Computer Privacy Annoyances

The Data Industrial Complex

What happens to all this data? It gets vacuumed up by huge data mining companies like Acxiom and ChoicePoint, who merge public and private data, then slice and dice it based on where you live, the products you buy, the magazines you read, how much money you make, and so on. This information is then resold to marketers, insurers, potential employers, and law enforcement agencies.

This data is used in myriad ways. For example, ChoicePoint’s 19 billion records are used for employer background checks, drug screening, criminal records searches, locating deadbeat dads, preventing mortgage or insurance fraud, biometric screening, analyzing DNA samples, verifying applicants for public assistance programs, and making sure banks comply with the guidelines of the USA Patriot Act (see Figure 1-5). ChoicePoint records have been used to locate 822 missing children, and to scrub the names of alleged felons from the rolls of Florida voters in 2000. The company is a particular favorite of Uncle Sam. According to a 2001 report in the Wall Street Journal , ChoicePoint has contracts with 35 Federal agencies; on its web site, the company boasts of its contracts with the Department of Homeland Security.

Figure 1-5. ChoicePoint owns http://Rapsheets.com, a national criminal records database, and Vital Chek Network, which maintains birth records of all babies born in the U.S.

FAIR INFORMATION PRACTICE PRINCIPLES

Collecting data on consumers isn’t necessarily a bad thing; it’s what the data collector does with your information afterward that counts. Over the years, a generally agreed upon set of principles have developed that apply to organizations that gather data on individuals, be they a government agency or a mom-and-pop web site. Here’s how a by-the-book data collector should operate—and what most of them actually do.

Notice: At minimum, anyone collecting data should tell you what kinds of information they’re gathering and how they’re planning to use it. If they’re sharing the data, they should tell you who will have access to it. In most cases this information is buried inside a web site’s privacy policy, hidden in a software license splash screen, or printed in tiny text on what looks like a piece of junk mail.

Consent: Ideally the data collector asks permission before sharing your data with third parties. In most cases, though, it’s the opposite—you must tell the data collector to stop sharing your data, assuming they even give you that option. (In Europe, Canada, and much of Asia, a data collector can’t share your information without your explicit permission.)

Access: You should be able to view your data and correct any mistakes. For example, the Fair Credit Reporting Act makes it possible to view your credit report and challenge erroneous information—a good thing, given that most credit reports are rife with errors.

Security: The data collector must make efforts to limit access to your information and keep it secure. They might even tell you, in general terms, how they keep the information safe. Of course, this doesn’t mean squat if the company gets hacked or an employee steals your information.

Enforcement: If the company has to comply with laws regulating data collection, they should tell you. In some cases, they might have to answer to the FTC, FCC, or the state attorneys general; in other cases, private citizens may be able to sue companies that fail to follow the rules. But most data collectors are self-regulated—so it’s strictly buyer beware.

Acxiom, which maintains records on 169 million consumers, is another grateful recipient of your tax dollars. The firm’s consumer data was used in the controversial Computer Assisted Passenger Pre-screening System II (CAPPS II), which attempted to identify potential terrorists by analyzing their purchase histories and other data. The project was pronounced dead in July 2004 by then-DHS chief Tom Ridge, though aspects of it have re-emerged in the department’s new Secure Flight program.

The Federal government’s increasing reliance on commercial databases has been spurred largely by the war on terror. According to documents obtained by the Electronic Privacy Information Center (EPIC), the FBI requested and received more than 300 million passenger records from major U.S. airlines after 9/11. Virtually everyone who flew, booked a rental car, or checked into a hotel between June 2001 and January 2002 is now on file at the FBI.

But it’s not limited to just the Feds fighting terrorism. Grocery store loyalty programs and electronic toll booth records have been used for routine criminal investigations by local law enforcement.

The use of commercial databases by government agencies has privacy advocates deeply concerned. Unlike public records, commercial databases operate with little or no legal oversight, and mistakes are common. A US Public Interest Research Group study in June 2004 found that 4 out of 5 credit reports contain errors. It’s one thing to have your credit denied because of a mistake in a database; it’s quite another to find yourself fired or arrested for a crime you didn’t commit. And even accurate data can be misinterpreted.

Case in point: In August 2004, Philip Scott Lyons was arrested for attempting to burn down his own house while his wife and child were inside. Law enforcement agents thought they’d obtained an important clue when they accessed Lyons’ Safeway Club Card shopping records and discovered he’d purchased a fire-starter similar to the one used to ignite his house. Lyons, a 25-year veteran of the Tukwila, Washington fire department, was relieved of his duties until someone else confessed to the crime five months later.

“The ugly scenario is that information from a commercial database, which is subject to few accountability rules, may be used for government decision making,” says Chris Hoofnagle, Associate Director of EPIC. “Someone might use it to screen you, arrest you, or question you every time you fly. A whole series of governmental powers could be triggered by data collected by the private sector.”

Unfortunately, you may never find out what the government thinks it knows about you. In the current political climate, privacy has taken a back seat to concerns over security—if it’s even in the vehicle at all. (For the 411 on what data Uncle Sam collects and what you can do about it, see Chapter 6.)