The $25,000 attachment a five-second scan would have caught
Citrus County's records manager sent 74 pages of health-insurance spreadsheets — Social Security numbers for about 1,300 county employees and family members — out in a public-records reply. He lost his job, and taxpayers will cover the $25,000 deductible. The uncomfortable part: the check that catches exactly this is standard, government-grade software. In one common case it already ships inside licenses governments pay for. In another, it's free, open-source, and never lets the data leave the building.
- Records Manager Mike Bridges attached the spreadsheets to a records reply, admitted he had not adequately reviewed the attachments, and lost his job. The recipient forwarded the file to two more people; the Sheriff's Office got it deleted. County Administrator Steve Howard authorized legal and identity-protection services; cyber insurance covers the services, the county pays the ~$25,000 deductible; commissioners consider formal approval tomorrow, Oct. 27.
- Data-loss-prevention software (Microsoft Purview DLP is the common government example) scans outbound email and attachments for Social Security numbers — a built-in pattern type — and can warn the sender, require a justification, or block the send. It is included in mid-tier Microsoft 365 plans, and government tenants run inside Microsoft's FedRAMP-authorized government clouds.
- Records-specific platforms (GovQA, JustFOIA, Logikcull for Public Records) build automated PII detection and redaction into the records workflow itself; the vendors market government compliance credentials and claim hundreds of agency customers.
- The privacy distinction: under government/enterprise contracts, customer data is not used to train the models and the agency controls retention and audit. And Microsoft's open-source Presidio detector runs entirely on an agency's own servers — the data goes nowhere at all. Microsoft's own documentation warns no detector catches everything; these tools are a second set of eyes, not a replacement reviewer.
Start with what it cost, because that's the headline and it's true. A public-records reply left Citrus County's government carrying an attachment it should never have carried: 74 pages of health-insurance spreadsheets, covering about 1,300 county employees and their family members, Social Security numbers included. The county's records manager, Mike Bridges, admitted he had not adequately reviewed the attachments before sending. He lost his job. The person who received the file forwarded it to two other people before the Sheriff's Office got it deleted. County Administrator Steve Howard authorized lawyers and identity-protection services on the spot; the county's cyber insurance picks up the services, and county taxpayers pick up the first roughly $25,000 — the deductible — with commissioners set to formally approve the arrangement tomorrow. No hacker. No foreign adversary. One unchecked attachment.
Now the part nobody at the courthouse is likely to say out loud: this is one of the most preventable failures in modern government, and the prevention is not exotic. Software in the data-loss-prevention category sits at the email gate and reads what's about to leave. It is not a chatbot and it is not 'thinking.' It is pattern machinery, and Social Security numbers are its home turf — a fixed nine-digit shape, validated by context and checksum. A spreadsheet carrying page after page of them is not a subtle catch. It is the loudest signal the software exists to hear, and hearing it takes seconds. Configured the way universities and agencies already run it, the tool would have stopped the message, or at minimum thrown a warning in the sender's face: this email contains Social Security numbers — send anyway? Bridges might have clicked through. He would first have had to look — which is the one thing that didn't happen.
Where does a county get such a thing? Three lanes, all of them already government business. The common one rides inside Microsoft 365: Purview's DLP covers Exchange email, ships in the mid-tier plans most governments license, and runs for government tenants in the FedRAMP-authorized government cloud. Nothing in the reporting says whether Citrus County had the control available and unflipped, or never had it in reach — and either answer indicts the setup, not the software. The second lane is the records platforms themselves: GovQA, JustFOIA, and Logikcull's public-records product build automated PII detection and redaction into the request workflow, market themselves on government compliance, and claim hundreds of state and local customers between them (their numbers, labeled as such). The third lane answers the privacy objection by deleting it. Microsoft's Presidio is an open-source PII detector, free under an MIT license, designed to run entirely on the agency's own servers. There is no vendor to trust and no cloud to audit, because the data never leaves the building.
That objection deserves its sentence, because it's the first one everyone raises: you want to run government records through AI? Under consumer terms — pasting documents into a free chatbot — skepticism is earned. Under government contracts it is a different legal animal: the vendor commits that customer data is not used to train its models, the agency sets retention, and every access is auditable. And in the on-premises lane there is no third party in the room at all. 'AI' is doing a lot of work in that objection; the honest version separates the three.
Honesty runs the other way too. Microsoft's own documentation warns that no automated detector guarantees it will find everything — names in odd formats, scanned images, the weird cases. These tools do not replace the reviewer. What they replace is the reviewer's loneliness. Citrus County's process put one person, alone, between 1,300 families' Social Security numbers and the send button, and asked him to eyeball 74 pages of spreadsheets without help. He blinked. A machine doesn't get tired at page 40 — and a human confirming machine flags is a human doing a job he can actually succeed at.
Tomorrow the commission votes on paying for the cleanup: the lawyers, the monitoring, the deductible. That's the bill for the last attachment. The question that belongs on the same agenda is smaller and cheaper: what reads the next one before it leaves? The county can keep trusting eyeballs. It just sent 1,300 of its own people the invoice for how that went.