New York Times March 21, 2005 Investigators Argue for Access to Private Data By Tom Zeller, Jr.
		Diany Castillo, a 54-year-old home health care aide who lives in Brooklyn, says she is grateful that the fragmented bits of her past - her moves from one state to another, her marriages and her name changes - can be found in the vast commercial databases that contain personal information on tens of millions of Americans.    Last October, a private investigator in Los Angeles used those digital bread crumbs to track down Ms. Castillo and send her a letter. Her estranged daughter, Diani Ramos, adrift for nearly a decade on the streets of southern California, was looking for her, the letter said. The two were reunited in November.   In the heated debate over privacy rights and the sale of personal information by the data-mining industry, the story of Ms. Castillo and Ms. Ramos may represent a contrarian’s view. But Bernard Cane, the private detective who found Ms. Castillo, says this kind of happy ending could become much rarer if lawmakers begin to limit access to commercial databases, which can include, among other personal information, Social Security numbers.   In many ways, the interests of Mr. Cane and his clients highlight the difficulties in finding a one-size-fits-all solution that both protects consumer privacy and makes some information available for tasks like this one. “How does a doctor do surgery without a scalpel?” Mr. Cane asked.       “You’ve got to have the right tools to do a job.”   Until now, the Sam Spade lobby has had surprising success in arguing that civilian investigators, like insurance brokers, employment screeners and other businesses, have a legitimate need for some sensitive consumer information. But over the last month, as one company after another - first ChoicePoint, then Bank of America and two weeks ago, LexisNexis - revealed the loss or theft of millions of bits of sensitive consumer data, Americans have been forced to contemplate the vulnerability of their personal information.   Congressional hearings into that vulnerability - and into the loosely regulated data trade - have already begun. And as privacy advocates, federal and state lawmakers and ordinary consumers beat the drum for new regulations on the commercial handling of consumer data, private investigators - who are major buyers of personal information from data brokers - have been bracing for more scrutiny of their access.   The digital information available to Mr. Cane and others in his business was greatly enhanced in 1993, when the Federal Trade Commission made a formal distinction between full credit reports, which are governed by specific rules of access, and the identifying information at the top of a credit report. The latter, which is known as the “header,” includes the person’s name, most recent address, date of birth and Social Security number.   That distinction allowed credit reporting companies to sell the header information to the growing data-brokering industry, which was already amassing dossiers on millions of Americans using public information sources like court filings and criminal records. The commercial data trove quickly got filled with millions of Social Security numbers, and the question of just who ought to be able to gain access to those databases has been fiercely debated and haphazardly regulated ever since.   The Federal Trade Commission permitted a working group formed by several database companies to come up with self-regulating guidelines in 1997. But privacy advocates argue that individual commercial data brokers still decide themselves who is eligible to buy personal information. The Gramm-Leach-Bliley Act, which went into effect in July 2001, reversed the credit header rule and prohibited credit reporting agencies from selling that information outside the rules set out by the Fair Credit Reporting Act. But the law did not clearly address what data brokers and their subscribers could do with the information already in their systems.   The access now enjoyed by private investigators troubles privacy advocates. “We’re concerned generally about accountability in this profession,” said Chris Jay Hoofnagle, an associate director for the Electronic Privacy Information Center, a digital rights group based in Washington. Mr. Hoofnagle pointed out that investigators were not licensed in all states, and that in some jurisdictions licensing was a mere formality.   Data brokers could conceivably limit access to investigators in states with robust licensing rules, like California, Georgia and New York, but there is little evidence that this is done in practice. And other critics have argued that inaccuracies in the databases make them dubious sources for conducting investigations. Organizations like the Privacy Rights Clearinghouse, for instance, have gathered information on hundreds of cases in which consumers were wrongly denied credit or, worse, wrongly associated with a crime or a debt.   And still other critics suggest that investigators could get all the information they need the old- fashioned way - by hitting the streets, reviewing court records and asking questions - without ever having to look at anything like a credit header. “Private investigators using information brokers are simply lazy,” said Robert Ellis Smith, editor and publisher of a newsletter, Privacy Journal. “They don’t want to do the legwork.” But Kirsti Ekeholm, a licensed private investigator based in Atlanta, says her profession is too frequently dismissed in just this way. Investigators with expertise in databases know how to handle information that can often be incomplete or incorrect, she said.   “These records were never designed to be exploited as a commodity to be sold,” Ms. Ekeholm said. “And while it’s not possible - you can’t stop private information from being available - you can limit how it’s sold and limit what industries will have access to it.” Indeed, Ms. Ekeholm is among the many private investigators who have tried to stop big brokers like ChoicePoint from making even their less-sensitive data widely available, particularly to the general public. Part of this, of course, is simple turf protection for their business. But Ms. Ekeholm also argues that her industry shares the public’s concerns over privacy, and that licensed investigators are trained to know how to protect it.   “The P.I. industry gets a black eye in all this,” Ms. Ekeholm said. “But we have just as much interest in protecting privacy as anyone else. I don't want my information readily available to just anyone.”   Several past Congressional efforts have sought to limit that availability across the board - including to investigators. But so far none has emerged from committee. In such cases - and in numerous negotiations with the Federal Trade Commission, privacy advocates and state and federal legislators - the National Council of Investigation and Security Services, a trade group representing civilian investigators, has mounted vigorous campaigns to stifle new regulations. But major security gaffes at companies like ChoicePoint, which was fooled by thieves masquerading as legitimate subscribers, might make things considerably tougher for the industry this legislative session.   “One of our strongest arguments has been that we are vetted,” said Bruce Hulme, a private investigator in New York City and chairman of the trade group’s legislative committee. “And if ChoicePoint and others do not properly vet their customers, then we’re all in trouble.”   One bill introduced in January by Senator Dianne Feinstein, Democrat of California, would require companies to notify consumers when breaches of security occur. It has won support from the investigators’ lobby. But another of Senator Feinstein’s bills, the Privacy Act of 2005, is opposed by investigators because it would limit access to all kinds of information that they use every day - including the credit headers, Mr. Hulme said. And if that happens, investigators insist, reunions like that between Ms. Ramos and her mother would become a much rarer thing.   In an interview, Ms. Ramos explained how, at the age of 18, suffering from an abusive past, clinical depression and a mental fog induced by an antipsychotic drug, she left her family, which was then living in Fort Myers, Fla., and headed to California, seeking what she called “a better life.” She did not find it. Instead, she says, she drifted for years between halfway houses, shelters and the streets in Compton, Hollywood, Bell Gardens and, finally, San Diego. During her time in California, Ms. Ramos said, she was raped, robbed and jailed, and by last fall, she wanted desperately to go home. But after nine years, all ties to her family back in Florida had evaporated. Phone numbers were long forgotten and, in her troubled mind, even names and places had become sketchy.   In a strange twist, Ms. Ramos reached out to the Privacy Rights Clearinghouse in San Diego for help. She had become convinced - wrongly - that her identity had been appropriated by thieves. The group put Ms. Ramos in touch with Certified Investigative Professionals, a membership organization in Santa Monica, which then put her in touch with Mr. Cane. Ms. Ramos recalled names and middle names that her mother used - Diany, Ziani, Janet. She had surnames, married and maiden, but the spellings varied, and were only guessed at phonetically - Pechouka, or Pacheco, she thought. Or Mourra. And there was the street in Fort Myers where they had once lived - Seminole Street.   The information turned up thousands of possible leads and duplicate names, Mr. Cane said. But as he narrowed the field, it was his ability to view Social Security numbers that allowed him to link various records associated with Ms. Castillo, even as her name and location changed. The process took about two weeks, Mr. Cane said. He did not charge Ms. Ramos.   “Given the holes in the information, it might have taken six months to a year” without the header information, Mr. Cane said. “I’d have had to retain folks, do background records searches on the ground, flown back and forth to Florida.” If new legislation were to force such globe-trotting, Mr. Cane said, he could not afford to do it - and neither could the justice system, which, he says, relies more heavily on private investigators using the data bazaar than anyone wants to admit. “I don’t want to find a new vocation,” Mr. Cane said. “But if they knock any more teeth out of my tiger, I’ m going to have to retire my tiger.”
			HOME www.WayneBrewer.com