Privacy rights and wrongs
todd pukanecz
PERSONAL DATA MORE PUBLIC THAN YOU THINK
WASHINGTON, D.C.- In the underground market for personal information
the going rate for your 10-year earnings history is $175.
That price tag surfaced in a 18-month federal investigation of a
nationwide ring of "information brokers" who allegedly bribed Social
Security Administration employees to make computer searches for the
records of thousands of people. According to officials, the alleged SSA
accomplices receive $25 per record, but the broker gives it a big markup
and sells the information to private investigators, creditors, and
businesses for $175.
"The investigation appears to involve the largest case ever of
theft from government computer files and may well involve the most
serious threat to individual privacy in modern times," said US Sen.
Danniel Patrick Moynihan (D-NY) at a hearing on the matter late last
month [CW, March 2]. The SSA has earnings records for nearly 140
million workers.
It is not just consumers who should be concerned. The emergence of
this black market in personal information also means that corporate data
security officers should be extra vigilant about protecting personnel
and customer records, said security consultant Robert P. Campbell,
president of Advanced Information Management, Inc. in Woodbridge, VA.
Campbell said there is little evidence of a corporate problem so
far, but he said creditors and health insurers are very hungry for
personal financial data to supplement credit bureau reports. "They'll
get it any way they can to avoid making costly loan or insurance
mistakes," he said.
According to Campbell, information brokers could hire "dumpster
divers," computer hackers or insiders to get highly marketable
information. However, at a time of massive corporate layoffs, the
biggest threat may be departing employees who walk out with a diskette of
vital information, he said.
Last December, federal grand juries in Florida and New Jersey
indicted 23 people, including eight information brokers and several SSA
employees, for buying and selling confidential information held in
government computers. The ring included police officers who sold
criminal histories from the National Crime Information Center (NCIC)
database.
Evan D. Hendricks, editor of "Privacy Times" newsletter in
Washington, DC, said the indictments are "most likely the tip of a very
ugly iceberg," and he expects more cases will follow.
There have been several people indicted in recent months, such as
the Virginia state police officer who allegedly sold criminal history
checks for $200 each and an Internal Revenue Service official who
allegedly sold confidential information.
The ultimate buyers of the SSA and NCIC information have not yet
been identified, but Moynihan said they apparently include private
investigators, prospective employers, lawyers and insurance companies.
The information is used for "locating people or making decisions on
hiring, firing, suing or lending," testified Larry D. Morey, deputy
inspector general at the US Department of Health and Human Services,
the parent agency of the SSA.
Investigators were tipped off by a sales brochure from Nationwide
Electronic Tracking (NET), an electronic information broker in Tampa,
Fla., which promised fast access to confidential information.
NET's principals agreed to plead guilty to illegal disclosures of
federal information and then cooperate in a sting operation. Officials
planted names in the black market and then used a computer audit trail
to catch SSA employees who made queries for those names, Morey said.
Morey said brokers typically have one or more SSA employees "under
contract" and pay $25 for each earnings history. Another technique,
called "pretexting"," is to get the data by phone after claiming to be
an SSA employee from another office where the computer is down.
SSA officials said their on-line records are adequately protected
from unauthorized access, but it is hard to stop authorized users from
accepting bribes to disclose information. The SSA does use Computer
Associates International, Inc.'s Top Secret to control employee access
to particular mainframe files on a need-to-know basis, but the indicted
employees were authorized users of the files in question.
The SSA called for tougher penalties for disclosures and issued a
special bulletin on confidentiality to its employees, advising them no
to "obtain or release information about celebrities, sports figures,
friends, relatives or co-workers for non-program purposes."
--------------
In a box labeled "Dossiers for Sale"
A 1990 sales brochure from Nationwide Electronic Tracking in Tampa,
Fla., provides the following price list for obtaining confidential
information.
- With name and address, will conduct nationwide search for Social
Security Number
= $10, in two hours
- With name and SSN, will obtain recent places of employment and
subject's earnings (last 10 years)
= $175, in three to five days.
- Subject's credit history
= $10, in on to two hours.
- Subject's criminal history
= $100, in one week.
- with subject's name and address, will obtain names, phone numbers and
addresses of up to nine current neighbors
= $10, in one to two hours.
=========== Wake up John Doe. You're the hope of the world! ===========
-------- /^^\ ---- Todd Pukanecz ---- ---- CCCS@VTVM1 ----
----- / > --- Ag. Econ. DPL --- "Chalk up another one to
--- /\_ / @ \ -- Virginia Tech -- the Pontious Pilots of the
- /________________> - Blacksburg VA - world" - _MEET_JOHN_DOE_