Jeb Bush dumps emails including social security numbers of Florida residents online

Florida man strikes again

Jeb Bush, a rumored 2016 Republican presidential candidate, just decided to publish hundreds of thousands of emails sent to him during his time as governor of Florida. On its face it seems like a great idea in the name of transparency, but there's one huge problem: neither Bush nor those who facilitated the publication of the records, including the state government, decided to redact potentially sensitive personal information from them.

"In the spirit of transparency, I am posting the emails of my governorship here," a note on Bush's website says. "Some are funny; some are serious; some I wrote in frustration." Some also contain the email addresses, home addresses, phone numbers, and social security numbers of Florida residents. The emails are available in Outlook format, and can be searched on the web at Bush's website.

The Verge did not receive a response from Mr. Bush or his Political Action Committee's office at the time of publication.

"In the spirit of transparency, I am posting the emails of my governorship."

We reviewed many of the emails released by Bush, and found a wide variety of communications — everything from religious parables, to praise of the governor's support of creationism, to routine bureaucratic correspondence. But some of the emails appear to be highly sensitive or personal. Many, like the one excerpted below, share tales of personal struggle or sorrow.

Quote

This is just a sharing...today..i feel beaten down... ... want to help many and hope I can get there some day....through my empowerment it will be a testament to my message and the ability to share my future resources...its a lonely road...so many seem actively against you...your back is to the wall...you have many another two months of business survival...

P.S. this is just sharing with a friend... please no action or follow-up or any communications or assistance sought of nay kind...its my struggle to work through and find a way...just feeling "beaten" today...at 37 I feel like 60 today .....and tomorrow will be better.

Confidential communications intended for indicated recipient only

Other emails include potentially sensitive details about government operations. One email reviewed by The Verge discussed termination of a Florida Lottery employee; the email revealed the reasons for his termination, including "conduct unbecoming a public employee, insubordination, and neglect of duty." The employee had emailed then-governor Bush to appeal for reinstatement. Bush followed up with a lottery official to see if his request could be granted.

Some include personal appeals from citizens with medical or employment issues. And a subset of these messages contain sensitive data like social security numbers, as in the email shown below. (The redactions are our own.)

Another email, sent on behalf of a healthcare representative and shown below, contains information about a child with a life-threatening medical condition. The email exposes the child and mother's name, the mother's home state and phone number, her social security number, and her healthcare identification number.
     
Florida's freedom of information laws are very broad. As Bush notes in the signature of many of his emails, "Florida has a very broad public records law," and "your email communications may therefore be subject to public disclosure."  However, social security numbers in particular are protected. As Florida private attorney Richard A. Harrison tells The Verge, social security numbers are "both confidential and exempt" from public disclosure under state law. "They can be released only for the limited purposes specified in that section, of which this is not one," Harrison says. "It doesn't matter how an agency or official obtained the information; once obtained it is a public record and the SSNs are confidential and exempt under the law." But that doesn't mean the former governor is legally responsible for the data leak. Harrison says the state's legal custodian of records is charged with ensuring no confidential or exempt information is released.

Under Florida law, that custodian might get off with just a scratch. Violation of the public records statute in this circumstance is considered a "noncriminal infraction" that's punishable by a fine "not exceeding $500." Someone who knowingly or willfully violates the privacy law is subject to harsher penalties — but it might be pretty easy to avoid those given the immense size of the records.

Jeb Bush's camp was quick to shift blame to the state. Kristy Campbell, a spokesperson for Bush, told BuzzFeed News that the release is "an exact replica of the public records on file with the Florida Department of State and are available at anyone's request under Chapter 119 sunshine laws." Of course, that statement isn't entirely true, since social security numbers are definitely exempt (and confidential) under that same chapter of the law.

Social Security Numbers are both confidential and exempt from disclosure under Florida law
Many of the same emails Bush released today may have already been available online as of December, 2014, thanks to a request made by the Florida Center for Investigative Reporting. Some publications, including The Washington Post and The Hill, combed the email records for policy insight, but did not appear to stumble upon sensitive personal information.

Obviously one of the lessons here is that you shouldn't email information to public officials that you want to keep private, at least not in Florida. But even if most of these emails are broadly subject to disclosure under the state's sunshine law, it's concerning that such a huge, indiscriminate data dump could include so much personal information. "Emails that bear on public decisions should be made public, but certainly emails with social security numbers or private medical information are not relevant to that," Bruce Jacob, a constitutional and criminal law professor at Florida's Stetson University told The Verge. "It's hard to imagine a court finding a persona guilty of a crime if it was a mistake, but certainly this is not a good thing for private information of that kind to be released."

At minimum, the data dump shows a serious ignorance of the volume of sensitive information in the records and a carelessness about their disclosure. And while a Florida bureaucrat may ultimately be to blame, it's not a good look for Jeb Bush — someone who called himself the first "eGovernor," and a man who may want to sit in the White House.

Update, 3:10 PM: This story has been updated to include additional emails from the archive, as well as prior reports on the archive from December, 2014.

Update, 3:22 PM: Updated with a statement by a spokesperson for Jeb Bush.

Update, 3:53 PM: Time reporter Zeke Miller, reporting from a Q&A with Jeb Bush, reported on Twitter that Bush is now aware of the personal information in the email dump, and that it will be removed. Miller reports that Bush's PAC posted only what is already in the public record, echoing the statement given by Bush's spokesperson to BuzzFeed News. We're not sure how long that will take, or if Bush's PAC will take down the emails temporarily in the meantime (it will presumably take a while to scan through hundreds of thousands of emails), but we'll keep you updated.
 
Update, 5:35 PM: Researchers are now poring over the email dump for personal information. It appears Bush's team, and perhaps Florida state government, will have lots of work to do if they want to purge the data from the records — and some explaining about how this happened. It's more than a few bits of personal information.
 
Update, 11:00PM: The raw .pst files have now been removed from Jeb Bush's site. "We were informed that some personal information was available in the raw data so we removed these files," reads an error message. "You may still read these emails on the email calendar link, where we have redacted personal information we have been able to locate."