrective measures.

The newspaper chose not to provide specific details about where and how it obtained the information, even though public officials, privacy-rights activists and federal fraud experts interviewed for this story said identity thieves are already well aware of such methods.

In fact, the U.S. Government Accountability Office has raised concerns about the availability of Social Security numbers on public records — particularly those published online — year after year.

In its most recent study, the auditing and investigative arm of Congress found 85 percent of counties nationwide make such records available in bulk or online, and only 16 percent of counties place any restrictions on the types of entities that can obtain those records.

This newspaper also understands that citizens' access to public records is paramount in holding government and its leaders accountable. But even open-records advocates state, in no uncertain terms, that releasing Social Security numbers on public records is a bad practice.

They unequivocally favor redacting the information.

"It would be dangerous to release someone's Social Security number, particularly in this age of identity theft," said Terry Mutchler, executive director of Pennsylvania's Office of Open Records.

"I do not believe that a citizen's ability to access open records, or accountability of their government, is harmed if any agency withholds a Social Security number," Mutchler said.

Craig Staudenmaier, a Harrisburg attorney and right-to-know expert, pointed out that the state's new open-records law exempts records holding Social Security numbers from public inspection.

"It doesn't make them do it, but I would not want to be the agency to release a document with a Social Security number on it," Staudenmaier said. "My personal thought is that there is very little need, if any, for public access to people's Social Security numbers."

How thieves seek records

Anecdotal evidence from here and across the country suggests criminals are turning to public records to obtain seemingly private information such as Social Security numbers, the primary tool for stealing someone's identity and unlocking credit cards and bank accounts.

"It certainly is one of the well-known means that identity thieves use to obtain Social Security numbers. It has been from the outset," said Joanna Crane, an attorney and manager of the Federal Trade Commission's Identity Theft Program.

The FTC estimates that 1 in 25 Americans — roughly 9 million people — discovers that he or she is a victim of identity theft every year.

In a recent case, the federal Department of Justice nabbed two men who allegedly went to the courthouse and got Social Security numbers of some 100 Lancaster and York residents accused of drunken driving and opened bank accounts and applied for loans in their names.

The two got the Social Security numbers from criminal records — public records — and allegedly netted $27,000, according to authorities.

In Madonna's case, the identity thief opened up four credit cards in her name and rang up hundreds of dollars in charges — from an online dating service to mail-order steaks — before being tracked down by the state Attorney General's office.

Public record, private info

Pennsylvania's new open-records law, which went into effect this year, flipped the presumption on government records by making most of them open to the public by default rather than off-limits by default.

But there are some exceptions — including records that contain Social Security numbers. The law already allows public agencies to redact such information. Though it doesn't require them to do so, most noncourt-related county offices say they do black out the Social Security numbers on copies provided to the public.

"The Office of Open Records is aware and concerned about situations that present themselves to identity theft," Mutchler said. "It's incumbent upon the agency, but not required by law, to remove it."

Providing such information on the Web is "not a violation of the Right-to-Know Law but it might be a violation of the law of common sense to leave those numbers on there," Mutchler said.

Many of the Social Security numbers we found were contained in real estate records, which are posted online by the recorder of deeds office. But Social Security numbers can be found on other court-related records as well.

This newspaper contacted all the people for whom it found Social Security numbers and are named in this report, and we gave them instructions on how to have their information redacted from the online records before publishing this story.

Many declined to comment and are therefore not named in this report. But others were quite willing to talk on the record.

State Rep. Dave Hickernell said he was "disturbed and shocked to learn that my personal Social Security number was available on a document for public view on the Lancaster County Web site."

"As incidents of identity theft become more and more common, we must take steps to protect the privacy of our citizens," Hickernell said. "Identity thieves can do tremendous financial damage once they obtain a victim's Social Security number, and for that reason I believe we must put protections in place to keep them from getting that information."

State Supreme Court Justice J. Michael Eakin was not surprised we found his number online. He was aware that Social Security numbers appear on some real estate records.

"I've said for years that the information that we give out, day in and day out, is incredible. We hope there's no reason for someone to collect it all and put it together," Eakin said.

Eakin said he hoped counties would follow Lancaster's lead in allowing people to have their Social Security numbers redacted from the online images. The recorder of deeds office here was the first to offer such a feature on its Web site.

"I don't want to speak for the whole court, but I certainly can say that we've been aware of it, have discussed ways of dealing with it," Eakin said. "But the diversity of counties makes it difficult to come up with a uniform plan. This certainly brings home the fact that we need to encourage the counties to have something like this — a redaction process — so that people can take care of it."

Others aren't satisfied with the effort.

B.J. Ostergren of Virginia, a privacy advocate who has been leading the fight to remove government records containing Social Security numbers from the Web, said there's a huge difference between maintaining public records at the courthouse and posting them online.

To prove her point, she directed us to her Web site, The Virginia Watchdog, where she has posted former Florida Gov. Jeb Bush's deed, which contains his Social Security number.

"I would not drive from my home in Virginia to Miami-Dade County, Florida, to get that," she said. "But anyone can do it from the Internet. It's just a ridiculous thing. Having these records on an open Web site, open to the world, is dangerous and idiotic."

Privacy initiatives

The recorder of deeds office maintains some 12 million real estate records — documents it began putting online in 2001 — but only a small portion actually hold such sensitive information. Still, some of those records do hold Social Security numbers and, by law, they are considered a matter of public record.

"I would say somewhere between 5 and 10 percent may have Social Security numbers," Recorder of Deeds Steve McDonald said. "They're open and public records. Anybody can ask for anything, and I can't ask why."

When his office began publishing records online, "Identity theft wasn't even a discussion at that point. It really is a pretty recent occurrence. The last five to six years is when people have begun to discover, 'Oh, well there's a great way to discover that kind of sensitive information.'"

Since identity theft has become more of an issue, the deeds office has been working to redact Social Security numbers from the images posted online. It also redacts the numbers from images of any new document submitted to the office.

"We're taking a two-pronged approach. We're making the public aware and saying, 'Hey, go look for yourself,' and we're going to make a concerted effort to electronically go back through the records and find these — but don't just depend on that.

"Look at your own records and tell us, fill out the Web form," McDonald said. "It's a really big project to figure out how to do it well, systematically, and make sure we don't do something that would give people a false sense of security."

The Web site is at www.lancasterdeeds.com.

Although there have been instances in which identity thieves used public records, they represent only about 2 percent of the cases nationwide, said McDonald, who is well-versed on the issue.

He added that he knows of no case in which records his office maintains were the source of such a crime.

You and your Social Security number

The sources contacted for this story were unanimous in their belief that access to public records is vital, but suggested it should not come at the expense of privacy violations. Most believe Social Security numbers should not be available to the public because they are, by far, the most sensitive and oft-sought piece of information by identity thieves.

"That's how credit reporting agencies match individuals to their credit records," Crane said. "Most identity thieves are in it for the money. Among the new accounts that thieves seek to open, the most common are banking, credit and telecom."

Crane suggested citizens educate themselves about what information is available about them on the Web and in hard copy records. She said they should press lawmakers to pass laws to ensure Social Security numbers don't appear on public records.

"If they were needed, that would be one thing," Crane said. "But you can use an alternative identifier for all of those things."

Lancaster County Judge Joseph C. Madenspacher, a former district attorney, said he was troubled but not totally shocked that we were able to find his Social Security number.

"Obviously it's easy to find this stuff," he said. "Everything that I've read is that it is really easy to find this, and more often than not, public records and government records is one of the easiest ways to do it."

Madenspacher said he has made every effort over the years to protect such information.

"Whenever I'm asked for my Social Security number by someone who has no need for it, I don't give it," he said.

"People have to be aware as to exactly who they're filling out forms for," the judge added. "If people have no need for your Social Security number — and many people don't have a need for a Social Security number — you don't have to give it to them."

Barry Kornhauser, the playwright-in-residence at the Fulton Theatre, was surprised and concerned that his Social Security number was online.

"I didn't think about it much at all. Most surprising is the fact that it's a government site that was so open and available. It's not as though I was shopping online and through that my Social Security number was found," Kornhauser said. "It's a little unsettling, and one would hope government offices would be more protective of such information."

State Rep. Mike Sturla, a Democrat from Lancaster and member of House leadership, was not surprised to learn his Social Security number had been obtained by this newspaper because it is present on so many records, public and private.

"I probably give out my Social Security number once a week — on every form I fill out. I go to the doctor's office, I give out my Social Security number to prove I'm not an illegal citizen," Sturla said.

Most states have laws specifically prohibiting posting or displaying Social Security numbers on public records. Pennsylvania is one of the few states that does not have such a law on the books.

One bill before the Legislature, House Bill 547, would prohibit the use of full Social Security numbers on state forms. Under the bill, no one would be required to provide more than the last four digits of their Social Security number on state forms.

State Rep. Gordon Denlinger of Narvon was not even remotely surprised that we found his Social Security number online.

"As we continue to put more records out on the Internet in electronic form, I think it's to be expected that there is a degree of accessibility that opens the door to potential theft," Denlinger said.

"I've had a growing concern about the issue of identity theft and its impact on senior citizens and the broader community," he said. "There are various bills and ideas that are being considered in Harrisburg, but private citizens should also take steps such as credit monitoring and having their private information redacted to protect their financial information."

We also found the Social Security number of Susan Shapiro, an anchor and investigative reporter at WGAL News 8.

"It's very concerning to me to have your Social Security number out there for all of the world to see," she said. "It isn't really surprising. Even now, in this day and age, they ask for your Social Security number for everything. I'm not shocked that it's out there."

Lancaster County President Judge Louis J. Farina, whose Social Security number we found online as well, said the discovery represented the "ugly side of the public's right to know."

"I fully support the idea of public records being available to the public," Farina said. "The balance, though, has to be that privacy has to be protected."

Farina said he views the posting of records with Social Security numbers online as crossing a line.

Recovering from ID theft

Identity-theft victims can spend months or years — and their hard-earned money — restoring their good name and credit record. In the meantime, they may lose job opportunities or be refused loans, education, housing or cars. They can even be arrested for crimes they did not commit.

In Maribeth Madonna's case, the identity thief spent a short amount of time — a few months — in prison for her crimes. Madonna, though, has spent countless hours taking precautions to prevent further problems.

"It irritated me that someone could commit a crime in my name. It's too easy and the penalty too light," Madonna said. "I was very upset by it. I spent hours trying to remedy all the problems she created."

In a twist of irony, a check of Madonna's identity-theft case on file at the courthouse revealed, of all things, her Social Security number.

tmurse@lnpnews.com