DEA agent charged with selling citizens' data

[InfoSec News <isn () C4I ORG>]

http://www.theregister.co.uk/content/6/16278.html

By: Kevin Poulsen
Posted: 23/01/2001 at 03:37 GMT

A twelve-year veteran of the of the US Drug Enforcement Administration
(DEA) pleaded not guilty Monday in federal court in Los Angeles to
charges of illegally selling sensitive information about private
citizens pulled from federal and state law enforcement computers.

DEA Special Agent Emilio Calatayud is charged in an eleven count
indictment with wire fraud, bribery, and violation of the Computer
Fraud and Abuse Act for allegedly selling "criminal history and law
enforcement information" to private investigations firm Triple Check
Investigative Services in Los Angeles. His trial is scheduled for 13
March.

According to prosecutors, the 34-year-old Calatayud peddled data for
six years beginning in 1993, supplementing his government paycheck by
anywhere from $1,080 to $8,500 in cash each year. The indictment
charges that, in all, Calatayud earned at least $22,580 with his
computer access, at a rate of between $60 and $80 per target.

By those figures, Calatayud would have run queries on approximately
300 - 400 people who were being investigated by Triple Check -- though
presumably not all of those people had records to be found.

The purloined data allegedly came from three law enforcement computers
to which Calatayud had otherwise lawful access: the FBI's National
Crime Information Centre (NCIC), which maintains nationwide records on
arrest histories, convictions and warrants; the California Law
Enforcement Telecommunications System (CLETS), a state network that
gives agents access to California motor vehicle records, rap sheets
and fingerprints; and a DEA database called the Narcotics and
Dangerous Drug Information System (NADDIS).

The NADDIS computer, located in Rockville, Maryland, is described by a
Justice Department Web page as a repository of information on
"subjects of interest" to the DEA, "consisting of over 3,500,000
individuals, businesses, vessels and selected airfields."

Calatayud has been suspended with pay since August 1999, when he fell
under the joint DEA, FBI and Justice Department investigation that
ultimately lead to his arrest earlier this month. He is now free on
$100,000 bail, and his DEA salary has been suspended.

Triple Check's owner could not be reached for comment. The company was
not charged in the indictment. Calatayud's attorney, Douglas E.
McCann, did not immediately return a phone call Monday.

"The sale of confidential information by a member of a law enforcement
agency jeopardizes the viability of criminal investigations, threatens
the safety of members of the public and undermines the integrity of
our entire law enforcement community," said United States Attorney
Alejandro Mayorkas in a statement. "The proper response to such an
abuse of the public trust is an aggressive prosecution."

If the indictment proves accurate, the case highlights the risks posed
by the increasingly large number of government databases that house
information on individuals, and are widely accessible with minimal
security, says ACLU associate director Barry Steinhardt.

"There's corruption at all levels of government," says Steinhardt.
"The more aggregate and searchable a database is, the greater the
likelihood that it'll be used, both in authorized ways, and in
unauthorized ways that may be criminal."

ISN is hosted by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".