IP: FBI buys data from private sector

[David Farber <dave () farber net>]

> Date: Fri, 13 Apr 2001 13:04:12 -0400
> To: eff-priv () eff org
> From: Lauren Gelman <gelman () eff org>
>
>
>
> ===============================================
>
>
> FBI's Reliance on the Private Sector
> Has Raised Some Privacy Concerns
>
> By GLENN R. SIMPSON
> Staff Reporter of THE WALL STREET JOURNAL
>
> WASHINGTON -- Big Brother isn't gone. He's just been outsourced.
>
> After surveillance scandals in the 1960s and 1970s, the Federal
> Bureau of Investigation and other federal law-enforcement
> authorities curbed their file-keeping on U.S. citizens. But in
> the past several years, the FBI, the Internal Revenue Service
> and other agencies have started buying troves of personal data
> from the private sector.
>
> > From their desktop computers, 20,000 agents at the IRS have
> access to outside data on taxpayers' assets, driving histories,
> phone numbers and other personal statistics. Using a password,
> FBI agents can log on to a custom Web page that links them with
> privately owned files on tens of millions of Americans. And with
> just a few keystrokes, the U.S. Marshals Service can find out
> if a fugitive has recently rented a mailbox or acquired a new
> phone line.
>
> 'An End Run'
>
> Behind such high-tech tools are ChoicePoint Inc., a publicly
> held Alpharetta, Ga., company and other commercial "look-up"
> services. ChoicePoint and its rivals specialize in doing what the
> law discourages the government from doing on its own -- culling,
> sorting and packaging data on individuals from scores of sources,
> including credit bureaus, marketers and regulatory agencies.
>
> Privacy activists say that by outsourcing these tasks, federal
> agencies are violating at least the spirit of the nation's major
> privacy law, which admonishes the agencies to maintain only
> the data about a given individual that they need to do their
> jobs. "It's simply an end run around the Privacy Act" of 1974,
> says Marc Rotenberg a lawyer for the Electronic Privacy Information
> Center, an advocacy group based here.
>
> Back in the 1970s, critics say, lawmakers never imagined that
> technology would place so much data within the government's reach
> but outside its actual possession. They add that the government's
> alliances with ChoicePoint and its peers have evolved largely
> without debate or congressional oversight at a time of increasing
> public concern about online threats to privacy.
>
> ChoicePoint and its federal clients say their use of the company's
> data follows both the letter and spirit of the law. And, indeed,
> there has been little evidence so far of privacy violations
> arising from government access to the data. "We are only permitted
> to obtain evidence and information consistent with applicable
> laws, including the Privacy Act, and rigorous attorney general
> guidelines," says FBI spokesman John Collingwood. "A vigorous
> inspection process, judicial oversight of prosecuted cases
> and civil remedies are in place to enforce compliance by FBI
> employees."
>
> ChoicePoint Chief Executive Derek Smith calls his company's
> dealings with the government "a natural extension" of its business
> of equipping insurers and other companies to check out prospective
> partners and clients.  Similarly, he says, the company helps the
> government find criminals and uncover fraud that hurts taxpayers.
>
> Mr. Smith says his company's contracts define appropriate uses
> of its data and that ChoicePoint audits them to make sure those
> conditions are met. "I care very much about making sure the
> information is used to make a safer, more secure society," he says.
>
> Federal agencies contract with several private-sector companies for
> data and related services. Among them is Lexis-Nexis, a unit of
> Anglo-Dutch publisher Reed-Elsevier PLC, whose databases include
> newspaper articles, legal briefs and other public records. But
> ChoicePoint is the biggest supplier to law enforcement.
>
> The FBI's Investigative Information Services unit, which helps
> agents obtain information on individuals for their investigations,
> relies heavily on ChoicePoint's services. On the Web, FBI agents
> also can go to www.cpfbi.com1 -- "ChoicePoint Online for the FBI"
> -- for help in conducting their own searches. On that Web page,
> the company's logo appears alongside the FBI's official seal.
>
> "The FBI has located nearly 1,300 subjects of criminal cases
> using these kinds of searches," Mr. Collingwood says. The service
> "saves countless hours of manual records checks, a process the
> FBI has relied on for decades." Neither the FBI nor ChoicePoint
> would disclose how much the agency pays the company.
>
> The Justice Department's contract with ChoicePoint ballooned to $8
> million last year from $1 million in 1996.  Treasury Department
> documents show that the exclusive multiyear deal the IRS signed
> with the company in August is worth a total of $8 million to
> $12 million. The company says its clients include at least 35
> federal agencies.
>
> That business has contributed to ChoicePoint's impressive financial
> performance. Since it became a standalone company four years
> ago, ChoicePoint's stock price has more than doubled. Thursday
> in 4 p.m. New York Stock Exchange composite trading, its shares
> rose 65 cents to $35.50, down from its 52-week high of $44.67
> in December. Last year, ChoicePoint's business and government
> division had revenue of $292.4 million, up 24% from 1999, and its
> operating income more than tripled to $45.3 million. The division
> now accounts for more than half the company's total revenue.
>
> ChoicePoint says it buys its primary information for the data
> products it markets to the government, private detectives and
> the media from the nation's three major credit bureaus. They
> are Equifax Credit Information Services Inc., a unit of former
> ChoicePoint parent Equifax Inc.; Trans Union LLC and Experian
> Information Solutions Inc. Each of the three companies maintains
> credit histories on more than 180 million Americans.
>
> The company takes these credit-bureau files and retains the portion
> that lists the consumer's name, known aliases, birthdate, Social
> Security number, current and prior addresses and phone number. The
> credit-bureaus are valuable sources of such data because their
> records tend to be up-to- date. That's because people typically
> tell their creditors when they move, even if they fail to tell
> the Postal Service.
>
> ChoicePoint indexes this data under the subject's Social
> Security number and stirs in more information it gleans from
> other sources. These sources, including local, state and federal
> agencies, sell the company data ranging from motor-vehicle, driver
> and boat registrations, liens and deed transfers to phone listings,
> military personnel records and voter rolls.
>
> By mixing and matching its databases, ChoicePoint can accumulate
> all kinds of information -- a speeding fine, a bankruptcy filing,
> a spouse's name -- under a single Social Security number, tailoring
> the data and related software to a particular client. However, the
> company has warned investors that its ability to do business would
> suffer if Congress were to enact laws restricting the private use
> of Social Security numbers, as has been proposed in recent years.
>
> Address Inspector
>
> The Health Care Financing Administration uses the company's
> Address Inspector software to help identify fraudulent Medicare
> claims. The product lets it check health-care providers' addresses
> against two million of what ChoicePoint calls "high-risk and
> fraudulent business addresses." They include private mailboxes
> and street addresses in high-crime areas. Though many who rent
> private mailboxes do so out of concern for their privacy, those
> box numbers still can end up in ChoicePoint's hands if they are
> used in dealings with businesses or government.
>
> Although ChoicePoint says it has records on nearly every American
> with a credit card, it doesn't always provide access to that
> data. The company's Autotrack service is popular with many agencies
> and businesses and is also used by reporters at The Wall Street
> Journal. But entering the name of FBI Director Louis Freeh into the
> Autotrack database produces an error message. A company spokesman
> says ChoicePoint intentionally blocks Mr. Freeh's records as an
> act of good corporate citizenship.
>
> Among the tools ChoicePoint offers law-enforcement agencies
> is the ability to set up "alert" files that continuously scan
> databases for information on a suspect. So far, the U.S. Marshals
> Service, which has a $3.8 million contract with ChoicePoint,
> is the only agency that uses this feature. In 1999, one such
> alert showed that a woman wanted for mail fraud had rented a
> private mailbox. A follow-up investigation led to her arrest,
> according to agency records.
>
> While they decline to discuss details of their relationship with
> ChoicePoint, the FBI and other agencies say they aren't doing
> anything new except retrieving data electronically instead of
> digging through various far-flung paper files. Before ChoicePoint,
> "We went all over the place going to the same sources of
> information as ChoicePoint is going to," says Greg Gagne,
> a spokesman for the Immigration and Naturalization Service,
> which paid the company $1.5 million last year.
>
> Three decades ago, revelations about the FBI's history of
> compiling files on Vietnam War protesters, civil-rights activists,
> celebrities and thousands of other citizens seemingly picked at
> random set off a wave of public outrage. Among those with files
> were Albert Einstein, Rock Hudson, Cesar Chavez and Henry Ford.
>
> Congress responded by passing the Privacy Act of 1974, which was
> designed to discourage such wholesale data gathering. While the
> law doesn't explicitly prohibit the government from compiling
> dossiers on presumably law-abiding private citizens, the FBI and
> other agencies in the past have generally interpreted it that way.
> Moreover, some of those agencies' own internal guidelines bar
> them from actively assembling such files themselves.
>
> For instance, the FBI's "Manual of Investigations, Operations and
> Guidelines" says, "Only that information about an individual which
> is relevant and necessary to accomplish a purpose authorized by
> statute, executive order of the president, or by the Constitution
> is to be recorded in FBI files."
>
> Scott Charney, former head prosecutor in the Justice Department's
> computer crime unit, says department guidelines prohibit the
> collection of public or other data on an individual unless the
> agency has reason to believe he may have committed a crime. "If
> the government can't go out and collect information on you
> absent predication, they shouldn't be able to go out" and buy
> it from an outside source, says Mr. Charney, now a lawyer for
> PricewaterhouseCoopers LLC.
>
> Indeed, some attorneys think the government's reliance on
> outside data collectors may violate citizens' rights to protection
> against unreasonable searches. Gerry Goldstein, a criminal defense
> lawyer in San Antonio, says that, "When the government actively
> encourages and solicits individuals to act on their behalf,
> those individuals," in effect, become government agents.
>
> Mr. Gagne of the INS dismisses that argument. The government,
> he says, didn't solicit ChoicePoint or other data providers to
> build their databases. "They were doing this for quite some time"
> before the government started buying the data, he says.
>
> Another concern cited by critics is that Uncle Sam historically has
> proved to be an unreliable safekeeper of private information. In
> 1993, an inquiry by the General Accounting Office, Congress's
> investigative arm, found that the FBI's own audits had repeatedly
> reported misuse of the agency's biggest internal database,
> the National Crime Information Center. Last year, the GAO said
> the federal government wasn't complying with privacy standards
> the Federal Trade Commission had proposed for businesses. And a
> recent House investigation gave the government's computer-security
> efforts a "D-minus" grade.
>
> Moreover, the public data ChoicePoint and its rivals use to build
> their databases aren't always accurate -- as ChoicePoint itself
> has found.
>
> Florida Lawsuit
>
> In January, the National Association for the Advancement of Colored
> People sued ChoicePoint and the state of Florida in federal court
> in Miami, accusing the company of supplying faulty data that led to
> thousands of citizens being wrongly purged from Florida voter rolls
> in the November election. ChoicePoint has admitted that some data
> it provided was inaccurate, but it says its DBT Online Inc. unit,
> which was hired by the state to compile lists of convicted felons
> still carried on the rolls, warned state officials that the data
> needed to be verified. Florida election officials have blamed their
> predecessors and county authorities for not following through.
>
> In another incident, this time in the private sector, a
> Chicago-area woman was fired in 1998 from her technical job at
> a major computer maker after ChoicePoint told her employer that
> she was a convicted drug dealer and shoplifter. In fact, the
> woman had no criminal record. A ChoicePoint spokesman concedes
> the mistake. The woman's employer rehired her, but in a menial
> job. She sued both companies and reached a confidential settlement.
>
> Until four years ago, ChoicePoint was part of Atlanta-based
> Equifax. Like other credit bureaus, Equifax's collection and
> sale of personal data on American consumers has been dogged by
> controversy over the years, leading regulators to put stricter
> rules on the companies' practices.
>
> In 1993, Mr. Smith took the helm of Equifax's insurance-services
> division, which helped insurers evaluate the risks of taking on new
> policyholders. He says he quickly realized that the money-losing
> unit could serve another, potentially lucrative purpose. With
> society becoming more mobile, he says, he decided to pitch the
> division's database as a way for companies to feel more secure
> in dealing with relative strangers. The division's fortunes
> rebounded, with its operating income tripling in 1994. Equifax
> spun the division off in 1997, and Mr. Smith went along as CEO.
>
> Meanwhile, the FBI and others started to appreciate the value
> of computerized databases and looking to the private sector for
> help in gathering records. Two companies, CDB Infotek and DBT,
> won much of this early business, because of their experience
> selling data to police departments.
>
> ChoicePoint acquired CDB Infotek in 1996 and purchased DBT last
> year. It also bought up more than a dozen other firms that bought
> police reports and records relating to drug tests, physicians'
> backgrounds, insurance fraud, and litigation. DBT brought in the
> biggest haul. The data DBT had collected from insurers, private
> eyes, law firms and government doubled ChoicePoint's data bank
> to 10 billion records.
>
>
>
> ________________________________________________
>  Lauren Gelman                  Phone: 202/487-0420
>  Director of Public Policy             email: gelman () eff org
>  Electronic Frontier Foundation



For archives see: http://www.interesting-people.org/