Massachusetts on-line assessment databases are a bit too accessible

While engaged recently in a discussion with a parent at our children’s school whom I felt was being overly paranoid about sharing her home address with other parents, I googled her name, suspecting that I would be able to illustrate to her that the information she was trying to protect was already available on-line.

I succeeded far more than I’d expected.

One of the first matches returned by Google was her home’s property listing in the on-line property assessment database for the town of Arlington, Massachusetts, where she lives. Her name, her husband’s name, their address, a picture of the house, a floor-plan sketch, the date they bought the house, their purchase price, and all of the information used by the town to calculate the assessed value of the house were instantly available.

Arlington’s webmaster is guilty of two offenses: (1) providing an interface for searching the assessment database by name (i.e., if you go to http://arlserver.town.arlington.ma.us/Property/, you can search not only by address, but also by the owner’s name); and (2) allowing its assessment database to be indexed by public search engines.

This is not a small thing. Consider a domestic abuse victim who moves to a new house in a new town to get away from her abuser. She takes precautions to avoid being tracked down, e.g., ordering telephone service in a fake name and paying the telephone company extra for an unlisted number. Unfortunately, however, the town she has moved to is Arlington, which proceeds to publish her name and address on its Web site for the world to see and search.

Or what about when the photo of the state-champion girls soccer team runs in the paper, with a caption identifying all the players and the town they’re from? It’s like a restaurant menu for every pedophile in the state, with the town assessment database conveniently telling them exactly where to go for take-out.

The discovery of Arlington’s carelessness with its residents’ privacy prompted me to check on Boston, where I live. Boston, too, allows its assessment database to be searched by name, but at least its database isn’t indexed in Google. Someone with nefarious intent trying to locate a Boston resident must already know that s/he owns a house in Boston. That’s bad, but not as bad as Arlington.

I decided to check some other towns and cities in Massachusetts to see how they stack up.

I checked 61 additional towns and cities, of which only ten had their data sufficiently secured (i.e., not easy to view the entire assessment database, not searchable by name, and not searchable in Google). I found one town besides Arlington, Ashburnham, whose records were searchable in Google, and four towns (including Ashburnham) where it was easy to view the entire assessment database without needing to perform individual searches. In addition, I discovered that independent of town and city records, the registries of deeds of most Massachusetts counties allow their land records to be searched by name, most of them from a single, convenient Web site.

When assessment and land records were kept only on paper, they were organized by street name and number, not by owner name. When Massachusetts communities began to put these records on-line for public access, did they stop to think of the privacy, security and safety implications of allowing them to be searched by name? Apparently, only ten of the 63 communities I looked at did, and most of them are probably in counties which didn’t.

Is Massachusetts typical?

For those who are curious, here are the details of what I found:

• Cambridge – not searchable by name, not searchable in Google (PASS)
• Abington – searchable by name, entire database can be viewed by sending an empty search, not searchable in Google (FAIL)
• Adams – spreadsheet containing town’s entire assessment database (last updated FY03) available on Web site, not searchable in Google (FAIL)
• Amesbury – searchable by name with free registration, entire database can be viewed by sending an empty search, not searchable in Google (FAIL)
• Amherst – not searchable by name (“Owner Names are purposely not a part of the search interface”), not searchable in Google (PASS)
• Andover – owner names don’t appear in database (PASS)
• Ashburnham – database available as PDFs on Web site, searchable in Google (FAIL)
• Ashby – searchable by name, not searchable in Google (FAIL)
• Acton, Acushnet, Agawam, Aquinnah, Ashfield, Auburn, Avon – assessment database doesn’t appear to be on-line (PASS)

Note that Abington and Amesbury both appear to use a third-party service called Vision Appraisal Technology (http://www.visionappraisal.com/) to host their on-line assessment databases.

Ashby uses software hosted by the Community Software Consortium (http://csc-ma.us/). This software also appears to be used by Alford, Ashland, Ayer, Bedford, Berkley, Bernardston, Bolton, Brookfield, Charlemont, Chester, Duxbury, East Brookfield, Egremont, Framingham, Gill, Grafton, Great Barrington, Hardwick, Heath, Hingham, Holliston, Lancaster, Lee, Lunenburg, Mattapoisett, Maynard, Monroe, Needham, New Braintree, North Andover, North Brookfield, Northborough, North Reading, Oakham, Richmond, Royalston, Saugus, Seekonk, Sheffield, Somerset, Southborough, Swansea, Tolland, Uxbridge, West Brookfield, and Windsor, all of which therefore FAIL, and furthermore, there’s a single convenient interface that one could use to easily search for a particular person by name in all of these communities.