Data Safety

March 7, 2005

Up to 500,000 people are potential victims of a scam involving records illegally obtained from the data mining service, ChoicePoint, Inc.  The company is a spin-off of credit reporting agency Equifax.  ChoicePoint data bases contain 19 billion social security numbers, credit histories, motor vehicle registrations, professional licenses, medical histories, job applications, lawsuits and criminal records.  This company has given out at least 145,000 social security numbers and other private records to criminals who obtained detailed dossiers on 35,000 people and stole the identities of 700 or more. These criminals set up businesses on paper and registered them with the appropriate government agencies.  Armed with false identities and business licenses for non-existent businesses, the con artists posed as insurers, debt collectors or other business officials to open over 50 accounts with ChoicePoint.

ChoicePoint collects and shares personal data used in employee background checks, fraud investigations, debt collection and credit checks and is also involved in data collection by state governments and federal government agencies, namely the Department of Justice and other homeland security agencies.  Legally, private businesses can collect records that the government can not.  Hiring such companies gives government access to that data.

The federal government maintains extensive data collections about ordinary citizens under such laws as the “Health Insurance Portability and Accountability Act”, the “Patriot Act” and the “Aviation and Transportation Security Act”. The “Aviation and Transportation Act” creates a “trusted traveler card” that links biometric identifiers to private and government databases.  This may be the precursor to National ID cards that may be a component of the proposed “Real ID Act”.

There are several problems with data mining and government use of such services.  These include unreasonable search and seizure, the ability of terrorists to obtain data for the purpose of creating false identities, inaccurate data about citizens, and the possibility that government agencies will be so overwhelmed by the sheer volume of data that items critical to national security will be missed.

The fourth amendment states “The right of people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”  Data is the modern day equivalent to papers.  Data mining is just fishing.  Government access to “red flag” items such as transfers of money to organizations that support terrorism without a warrant is fine.  Access to any and all information about law-abiding citizens without probable cause is unconstitutional.

The main threat to national security that can result from data mining is identity theft by terrorists.  If criminals can do that, why not terrorists?  Data mining companies make it easier than ever for people to collect others’ records.  What is there to stop a terrorist from getting a “trusted traveler card” or national ID card with the terrorist’s biometric identifiers and the identity of a law-abiding citizen?

Another problem with data collection by businesses and government is inaccurate information due to data entry errors, computer glitches or deliberate tampering by hackers.  Such errors in information obtained by the government can place an innocent individual on a “no fly” list or place him under investigation.

Failure to find information critical to national security among too much data is another drawback of data mining.  For example, prior to September 11, 2001, the government was notified about several of Mohammed Atta’s financial transactions, but did not act on the information.

Much identity theft is due to the negligence of the data brokering companies.  According to a March 5, 2005 Washington Post article, two years ago there was another identity theft scam involving ChoicePoint.  One would think ChoicePoint had learned its lesson, but no.  In the recent scam, the criminals faxed account applications to ChoicePoint from Kinko’s stores and received sensitive information from ChoicePoint by fax at Kinko’s locations and by mail at mailbox stores.   It is a standard practice to verify that business numbers and addresses are registered in the name of that business.  Food delivery services verify that addresses and phone numbers match.  Shouldn’t companies handling sensitive data do likewise?  If failure to verify wasn’t irresponsible enough, ChoicePoint discovered the identity theft scam in October 2004 yet failed to notify those whose data was compromised until February 2005!  Is it a good idea for our government rely on information from a company that does little or nothing to secure its data?  When our information is easy to steal or tamper with, how secure can we be?  To those who say, “If you’re not doing anything wrong, why does it matter?”, it can cause you no end of trouble if your information is stolen, tampered with or simply erroneous.

Eva Ellsworth