Home Contact Us Privacy News APC
News Services Speeches
PrivacyToday.com™
Global
Privacy Issues At The Click Of Your Mouse™
Official website of
American Privacy Consultants, Inc.™
Statement by Robert Douglas
Before the
Committee on Government Reform
Subcommittee on Government Management,
Information and Technology
United States House of Representatives
Hearing On
Establishing a Commission for the Comprehensive
Study of Privacy Protection
H.R. 4049
April 12, 2000
Thank you, Mr. Chairman. My name is Robert Douglas and I am the
founder and Chief Executive Officer of American Privacy Consultants. American Privacy Consultants assists
businesses, government agencies, legislators and the media understand and
implement appropriate privacy policies and strategies in today’s fast changing
privacy environment.
First, Mr. Chairman, let me state that I appreciate
the opportunity to appear before you to give my support for the creation of a
Privacy Commission and to state my belief that a comprehensive review of
current privacy law and the formulation of a privacy plan for the 21st
Century is important and long overdue.
I firmly believe the challenges created by the Information Age to the
privacy expectations of our citizens is one of the most significant problems
facing our nation today. Striking the
right balance between safeguarding the traditional privacy rights and values of
all Americans and allowing enough commonsense access to information that is
helping the Information Age to thrive will not be an easy task. Nor is it one that should occur on a
piecemeal basis. It is time for this
country to have a comprehensive privacy plan and strategy.
I want to personally thank you for your
willingness and desire to address this serious issue and the time you have
invested on this problem. I am aware
from both the proposed legislation before us today and other recent activity in
Congress that our Nation’s representatives have heard the concerns of the
American people and are moving to take action.
I particularly want to thank your Committee’s staff, and specifically
Heather Bailey, for the time they have invested with me discussing this problem
and assisting me in preparing for my testimony today.
Prior to founding APC, I was a Washington, DC private detective with more than 17 years experience in complex criminal defense investigation and trial preparation. In 1997 after becoming concerned about my own experiences in purchasing personal information from “Information Brokers” and other private investigators I began investigating the practice of Information Brokers selling citizens personal financial information on the Internet.[1] I took the results of this investigation to Congress and this resulted in my testifying before the Committee on Banking and Financial Services, during the July 28, 1998 Hearing On The Use Of Deceptive Practices To Gain Access To Personal Financial Information. Along with other witnesses I exposed the use of identity theft and fraud by Information Brokers to penetrate banking security systems. That hearing resulted in passage of the Financial Information Privacy Act (FIPA), which was incorporated into the Gramm-Leach-Bliley financial modernization bill signed into law on November 12, 1999.
At the 1998 hearing I informed Congress through the Banking Committee that the use of identity theft, fraud and deception was rampant in the information broker industry and extended well beyond personal financial information.[2] However, given the scope of the Banking Committee’s jurisdiction the Financial Information Privacy Act (FIPA) provisions attacking the use of identity theft, fraud and deception under Gramm-Leach-Bliley were narrowly defined and constrained to the illegal access of personal financial information. It is my hope that passage of H.R. 4049 will result in a Privacy Commission that can, as a small but important part of a broader mandate, investigate the use of identity theft to access and steal many other types of personal information of citizens and residents of the United States.
Given my past and current occupations I am often asked what personal information can be gathered about the average citizen. The truth is almost anything can be learned about anybody in the United States today. Name, address, social security number, date of birth, phone number (whether listed, unlisted, or non-published), height, weight, eye color, hair color, mother’s maiden name, relatives names and addresses, neighbors names and addresses, criminal records, civil records, tax liens, real estate holdings, bank account numbers and balances, stock holdings, credit card account numbers and individual credit card transactions, long distance phone records, cellular phone records, pager records, 800 number records, motor vehicle records, driving records, aircraft or watercraft ownership, credit histories, medical histories, where you shop and what you buy, where you went to school, what your grades were, even your SAT scores as Vice-President Gore and Governor Bush saw on the front page of the Washington Post.
When I recite that partial list the follow-up question is always; “How?”
The impact of technology on privacy today is the ability to accumulate, store, filter, cross-reference, analyze and disseminate vast amounts of information about anyone in a fast and cost-efficient manner that was previously unavailable. The partial list I provided of the information that can be obtained on anyone has always been available through one means or another. However, until relatively recently this information was rarely accessed to any large degree because of the time and expense that would have been involved in locating it across thousands of different individual computer databases or paper record storage facilities. Today all that information is quickly being accumulated into vast super-databases and is being packaged and sold like any other commodity.
The expanding use of the Internet coupled with decreasing costs and increasing capacity for accumulation and storage of data has brought the information age to a point where almost anyone can now afford to participate in the buying or selling of data of any type about anybody.
Simply put, privacy in the United States is too often a concept not a reality.
For the
purpose of today’s hearing I would like to focus on several particularly egregious
categories of personal information that are being advertised and sold on the
World Wide Web. The first example is
found at Docusearch.com and is a menu
of personal biographical information being sold by a company called Docusearch
operating out of the state of Florida.
|
||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
From the Locate Searches menu one can
easily see that most anyone’s Social Security number, address, date of birth
and address can be purchased. These are
the essential ingredients for identity theft.
With this information a criminal can impersonate anyone they choose and
gain access to all other personal information concerning the target of the
identity theft.
The following web page from the Docusearch
site is the description of the Social Security Number Search:
Search For Social Security Number
Search
Price
$49.00
Availability
National
Approximate
Return Time
1 Business Day
Requires
Subject's full name &
complete last known street address
Search Description
This search accesses one national
service bureau and is used to locate the Subject's Social Security Number.
Search Strategy
This search should be ordered if you do not know your Subject's Social Security
Number, but do possess their first and last name, and a current or previous
complete street address. The source of this search is obtained from a major
service bureau. We all know that, (with very few exceptions), no matter where
you live, maintaining credit is an absolute necessity. The fact that your
Subject may have poor credit, is of little consequence. When collection bureaus
and skip tracers locate them; they report their findings to the subscribing
credit bureau who; in turn, updates the Subject's Credit Header.
Credit
Header
The Credit Header is the top portion of a Credit Report, and details the
Subject's current and previous addresses, as reported by participating
subscribers as well as the Subject. It usually dates back 7 years or so.
Note: No credit history, ratings, assessments or financial data pertaining to
the Subject, will be accessed or returned with search results.
Important Note
There are a couple factors that can reduce your chances of success. One being
the accuracy of the submitted information. The slightest inaccuracy will likely
return inconclusive results. Another factor is the age of your information.
Most credit bureaus purge previous addresses dating prior to 7-10 years.
To gain a greater understanding about Locate Searches, and how to select the
one which best serves your specific needs, please review Anatomy
of a Locate Search, as well as the
additional helpful links provided below.
This page is important because it documents the use of credit headers for obtaining and selling on the Internet personal biographical information first obtained as part of credit transactions and then sold to private investigators and information brokers by credit bureaus. This is a common and widespread practice that must be revisited by Congress. While there are many useful and legitimate reasons for the access of credit header information in certain legal contexts, and despite all intents and purposes of the credit industry, the wholesale access of biographical data maintained as part of credit reports goes on at an alarming rate. There are hundreds of web sites on the Internet selling biographical information obtained from credit reports.
The sale of credit headers is the
starting point for many forms of identity theft as it gives the identity thief
all the biographical information necessary to impersonate the true owner of the
information. This ability to then
impersonate the true owner opens up access to all other forms of personal
information sought by the identity thief.
Congress should extend the same permissible purposes test
currently in place for the access to credit data under the FCRA to the
biographical data included in the “credit header” which is now exempted under
current interpretations of the FCRA.
Another company, Strategic Data Service
located at Datahawk.com sells similar information:
|
OTHER GREAT LOCATOR SERVICES |
Click here to order!
|
Locate a person's Social Security
#:
$49 |
|
Locate a person's Current Employer: $169 |
|
Locate a person's Date of Birth:
$69 |
|
Locate a person's Driver's License #:
$69 |
|
Find physical address of P.O. Box
Owner: $99 |
Again we see the sale of all types of
personal information useful for identity theft. Additionally, on the above list we see the sale of the physical
street address for a Post Office Box owner.
Our citizens pay extra for PO boxes to protect their privacy and U.S.
Postal Regulations recognize very few exceptions for obtaining the corresponding
physical address. Yet we see it here
for sale on the Internet.
The next category shows the sale of
Driver and Vehicle Searches at the Docusearch web site. Included in the list are the sale of names
and addresses associated with a license plate and the sale of specific driver
license numbers. Both pieces of
personal information are often used in identity theft.
|
Driver & Vehicle Searches |
|
Search Name |
Price |
|
|
|
49 States |
39.00 |
|
|
|
16 States |
39.00 |
|
|
|
38 States |
39.00 |
|
|
|
9 States |
49.00 |
|
|
|
34 States |
55.00 |
|
|
|
50 States |
52.00 |
|
|
The following web page from the
Docusearch site is the description of the Driver History/Records By Name &
License Number Search:
Driver History/Records By Name & License
Number
Search Price
$39.00
Availability
See Chart
Approximate Return
Time
Search results are obtained directly from each state, so
return times do vary. The average return time is normally 2-3 business days.
Requires
See Chart
Search Description
Driving Records may provide
identifying information and insight into a person's character. It is also
useful to determine the status and accuracy of one's own Driving Record,
especially when applying for insurance or receiving a ticket, out of State.
Information returned may include driver's license number, class and status,
full name, date of birth, physical description, dates of convictions,
violations and accidents, sections violated, docket numbers, court locations
and accident report numbers. Only one State per search will be performed. If
the Subject's middle name is recorded on the license, you must include
the full middle name in your request. The middle initial will not
suffice.
Note: DMV records are obtained directly from the issuing agency and are subject
to local & state laws. Some states restrict access* to the Subject's physical
address, and therefore may be omitted. This is out of our control and laws
change often and without notice.
*The State of California restricts access and will not return current address
information.
Many Americans believe that the passage
of the Drivers Privacy Protection Act stopped the sale of this type of
information. However, the act allowed
an exemption for private investigators.
So, as the search description above notes, it is currently left to
individual States to regulate the types of information available to private
investigators and information brokers.
Unfortunately, there are a number of information brokers who are also
private investigators, or who have established relationships with private
investigators, that are subsequently accessing this information and selling it
to almost anyone who submits a request via the Internet.
The next web page category from
Docusearch is Telephone Searches:
|
||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
One can see from this listing that almost
any phone number can be traced back to it’s owner whether or not the individual
owner has taken steps to protect their privacy by paying extra for an unlisted
or non-published number.
The next web page is the Search For
Non-Published Telephone Number Description from the above Telephone Searches
category:
Search For Non-Published Telephone Number
Search
Price
$59.00
Availability
National
Approximate
Return Time
2-3 Business Days
Requires
Subject's Complete Street
Address
Search Description
Given any Subject's complete street address, including zip code and any
apartment number, this search will return the Non-Published Telephone Number on
record.
Responsible Purpose For Search
This search may return sensitive, confidential, and/or private information. For
this reason, DOCUSEARCH.COM requires an explanation stating the purpose for
requesting this search, and its' intended use. Additionally, we reserve the
right to decline to perform any search which we deem not to be for a legitimate
business purpose or may cause emotional or physical harm.
*Significant
restrictions apply
We can see from the description that by just knowing someone’s address
we can obtain the phone number—even if non-published. This is the type of information that a stalker or harasser uses
to chase their prey. While the search
description states that a purpose needs to be stated for the request, it is not
difficult for someone with criminal intent to make up a reason that will
satisfy this requirement.
Again, we find similar services offered
by Strategic Data Services:
Unlisted & Unpublished Telephone Numbers, Number Ownership Information, Reverse Number Tracing, Cellular & Pager Telephone Record Searches.
|
Residential Telephone Number Searches |
|
Description
Delivery in business
days:
3-5 days 24 hrs 6 hrs |
|
Produce
unlisted number from name & address: |
$
65 |
$119 |
$169 |
|
Produce name
& address from unlisted number: |
$
45 |
$ 99 |
$149 |
|
Produce
unlisted number by address only: |
$
99 |
$149 |
$199 |
|
One month's
L.D. calls (dates & numbers called): |
$
99 |
$149 |
$199 |
|
Call record
Extra Detail (Time of day for calls & length) |
$
29 |
$ 29 |
$
29 |
|
Cellular & Pager Searches |
|
Description
Delivery in business days: 3-5 days 24 hrs
6 hrs |
|
Produce name and address from cellular number: |
$ 99 |
$149 |
$199 |
|
Produce name & address from pager number: |
$129 |
$179 |
$229 |
|
Produce monthly call records for cellular number: |
$149 |
$219 |
$249 |
|
Call record Extra Detail (Time of day for calls &
Length): |
$ 29 |
$ 29 |
$ 29 |
However, in the above list we see the
addition of long distance toll records.
In other words, you can purchase the long distance phone records
including the number called, the date, time and duration of the call. Further, there is no requirement for a
purpose to be stated.
The next web page category from
Docusearch is Financial Searches:
|
|||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||