Source: s3://data.kl3m.ai/documents/govinfo/USCOURTS/USCOURTS-ca4-09-01723/USCOURTS-ca4-09-01723-0/pdf.json

Nature of Suit Code: 440
Nature of Suit: Other Civil Rights
Cause of Action: 

---

PUBLISHED

UNITED STATES COURT OF APPEALS

FOR THE FOURTH CIRCUIT

BETTY J. OSTERGREN, 

Plaintiff-Appellee,

v.

KENNETH T. CUCCINELLI, II, in his

official capacity as Attorney

General of Virginia,  No. 09-1723

Defendant-Appellant.

ELECTRONIC PRIVACY INFORMATION

CENTER,

Amicus Supporting Appellee. 

BETTY J. OSTERGREN, 

Plaintiff-Appellant,

v.

KENNETH T. CUCCINELLI, II, in his

official capacity as Attorney

General of Virginia,  No. 09-1796

Defendant-Appellee.

ELECTRONIC PRIVACY INFORMATION

CENTER,

Amicus Supporting Appellant. 

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 1 of 47
Appeals from the United States District Court

for the Eastern District of Virginia, at Richmond.

Robert E. Payne, Senior District Judge.

(3:08-cv-00362-REP)

Argued: March 23, 2010

Decided: July 26, 2010

Before DUNCAN and DAVIS, Circuit Judges, and

Joseph R. GOODWIN, Chief United States District Judge

for the Southern District of West Virginia,

sitting by designation.

Affirmed in part, reversed in part, and remanded by published

opinion. Judge Duncan wrote the opinion, in which Judge

Davis and Judge Goodwin concurred. Judge Davis wrote a

separate concurring opinion.

COUNSEL

ARGUED: Earle Duncan Getchell, Jr., OFFICE OF THE

ATTORNEY GENERAL OF VIRGINIA, Richmond, Virginia, for Appellant/Cross-Appellee. Rebecca Kim Glenberg,

AMERICAN CIVIL LIBERTIES UNION FOUNDATION

OF VIRGINIA, Richmond, Virginia, for Appellee/CrossAppellant. ON BRIEF: William C. Mims, Attorney General

of Virginia, Stephen R. McCullough, State Solicitor General,

William E. Thro, Special Counsel, Martin L. Kent, Chief

Deputy Attorney General, Stephen M. Hall, Assistant Attorney General, OFFICE OF THE ATTORNEY GENERAL OF

VIRGINIA, Richmond, Virginia, for Appellant/CrossAppellee. Frank M. Feibelman, Cooperating Attorney, ACLU

OF VIRGINIA, Richmond, Virginia, for Appellee/Cross2 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 2 of 47
Appellant. Marc Rotenberg, John Verdi, Jared Kaprove, Matthew Phillips, ELECTRONIC PRIVACY INFORMATION

CENTER, Washington, D.C., for Amicus Supporting

Appellee/Cross-Appellant.

OPINION

DUNCAN, Circuit Judge:

This appeal arises from a First Amendment challenge to

Virginia’s Personal Information Privacy Act, Va. Code

§§ 59.1-442 to -444. Section 59.1-443.2 prohibits

"[i]ntentionally communicat[ing] another individual’s social

security number to the general public." The district court

found this section unconstitutional as applied to an advocacy

website that criticized Virginia’s release of private information and showed publicly available Virginia land records containing unredacted Social Security numbers ("SSNs").

Ostergren v. McDonnell, No. 08-362, 2008 WL 3895593, at

*14 (E.D. Va. Aug. 22, 2008). Later, the court entered a permanent injunction barring Virginia from punishing the republication of "publicly obtainable documents containing

unredacted SSNs of Virginia legislators, Virginia Executive

Officers or Clerks of Court as part as [sic] an effort to reform

Virginia law and practice respecting the publication of SSNs

online." Ostergren v. McDonnell, 643 F. Supp. 2d 758, 770

(E.D. Va. 2009). Both decisions are challenged on appeal. For

the reasons that follow, we affirm in part and reverse in part.

I.

Betty Ostergren resides in Hanover County, Virginia, and

advocates for information privacy across the country. Calling

attention to Virginia’s practice of placing land records on the

Internet without first redacting SSNs, she displayed copies of

Virginia land records containing unredacted SSNs on her

OSTERGREN v. CUCCINELLI 3

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 3 of 47
website. After section 59.1-443.2 was amended to prohibit

this practice, but before the amendment took effect in July

2008, Ostergren brought this constitutional challenge.1

A.

The clerk of court for each county in Virginia maintains

documents affecting real property within the county. These

"land records" reflect the ownership, conveyance, encumbrance, or financing of real property.2

 They include deeds,

contracts, liens, divorce decrees, and various other documents. See Va. Code § 17.1-227. Virginia law requires that

clerks make land records available for public inspection. See

Va. Code § 17.1-208. Any person can review and copy land

records by visiting the courthouse and requesting them.

During the 1990s, many clerks of court began placing land

records on the Internet. According to counsel for the Attorney

General, the impetus came mainly from the real estate industry because online access to land records facilitated numerous

real estate transactions. The Virginia General Assembly

encouraged this practice by allowing clerks to charge a fee for

online access. See Va. Code § 17.1-276. The General Assembly later established a "Technology Trust Fund Fee" assessed

for every document recorded, and set aside the revenue for

1We provide factual background primarily through July 2008. Regarding the district court’s decision finding section 59.1-443.2 unconstitutional, we cannot consider later factual developments because the record

below did not extend beyond July 2008. See Kirkpatrick v. Lenoir County

Bd. of Educ., 216 F.3d 380, 384 (4th Cir. 2000) ("From a procedural

standpoint, courts hearing a case on appeal are limited to reviewing the

record that has been developed below."). Regarding injunctive relief, we

could theoretically have considered factual background through June

2009, but the record below contains little evidence about factual developments after July 2008. 

2Virginia law states that "‘[l]and records’ means any writing authorized

by law to be recorded on paper or in electronic format that the clerk

records affecting title to real property . . . ." Va. Code § 17.1-292(B). 

4 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 4 of 47
improving access to public records through information technology. See Va. Code § 17.1-279. The General Assembly also

declared "the intent . . . that all circuit court clerks provide

secure remote access to land records on or before July 1,

2006." 2004 Va. Acts 980. Finally, in 2007, the General

Assembly imposed guidelines for posting land records online,

see Va. Code § 17.1-294, and required that "[e]very circuit

court clerk shall provide secure remote access to land records

. . . on or before July 1, 2008," Va. Code § 17.1-279(D)(3).

The parties stipulated that "[u]nder Virginia’s ‘secure

remote access’ system, any person may, for a nominal fee,

obtain online access to all of the land records for a given

locality." J.A. 86. Guidelines require that an individual must

register and obtain a username and password before using the

system. See Information Technology Resource Management

Standard, SEC503-02 §§ 1.4(3), 2.1 (Va. Info. Techs. Agency

Mar. 28, 2005). This involves signing an agreement, paying

a fee (possibly several hundred dollars per year), and providing certain personal information (first and last names, business name, mailing address, telephone number, email address,

and citizenship status). Id. § 2.1.1. "Registration must be in

person or by means of a notarized or otherwise sworn application that establishes the prospective Subscriber’s identity,

business or residence address, and citizenship status." Id.

§ 2.1.2.

By July 2008, every county in Virginia had made its land

records available on the Internet through secure remote

access. This included over 200 million Virginia land records.

B.

Virginia’s decision to place land records online raised certain concerns about information privacy. For many decades,

attorneys included SSNs on real estate documents submitted

for recording. Initially assigned for the purpose of administering Social Security laws, nine-digit SSNs have become

OSTERGREN v. CUCCINELLI 5

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 5 of 47
widely used for identification and account authentication by

government agencies and private organizations because no

two people have the same number. They are thus highly susceptible to misuse. An unscrupulous individual who knows

another’s SSN could, for example, obtain fraudulent credit

cards or order new checks on that person’s account.

When clerks of court began placing land records online,

they did nothing to redact SSNs. At that time, Virginia law

neither required such redaction nor prevented attorneys from

submitting documents for recording that contained unredacted

SSNs. In 2003 and 2004, however, the General Assembly provided that "clerk[s] may refuse to accept any instrument submitted for recordation that includes a grantor’s, grantee’s or

trustee’s social security number," and clarified that "the attorney or party who prepares or submits the instrument has

responsibility for ensuring that the social security number is

removed from the instrument prior to the instrument being

submitted for recordation." Va. Code § 17.1-227. Virginia law

also provides that clerks "shall be immune from suit arising

from any acts or omissions relating to providing secure

remote access to land records pursuant to this section unless

the clerk was grossly negligent or engaged in willful misconduct." Va. Code § 17.1-294(D).

The General Assembly finally addressed redaction in the

2007 legislation mandating that clerks provide secure remote

access by July 1, 2008. See Va. Code § 17.1-279(D)(3). The

General Assembly noted clerks’ authority to redact SSNs

from digital land records available through secure remote

access, authorized hiring private vendors to run redaction

software, and authorized using Technology Trust Fund money

for this purpose. See Va. Code § 17.1-279. The legislation

would have also required clerks to complete the redaction

process by July 1, 2010, but this provision never went into

effect because the General Assembly failed to appropriate the

necessary funds. See 2007 Va. Acts 872; 2007 Va. Acts 748.

These efforts focused solely on digital land records available

6 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 6 of 47
online. Virginia does not redact SSNs from original land

records maintained at local courthouses even though Virginia

law requires that such records remain publicly accessible.

The redaction process involves two steps—one electronic,

the other manual. First, computer software checks digital land

records and, in essence, labels each document "SSN found,"

"SSN probably found," "SSN possibly found," and "SSN not

found." Individuals then manually review all but the last category, which they randomly sample. According to stipulation,

The accuracy of the redaction methods used by the

circuit court clerks with regard to images that actually have social security numbers is between 95%

and 99%. After redaction, a social security number

that remains un-redacted in the online land records

will be redacted if the Clerk is informed of the inaccuracy. If not brought to the Clerk’s attention, it will

remain accessible in the online land records.

J.A. 230. One company, Computing System Innovations

("CSI"), handled redaction for 67 counties. In processing

about 50 million images, CSI manually reviewed about 5 million and discovered that 1,575,422 (about 3.21%) contained

SSNs.3

By July 2008, 105 of Virginia’s 120 counties reported that

they had completed the redaction process. Among the 15 that

remained, two planned to finish by July 2010 and the rest

planned to finish by December 2009. Despite the incomplete

redaction, these 15 counties nonetheless continued to make

their land records available online through secure remote

access.

3Ostergren testified that on July 15, 2008, after Hanover County purportedly finished redacting SSNs, she successfully located Hanover

County land records containing unredacted SSNs through secure remote

access. 

OSTERGREN v. CUCCINELLI 7

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 7 of 47
C.

When Virginia clerks of court started placing land records

containing unredacted SSNs online, Ostergren began lobbying

the General Assembly in opposition and contacting individuals whose SSNs were compromised. She has engaged in similar advocacy across the country, but such advocacy alone met

with little success. Ostergren created her website

www.TheVirginiaWatchdog.com in 2003 and, two years later,

began posting copies of public records containing unredacted

SSNs obtained from government websites. Since then, Ostergren has posted numerous Virginia land records showing

SSNs that she herself obtained through Virginia’s secure

remote access website. For example, she explained that

searching for the term "Internal Revenue Service," "Department of Justice," or "United States" produces thousands of

federal tax liens, and all those filed before 2006 contain SSNs.

In posting records online, Ostergren seeks to publicize her

message that governments are mishandling SSNs and generate pressure for reform.4

 She explained that "seeing a document containing an SSN posted on my website makes a

viewer understand instantly, at a gut level, why it is so important to prevent the government from making this information

available on line [sic]." J.A. 89. She added that merely

explaining the problem lacks even "one-tenth the emotional

impact that is conveyed by the document itself, posted on the

website." J.A. 89. Perhaps for this reason, Ostergren received

considerable media attention when she began posting records

online. Furthermore, many government agencies outside Virginia responded by removing public records from the Internet

or redacting private information.

4Normally Ostergren reveals only public officials’ SSNs, reasoning that

they are "the people who have the influence to address the problem." J.A.

89. She explained, however, that in June 2008 the clerk of court for

Pulaski County, Arkansas, refused to remove land records from the Internet pending SSN redaction until Ostergren published land records that

showed several prominent local citizens’ SSNs. 

8 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 8 of 47
Despite this success, Ostergren’s website has also contributed to the underlying social concern that motivates her advocacy. Because one can visit her website and find public

records showing SSNs without needing to register or input

search terms, Ostergren makes Virginia land records showing

SSNs more accessible to the public than they are through Virginia’s secure remote access system. Potential wrongdoers not

experienced or motivated enough to register for secure remote

access might nonetheless stumble upon Ostergren’s website

and obtain SSNs. Indeed, one person has pleaded guilty to

using Ostergren’s website to obtain fraudulent credit cards.

D.

The controversy that spurred this case arose from Ostergren’s disclosure of others’ SSNs printed in Virginia land

records that she posted online. Section 59.1-443.2 of the Code

of Virginia provides that "a person shall not . . .

[i]ntentionally communicate another individual’s social security number to the general public." Va. Code § 59.1-

443.2(A)(1). In Spring 2008, the General Assembly removed

a statutory exception for "records required by law to be open

to the public."5 2008 Va. Acts 837. The Attorney General of

Virginia later indicated that, after this change took effect on

July 1, 2008, Ostergren would be prosecuted under section

59.1-443.2 for publicly disseminating Virginia land records

containing unredacted SSNs.6

5Ostergren alleges that the General Assembly made this change "in

direct response to [her] website." J.A. 10. 

6For a section 59.1-443.2 violation, the Attorney General may seek various civil penalties, including fines and injunctions. See Va. Code §§ 59.1-

201 to -206. Furthermore, "[a]ny person who suffers loss as the result of

a violation" may "initiate an action to recover actual damages, or $500,

whichever is greater," or for a willful violation, "an amount not exceeding

three times the actual damages sustained, or $1,000, whichever is greater,"

plus "reasonable attorneys’ fees and court costs." Va. Code § 59.1-204. 

OSTERGREN v. CUCCINELLI 9

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 9 of 47
On June 11, 2008, Ostergren brought this action in the

Eastern District of Virginia under 42 U.S.C. § 1983 seeking

declaratory and injunctive relief, and attorney’s fees and

costs. She contended that enforcing section 59.1-443.2 against

her for publishing copies of public records lawfully obtained

from a government website violates the First Amendment.

During a hearing on Ostergren’s motion for preliminary

injunctive relief, Virginia’s Attorney General agreed not to

enforce the statute against Ostergren while this action remains

pending.

On August 22, 2008, the district court concluded, based

upon stipulated facts, that "Virginia Code § 59.1-443.2 is

unconstitutional as applied to Ostegren’s [sic] website as it

presently exists." Ostergren, 2008 WL 3895593, at *14. On

June 2, 2009, after further briefing and argument about

injunctive relief, the court entered

a permanent injunction . . . against enforcement of

Va. Code § 59.1-443.2 against any iteration of Ostergren’s website, now or in the future, that simply

republishes publicly obtainable documents containing unredacted SSNs of Virginia legislators, Virginia

Executive Officers or Clerks of Court as part as [sic]

an effort to reform Virginia law and practice respecting the publication of SSNs online.

Ostergren, 643 F. Supp. 2d at 770. The Attorney General

appealed, challenging the district court’s August 22, 2008,

constitutional determination. Ostergren cross-appealed, arguing that the June 2, 2009, award of injunctive relief was too

narrow. We consider the appeal and cross-appeal below.

II.

First we review the district court’s August 22, 2008, constitutional determination. "We review de novo a properly preserved constitutional claim." United States v. Hall, 551 F.3d

10 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 10 of 47
257, 266 (4th Cir. 2009). Virginia argues that SSNs are categorically unprotected speech that may be prohibited entirely.

Alternatively, Virginia argues that the state interest in preserving citizens’ privacy by limiting SSNs’ public disclosure

justifies barring Ostergren’s speech. In other words, Virginia

maintains that the First Amendment does not apply here and

that, even if it does, enforcing section 59.1-443.2 against

Ostergren should survive First Amendment scrutiny. We

address each argument in turn.7

A.

The First Amendment’s protection of "freedom of speech,

or of the press," was designed to allow individuals to criticize

their government without fear. U.S. Const. amend I; see Gentile v. State Bar of Nev., 501 U.S. 1030, 1034 (1991) ("There

7Virginia challenged standing and ripeness before the district court but

not on appeal. We observe that standing and ripeness are established

merely to satisfy ourselves of our jurisdiction. Although no prosecution

occurred, Ostergren has standing because the Attorney General planned to

initiate prosecution and section 59.1-443.2 was recently amended to reach

her speech. See N.C. Right to Life, Inc. v. Bartlett, 168 F.3d 705, 710 (4th

Cir. 1999) ("A non-moribund statute that facially restricts expressive

activity by the class to which the plaintiff belongs presents . . . a credible

threat [of prosecution], and a case or controversy thus exists in the absence

of compelling evidence to the contrary." (internal quotations and alterations omitted)); Mobil Oil Corp. v. Att’y Gen. of Va., 940 F.2d 73, 76 (4th

Cir. 1991) (holding that where a law was recently amended to cover conduct at issue "[i]t would be unreasonable to assume" that the government

made that change "without intending that it be enforced"). Furthermore,

Ostergren’s constitutional claim regarding publishing Virginia land

records appears ripe because "[t]he factual situation is well-developed,"

there are "no material facts that are in dispute," and "[t]he parties argue

only on the application of the law." Ostergren, 2008 WL 3895593, at *5;

see Miller v. Brown, 462 F.3d 312, 319 (4th Cir. 2006) ("balanc[ing] the

fitness of the issues for judicial decision with the hardship to the parties

of withholding court consideration" to assess ripeness and noting that "[a]

case is fit for judicial decision when the issues are purely legal and when

the action in controversy is final and not dependent on future uncertainties" (internal quotations omitted)). 

OSTERGREN v. CUCCINELLI 11

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 11 of 47
is no question that speech critical of the exercise of the State’s

power lies at the very center of the First Amendment."); New

York Times Co. v. Sullivan, 376 U.S. 254, 273 (1964) (calling

liberty to criticize government conduct "the central meaning

of the First Amendment"). This protection also precludes the

government from silencing the expression of unpopular ideas.

See Police Dep’t of Chi. v. Mosley, 408 U.S. 92, 95 (1972)

("[T]he First Amendment means that government has no

power to restrict expression because of its message, its ideas,

its subject matter, or its content."). Accordingly, laws restricting the content of expression normally are invalid under the

First Amendment unless narrowly tailored to promote a compelling state interest. See United States v. Playboy Entm’t

Group, Inc., 529 U.S. 803, 813 (2000) ("If a statute regulates

speech based on its content, it must be narrowly tailored to

promote a compelling Government interest."); see also R.A.V.

v. City of St. Paul, 505 U.S. 377, 382 (1992) ("Content-based

regulations are presumptively invalid.").

The Supreme Court has nevertheless identified certain categories of "unprotected" speech that may be circumscribed

entirely. Fighting words, obscenity, incitement of illegal

activity, and child pornography are examples. See Chaplinsky

v. New Hampshire, 315 U.S. 568, 571-72 (1942); Roth v.

United States, 354 U.S. 476, 485 (1957); Brandenburg v.

Ohio, 395 U.S. 444, 447-48 (1969); New York v. Ferber, 458

U.S. 747, 764 (1982); see also Schenck v. United States, 249

U.S. 47, 52 (1919) ("The most stringent protection of free

speech would not protect a man in falsely shouting fire in a

theatre and causing a panic."). The Court has said that these

categories of unprotected speech "are no essential part of any

exposition of ideas, and are of such slight social value as a

step to truth that any benefit that may be derived from them

is clearly outweighed by the social interest in order and

morality." Chaplinsky, 315 U.S. at 572.

Virginia argues that the unredacted SSNs on Ostergren’s

website should not be protected under the First Amendment

12 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 12 of 47
because they facilitate identity theft and are no essential part

of any exposition of ideas. See Eugene Volokh, CrimeFacilitating Speech, 57 Stan. L. Rev. 1095, 1146-47 (2005)

(arguing that SSNs and computer passwords are "categories

of speech that are likely to have virtually no noncriminal

uses" and that "[r]estricting the publication of full social

security numbers or passwords . . . will not materially interfere with valuable speech"). Although these observations

might be true under certain circumstances, we cannot agree

with Virginia’s argument here. The unredacted SSNs on Virginia land records that Ostergren has posted online are integral to her message. Indeed, they are her message. Displaying

them proves Virginia’s failure to safeguard private information and powerfully demonstrates why Virginia citizens

should be concerned.8 Cf. United States v. Hubbell, 530 U.S.

8Virginia argues that Ostergren could redact several digits from each

SSN and still express her message. But the First Amendment protects

Ostergren’s freedom to decide how her message should be communicated.

Although wearing a jacket bearing the words "Boo for the Draft" rather

than "Fuck the Draft" may convey the same political critique, the Supreme

Court found that the government cannot prohibit the more offensive version. Cohen v. California, 403 U.S. 15, 24 (1971) (noting "the usual rule

that governmental bodies may not prescribe the form or content of individual expression"). The Court explained: 

[M]uch linguistic expression serves a dual communicative function: it conveys not only ideas capable of relatively precise,

detached explication, but otherwise inexpressible emotions as

well. In fact, words are often chosen as much for their emotive

as their cognitive force. We cannot sanction the view that the

Constitution, while solicitous of the cognitive content of individual speech has little or no regard for that emotive function which

practically speaking, may often be the more important element of

the overall message sought to be communicated. 

Id. at 26. Furthermore, partial redaction would diminish the documents’

shock value and make Ostergren less credible because people could not

tell whether she or Virginia did the partial redaction. See Ross v. Midwest

Commc’ns, Inc., 870 F.2d 271, 274 (5th Cir. 1989) (holding that disclosing a rape victim’s name in a documentary about the convicted man’s

potential innocence was "of unique importance to the credibility and perOSTERGREN v. CUCCINELLI 13

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 13 of 47
27, 36-37 (2000) (noting that "the act of producing documents

in response to a subpoena . . . may implicitly communicate

statements of fact" because "[b]y producing documents . . .

the witness would admit that the papers existed, were in his

possession or control, and were authentic" (internal quotations

omitted)).

We find particularly significant just how Ostergren communicates SSNs. She does not simply list them beside people’s names but rather provides copies of entire documents

maintained by government officials. Given her criticism about

how public records are managed, we cannot see how drawing

attention to the problem by displaying those very documents

could be considered unprotected speech. Indeed, the Supreme

Court has deemed such speech particularly valuable within

our society:

Public records by their very nature are of interest to

those concerned with the administration of government, and a public benefit is performed by the

reporting of the true contents of the records by the

media. The freedom of the press to publish that

information appears to us to be of critical importance

to our type of government in which the citizenry is

the final judge of the proper conduct of public business.

Cox Broad. Corp. v. Cohn, 420 U.S. 469, 495 (1975). Thus,

although we do not foreclose the possibility that communicatsuasive force of the story"); Gilbert v. Med. Econ. Co., 665 F.2d 305, 308

(10th Cir. 1981) (regarding an article about medical malpractice that disclosed a doctor’s name and photograph, finding that "these truthful representations . . . strengthen the impact and credibility of the article" because

"[t]hey obviate any impression that the problems raised in the article are

remote or hypothetical, thus providing an aura of immediacy and even

urgency that might not exist had plaintiff’s name and photograph been

suppressed"). 

14 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 14 of 47
ing SSNs might be found unprotected in other situations, we

conclude, on these facts, that the First Amendment does reach

Ostergren’s publication of Virginia land records containing

unredacted SSNs.9

B.

We next consider whether enforcing section 59.1-443.2

against Ostergren for posting online Virginia land records

containing unredacted SSNs survives First Amendment scrutiny. Although Ostergren’s political speech criticizing Virginia "lies at the very center of the First Amendment,"

Gentile, 501 U.S. at 1034, publishing SSNs online undermines individual privacy. Freedom of speech must therefore

be weighed against the "right of privacy" which the Supreme

Court has also recognized. See Cox Broad., 420 U.S. at 488

(recognizing "the so-called right of privacy"). The Court tried

to strike that balance in Cox Broadcasting and subsequent

cases involving restrictions on truthful publication of private

information. Because we must decide where this case fits

within that balance, we begin our analysis by reviewing those

decisions.

In Cox Broadcasting, the Supreme Court ruled that the First

Amendment prohibits a lawsuit against a television station for

broadcasting a rape victim’s name when the station learned

9After this appeal was briefed and orally argued, the Supreme Court

clarified that Chaplinksy does not provide a sufficient test for identifying

categories of unprotected speech because such categories derive from history and tradition. See United States v. Stevens, 130 S.Ct. 1577, 1586

(2010) (declining to recognize a new category of unprotected speech for

depictions of animal cruelty). The Court also disavowed "a freewheeling

authority to declare new categories of speech outside the scope of the First

Amendment," admitting only that "[m]aybe there are some categories of

speech that have been historically unprotected, but have not yet been specifically identified or discussed as such in our case law." Id. Because we

already find Virginia’s argument unpersuasive, we need not also conduct

the historical analysis that Stevens would require. 

OSTERGREN v. CUCCINELLI 15

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 15 of 47
her identity from a publicly available court record. The issue

arose in the context of six youths being indicted for rape and

murder. Although their case garnered substantial press attention, the victim’s identity was not disclosed because Georgia

law prohibited "publish[ing] or broadcast[ing] the name or

identity of a rape victim." Id. at 472. During trial, the clerk of

court showed a reporter the indictments even though they

clearly stated the victim’s full name. The reporter later

explained, "[N]o attempt was made by the clerk or anyone

else to withhold the name and identity of the victim from me

or from anyone else and the said indictments apparently were

available for public inspection upon request." Id. at 472 n.3.

When the television station employing the reporter later

broadcast the victim’s name, her father sued for money damages. The Georgia Supreme Court held that his "complaint

stated a cause of action ‘for the invasion of the . . . right of

privacy, or for the tort of public disclosure,’" and rejected the

station’s First Amendment defense. Id. at 474 (quoting Cox

Broad. Corp. v. Cohn, 200 S.E.2d 127, 130 (Ga. 1973)).

The Supreme Court reversed. Although recognizing "a

strong tide running in favor of the so-called right of privacy,"

id. at 488, the Court reasoned that "the interests in privacy

fade when the information involved already appears on the

public record," id. at 494-95. The Court observed that "[b]y

placing the information in the public domain on official court

records, the State must be presumed to have concluded that

the public interest was thereby being served." Id. at 495. The

Court also discussed the importance of truthful reporting

about public records and expressed reluctance to create a doctrine that "would invite timidity and self-censorship and very

likely lead to the suppression of many items that . . . should

be made available to the public." Id. at 496. The Court concluded:

At the very least, the First and Fourteenth Amendments will not allow exposing the press to liability

for truthfully publishing information released to the

16 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 16 of 47
public in official court records. . . . Once true information is disclosed in public court documents open

to public inspection, the press cannot be sanctioned

for publishing it.

Id. The Court explained that "[i]f there are privacy interests

to be protected in judicial proceedings, the States must

respond by means which avoid public documentation or other

exposure of private information." Id.

Although Cox Broadcasting avoided deciding whether

truthful publication may ever be punished, subsequent cases

helped to clarify the relevant inquiry. In Oklahoma Publishing

Co. v. District Court, 430 U.S. 308 (1977), the Supreme Court

held that a trial court could not bar newspapers from publishing a juvenile offender’s name learned during a court proceeding open to the public. The Court explained, "‘Once a

public hearing ha[s] been held, what transpired there [can]not

be subject to prior restraint.’" Id. at 311 (quoting Nebraska

Press Ass’n v. Stuart, 427 U.S. 539, 568 (1976)). In Landmark Communications, Inc. v. Virginia, 435 U.S. 829 (1978),

the Court held that Virginia could not punish a newspaper for

publishing correct information that had been leaked about

confidential proceedings by the Virginia Judicial Inquiry and

Review Commission. The Court reasoned that Virginia’s

interests in preserving respect for courts and protecting individual judges’ reputations did not justify prohibiting speech

that "clearly served those interests in public scrutiny and discussion of governmental affairs which the First Amendment

was adopted to protect." Id. at 839.

The Supreme Court later articulated a constitutional standard based upon these decisions. In Smith v. Daily Mail Publishing Co., 443 U.S. 97 (1979), the Court observed that Cox

Broadcasting, Oklahoma Publishing, and Landmark Communications "all suggest strongly that if a newspaper lawfully

obtains truthful information about a matter of public significance then state officials may not constitutionally punish pubOSTERGREN v. CUCCINELLI 17

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 17 of 47
lication of the information, absent a need to further a state

interest of the highest order." Daily Mail, 443 U.S. at 103.

This case involved two newspapers convicted under a West

Virginia statute that barred publishing the names of juvenile

offenders without court approval. Reporters had learned certain juvenile offenders’ names by questioning witnesses,

police officers, and the prosecutor. The Supreme Court invalidated the convictions because West Virginia’s interest in protecting juvenile offenders’ anonymity was insufficiently

important and "there [was] no evidence to demonstrate that

the imposition of criminal penalties [was] necessary to protect

the confidentiality of juvenile proceedings." Id. at 105.

After this flurry of decisions, the Supreme Court applied

the Daily Mail standard roughly a decade later in another case

about a rape victim. In The Florida Star v. B.J.F., 491 U.S.

524 (1989), the appellee B.J.F. reported to local police that

she had been robbed and sexually assaulted. Despite its internal policy against revealing names of rape victims, the police

department inadvertently placed a police report containing

B.J.F.’s name in its press room. The department did not

restrict access to the press room or to reports made available

therein. After a reporter copied the police report verbatim, an

area newspaper published an article containing B.J.F.’s full

name. She sued for money damages, claiming the newspaper

had been per se negligent because Florida law prohibited

printing, publishing, or broadcasting names of rape victims in

any instrument of mass communication. During trial, B.J.F.

testified that publicity of her rape made her suffer extreme

embarrassment, receive additional threats of rape, change her

phone number and residence, seek police protection, and

obtain medical health counseling. The jury awarded damages

and a Florida appellate court affirmed, rejecting the newspaper’s First Amendment defense.

The Supreme Court reversed. Before applying the Daily

Mail standard regarding truthful publication of lawfully

obtained information, the Court noted three underlying con18 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 18 of 47
siderations that justified this analytical approach. First, that

the standard covers only lawfully obtained information means

that the government retains ample means of protecting interests that might be threatened by publication. This consideration has additional implications when the government itself

initially holds the information:

To the extent sensitive information is in the government’s custody, it has even greater power to forestall

or mitigate the injury caused by its release. The government may classify certain information, establish

and enforce procedures ensuring its redacted release,

and extend a damages remedy against the government or its officials where the government’s mishandling of sensitive information leads to its

dissemination. Where information is entrusted to the

government, a less drastic means than punishing

truthful publication almost always exists for guarding against the dissemination of private facts.

Id. at 534. Second, "punishing the press for its dissemination

of information which is already publicly available is relatively

unlikely to advance the interests in the service of which the

State seeks to act." Id. at 535. The Court added that "where

the government has made certain information publicly available, it is highly anomalous to sanction persons other than the

source of its release." Id. Third, "‘timidity and selfcensorship’ . . . may result from allowing the media to be punished for publishing certain truthful information." Id. (quoting

Cox Broad., 420 U.S. at 496). The Court explained that,

where the government discloses private information, not protecting its publication "would force upon the media the onerous obligation of sifting through government press releases,

reports, and pronouncements to prune out material arguably

unlawful for publication . . . even where the newspaper’s sole

object was to reproduce, with no substantial change, the government’s rendition of the event in question." Id. at 536. Having reiterated these considerations, the Court endorsed the

OSTERGREN v. CUCCINELLI 19

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 19 of 47
Daily Mail standard: "We hold . . . that where a newspaper

publishes truthful information which it has lawfully obtained,

punishment may lawfully be imposed, if at all, only when narrowly tailored to a state interest of the highest order." Id. at

541.

Applying this standard, the Supreme Court found that the

newspaper article about B.J.F. truthfully published lawfully

obtained information about a matter of public significance.

The Court also found that punishing the newspaper was not

narrowly tailored to Florida’s interest in preserving rape victims’ privacy because the police department itself could have

initially withheld the sensitive information.10 That the department’s disclosure was actually inadvertent was immaterial.

See id. at 538 ("B.J.F.’s identity would never have come to

light were it not for the erroneous, if inadvertent, inclusion by

the Department of her full name in an incident report made

available in a pressroom open to the public."). The Court concluded: "Where, as here, the government has failed to police

itself in disseminating information, it is clear under Cox

Broadcasting, Oklahoma Publishing, and Landmark Communications that the imposition of damages against the press for

its subsequent publication can hardly be said to be a narrowly

tailored means of safeguarding anonymity." Id.

Notably, Cox Broadcasting and its progeny avoided decid10Notably, the Court expressly avoided deciding whether Florida’s

asserted interest constituted "a state interest of the highest order"—

resolving the case instead solely on narrow-tailoring grounds. Daily Mail,

443 U.S. at 103; see Florida Star, 491 U.S. at 537 ("At a time in which

we are daily reminded of the tragic reality of rape, it is undeniable that

these are highly significant interests, a fact underscored by the Florida

Legislature’s explicit attempt to protect these interests by enacting a criminal statute prohibiting much dissemination of victim identities. We accordingly do not rule out the possibility that, in a proper case, imposing civil

sanctions for publication of the name of a rape victim might be so overwhelmingly necessary to advance these interests as to satisfy the Daily

Mail standard."). 

20 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 20 of 47
ing the ultimate question of whether truthful publication could

ever be prohibited. Each decision resolved this ongoing conflict between privacy and the First Amendment "only as it

arose in a discrete factual context." Florida Star, 491 U.S. at

530. The Florida Star Court noted that "the future may bring

scenarios which prudence counsels our not resolving anticipatorily." Id. at 532 (citing Near v. Minnesota ex rel. Olson, 283

U.S. 697, 716 (1931) (hypothesizing "publication of the sailing dates of transports or the number and location of

troops")).

Those decisions nonetheless make clear that Ostergren’s

constitutional challenge must be evaluated using the Daily

Mail standard.11 Accordingly, Virginia may enforce section

59.1-443.2 against Ostergren for publishing lawfully

obtained, truthful information about a matter of public significance "only when narrowly tailored to a state interest of the

highest order." Id. at 541. Virginia concedes that Ostergren

lawfully obtained and truthfully published the Virginia land

records that she posted online. Moreover, this information

plainly concerns "a matter of public significance," Daily Mail,

443 U.S. at 103, because displaying the contents of public

records and criticizing Virginia’s release of private information convey political messages that concern the public, see

Cox Broad., 420 U.S. at 495 ("Public records by their very

nature are of interest to those concerned with the administration of government, and a public benefit is performed by the

reporting of the true contents of the records by the media.");

Landmark Commc’ns, 435 U.S. at 839 (deeming the operation

of government affairs "a matter of public interest"). There11Counsel for the Attorney General conceded during oral argument that,

under this standard, Ostergren’s advocacy website cannot be distinguished

from a television station or newspaper. See Sheehan v. Gregoire, 272 F.

Supp. 2d 1135, 1145 (W.D. Wash. 2003) (considering a website about

police accountability "analytically indistinguishable from a newspaper"

where the website "communicates truthful lawfully-obtained, publiclyavailable personal identifying information with respect to a matter of public significance"). 

OSTERGREN v. CUCCINELLI 21

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 21 of 47
fore, the only remaining issues are (1) whether Virginia has

asserted a state interest of the highest order and (2) whether

enforcing section 59.1-443.2 against Ostergren would be narrowly tailored to that interest. We address each in turn.

1.

Virginia asserts that its interest in protecting individual privacy by limiting SSNs’ public disclosure constitutes "a state

interest of the highest order." Daily Mail, 443 U.S. at 103.

Although noting that "it should not be difficult for a court to

conclude that the protection of SSNs from public disclosure

should qualify as a State interest of the highest order," the district court reached the opposite conclusion upon reasoning

that Virginia’s conduct had been inconsistent with that interest. Ostergren, 2008 WL 3895593, at *10; see id. ("[T]he

State’s own conduct in making those SSNs publicly available

through unredacted release on the Internet significantly undercuts the assertion . . . that the State actually regards protection

of SSNs as an interest of the highest order."). Before discussing this issue, we address the proper analytical framework for

determining what constitutes a state interest of the highest

order.

a.

In assessing Virginia’s asserted interest, the district court

put to one side that interest’s actual importance and instead

considered only whether Virginia itself considered the interest

important—applying a subjective rather than objective standard. The court explained, "[I]t is not the perception of a federal court that defines a State interest of the highest order.

Instead, it is the State’s view and its conduct that, under

accepted First Amendment jurisprudence, must supply the

basis for such a conclusion." Id.; see Ostergren, 643 F. Supp.

2d at 766 ("Whether the State has an interest of the highest

order is answered by examining objectively the means by

which the State treats the information in question."). The

22 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 22 of 47
court later added, "When, as here, a State legislature has

expressed its own view of the priority of a State interest, a

federal court is not permitted to revise that view to save the

statute." Ostergren, 2008 WL 3895593, at *11.

In reaching this conclusion, the district court may have limited its consideration unnecessarily. In deciding what constitutes a state interest of the highest order, courts cannot be

bound by "the State’s view and its conduct." Id. at *10. For

example, although a state government might demonstrate a

fervent, consistently applied policy of punishing people for

not cleaning up after their dogs, we would not therefore be

compelled to consider this a state interest of the highest order.

Conversely, although a state government might practice racial

discrimination for decades—and many have—we would not

therefore be barred from considering racial equality a state

interest of the highest order. See Regents of Univ. of Ca. v.

Bakke, 438 U.S. 265, 396 (1978) (Marshall, J., concurring)

("In light of the sorry history of discrimination and its devastating impact on the lives of Negroes, bringing the Negro into

the mainstream of American life should be a state interest of

the highest order.").

Furthermore, Supreme Court precedent applying the Daily

Mail standard makes clear that objective criteria can be considered when deciding what constitutes a state interest of the

highest order. In Butterworth v. Smith, 494 U.S. 624 (1990),

Florida maintained that its interest in preserving grand jury

secrecy justified preventing a reporter from publicizing his

own grand jury testimony. Concluding that Florida’s asserted

interest did not constitute a state interest of the highest order,

the Court observed that the Federal Rules of Criminal Procedure contained no such requirement and that "only 14 States

have joined Florida in imposing an obligation of secrecy on

grand jury witnesses." Id. at 635. The Court explained that,

"[w]hile these practices are not conclusive as to the constitutionality of Florida’s rule, they are probative of the weight to

be assigned Florida’s asserted interests and the extent to

OSTERGREN v. CUCCINELLI 23

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 23 of 47
which the prohibition in question is necessary to further

them." Id. (emphasis added).12

Despite concluding that a subjective standard was required,

the district court nevertheless observed that "in concept, Va.

Code § 59.1-443.2 furthers what ought to be, by any objective

measure, a State interest of the highest order." Ostergren, 643

F. Supp. 2d at 769. We turn now to that issue.

b.

We find it helpful to place our inquiry in historical context

by discussing the genesis of modern privacy concerns surrounding SSNs. The Social Security Administration created

SSNs in 1936 merely to track individuals’ earnings and eligibility for Social Security benefits. They soon became used for

other purposes, however, because SSNs provide unique permanent identification for almost every person. Indeed, the

federal government was among the first to avail itself of their

utility. In 1943, President Roosevelt ordered that any federal

agency which "establish[es] a new system of permanent

account numbers pertaining to individual persons" must "utilize exclusively the Social Security Act account numbers."

Exec. Order No. 9397, 8 Fed. Reg. 16,095 (Nov. 30, 1943).

Countless state and federal agencies later adopted the SSN,

particularly during the 1960s. For example, Congress authorized the Internal Revenue Service to begin using the SSN for

taxpayer identification in 1961. See Act of Oct. 5, 1961, Pub.

L. No. 87-397, 75 Stat. 828 (1961). Private organizations,

especially financial institutions, also started using the SSN for

account identification and other purposes. Indeed, the Bank

12We note that, contrary to the concurrence’s suggestion, our First

Amendment analysis does indeed involve "a fact-intensive inquiry into the

state’s view and its actual conduct in furthering its asserted interest." Infra

at 47. We simply conduct that inquiry mainly regarding narrow-tailoring

—the approach Florida Star employed—rather than regarding the state

interest itself—the concurrence’s preferred approach. 

24 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 24 of 47
Records and Foreign Transactions Act, Pub. L. No. 91-508,

84 Stat. 1114 (1970), required banks, savings and loan associations, credit unions, and securities brokers and dealers to collect customers’ SSNs. See, e.g., id. § 101 (requiring "the

maintenance of appropriate types of records by insured banks

of the United States where such records have a high degree

of usefulness in criminal, tax, or regulatory investigations or

proceedings").

Public concern about information privacy, however, soon

increased. In 1973, the Department of Health, Education, and

Welfare published an influential report warning about "an

increasing tendency for the Social Security number to be used

as if it were an SUI [standard universal identifier]." U.S.

Department of Health, Education, and Welfare, Report of the

Secretary’s Advisory Committee on Automated Personal Data

Systems: Records, Computers, and the Rights of Citizens

xxxii (1973). Congress responded by enacting the Privacy Act

of 1974, 5 U.S.C. § 552a, which prohibits government agencies from denying rights, privileges, or benefits because a person withholds his SSN. By enacting this statute, "Congress

sought to curtail the expanding use of social security numbers

by federal and local agencies and, by so doing, to eliminate

the threat to individual privacy and confidentiality of information posed by common numerical identifiers." Doyle v. Wilson, 529 F. Supp. 1343, 1348 (D. Del. 1982). The related

Senate Report stated that widespread usage of SSNs was "one

of the most serious manifestations of privacy concerns in the

Nation." S. Rep. No. 93-1183 (1974), as reprinted in 1974

U.S.C.C.A.N. 6916, 6943.

Since then, usage of SSNs by federal and local agencies,

financial institutions, and other organizations has become

nearly ubiquitous. Beyond simply matching records with

accounts, these organizations also frequently use SSNs for

account authentication. This means that the SSN provides a

password that lets one modify account information. By consequence, the SSN has become a crucial piece of information

OSTERGREN v. CUCCINELLI 25

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 25 of 47
allowing the creation or modification of myriad personal

accounts. See U.S. Government Accountability Office, GAO

No. 09-759T, Identity Theft: Governments Have Acted to

Protect Personally Identifiable Information, but Vulnerabilities Remain 8 (calling the SSN "a vital piece of information

needed to function in American society" and noting that "U.S.

citizens generally need an SSN to pay taxes, obtain a driver’s

license, or open a bank account, among other things"). Unfortunately, for that reason, SSNs can easily be used to commit

identity theft—that is, tendering another’s identifying information to carry out financial fraud or other criminal activity.

See Jonathan J. Darrow & Stephen D. Lichtenstein, "Do You

Really Need My Social Security Number?" Data Collection

Practices in the Digital Age, 10 N.C. J. L. & Tech. 1, 4-5

(2008) ("Reflecting the unfortunate reality that a single number can provide access to multiple accounts, commentators

have lamented that the social security number has become a

‘skeleton key’ for identity theft criminals."). One therefore

has a considerable privacy interest in keeping his SSN confidential.

We previously considered this privacy interest in Greidinger v. Davis, 988 F.2d 1344 (4th Cir. 1993). Invalidating a

statute that required people to provide their SSN before they

could vote and then publicly disclosed that confidential information, we observed:

Since the passage of the Privacy Act, an individual’s

concern over his SSN’s confidentiality and misuse

has become significantly more compelling. For

example, armed with one’s SSN, an unscrupulous

individual could obtain a person’s welfare benefits

or Social Security benefits, order new checks at a

new address on that person’s checking account,

obtain credit cards, or even obtain the person’s paycheck.

Id. at 1353; see also City of Kirkland v. Sheehan, No. 01-2-

09513-7, 2001 WL 1751590, at *6 (Wash. Sup. Ct. May 10,

26 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 26 of 47
2001) ("[A]ccess to an SSN allows a person, agency or company to more efficiently and effectively search for and seize

information and assets of another, a power originally available only to the government and one which was subject to

direct Constitutional restraint."). We added that "the harm that

can be inflicted from the disclosure of a SSN to an unscrupulous individual is alarming and potentially financially ruinous." Greidinger, 988 F.2d at 1354. On average, victims of

identity theft lose about $17,000 and must spend over $1,000

and 600 hours of personal time cleaning up their credit

reports. See Danielle Keats Citron, Reservoirs of Danger: The

Evolution of Public and Private Law at the Dawn of the Information Age, 80 S. Cal. L. Rev. 241, 253 (2007).

Reflecting these concerns, Congress and all 50 States have

passed laws regulating SSN collection and disclosure. See

Andrew Serwin, Information Security and Privacy §§ 22-23

(2009); see, e.g., 18 U.S.C. § 2721 (restricting release of

SSNs from motor vehicle records). Some States also recognize a constitutional right barring the government from disclosing SSNs without consent. See, e.g., State ex rel. Beacon

Journal Publ’g Co. v. City of Akron, 640 N.E.2d 164, 169

(Ohio 1994). Although not dispositive, these practices indicate a broad consensus that SSNs’ public disclosure should be

strictly curtailed.

Given the serious privacy concerns and potential harm

stemming from SSN dissemination, Virginia’s asserted interest in protecting individual privacy by limiting SSNs’ public

disclosure may certainly constitute "a state interest of the

highest order." Daily Mail, 443 U.S. at 103. We need not ultimately decide that question, however, because our holding

below regarding narrow-tailoring suffices to resolve the constitutional challenge. We discussed this issue merely to provide guidance to the district court fashioning injunctive relief

on remand. See Elm Grove Coal Co. v. Dir., O.W.C.P., 480

F.3d 278, 299 n.20 (4th Cir. 2007) ("We choose to address

this discovery issue because it is likely to arise on remand.");

OSTERGREN v. CUCCINELLI 27

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 27 of 47
Charbonnages de France v. Smith, 597 F.2d 406, 417 (4th

Cir. 1979) ("[I]t may be appropriate to address a few points

presented on this appeal that, although not dispositive here,

could arise as important issues on remand.").

2.

We next consider whether enforcing section 59.1-443.2

against Ostergren would be narrowly tailored to Virginia’s

asserted interest in preserving individual privacy by protecting SSNs from public disclosure. Supreme Court precedent

imposes a stringent standard regarding narrow-tailoring. Cox

Broadcasting and its progeny indicate that punishing truthful

publication of private information will almost never be narrowly tailored to safeguard privacy when the government

itself released that information to the press. See Cox Broad.,

420 U.S. at 496 ("Once true information is disclosed in public

court documents open to public inspection, the press cannot

be sanctioned for publishing it."); Florida Star, 491 U.S. at

534 ("Where information is entrusted to the government, a

less drastic means than punishing truthful publication almost

always exists for guarding against the dissemination of private

facts."). Even where disclosure to the press was accidental,

Florida Star indicates that the press cannot be prevented from

publishing the private information. In that case, B.J.F.’s identity was disclosed to the press accidentally despite the police

department’s policy against revealing rape victims’ names.

The Supreme Court nonetheless concluded that "[w]here . . .

the government has failed to police itself in disseminating

information, it is clear under Cox Broadcasting, Oklahoma

Publishing, and Landmark Communications that the imposition of damages against the press for its subsequent publication can hardly be said to be a narrowly tailored means of

safeguarding anonymity." Florida Star, 491 U.S. at 538.

In both Cox Broadcasting and Florida Star, the government disclosed private information to the press and thereafter

sought to prevent media outlets from truthfully publishing that

28 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 28 of 47
information. This case appears similar in that Virginia likewise disclosed public records containing private information

to Ostergren and now seeks to prevent her from publishing

them online. Because Virginia "failed to police itself in disseminating information," Cox Broadcasting and Florida Star

suggest that preventing Ostergren from publishing those

records could almost never be narrowly tailored. Id. According to their stringent standard, Ostergren could never be prohibited from publicizing SSN-containing Virginia land

records she already lawfully obtained (including those posted

on her website),13 and Virginia would need to redact all original land records available from courthouses (not merely digital copies available through secure remote access) before

Ostergren could be prohibited from publishing SSNcontaining Virginia land records she might later obtain.14

13Whereas Ostergren posted online only about 30 records from various

States, her testimony indicates she obtained thousands of other public

records containing unredacted SSNs. 

14The district court was justifiably concerned about reaching this

extreme conclusion. When Ostergren maintained that under Cox Broadcasting she could continue publicizing additional SSNs until Virginia finished redacting all original land records and digital copies, the court

responded, 

[I]f I understand it correctly, under the relief you want, she can

go to the record, she can take thousands or hundreds of thousands, whatever is there, and publish them, and if she thinks that

20 names have shock value, what do you think her attitude might

be toward publishing thousands or hundreds of thousands? 

J.A. 192. Ostergren replied, 

It is relief I want, and I wish I could tell you a principled way to

make it narrower, but I can’t think of one, and I think that the

Cox court struck the balance between privacy and free speech in

the context of public records, and the way that they struck the

balance was to hold that when the Government makes something

available, they are responsible for controlling the dissemination

of information. They can’t make someone else do it. 

J.A. 193. The court responded again, 

OSTERGREN v. CUCCINELLI 29

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 29 of 47
Despite apparent similarities, however, the instant case also

differs from Cox Broadcasting and Florida Star in two critical respects that warrant consideration because they impact

our narrow-tailoring analysis. First, this case implicates a different conception of privacy—one predicated upon control of

personal information rather than secrecy. Second, Virginia’s

knowledge about and practical control over the private information here differs significantly from the situations involved

in Cox Broadcasting and Florida Star. Given these differences, this case requires a more nuanced analysis than that

suggested above.15 We consider each difference separately

below and then discuss the proper narrow-tailoring analysis.

a.

Cox Broadcasting involved Georgia’s tort of public disclosure of private information, in which "the plaintiff claims the

right to be free from unwanted publicity about his private

affairs, which, although wholly true, would be offensive to a

person of ordinary sensibilities." Cox Broad., 420 U.S. at 489.

[W]hat if accidentally the Social Security Administration, somebody went in and released all the Social Security numbers in the

country? Are you saying that Congress couldn’t come in with a

statute and say, you can’t replicate these things? What they

would do is try to take the system that had gone wrong, fix what

they can fix, knowing that there are people who have already gotten into the database that spilled accidentally, but knowing the

damage is somewhat limited and saying we are going to stop it

right here, and the way we’re going to stop it is making it unlawful for you, anybody, to take this information that’s been accidentally spilled and use it. 

J.A. 193. We share the district court’s concern and consider below how

the instant case may be distinguished from Cox Broadcasting and Florida

Star regarding narrow-tailoring. 

15We are distinguishing Cox Broadcasting and Florida Star merely with

regard to the proper narrow-tailoring analysis, not with regard to whether

the Daily Mail standard applies. 

30 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 30 of 47
This cause of action "define[s] and protect[s] an area of privacy free from unwanted publicity in the press." Id. at 491.

"[T]he gravamen of the claimed injury is the publication of

information, whether true or not, the dissemination of which

is embarrassing or otherwise painful to an individual." Id. at

489. Florida Star involved the same privacy interest. B.J.F.

suffered emotional distress because the fact that she had been

raped, information she had hoped to keep secret, had been

widely publicized. See Florida Star, 491 U.S. at 528 ("B.J.F.

testified that she had suffered emotional distress from the

publication of her name.").

Cox Broadcasting and Florida Star thus involved a particular conception of privacy whereby "private" matters are those

one would prefer to keep hidden from other people because

disclosure would be embarrassing or compromising.16 See

Whalen v. Roe, 429 U.S. 589, 598-99 (1977) (noting cases

protecting "privacy" that involved "the individual interest in

avoiding disclosure of personal matters"). Under this conception, one’s privacy interest hinges upon whether information

has been kept secret, and protecting privacy involves ensuring

that people can keep personal matters secret or hidden from

public scrutiny. See Daniel J. Solove, Conceptualizing

16The Seventh Circuit has explored the human desire for secrecy about

certain personal matters: 

Even people who have nothing rationally to be ashamed of can

be mortified by the publication of intimate details of their life.

Most people in no wise deformed or disfigured would nevertheless be deeply upset if nude photographs of themselves were published in a newspaper or a book. They feel the same way about

photographs of their sexual activities, however "normal," or

about a narrative of those activities, or about having their medical

records publicized. Although it is well known that every human

being defecates, no adult human being in our society wants a

newspaper to show a picture of him defecating. The desire for

privacy illustrated by these examples is a mysterious but deep

fact about human personality. 

Haynes v. Alfred A. Knopf, Inc., 8 F.3d 1222, 1229 (7th Cir. 1993). 

OSTERGREN v. CUCCINELLI 31

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 31 of 47
Privacy, 90 Cal. L. Rev. 1087, 1105 (2002) ("One of the most

common understandings of privacy is that it constitutes the

secrecy of certain matters. Under this view, privacy is violated by the public disclosure of previously concealed information."). Because this conception of privacy presupposes

secrecy, personal matters that have been publicly disclosed

can no longer be considered private. See id. at 1107 ("[T]he

view of privacy as secrecy often leads to the conclusion that

once a fact is divulged in public, no matter how limited or

narrow the disclosure, it can no longer remain private."). For

example, the Supreme Court embraced this reasoning in

Fourth Amendment cases indicating that one’s "reasonable

expectation of privacy" cannot encompass anything exposed

to the public or third parties. See California v. Greenwood,

486 U.S. 35, 40 (1988) (finding no reasonable expectation of

privacy in garbage because "plastic garbage bags left on or at

the side of a public street are readily accessible to animals,

children, scavengers, snoops, and other members of the public"); United States v. Miller, 425 U.S. 435, 442 (1976) (finding no reasonable expectation of privacy in personal financial

documents held by banks because "the documents obtained,

including financial statements and deposit slips, contain only

information voluntarily conveyed to the banks and exposed to

their employees in the ordinary course of business").

The instant case involves a different conception of privacy

not predicated upon secrecy. Cox Broadcasting and Florida

Star addressed the privacy concern that disclosing certain personal matters (information one had hoped to keep secret)

might cause embarrassment or reputational damage. But people do not feel embarrassed when asked to provide their SSN;

nor do they fear that their reputation will suffer when others

find out that number. People worry only about how their SSN

will be used—more specifically, about whether some unscrupulous person will steal their identity. The Fifth Circuit made

this same observation:

[A]n individual’s informational privacy interest in

his or her SSN is substantial. The privacy concern at

32 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 32 of 47
issue is not, of course, that an individual will be

embarrassed or compromised by the particular SSN

that she has been assigned. Rather, the concern is

that the simultaneous disclosure of an individual’s

name and confidential SSN exposes that individual

to a heightened risk of identity theft and other forms

of fraud.

Sherman v. U.S. Dep’t of the Army, 244 F.3d 357, 365 (5th

Cir. 2001); see also Nat’l Cable & Telecomms. Ass’n v. FCC,

555 F.3d 996, 1001 (D.C. Cir. 2009) ("[W]e do not agree that

the interest in protecting customer privacy is confined to preventing embarrassment . . . ."). Accordingly, this case

involves a particular conception of privacy whereby one does

not mind publicity itself but nonetheless would prefer to control how personal information will be used or handled. Under

this conception, privacy does not hinge upon secrecy but

instead involves "the individual’s control of information concerning his or her person." Nat’l Cable & Telecomms. Ass’n,

555 F.3d at 1001 (emphasis added and internal quotations

omitted).

This difference affects our narrow-tailoring analysis

because Cox Broadcasting’s holding stemmed from the conception of privacy predicated upon secrecy. The Supreme

Court noted that Georgia’s tort of public disclosure of private

information provided no remedy where the disclosed information was already publicly available. See Restatement (Second)

of Torts § 652D cmt. b ("There is no liability when the defendant merely gives further publicity to information about the

plaintiff that is already public."). The Court thus concluded

that "the interests in privacy fade when the information

involved already appears on the public record." Cox Broad.,

420 U.S. at 494-95. This makes sense where privacy hinges

upon secrecy because publicly accessible information could

not be considered private anymore and any emotional distress

resulting from disclosure would likely have already occurred.17

17The emotional distress that a rape victim experiences because of public disclosure of her identity occurs the moment she discovers that others

OSTERGREN v. CUCCINELLI 33

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 33 of 47
But the reasoning makes noticeably less sense where privacy

hinges upon control. Whereas emotional distress resulting

from disclosure occurs only once when one discovers the publicity, publicly accessible SSNs could be misused repeatedly

over time until they become less easily accessed. Furthermore, because SSNs are more easily accessed online than in

bound original land records, people worried about preventing

identity theft (rather than embarrassment) would indeed have

a considerable privacy interest against "merely giv[ing] further publicity." Restatement (Second) of Torts § 652D cmt. b.

The Supreme Court employed similar reasoning in United

States Department of Justice v. Reporters Committee for

Freedom of the Press, 489 U.S. 749 (1989). In that case,

reporters filed requests under the Freedom of Information

Act, 5 U.S.C. § 552, for criminal identification records,

known as "rap sheets," that the Federal Bureau of Investigation had created by collecting biographical data and criminal

history found in different state and local public records. The

government refused to disclose these rap sheets based on the

statutory exception for "records or information compiled for

law enforcement purposes . . . the production of [which] . . .

could reasonably be expected to constitute an unwarranted

invasion of personal privacy." 5 U.S.C. § 552(b)(7)(C). Arguing that this exception was inapplicable, the reporters reasoned that "[b]ecause events summarized in a rap sheet have

been previously disclosed to the public . . . [the] privacy interest in avoiding disclosure of a federal compilation of these

events approaches zero." Reporters Comm., 489 U.S. at 762-

63. The Supreme Court expressly rejected this "cramped

notion of personal privacy" and expounded as follows:

[T]he common law and the literal understandings of

privacy encompass the individual’s control of inforknow her secret. The harm feared by someone whose SSN has been disclosed, however, does not occur upon disclosure but rather upon the misuse of that information. 

34 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 34 of 47
mation concerning his or her person. In an organized

society, there are few facts that are not at one time

or another divulged to another. Thus the extent of the

protection accorded a privacy right at common law

rested in part on the degree of dissemination of the

allegedly private fact and the extent to which the

passage of time rendered it private.

Id. at 763. The Court then observed that "there is a vast difference between the public records that might be found after a

diligent search of courthouse files, county archives, and local

police stations throughout the country and a computerized

summary located in a single clearinghouse of information."

Id. at 764. In another case, the Court reiterated what this analysis makes clear: "An individual’s interest in controlling the

dissemination of information regarding personal matters does

not dissolve simply because that information may be available

to the public in some form." U.S. Dep’t of Def. v. Fed. Labor

Relations Auth., 510 U.S. 487, 500 (1994).

b.

The instant case also differs in another respect from Cox

Broadcasting and Florida Star regarding narrow-tailoring.

There, the Supreme Court held that punishing truthful publication of private information was not narrowly tailored

because the government could have initially refused to disclose that information to the press. This rationale assumes that

the government could have easily prevented initial disclosure.

See Florida Star, 491 U.S. at 538 ("[W]here the government

itself provides information to the media, it is most appropriate

to assume that the government had, but failed to utilize, far

more limited means of guarding against dissemination than

the extreme step of punishing truthful speech."). That assumption does not fully apply in this case.

Both Cox Broadcasting and Florida Star involved situations in which a government employee created the document

OSTERGREN v. CUCCINELLI 35

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 35 of 47
containing sensitive information that was later disclosed.

Thus, initial disclosure could have been avoided by not

recording the information or sealing the document from the

outset. In Florida Star, the Court recognized that the police

officer who prepared the incident report could have simply

omitted B.J.F.’s name. See id. Likewise, in Cox Broadcasting,

the government could have omitted the victim’s name from its

indictments or placed them under seal. See Cox Broad., 420

U.S. at 496 ("If there are privacy interests to be protected in

judicial proceedings, the States must respond by means which

avoid public documentation or other exposure of private

information.").

This appeal presents a quite different situation. For the

most part, private attorneys (rather than the government) were

responsible for creating real estate documents containing people’s SSNs and then submitting those documents for recording in Virginia. The clerk of court could have inspected these

documents before recording them and redacted any SSNs, but

even this solution differs from Cox Broadcasting and Florida

Star, where the government did not have to search for the sensitive information needing redaction. Given that every year

hundreds of thousands of documents are submitted for recording in Virginia, inspecting each one would have been no small

undertaking. Most importantly, however, attorneys began filing documents containing SSNs long before Virginia could

have been expected to comprehend the current threat of identity theft. For this reason, we find inapplicable Cox Broadcasting’s observation that "[b]y placing the information in the

public domain on official court records, the State must be presumed to have concluded that the public interest was thereby

being served." 420 U.S. at 495.

Virginia currently prohibits attorneys from submitting real

estate documents for recording that contain unredacted SSNs.

See Va. Code § 17.1-227. Given the historical circumstances,

however, clerks of court still possess millions of land records,

over three percent of which probably contain unredacted

36 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 36 of 47
SSNs. Inspecting all these records to find and redact SSNs

would be far more burdensome than sealing indictments and

police reports revealing rape victims’ identities. Moreover,

clerks cannot place original land records under seal while

completing such redaction because people must inspect them

to verify who owns what during real estate transactions. See

Va. Code § 17.1-208 (requiring that "any records and papers

of every circuit court that are maintained by the clerk of the

circuit court shall be open to inspection by any person"). Furthermore, regarding land records available through secure

remote access, the parties agree that running software used for

redacting SSNs costs about four cents per page and has a one

to five percent error rate. Virginia thus faces considerable

obstacles in avoiding initial disclosure of sensitive information that Cox Broadcasting and Florida Star did not have to

consider. Such realities plainly must factor into our narrowtailoring analysis.

c.

The factual differences between this case and Cox Broadcasting and Florida Star suggest the need for a more nuanced

analytical approach to the Daily Mail standard’s narrowtailoring requirement. The Supreme Court’s recognition of

different conceptions of privacy—one focused upon secrecy

and incompatible with any disclosure, the other focused upon

control and consistent with limited disclosure—and the unrealistic challenge of preserving total secrecy in this situation

strongly suggest that Virginia should have more latitude to

limit disclosure of land records containing unredacted SSNs

than Cox Broadcasting and Florida Star allowed for protecting rape victims’ anonymity. Specifically, the Court’s First

Amendment jurisprudence does not necessarily require that

Virginia redact SSNs from all original land records maintained in courthouse archives before someone like Ostergren

may be prevented from publishing them online.18 Ostergren’s

18Ostergren took the contrary position below, arguing that all original

land records had to be redacted before Virginia could prevent Ostergren

OSTERGREN v. CUCCINELLI 37

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 37 of 47
website supports this conclusion by recognizing the critical

difference between original land records available from courthouses and digital land records available through secure

remote access:

Once records are recorded at the courthouse, they

become public (unless sealed by a judge) and anyone

can get them. But shouldn’t we all have to drive to

the Courthouse to see them? Yes, but sadly that is

not the case anymore. Legislators have kowtowed to

special interests and in VA, they voted specifically

to allow these records online.

The Virginia Watchdog, http://www.opcva.com/watchdog/

RECORDS.html (last visited Apr. 26, 2010) (emphasis omitted); see Reporters Comm., 489 U.S. at 764 (noting "a vast

difference between the public records that might be found

after a diligent search of courthouse files, county archives,

and local police stations throughout the country and a computerized summary located in a single clearinghouse of information").

This certainly does not mean, however, that enforcing section 59.1-443.2 against Ostergren would be constitutional. We

cannot conclude that prohibiting Ostergren from posting public records online would be narrowly tailored to protecting

individual privacy when Virginia currently makes those same

records available through secure remote access without having redacted SSNs. The record reflects that 15 clerks of court

have not finished redacting SSNs from their land records,

from publishing SSNs online. See J.A. 120 ("Well, I think that the constitutional argument would still be solid even if the records were not available online, because they are open to anyone who wishes to see them.").

But suspending access to courthouse archives until Virginia completed

such an enormous redaction effort—requiring manual inspection of over

200 million physical documents—seems impossible because people

require access to land records for any real estate transaction. 

38 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 38 of 47
which are nonetheless available online. Under Cox Broadcasting and its progeny, the First Amendment does not allow Virginia to punish Ostergren for posting its land records online

without redacting SSNs when numerous clerks are doing precisely that.19 Cf. Florida Star, 491 U.S. at 535 ("[W]here the

government has made certain information publicly available,

it is highly anomalous to sanction persons other than the

source of its release."). Virginia could curtail SSNs’ public

disclosure much more narrowly by directing clerks not to

make land records available through secure remote access

until after SSNs have been redacted.20

In summary, Virginia’s failure to redact SSNs before placing land records online means that barring Ostergren’s protected speech would not be narrowly tailored to Virginia’s

interest in protecting individual privacy. For this reason, we

hold that enforcing section 59.1-443.2 against Ostergren for

the Virginia land records posted on her website would violate

the First Amendment. We thus affirm the district court’s

August 22, 2008, decision.

19For the same reason, Virginia could not punish Ostergren for publishing a SSN-containing land record that had accidentally been overlooked

during its imperfect redaction process—having a one to five percent error

rate—unless Virginia had first corrected that error. Even then, we leave

open whether under such circumstances the Due Process Clause would not

preclude Virginia from enforcing section 59.1-443.2 without first giving

Ostergren adequate notice that the error had been corrected. 

20Although suspending secure remote access until the redaction process

has ended would certainly make enforcing section 59.1-443.2 against

Ostergren more narrowly tailored, we leave open whether this safeguard

alone would be adequate under the Daily Mail standard. Once a greater

factual record has been developed on remand, the district court in fashioning injunctive relief should consider whether other safeguards are also

constitutionally required. See, e.g., Florida Star, 491 U.S. at 534 ("The

government may classify certain information, establish and enforce procedures ensuring its redacted release, and extend a damages remedy against

the government or its officials where the government’s mishandling of

sensitive information leads to its dissemination."). 

OSTERGREN v. CUCCINELLI 39

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 39 of 47
III.

We next consider Ostergren’s challenge to the district

court’s award of injunctive relief. "We review an order granting an injunction for an abuse of discretion, reviewing factual

findings for clear error and legal conclusions de novo." Muffley ex rel. NLRB v. Spartan Mining Co., 570 F.3d 534, 543

(4th Cir. 2009). The court entered

a permanent injunction . . . against enforcement of

Va. Code § 59.1-443.2 against any iteration of Ostergren’s website, now or in the future, that simply

republishes publicly obtainable documents containing unredacted SSNs of Virginia legislators, Virginia Executive Officers or Clerks of Court as part as

[sic] an effort to reform Virginia law and practice

respecting the publication of SSNs online.

Ostergren, 643 F. Supp. 2d at 770 (emphasis added). Ostergren claims this relief was too limited. Because her website

includes documents obtained from various States’ websites

revealing SSNs of non-Virginia public officials, Ostergren

contends that the injunction should have reached not only

"Virginia legislators, Virginia Executive Officers or Clerks of

Court" but also other public officials anywhere in the United

States. Id.

A.

When Ostergren raised this issue below during a hearing

about the propriety and scope of injunctive relief, counsel for

the Attorney General stated that section 59.1-443.2 did not

reach non-Virginia public records and that, regardless, the

Attorney General would not prosecute Ostergren for publishing such documents. Because the issue had never been disputed, even prior to litigation, the district court declined to

decide the question because that would "become[] an advisory

opinion." J.A. 301-02. In essence, the court concluded that

40 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 40 of 47
Ostergren failed to provide a case or controversy sufficient to

trigger federal judicial power. See Richmond Med. Ctr. For

Women v. Herring, 570 F.3d 165, 172 (2009) ("Article III . . .

extends the jurisdiction of courts only to cases and controversies, thus precluding courts from issuing advisory opinions

. . . ."). 

The precise issue the district court passed over was whether

the First Amendment prohibits Virginia from enforcing section 59.1-443.2 against Ostergren for publishing on her website public records that contain unredacted SSNs but were

obtained from other States’ websites. Before entertaining

Ostergren’s argument about this, we consider our own jurisdiction to decide that question. See Friedman’s, Inc. v. Dunlap, 290 F.3d 191, 197 (4th Cir. 2002) ("[T]he question of

whether we are presented with a live case or controversy is a

question we may raise sua sponte.").

Article III gives federal courts jurisdiction only over

"Cases" or "Controversies." U.S. Const. art. III, § 2, cl. 1. Our

judicial power may be exercised only where "‘conflicting

contentions of the parties . . . present a real, substantial controversy between parties having adverse legal interests, a dispute definite and concrete, not hypothetical or abstract.’"

Miller v. Brown, 462 F.3d 312, 316 (4th Cir. 2006) (quoting

Babbitt v. United Farm Workers Nat’l Union, 442 U.S. 289,

298 (1979)). From this requirement courts developed the doctrine of ripeness. "[I]ts basic rationale is to prevent the courts,

through avoidance of premature adjudication, from entangling

themselves in abstract disagreements . . . ." Abbott Labs. v.

Gardner, 387 U.S. 136, 148 (1967). We assess ripeness by

"balanc[ing] the fitness of the issues for judicial decision with

the hardship to the parties of withholding court consideration." Miller, 462 F.3d at 319 (internal quotations omitted).

Because "[t]he doctrine of ripeness prevents judicial consideration of issues until a controversy is presented in clean-cut

and concrete form," id. at 318-19 (internal quotations omitted), "problems such as the inadequacy of the record . . . or

OSTERGREN v. CUCCINELLI 41

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 41 of 47
ambiguity in the record . . . will make a case unfit for adjudication on the merits," Scott v. Pasadena Unified Sch. Dist.,

306 F.3d 646, 662 (9th Cir. 2002) (internal quotations omitted).

Ostergren developed almost no evidentiary record to

inform our decision about the issue raised. The record does

not indicate from which States’ websites she obtained public

records containing unredacted SSNs, whether those records

had previously been publicly disclosed, or how these States

protected SSNs from public disclosure. We have only a stipulation that her website "includes public records obtained from

government websites in other states." J.A. 86. We cannot

imagine how any court could decide the question now presented with such a paltry evidentiary record, particularly

given the fact-intensive inquiry required by Cox Broadcasting

and its progeny. Ostergren also failed to develop any legal

theory explaining why our First Amendment analysis about

Virginia’s land records should also encompass public records

from other States. Her attorney admitted at oral argument, "I

have not found a satisfactory answer to that question."

Finally, thus far the Attorney General does not believe that

section 59.1-443.2 would reach non-Virginia public records,

and seems opposed to prosecuting Ostergren for publishing

such documents. In short, we have no evidence, no argument,

and no underlying dispute for the thorny constitutional question that Ostergren has raised. We therefore also have no

jurisdiction to decide that question. See California Bankers

Ass’n v. Shultz, 416 U.S. 21, 64 (1974) ("Passing upon the

possible significance of the manifold provisions of a broad

statute in advance of efforts to apply the separate provisions

is analogous to rendering an advisory opinion upon a statute

or a declaratory judgment upon a hypothetical case." (internal

quotations omitted)).

B.

Although we decline to consider whether the First Amendment prohibits Virginia from enforcing section 59.1-443.2

42 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 42 of 47
against Ostergren for publishing non-Virginia public records

containing unredacted SSNs, that does not moot Ostergren’s

cross-appeal. We therefore proceed to consider whether the

district court abused its discretion by entering a permanent

injunction that protected only "republish[ing] publicly obtainable documents containing unredacted SSNs of Virginia legislators, Virginia Executive Officers or Clerks of Court as part

as [sic] an effort to reform Virginia law and practice respecting the publication of SSNs online." Ostergren, 643 F. Supp.

2d at 770.

While district courts have broad discretion when fashioning

injunctive relief, their powers are not boundless. "Once a constitutional violation is found, a federal court is required to tailor the scope of the remedy to fit the nature and extent of the

constitutional violation." Dayton Bd. of Educ. v. Brinkman,

433 U.S. 406, 420 (1977) (internal quotations omitted); see

Missouri v. Jenkins, 515 U.S. 70, 88 (1995) ("[T]he nature of

the . . . remedy is to be determined by the nature and scope

of the constitutional violation." (internal quotations omitted)).

Because we found that enforcing section 59.1-443.2 against

Ostergren for the Virginia land records posted on her website

violated the First Amendment under Cox Broadcasting and its

progeny, we must consider whether the district court’s injunctive relief was tailored to fit that violation. We are mindful

that "[w]hile a remedy must be narrowly tailored, that requirement does not operate to remove all discretion from the District Court in its construction of a remedial decree." United

States v. Paradise, 480 U.S. 149, 185 (1987).

The district court tried "to frame a remedial injunction that

. . . accommodate[s] the First Amendment rights of Ostergren

and, at the same time, affords some protection to the innocent

members of the public who have no control of the release of

the public records containing their SSNs." Ostergren, 643 F.

Supp. 2d at 769. Although we commend the court’s conscientious effort to find minimally disruptive equitable relief, we

conclude that its injunction was not tailored "to fit the nature

OSTERGREN v. CUCCINELLI 43

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 43 of 47
and extent of [Virginia’s] constitutional violation." Brinkman,

433 U.S. at 420 (internal quotations omitted). The following

examples are illustrative.

First, the injunction does not protect Ostergren in publishing Virginia land records containing private individuals’

SSNs. Under our First Amendment analysis, Ostergren’s constitutional right to publish Virginia land records containing

unredacted SSNs does not depend on the political status of

people whose SSNs are compromised. Therefore, restricting

injunctive relief to "the SSN-containing records of State legislators, State Executive Officers and Clerks of Court, those

who actually can act to correct the problem," contradicts our

First Amendment holding. Id. at 770. The district court said

that this limitation "largely only ratifies Ostergren’s current

course of conduct and, as she herself stated, would not have

a seriously deleterious effect on her public advocacy." Id. But

these circumstances do not justify ignoring the First Amendment. Furthermore, the record shows that Ostergren’s advocacy did involve private individuals’ SSNs. In June 2008, the

clerk of court for Pulaski County, Arkansas, refused to

remove land records from the Internet pending SSN redaction

until Ostergren published land records showing several prominent local citizens’ SSNs.

Second, the injunction does not protect Ostergren in publishing Virginia land records that contain non-Virginia public

officials’ SSNs.21 Many non-Virginia public officials conduct

real estate transactions in Virginia and may have private

information exposed in Virginia land records. For example,

the record reflects that Ostergren published a land record from

21Conversely, the injunction protects Ostergren in publishing nonVirginia public records containing Virginia public officials’ SSNs. As we

have noted, however, the question of whether Virginia could enforce section 59.1-443.2 against Ostergren for publishing non-Virginia public

records containing unredacted SSNs was not ripe for judicial consideration. See ante at III.A. 

44 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 44 of 47
Fairfax County, Virginia, that contains General Colin Powell’s unredacted SSN. Nothing in our First Amendment analysis justifies treating these records differently from other

Virginia land records. Thus, even allowing the distinction

between public and private individuals, the injunctive relief

still does not adequately remedy Virginia’s constitutional violation.

For the reasons stated above, we conclude that the district

court abused its discretion by not "tailor[ing] the scope of the

remedy to fit the nature and extent of the constitutional violation." Brinkman, 433 U.S. at 420 (internal quotations omitted); see United States v. Delfino, 510 F.3d 468, 470 (4th Cir.

2007) ("A district court abuses its discretion when it . . . fails

to consider judicially recognized factors constraining its exercise of discretion . . . ."). We thus reverse the district court’s

June 2, 2009, decision and remand for further proceedings

consistent with this opinion.

IV.

We recognize that on remand the district court will require

a more developed factual record to determine proper injunctive relief. This includes evidence about the status and effectiveness of Virginia’s current redaction efforts. Depending on

the scope of section 59.1-443.2, this may also include evidence about non-Virginia public records that Ostergren would

publish on her website. Because our constitutional analysis

turned on how Virginia has handled public records rather than

on whose SSNs are being exposed, the district court should

frame the injunctive relief accordingly. The court should also

heed Florida Star’s warning "that the sensitivity and significance of the interests presented in clashes between First

Amendment and privacy rights counsel relying on limited

principles that sweep no more broadly than the appropriate

context of the instant case." 491 U.S. at 533.

OSTERGREN v. CUCCINELLI 45

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 45 of 47
AFFIRMED IN PART, 

REVERSED IN PART, 

AND REMANDED

DAVIS, Circuit Judge, concurring:

I am pleased to concur in the fine opinion of my good colleague. I write separately to elaborate my view of one issue,

namely, the appropriate test for identifying and assessing in

First Amendment cases the existence of "a state interest of the

highest order."

When evaluating whether a state’s asserted interest rises to

the level shared by those of "the highest order," courts must

consider and weigh heavily the state’s expressed views and its

conduct or they risk denuding First Amendment rights. In

Florida Star v. B.J.F., 491 U.S. 524, 537-38 (1989), the Court

explained that Florida’s statute failed to further a state interest

of the highest order for three reasons, the first of which was

that the appellant obtained the identifying information in

question from the government in consequence of official mishandling of the information. Id. at 538. This factor, combined

with the breadth and facial underinclusiveness of Florida’s

statute, led the Court to find "no such interest is satisfactorily

served by imposing liability under [the statute] to appellant

under the facts of this case." Id. at 541.

Considering a state’s view and its actual conduct is particularly important in First Amendment cases like this one, in

which the Commonwealth, a party to the case, undertakes to

punish an individual for re-publishing information initially

published by the Commonwealth itself. In such cases, courts

should not casually treat a "state interest of the highest order"

synonymously with a judicially-noticeable, constitutionallyrooted, "compelling governmental interest," such as the eradication of racial discrimination. See Maj. Op. at 23. Rather, the

state’s dual role as publisher and re-publication punisher

necessitates a more searching analysis of its involvement. For

46 OSTERGREN v. CUCCINELLI

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 46 of 47
this reason, while I agree with the observation in the majority

opinion that certain evolving "practices indicate a broad consensus that SSNs’ public disclosure should be strictly curtailed," Maj. Op. at 27, where, as here, an individual state has

not manifested its genuine embrace of that "consensus," then

judicially-noticed facts do not trump the state’s tangible

actions, nor can they render the state’s behavior an unimportant or minor aspect of the proper analysis. 

Thus, an analysis of a state’s view and its actual conduct in

furthering its asserted interest is imperative in striking the

proper balance, under the First Amendment, between pursuit

of "a state interest of the highest order," on the one hand, and,

on the other hand, the state’s efforts to restrict the exercise of

constitutionally-protected expressive activity. This is not to

say that "objective" data have no role to play in the analysis

of a federal court’s assessment of whether an asserted state

interest rises to become one "of the highest order." See Maj.

Op. at 23. But such a consideration should not, and must not,

supplant a fact-intensive inquiry into the state’s view and its

actual conduct in furthering its asserted interest.*

In sum, when a state seeks to punish a speaker for republishing state-published information, the state should be

expected, in the words of a contemporary colloquialism, not

simply to talk the talk, but to walk the walk, as well. The district court did not err in so concluding here.

*Butterworth v. Smith, 494 U.S. 624 (1990), is not to the contrary.

There, the Supreme Court held unconstitutional a Florida statute that prohibited a writer’s disclosure of his own grand jury testimony. Id. at 626.

In so holding, the Court considered whether other states maintain such a

rule and whether the Federal Rules prohibited the writer’s actions. Id. at

634-35. But of course, in Butterworth, the state never had control of the

information in question: the writer’s testimony. Thus, the Court had scant

reason to consider the actions of the state in safeguarding the information

because the state never controlled the information in the first place. 

OSTERGREN v. CUCCINELLI 47

Appeal: 09-1723 Doc: 32 Filed: 07/26/2010 Pg: 47 of 47