21 Jan Extracting and redacting: Is solution to state's privacy fumbles right in its own back yard?
Madison, Wis. – Extract Systems may or may not have been able to prevent the latest information security breaches involving state government, but the Madison-based company has plenty of other customers in government agencies across the nation.
The exact cause of the visible mailing of more than 260,000 Social Security numbers along with an informational booklet is not officially known, but the state is drawing strong criticism for three data breaches in 13 months. In late 2006, a Department of Revenue contractor took the blame for sending 171,000 tax booklets with the recipients’ Social Security numbers on the cover, and more recently it acknowledged that 5,000 new tax mailings went out with social Security numbers in full view.
David Rasmussen, president of Extract Systems, is not sure what happened in the latest security breaches, though he suspects it’s a simple case of database mismanagement. But with 500 customers in the United States, mostly government agencies and a growing number of private-sector clients, he has led the company’s transformation into a check against the kind of snafus that are dogging state government.
The potential applications go beyond Social Security or bank account numbers, and Rasmussen provided an example. “It’s not just about Social Security numbers,” Rasmussen explained. “There are companies out there that track automobile accidents. On those documents for accidents, there are all kinds of private information, including drivers’ license numbers and addresses.
“These companies have contracted with us to redact that information.”
Let me redact that
Extract Systems develops data entry privacy software that provides automated data extraction, which helps prevent identity theft. It has three products on the market, including image redaction software. The reference to image does not necessarily pertain to photographs, but to images of documents – documents that occasionally are modified by workflow practices and contain sensitive information.
As Rasmussen explains, most workflows have three basic steps: the collection of information, the input of information into a given system (including data that must be protected), and the reproduction of that information. It is the collection, protection, and reproduction of information that most often gets organizations into trouble.
Exact Systems has applied the redaction technology in several vertical markets, including county recorders of deeds offices. When someone buys or sells a home, various parties like title companies need access to all the land records available at this office. Recorders are required by law to record, protect, and reproduce the data, and in many cases these records have a lot of personally identifying information – including Social Security or credit card numbers. The technology can scan large documents, including PDFs with 30 or 40 pages, and look for certain word groupings that would signify private information.
The redaction technology relies on two things. One is an optical character recognition, a software program that translates a scanned image into text. Once the data is in a text format, the second part of the solution comes into play. The software reads text like a human being would, looking for clues to sensitive information.
“For a Social Security number, we would look for something that simply says, `The Social Security number is,’” Rasmussen said. “It’s more complicated than that of course, but that’s basically how it works.”
What happens in Vegas…
Overall, Extract Systems markets three software products that search documents for important information. Its Geographic Information System looks for bearings and distances to automate survey documents, which can speed up the mapping process for surveyors and free staff up for duties other than manual data entry.
The third product is deployed for automated data capture and also is used in a number of recorder’s offices, including Waukesha County, several Detroit suburbs, and Clark County Nevada, where the goal is for private data generated in Las Vegas to stay in Vegas. By Rasmussen’s figures, the product can cut headcount applied to that particular workflow by 40 percent, allowing users to apply human resources to tasks that “actually require human resources” and reduce manual data entry costs without outsourcing.
Extract Systems will sell direct, but prefers to work with industry partners. It has 18 partners that have their own customers, many who sell to county governments, and it works with two of the largest providers of technology to county recorder’s offices. Through an OEM licensing process, Extract Systems will loan partners its software, and the partners then incorporate it into their technology and deliver the package to their customers.
The company employs 18 people, a mixture of software engineers who build the technological tools that find information, rule writers who learn those techniques and apply them, and salespeople. The company plans to add five employees this year, but its long-term goal is to reward investors, a combination of angel and institutional, by putting itself in a position to be acquired by a current or future customer that must have Extract Systems as part of its technology portfolio.
Ignored by the state
Established in 1998, the company changed its name from UCLID Software to Extract Systems because Rasmussen often received blank stares when he invoked the old name. Originally a developer of mapping software, the company was named for a 16th Century geometry legend, but those blank expressions helped convince Rasmussen that the future of the company would be in automated redaction. The name change coincided with a market repositioning that has placed Extract Systems on a fast-growth track averaging 50 to 75 percent revenue growth over the past four years.
Part of the company’s family of products is the ID Shield automated redaction tool, which won first place in the information technology category in the 2007 Governor’s Business Plan Contest and won the Governor’s Best New Product Award in the small business category. Given this recognition, one would think there is no excuse for state government to be ignorant of potentially valuable technology in its own back yard, yet the state of Wisconsin has not employed the company’s technology to protect data.
“It was nice publicity,” Rasmussen said of the aforementioned awards, “and we did talk to a couple of state employees, but the conversations with the state have gone nowhere. With the difficulty the state has in purchasing, everyone is paranoid and they don’t want to talk to vendors. They are afraid to talk to vendors, and vendors can help them solve problems.”
Related stories
• Doyle asks Metavante to investigate state data breaches
• Surgical products company wins Governor’s Business Plan Contest
• Business plan finalists capture technology
• Summer venture investments total $18 million for Wisconsin start ups
• MDC provides venture funding for tech companies