IP: FBI buys data from private sector

[David Farber <dave@farber.net>]

>Date: Fri, 13 Apr 2001 13:04:12 -0400
>To: eff-priv@eff.org
>From: Lauren Gelman <gelman@eff.org>
>
>
>
>===============================================
>
>
>FBI's Reliance on the Private Sector
>Has Raised Some Privacy Concerns
>
>By GLENN R. SIMPSON
>Staff Reporter of THE WALL STREET JOURNAL
>
>WASHINGTON -- Big Brother isn't gone. He's just been outsourced.
>
>After surveillance scandals in the 1960s and 1970s, the Federal
>Bureau of Investigation and other federal law-enforcement
>authorities curbed their file-keeping on U.S. citizens. But in
>the past several years, the FBI, the Internal Revenue Service
>and other agencies have started buying troves of personal data
>from the private sector.
>
> >From their desktop computers, 20,000 agents at the IRS have
>access to outside data on taxpayers' assets, driving histories,
>phone numbers and other personal statistics. Using a password,
>FBI agents can log on to a custom Web page that links them with
>privately owned files on tens of millions of Americans. And with
>just a few keystrokes, the U.S. Marshals Service can find out
>if a fugitive has recently rented a mailbox or acquired a new
>phone line.
>
>'An End Run'
>
>Behind such high-tech tools are ChoicePoint Inc., a publicly
>held Alpharetta, Ga., company and other commercial "look-up"
>services. ChoicePoint and its rivals specialize in doing what the
>law discourages the government from doing on its own -- culling,
>sorting and packaging data on individuals from scores of sources,
>including credit bureaus, marketers and regulatory agencies.
>
>Privacy activists say that by outsourcing these tasks, federal
>agencies are violating at least the spirit of the nation's major
>privacy law, which admonishes the agencies to maintain only
>the data about a given individual that they need to do their
>jobs. "It's simply an end run around the Privacy Act" of 1974,
>says Marc Rotenberg a lawyer for the Electronic Privacy Information
>Center, an advocacy group based here.
>
>Back in the 1970s, critics say, lawmakers never imagined that
>technology would place so much data within the government's reach
>but outside its actual possession. They add that the government's
>alliances with ChoicePoint and its peers have evolved largely
>without debate or congressional oversight at a time of increasing
>public concern about online threats to privacy.
>
>ChoicePoint and its federal clients say their use of the company's
>data follows both the letter and spirit of the law. And, indeed,
>there has been little evidence so far of privacy violations
>arising from government access to the data. "We are only permitted
>to obtain evidence and information consistent with applicable
>laws, including the Privacy Act, and rigorous attorney general
>guidelines," says FBI spokesman John Collingwood. "A vigorous
>inspection process, judicial oversight of prosecuted cases
>and civil remedies are in place to enforce compliance by FBI
>employees."
>
>ChoicePoint Chief Executive Derek Smith calls his company's
>dealings with the government "a natural extension" of its business
>of equipping insurers and other companies to check out prospective
>partners and clients.  Similarly, he says, the company helps the
>government find criminals and uncover fraud that hurts taxpayers.
>
>Mr. Smith says his company's contracts define appropriate uses
>of its data and that ChoicePoint audits them to make sure those
>conditions are met. "I care very much about making sure the
>information is used to make a safer, more secure society," he says.
>
>Federal agencies contract with several private-sector companies for
>data and related services. Among them is Lexis-Nexis, a unit of
>Anglo-Dutch publisher Reed-Elsevier PLC, whose databases include
>newspaper articles, legal briefs and other public records. But
>ChoicePoint is the biggest supplier to law enforcement.
>
>The FBI's Investigative Information Services unit, which helps
>agents obtain information on individuals for their investigations,
>relies heavily on ChoicePoint's services. On the Web, FBI agents
>also can go to www.cpfbi.com1 -- "ChoicePoint Online for the FBI"
>-- for help in conducting their own searches. On that Web page,
>the company's logo appears alongside the FBI's official seal.
>
>"The FBI has located nearly 1,300 subjects of criminal cases
>using these kinds of searches," Mr. Collingwood says. The service
>"saves countless hours of manual records checks, a process the
>FBI has relied on for decades." Neither the FBI nor ChoicePoint
>would disclose how much the agency pays the company.
>
>The Justice Department's contract with ChoicePoint ballooned to $8
>million last year from $1 million in 1996.  Treasury Department
>documents show that the exclusive multiyear deal the IRS signed
>with the company in August is worth a total of $8 million to
>$12 million. The company says its clients include at least 35
>federal agencies.
>
>That business has contributed to ChoicePoint's impressive financial
>performance. Since it became a standalone company four years
>ago, ChoicePoint's stock price has more than doubled. Thursday
>in 4 p.m. New York Stock Exchange composite trading, its shares
>rose 65 cents to $35.50, down from its 52-week high of $44.67
>in December. Last year, ChoicePoint's business and government
>division had revenue of $292.4 million, up 24% from 1999, and its
>operating income more than tripled to $45.3 million. The division
>now accounts for more than half the company's total revenue.
>
>ChoicePoint says it buys its primary information for the data
>products it markets to the government, private detectives and
>the media from the nation's three major credit bureaus. They
>are Equifax Credit Information Services Inc., a unit of former
>ChoicePoint parent Equifax Inc.; Trans Union LLC and Experian
>Information Solutions Inc. Each of the three companies maintains
>credit histories on more than 180 million Americans.
>
>The company takes these credit-bureau files and retains the portion
>that lists the consumer's name, known aliases, birthdate, Social
>Security number, current and prior addresses and phone number. The
>credit-bureaus are valuable sources of such data because their
>records tend to be up-to- date. That's because people typically
>tell their creditors when they move, even if they fail to tell
>the Postal Service.
>
>ChoicePoint indexes this data under the subject's Social
>Security number and stirs in more information it gleans from
>other sources. These sources, including local, state and federal
>agencies, sell the company data ranging from motor-vehicle, driver
>and boat registrations, liens and deed transfers to phone listings,
>military personnel records and voter rolls.
>
>By mixing and matching its databases, ChoicePoint can accumulate
>all kinds of information -- a speeding fine, a bankruptcy filing,
>a spouse's name -- under a single Social Security number, tailoring
>the data and related software to a particular client. However, the
>company has warned investors that its ability to do business would
>suffer if Congress were to enact laws restricting the private use
>of Social Security numbers, as has been proposed in recent years.
>
>Address Inspector
>
>The Health Care Financing Administration uses the company's
>Address Inspector software to help identify fraudulent Medicare
>claims. The product lets it check health-care providers' addresses
>against two million of what ChoicePoint calls "high-risk and
>fraudulent business addresses." They include private mailboxes
>and street addresses in high-crime areas. Though many who rent
>private mailboxes do so out of concern for their privacy, those
>box numbers still can end up in ChoicePoint's hands if they are
>used in dealings with businesses or government.
>
>Although ChoicePoint says it has records on nearly every American
>with a credit card, it doesn't always provide access to that
>data. The company's Autotrack service is popular with many agencies
>and businesses and is also used by reporters at The Wall Street
>Journal. But entering the name of FBI Director Louis Freeh into the
>Autotrack database produces an error message. A company spokesman
>says ChoicePoint intentionally blocks Mr. Freeh's records as an
>act of good corporate citizenship.
>
>Among the tools ChoicePoint offers law-enforcement agencies
>is the ability to set up "alert" files that continuously scan
>databases for information on a suspect. So far, the U.S. Marshals
>Service, which has a $3.8 million contract with ChoicePoint,
>is the only agency that uses this feature. In 1999, one such
>alert showed that a woman wanted for mail fraud had rented a
>private mailbox. A follow-up investigation led to her arrest,
>according to agency records.
>
>While they decline to discuss details of their relationship with
>ChoicePoint, the FBI and other agencies say they aren't doing
>anything new except retrieving data electronically instead of
>digging through various far-flung paper files. Before ChoicePoint,
>"We went all over the place going to the same sources of
>information as ChoicePoint is going to," says Greg Gagne,
>a spokesman for the Immigration and Naturalization Service,
>which paid the company $1.5 million last year.
>
>Three decades ago, revelations about the FBI's history of
>compiling files on Vietnam War protesters, civil-rights activists,
>celebrities and thousands of other citizens seemingly picked at
>random set off a wave of public outrage. Among those with files
>were Albert Einstein, Rock Hudson, Cesar Chavez and Henry Ford.
>
>Congress responded by passing the Privacy Act of 1974, which was
>designed to discourage such wholesale data gathering. While the
>law doesn't explicitly prohibit the government from compiling
>dossiers on presumably law-abiding private citizens, the FBI and
>other agencies in the past have generally interpreted it that way.
>Moreover, some of those agencies' own internal guidelines bar
>them from actively assembling such files themselves.
>
>For instance, the FBI's "Manual of Investigations, Operations and
>Guidelines" says, "Only that information about an individual which
>is relevant and necessary to accomplish a purpose authorized by
>statute, executive order of the president, or by the Constitution
>is to be recorded in FBI files."
>
>Scott Charney, former head prosecutor in the Justice Department's
>computer crime unit, says department guidelines prohibit the
>collection of public or other data on an individual unless the
>agency has reason to believe he may have committed a crime. "If
>the government can't go out and collect information on you
>absent predication, they shouldn't be able to go out" and buy
>it from an outside source, says Mr. Charney, now a lawyer for
>PricewaterhouseCoopers LLC.
>
>Indeed, some attorneys think the government's reliance on
>outside data collectors may violate citizens' rights to protection
>against unreasonable searches. Gerry Goldstein, a criminal defense
>lawyer in San Antonio, says that, "When the government actively
>encourages and solicits individuals to act on their behalf,
>those individuals," in effect, become government agents.
>
>Mr. Gagne of the INS dismisses that argument. The government,
>he says, didn't solicit ChoicePoint or other data providers to
>build their databases. "They were doing this for quite some time"
>before the government started buying the data, he says.
>
>Another concern cited by critics is that Uncle Sam historically has
>proved to be an unreliable safekeeper of private information. In
>1993, an inquiry by the General Accounting Office, Congress's
>investigative arm, found that the FBI's own audits had repeatedly
>reported misuse of the agency's biggest internal database,
>the National Crime Information Center. Last year, the GAO said
>the federal government wasn't complying with privacy standards
>the Federal Trade Commission had proposed for businesses. And a
>recent House investigation gave the government's computer-security
>efforts a "D-minus" grade.
>
>Moreover, the public data ChoicePoint and its rivals use to build
>their databases aren't always accurate -- as ChoicePoint itself
>has found.
>
>Florida Lawsuit
>
>In January, the National Association for the Advancement of Colored
>People sued ChoicePoint and the state of Florida in federal court
>in Miami, accusing the company of supplying faulty data that led to
>thousands of citizens being wrongly purged from Florida voter rolls
>in the November election. ChoicePoint has admitted that some data
>it provided was inaccurate, but it says its DBT Online Inc. unit,
>which was hired by the state to compile lists of convicted felons
>still carried on the rolls, warned state officials that the data
>needed to be verified. Florida election officials have blamed their
>predecessors and county authorities for not following through.
>
>In another incident, this time in the private sector, a
>Chicago-area woman was fired in 1998 from her technical job at
>a major computer maker after ChoicePoint told her employer that
>she was a convicted drug dealer and shoplifter. In fact, the
>woman had no criminal record. A ChoicePoint spokesman concedes
>the mistake. The woman's employer rehired her, but in a menial
>job. She sued both companies and reached a confidential settlement.
>
>Until four years ago, ChoicePoint was part of Atlanta-based
>Equifax. Like other credit bureaus, Equifax's collection and
>sale of personal data on American consumers has been dogged by
>controversy over the years, leading regulators to put stricter
>rules on the companies' practices.
>
>In 1993, Mr. Smith took the helm of Equifax's insurance-services
>division, which helped insurers evaluate the risks of taking on new
>policyholders. He says he quickly realized that the money-losing
>unit could serve another, potentially lucrative purpose. With
>society becoming more mobile, he says, he decided to pitch the
>division's database as a way for companies to feel more secure
>in dealing with relative strangers. The division's fortunes
>rebounded, with its operating income tripling in 1994. Equifax
>spun the division off in 1997, and Mr. Smith went along as CEO.
>
>Meanwhile, the FBI and others started to appreciate the value
>of computerized databases and looking to the private sector for
>help in gathering records. Two companies, CDB Infotek and DBT,
>won much of this early business, because of their experience
>selling data to police departments.
>
>ChoicePoint acquired CDB Infotek in 1996 and purchased DBT last
>year. It also bought up more than a dozen other firms that bought
>police reports and records relating to drug tests, physicians'
>backgrounds, insurance fraud, and litigation. DBT brought in the
>biggest haul. The data DBT had collected from insurers, private
>eyes, law firms and government doubled ChoicePoint's data bank
>to 10 billion records.
>
>
>
>________________________________________________
>  Lauren Gelman                  Phone: 202/487-0420
>  Director of Public Policy             email: gelman@eff.org
>  Electronic Frontier Foundation
>
>
>
>
>
>



For archives see: http://www.interesting-people.org/