By Gabriel Walters, ACLU of Virginia Legal Fellow
Today the Fourth Circuit Court of Appeals in Richmond, Virginia, heard oral argument in a case on the cutting edge of privacy, technology, and freedom of expression. The case, Ostergren v. McDonnell, involves a First Amendment challenge to a Virginia statute that penalizes the communication of Social Security Numbers (SSNs) to the general public.
The ACLU of Virginia represents B.J. Ostergren, a Virginia resident who publishes a website advocating that the Commonwealth of Virginia better protect SSNs against the crime of identity fraud. To make her point plain, Ostergren posts on her website public records containing the SSNs of certain public officials, including Virginia legislators and clerks of court.
Ostergren herself has not committed identity theft, and does not encourage it. Rather, the SSNs on her website serve as an object lesson to the people who are best situated to prevent the harms of identity theft, that this information is out there—and that the SSNs are easily found in public documents. Ostergren has found the documents on her website from government websites. Currently, anyone in the world can log in to the site, and for a small fee, access hundreds of thousands of SSNs within seconds.
For years, Ostergren advocated for better privacy protection, without posting SSNs on her website. No one in power listened. But as soon as she showed them how easy it was for anyone—whether for a legitimate purpose or not—to obtain their SSNs, legislators took notice. The General Assembly of Virginia has taken some steps to redact SSNs from public documents, but has not fully funded the redaction process. Nor has the General Assembly taken action to remove the unredacted documents from the website until redaction is completed. Rather than take these or other steps to protect the privacy of Virginia’s citizens, the General Assembly enacted a statute penalizing citizens who communicate SSNs to the general public—even citizens like Ostergren, who uses SSNs as the key part of her political advocacy.
Today the court wanted to know, essentially: can the Commonwealth do that? Can it, without violating the free speech clause of the United States Constitution, punish an individual merely for republishing public documents on her website?
A line of U.S. Supreme Court cases establishes that the government cannot punish the publication of truthful information, lawfully obtained, on a matter of public importance, without showing a state interest of the highest order. Furthermore, the means to achieve that interest must be narrowly tailored so as not to suppress any more speech than is necessary—it must be the least restrictive means.
In this case, there’s no doubt that what Ostergren puts on her site is truthful, and that she obtained the public documents lawfully. And the discussion of SSNs, privacy rights and identity theft raised by her website is surely a matter of public importance. The Commonwealth asserts it has an interest of the highest order in protecting its citizens from the harms of identity theft.
The judges cut right to the chase. They asked the Solicitor General whether the Commonwealth could have more narrowly tailored its means of preventing the dissemination of SSNs—from public records wholly within the government’s custody and control—by adopting methods such as redaction or removal from online access until redaction is complete. When the Solicitor General answered that the statute at issue could not be more narrowly tailored, one of the judges shot back, “It couldn’t have been broader, either, could it?” After probing questions asked of both sides from an active bench, the court concluded the hearing and adjourned for a recess, during which the judges greeted counsel for both sides.
The law and the facts are on Ostergren’s side. The Commonwealth argued that Supreme Court precedent should not cover the facts here, but it could not marshal much precedent in support. The Commonwealth emphasized to the court the dangers posed by dissemination of SSNs—dangers that are undoubtedly real and do in fact pose a threat to privacy. But Ostergren is a privacy advocate, engaging in core political speech with the goal of raising awareness of the threat posed by SSNs, and republishing public documents available to anyone, to finely make her point. The court should rule in her favor.