From: "L. Detweiler" <ld231782@longs.lance.colostate.edu>
Date: Sun, 10 Oct 93 23:36:44 PDT
To: cypherpunks@toad.com
Subject: Identity Tracking through Databases (fwd)
Message-ID: <9310110636.AA12175@longs.lance.colostate.edu>
MIME-Version: 1.0
Content-Type: text/plain


from

PRIVACY Forum Digest       Sunday, 10 October 1993       Volume 02 : Issue 32

          Moderated by Lauren Weinstein (lauren@vortex.com)
            Vortex Technology, Woodland Hills, CA, U.S.A.

===cut=here===

Date:    Sun, 10 Oct 93 16:52 PDT
From:    lauren@vortex.com (Lauren Weinstein; PRIVACY Forum Moderator)
Subject: Personal Privacy vs. the "Digital Detective"? 

Greetings.  This is going to be a somewhat complex message, but I feel
that it's an important one, so please try to bear along with me.

Also, I must ask that anyone who wishes to forward any information from this
message please forward the entire message and keep it intact and complete
with all attributions--any further excerpting from this material could be
extremely confusing, to say the least.

A few days ago, in my capacity as PRIVACY Forum moderator, I received an
e-mail submission from Patrick Townson, politely asking if I would consider
publishing it in the digest.  (Pat is moderator of the TELECOM digest; we
have various communications regarding digest matters from time to time.)

The submission was essentially an ad promoting a new service he is 
offering.  I informed him that my policy is not to run ads, though
particular products and services may be mentioned in the context
of informational or discussion messages submitted to the Forum.  

However, the particular ad in question is potentially of significant
importance to readers of PRIVACY Forum, and brings to a sharp focus
a number of issues which we've had bouncing around for sometime, with
seemingly little action.  So, I asked for and received permission from
Pat to publish excerpts from his ad, as well as excerpts from our
private communications that occurred after I read his original submission.
I've attempted to keep these excerpts in context, and I'll have additional
comments as we go along.  Once again, I'm sorry about the complexity of
this message. 

   ----
EXCERPTED MATERIAL BEGINS BELOW.  Omitted material is indicated by
"..." in the text.  The original complete message was widely distributed
on Usenet, as indicated by the "Newsgroups" field below.

			***************

From: ptownson@telecom.chi.il.us
Newsgroups: comp.society.privacy,alt.privacy,misc.consumers,
	misc.legal,misc.misc,chi.general
Subject: Digital Detective At Your Service
Date: Wed, 6 Oct 1993 15:35:00 CDT

                      DIGITAL DETECTIVE
		
...

I wish to announce my recent aquisition of some databases which are
primarily used by skip-tracing, investigative and government agencies
to locate people, any assets they may have, and other pertinent and
personal details of their lives.

These databases are being made available to anyone who wishes to have
access to them. The charges are simply being passed along, 'at cost'
based on what I am paying. 

...

SOCIAL SECURITY NUMBER TRACING:
===============================

You provide an SSN. I will advise you of all the names which have
been used with this SSN, and the addresses which go with each. Or
it can be the other way around: you supply an exact name and address
(it can sometimes be a former address), and I will supply you with
the SSN used by that person.

      Cost for each lookup, either direction is $60.00

PEOPLE FINDER:
==============

You provide a name. Any name okay, but very common names will
render a useless list. Middle initials and last known address is
requested if possible.  You'll receive a listing of every person who
has that name, along with other data:

     New address if they moved;
     Telephone number provided the number is published;
     Residence type;
     Length of residence;
     Gender;
     Date of birth;
     Up to four other household members and their dates of birth.

For additional information, People Finder also can provide a neighbor
listing which includes up to ten neighbors, their addresses, phone
numbers and residence types. 

...

It can be searched by telephone number only: You provide the phone
number, I will respond with the person's profile and neighbor listing.
Or it can be searched by address only, with the same results.

...

      Cost for each lookup is based on how extensive the search
      is. 

...

                Both address/phone trace      $90

...

CONSUMER CREDIT REPORTS:
========================

Consumer Credit reports availale from one bureau,     $60
Consumer Credit reports available from three bureaus, $100

I need two things:

  1. The name and address of the person, plus SSN if possible.
  2. A *signed* statement that your request is for bonafide,
     legal reasons, i.e. you are considering an extension of
     credit to the person, or possibly employing them, etc. I
     cannot proceed without this signed statement.

...

Has someone ever filed bankruptcy?  The database will tell you
if they have or not. Not all federal districts are yet installed
but for those that are in the database, I can get you the details:

...

Criminal History records available at $75-100 per jurisdiction you
request searched. 
      Want to know if someone has ever been in prison?
      Want to know if someone has ever been sued, or been a
        defendant in a criminal action?

...

Death Records can be provided in various formats:

      By SSN only - is the holder of that SSN deceased or not?  $30
      By name - a more detailed account of their demise         $40

Drivers Records can be pulled but the exact name and DOB
is essential; otherwise if you have the full driver's license
number, the search can be reversed, providing a name and DOB
plus address. (Then use People Finder address trace on them.)   $65

    [ Various other information types listed omitted.  -- MODERATOR ]

...

Information should be available to everyone, not just the lawyers
and bankers and government agencies. I'll provide information to
anyone, at anytime from the categories above. Hope to hear from
you soon with your requests.

Here's to successful snooping! Get the goods on your friends and
enemies alike. An imposter/fraud/con-artist on the net? Expose them
in a detailed message with stuff you get from the database. 

Patrick Townson
for DIGITAL DETECTIVE

			***************

      >>> End of excerpted material from original submission <<<

After reading the original ad, I had a number of exchanges with Pat
regarding the possible negative reactions to this service among
the PRIVACY Forum readership.  Here are some excerpts from
that discussion.

   ----- Excerpts from followup messages begin below -----

>From Pat:

Say whatever you like. I would ask that you point out a couple of
pertinent things however:

1. All the information is gleaned from public sources. You'll find
very few non-pub phone numbers for example unless the person used it
someplace. And *yes* there are public sources of SSN's ... I know 
where, you don't know where, so you pay me to tell you where or at
least produce the results.

2. All information is available free of charge to anyone who wants to
go to the sources and get it himself. I'm placing myself in the middle
as the 'gopher' ...I'll go fetch the information if you pay me. When
I say 'free of charge if you get it yourself' I am not including the
occassional cost of making copies, etc. That much is assumed.

Regards criminal histories for example, if someone does not like the
information being given out, then their real beef is with the concept
of free, open to the public trials in the USA. In every courthouse in
America, anyone is free to walk in, sit down and observe a trial going
on. We do not have secret trials in the USA.  So I am free to observe
you on trial, and you are free to observe me on trial. It should
follow then that we are free to exchange information with each other
about trials we have observed. 

About 85 percent of the counties in the USA gladly supply transcripts
and summaries of judgments regards criminal cases in their jurisdiction
to anyone who asks for them (plus again, the copy costs etc). It is not
feasable for you to come to Chicago and visit our courthouse, nor for me
to visit the courthouses in California. So we cooperate with each other
by you looking up things for me there and me looking up things for you
here. It then should follow that a logical next step is to put it all
on a computer; all researchers contibute their data to the common
database. 

And so it goes. All I do is fetch the records you have created about
yourself as a service for people who don't want to go to the trouble
of fetching them for themselves.

3. Regards credit bureaus:  Anyone can be a commissioned sales agent
for the credit bureaus as long as they sign up with the bureaus to do
that. You'll note I refuse to pull bureau files without your signed
statement saying that you have a lawful purpose, ie an extension of
credit or possible employment, etc. This puts the burden on you. In
fact the bureaus themselves say in their contracts that they release
information to their clients making the assumption the client has a
lawful right to the information. If not, its your ass .. not theirs.
If a bureau is pulled on you, you later find out and ask me why,
I refer you to the person who purported to be lawfully inquiring.
Doing so, I've met the requirements of the law.

It is all public information except for the consumer credit reports,
and for those the people who own the data base which I use absolutely
insist on meeting all legal requirements.

4. Finally, it is only because we have computers that we can keep
records in the prolific way we do.  Do you also object to manual
record keeping?  Or is your complaint only that because it is
computerized it has become so much easier for the average person to
obtain?

Remember, YOU are the person who gave out your SSN (I do not do the
trace from government records but from public collections) ...

YOU are the person who registered your telephone number in a
directory of same with your address, etc. 

If you don't like people collecting information, don't give them any
to collect, and get the law changed so that like in Russia you can
be tried in secret and taken away in the middle of the night. Then
there won't be any information for the public to look at regards what
you were convicted of.

Please summarize the above as my response to negative comments.

Pat


[ Below, text after ">" is from Lauren, other text is from Pat ]:

Lauren:
> I'm not disagreeing with your statements that it's all (presumably)
> public information.  In effect, that's what needs to be stopped!

Pat:
Well, then you better go to work on getting the First Amendment
repealed or greatly modified addressing the issue of what people are 
permitted to say to other people, etc. If you feel I should be  forbidden
to speak about your SSN, so be it.  Get the law changed and make sure
it is constitutional.

> In any case, publicizing your service may well have the effect of helping to
> foster efforts to pass pending and future legislation to control the reuse
> and distribution of such info, simply because so many people would get so
> irate that such a service existed with such simple access.  

I want people to see how easy it is. I want enough people doing it
that the cost of accessing the databases comes down from sixty dollars
for an SSN to sixty cents!  I want getting all sorts of info on your
neighbors, enemies, employers and employees to be as easy as pushing
a few keys on your keyboard. 

...

Nope, won't affect business at all because people have a short
attention span. They will read it, cluck their tongues and by next
week have forgotten. At my former employment I used to give seminars
on how to collect bills. I gave these to employees of companies
working collection. Afraid it would cut back the business they sent to
our firm?  Not at all. For a week or two, yes .. then they forget and
go back to their old ways.  Same thing here.

...

Big firms, lawyers, bankers, law enfocement; they all get into the same
information I use. Why shouldn't you be able to get into it also?  You think
if the laws are changed the lawyers won't somehow exempt themselves anyway?
<grin> ... 

And as my ex-employer used to say, there is plenty of money to be made
in collections and investigations by staying one hundred percent within
the law ... no need to hack government data bases, no need to steal
files from the credit bureau, no need to break into computers ... 

Someone wrote me and said getting into the NCIC was illegal (they were
referring to my criminal histories database) ... hell, I get no where
near NCIC .. I just use the combined efforts of researchers all over
the USA who visit their courthouse daily to pull the new files for
review; ditto with the Real Property transactions, tax records, voting
records, etc .. 

... but bear in mind if you try to censor the information
you are treading dangerously into First Amendment stuff ...

...

I thought it would make for great fun. Other than yours, the only
letters I am answering on this are the ones which contain credit card
numbers or EFT instructions ... and orders are coming in already.

The neat thing about public information is you cannot be guilty of
libel or slander when you distribute it as long as you do not 
embellish upon it.  And my answers to inquiries go out ALWAYS as
follows:

  "In consulting the XXX database, I noted the XXX database
  made the following statement(s) and/or allegation(s):

    (then the record)

  "If what was recorded in the XXX database is not correct,
  then the subject of the inquiry made at your request should
  notify the XXX database management of the error(s) and take
  appropriate action to correct the database record."

It is never me claiming or alleging anything.... just telling
you what I found out when I read the record. Same as the old
credit bureau routine. Since I dont personally keep the rcords like
the credit bureau does, it is not even within my power to correct
the records.

Obviously, that old First Amendment needs to be greatly modified, eh?

Pat

    ----- End of excerpts from followup messages -----


Lauren here again.  I think the above should give the flavor of the
discussion and the related issues.  We had some other discussions where I
pointed out that the First Amendment wasn't really the issue, since it was
not absolute, and that I felt some form of required "informed consent"
(e.g., requiring firms to get written permission from customers from whom
they obtain SS#, etc. before making it available to any commercial
databases) would be a big help.

But here's the *real* issue.  If we assume that Pat is right in his
statements that all of the information to which he has access is
legally distributable, it goes far to pointing out what an utter
disgrace the state of privacy and privacy laws in this country
have become.   

Pat is certainly correct that many organizations already apparently have
access to all of this data.  All he's doing, seemingly, is trying to make a
buck by providing "broader" access to the info.  While one can argue that
this is a very unfortunate thing to be doing, due to the range of new abuse
that could potentially occur, it is also true that many crooks *already*
have access to all this info, and that the information is already widely
abused.

Pat also suggests that there won't be any sustained opposition to
such information releases--that most people have a very short attention
span, will just read the message, and promptly forget about it.
Is he right?

The real problem is not with Pat's service, of course.  The problem is that
what should be private information is flowing around with such utter lack of
sensible controls.  If there were reasonable controls, it would be
impossible for Pat's service, or many other similar services that cater to
other customers out there, to be operational.

There is certainly a philosophical underpinning to all of this.  By analogy,
Pat's view that everyone should have access to all the information available
on everybody seems similar to the view that the way to solve the violent
crime problem is to make sure that everyone in the country is carrying a gun
at all times and is provided with plenty of ammunition.  While some will no
doubt agree with both of these concepts, hopefully many of us do not.

It should now be crystal clear that the privacy situation in this country
is in shambles.  You can't just sit there, read this, and then file it
off and forget it.  Sooner or later, and most likely sooner, *you*
are going to be affected.

And just exactly what, my friends, are we going to do about it?

--Lauren--