Investigators Argue for Access to Private Data

[R.A. Hettinga]

<http://www.nytimes.com/2005/03/21/technology/21data.html?th=&pagewanted=print&position=>

The New York Times

March 21, 2005

Investigators Argue for Access to Private Data
 By TOM ZELLER Jr.


iany Castillo, a 54-year-old home health care aide who lives in Brooklyn,
says she is grateful that the fragmented bits of her past - her moves from
one state to another, her marriages and her name changes - can be found in
the vast commercial databases that contain personal information on tens of
millions of Americans.

 Last October, a private investigator in Los Angeles used those digital
bread crumbs to track down Ms. Castillo and send her a letter. Her
estranged daughter, Diani Ramos, adrift for nearly a decade on the streets
of southern California, was looking for her, the letter said.

 The two were reunited in November.

In the heated debate over privacy rights and the sale of personal
information by the data-mining industry, the story of Ms. Castillo and Ms.
Ramos may represent a contrarian's view.

 But Bernard Cane, the private detective who found Ms. Castillo, says this
kind of happy ending could become much rarer if lawmakers begin to limit
access to commercial databases, which can include, among other personal
information, Social Security numbers. In many ways, the interests of Mr.
Cane and his clients highlight the difficulties in finding a
one-size-fits-all solution that both protects consumer privacy and makes
some information available for tasks like this one.

 "How does a doctor do surgery without a scalpel?" Mr. Cane asked. "You've
got to have the right tools to do a job."

Until now, the Sam Spade lobby has had surprising success in arguing that
civilian investigators, like insurance brokers, employment screeners and
other businesses, have a legitimate need for some sensitive consumer
information. But over the last month, as one company after another - first
ChoicePoint, then  Bank of America and two weeks ago, LexisNexis - revealed
the loss or theft of millions of bits of sensitive consumer data, Americans
have been forced to contemplate the vulnerability of their personal
information.

 Congressional hearings into that vulnerability - and into the loosely
regulated data trade - have already begun. And as privacy advocates,
federal and state lawmakers and ordinary consumers beat the drum for new
regulations on the commercial handling of consumer data, private
investigators - who are major buyers of personal information from data
brokers - have been bracing for more scrutiny of their access.

 The digital information available to Mr. Cane and others in his business
was greatly enhanced in 1993, when the Federal Trade Commission made a
formal distinction between full credit reports, which are governed by
specific rules of access, and the identifying information at the top of a
credit report. The latter, which is known as the "header," includes the
person's name, most recent address, date of birth and Social Security
number.

 That distinction allowed credit reporting companies to sell the header
information to the growing data-brokering industry, which was already
amassing dossiers on millions of Americans using public information sources
like court filings and criminal records.

 The commercial data trove quickly got filled with millions of Social
Security numbers, and the question of just who ought to be able to gain
access to those databases has been fiercely debated and haphazardly
regulated ever since.

 The Federal Trade Commission permitted a working group formed by several
database companies to come up with self-regulating guidelines in 1997. But
privacy advocates argue that individual commercial data brokers still
decide themselves who is eligible to buy personal information.

 The Gramm-Leach-Bliley Act, which went into effect in July 2001, reversed
the credit header rule and prohibited credit reporting agencies from
selling that information outside the rules set out by the Fair Credit
Reporting Act. But the law did not clearly address what data brokers and
their subscribers could do with the information already in their systems.

 The access now enjoyed by private investigators troubles privacy advocates.

 "We're concerned generally about accountability in this profession," said
Chris Jay Hoofnagle, an associate director for the Electronic Privacy
Information Center, a digital rights group based in Washington. Mr.
Hoofnagle pointed out that investigators were not licensed in all states,
and that in some jurisdictions licensing was a mere formality.

 Data brokers could conceivably limit access to investigators in states
with robust licensing rules, like California, Georgia and New York, but
there is little evidence that this is done in practice. And other critics
have argued that inaccuracies in the databases make them dubious sources
for conducting investigations.

 Organizations like the Privacy Rights Clearinghouse, for instance, have
gathered information on hundreds of cases in which consumers were wrongly
denied credit or, worse, wrongly associated with a crime or a debt.

 And still other critics suggest that investigators could get all the
information they need the old-fashioned way - by hitting the streets,
reviewing court records and asking questions - without ever having to look
at anything like a credit header.

 "Private investigators using information brokers are simply lazy," said
Robert Ellis Smith, editor and publisher of a newsletter, Privacy Journal.
"They don't want to do the legwork."

But Kirsti Ekeholm, a licensed private investigator based in Atlanta, says
her profession is too frequently dismissed in just this way. Investigators
with expertise in databases know how to handle information that can often
be incomplete or incorrect, she said.

"These records were never designed to be exploited as a commodity to be
sold," Ms. Ekeholm said. "And while it's not possible - you can't stop
private information from being available - you can limit how it's sold and
limit what industries will have access to it."

Indeed, Ms. Ekeholm is among the many private investigators who have tried
to stop big brokers like ChoicePoint from making even their less-sensitive
data widely available, particularly to the general public. Part of this, of
course, is simple turf protection for their business. But Ms. Ekeholm also
argues that her industry shares the public's concerns over privacy, and
that licensed investigators are trained to know how to protect it.

 "The P.I. industry gets a black eye in all this," Ms. Ekeholm said. "But
we have just as much interest in protecting privacy as anyone else. I don't
want my information readily available to just anyone."

Several past Congressional efforts have sought to limit that availability
across the board - including to investigators. But so far none has emerged
from committee.

 In such cases - and in numerous negotiations with the Federal Trade
Commission, privacy advocates and state and federal legislators - the
National Council of Investigation and Security Services, a trade group
representing civilian investigators, has mounted vigorous campaigns to
stifle new regulations.

 But major security gaffes at companies like ChoicePoint, which was fooled
by thieves masquerading as legitimate subscribers, might make things
considerably tougher for the industry this legislative session.

"One of our strongest arguments has been that we are vetted," said Bruce
Hulme, a private investigator in New York City and chairman of the trade
group's legislative committee. "And if ChoicePoint and others do not
properly vet their customers, then we're all in trouble."

 One bill introduced in January by Senator Dianne Feinstein, Democrat of
California, would require companies to notify consumers when breaches of
security occur. It has won support from the investigators' lobby. But
another of Senator Feinstein's bills, the Privacy Act of 2005, is opposed
by investigators because it would limit access to all kinds of information
that they use every day - including the credit headers, Mr. Hulme said.

 And if that happens, investigators insist, reunions like that between Ms.
Ramos and her mother would become a much rarer thing.

 In an interview, Ms. Ramos explained how, at the age of 18, suffering from
an abusive past, clinical depression and a mental fog induced by an
antipsychotic drug, she left her family, which was then living in Fort
Myers, Fla., and headed to California, seeking what she called "a better
life."

 She did not find it. Instead, she says, she drifted for years between
halfway houses, shelters and the streets in Compton, Hollywood, Bell
Gardens and, finally, San Diego. During her time in California, Ms. Ramos
said, she was raped, robbed and jailed, and by last fall, she wanted
desperately to go home.

 But after nine years, all ties to her family back in Florida had
evaporated. Phone numbers were long forgotten and, in her troubled mind,
even names and places had become sketchy.

 In a strange twist, Ms. Ramos reached out to the Privacy Rights
Clearinghouse in San Diego for help. She had become convinced - wrongly -
that her identity had been appropriated by thieves. The group put Ms. Ramos
in touch with Certified Investigative Professionals, a membership
organization in Santa Monica, which then put her in touch with Mr. Cane.

 Ms. Ramos recalled names and middle names that her mother used - Diany,
Ziani, Janet. She had surnames, married and maiden, but the spellings
varied, and were only guessed at phonetically - Pechouka, or Pacheco, she
thought. Or Mourra. And there was the street in Fort Myers where they had
once lived - Seminole Street.

The information turned up thousands of possible leads and duplicate names,
Mr. Cane said. But as he narrowed the field, it was his ability to view
Social Security numbers that allowed him to link various records associated
with Ms. Castillo, even as her name and location changed.

 The process took about two weeks, Mr. Cane said. He did not charge Ms. Ramos.

 "Given the holes in the information, it might have taken six months to a
year" without the header information, Mr. Cane said. "I'd have had to
retain folks, do background records searches on the ground, flown back and
forth to Florida."

 If new legislation were to force such globe-trotting, Mr. Cane said, he
could not afford to do it - and neither could the justice system, which, he
says, relies more heavily on private investigators using the data bazaar
than anyone wants to admit.

 "I don't want to find a new vocation," Mr. Cane said. "But if they knock
any more teeth out of my tiger, I'm going to have to retire my tiger."

 Copyright 2005 
-- 
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com