U.S. SENATOR PATRICK LEAHY

Leahy Calls For Hearings On Info Brokers
That Are Emerging As Private Intelligence Agencies 

ChoicePoint Episode Is Latest Tripwire Warning Of The Need For Privacy Protections

WASHINGTON (Tuesday, Feb. 22) – The ranking member of the Senate Judiciary Committee, a longtime champion of the public’s privacy rights, says ChoicePoint’s sale of personal and financial records of thousands of Americans to con artists is a tripwire that should trigger a broad congressional examination of the rapid rise of private intelligence bureaus with little oversight and few rules that protect public privacy. 

“New technologies, new private-public domestic security partnerships, and the rapid rise of giant information brokers that collect and sell personal information about each and every American have all combined to produce powerful new threats to privacy,” said Sen. Patrick Leahy, D-Vt.  “It’s time to turn some sunshine on these developments so the public can understand how and why their personal information is being used.” 

Leahy is calling for a series of hearings before the Senate Judiciary Committee to examine the privacy, security and civil liberty implications of recent trends in information technology, including the creation of digital dossiers on individuals and the sale of personal data to the government as these enhanced information-gathering technologies continue to emerge.   

In a letter to Committee Chairman Arlen Specter (R-Pa.) sent on Tuesday, Leahy said, “There is no doubt that the advances of the information age have improved our lives and made us safer.  But we will only be able to maximize their benefits to secure our nation and preserve its values if we take proactive steps to understand these new technologies and their implications.” 

MSNBC last week reported that criminals posing as legitimate businesses bought access to personal and financial data stored by ChoicePoint, which compiles databases that include information on virtually every American, including credit information, Social Security numbers and other data, which the firm sells to legitimate firms and to government agencies.  ChoicePoint has notified consumers in all 50 states that their personal data may have been accessed by “unauthorized third parties,” including more than 34,000 consumers in California, more than 10,000 in Florida and almost 7,000 in North Carolina. Reports indicate that at least 145,000 may be affected. 

“We need to master these technological advances rather than allow them to master us. Recent events indicate that we are in danger of losing this struggle,” said Leahy, pointing to the ChoicePoint episode as well as sobering findings of an investigation of these issues in the new book, “No Place to Hide” by Washington Post reporter Robert O’Harrow Jr. 

“Privacy and liberty have always been important to the American people, and our collective vigilance in protecting these cherished values has allowed us to enjoy unparalleled freedoms, safety and economic benefits. We must continue this vigilance,” Leahy said. “It is time for the sunshine of congressional oversight to begin clarifying some of these issues.” 

# # # # # 

[Leahy Letter to Specter Follows.]

February 22, 2005 

The Honorable Arlen Specter
Chairman
Senate Committee on the Judiciary
226 Dirksen Senate Office Building
Washington, D.C.  20510 

Dear Arlen, 

I offer again my best wishes and prayers for a speedy recovery as you face this challenge, and I look forward to your quick return to the Senate.    

In recent days, we have learned that the personal information of 145,000 Americans was sold by a private corporation, ChoicePoint Inc., to criminals posing as legitimate businesses.  According to media reports, these criminals amassed enough sensitive information about citizens in all 50 states, including more than 1,800 in Pennsylvania, to lay the groundwork for a massive identity-theft ring that shocked law enforcement officials.  

We are in an era in which advanced technologies have opened up new possibilities that even a few years ago seemed out of reach.  Among those advances is the rapid collection, sharing and analyzing of large amounts of data previously unavailable without great effort, if at all.  These powerful tools have enhanced our law enforcement and homeland security efforts, as well as made our lives more convenient and enjoyable.   

These advances also present new challenges that require vigilant congressional scrutiny. The American people have the right and the need to know and understand how their personal information is being used.  It is time for the sunshine of congressional oversight to begin clarifying some of these issues.  I am writing to request a series of oversight hearings before the Judiciary Committee to consider these and other important issues relating to technology, privacy and security protections:  

• Information Brokering.  The rapid rise of database giants such as ChoicePoint, Acxiom, and LexisNexis has created new challenges for privacy and security.  These information brokers have amassed billions of private and public records on individuals that include sensitive information such as financial, travel, medical and insurance data.  They often go into such detail as the names of neighbors and family members or the collection of digital photographs of individuals.  I know of one woman, who when recently contacted by her credit card company to verify purchases, was asked to confirm detailed information about her ex-husband and the address of her former sister-in-law rather than the usual social security number or mother’s maiden name.  These companies use this information to create “digital dossiers” on individuals so that they can sell this data to other companies for a variety of purposes including marketing and screening for employment.  Very little is known about the integrity and handling of this information, and there are insufficient rules and oversight to protect public privacy.  The activities of this industry can have significant consequences, as illustrated by the recent development with the ChoicePoint, which has information on virtually every American.  ChoicePoint is not alone; Acxiom has had two similar breaches.  This is only the latest tripwire warning about the privacy implications that lie ahead for the American people as these technologies rush onward. (I attach recent articles on ChoicePoint).
   
• Government Access to Commercial Data.  Increasingly, the FBI, DHS and many other agencies turn to information brokers to gather and analyze individuals’ personal data on their behalf for a variety of purposes -- e.g., to screen airline travelers or identify possible terrorists.  For example, an executive of ChoicePoint was recently quoted as saying, “We do act as an intelligence agency, gathering data, applying analytics.”  Also notable, in a recent public radio documentary drawn from the groundbreaking book, “No Place To Hide,” by Washington Post reporter Robert O’Harrow Jr. -- which chronicles and analyzes the emergence of these personal database brokers – former U.S. Assistant Attorney General Viet Dinh, now a ChoicePoint security consultant, said, “The amount of information that is publicly available to businesses about any individual is mind-boggling.  I am not comfortable that we are where we need to be in order to circumscribe governmental use of private intelligence.  The government alone can tail us, can investigate us and can deprive us of life and liberty.”  The Committee should look at how to maximize the benefits of this capability for legitimate purposes, while ensuring that our legal protections on accessing and using such data keep pace.
   
• Government Data Mining.  New technologies have allowed computers to rapidly sort and process information for a myriad of purposes, including identifying how people are related, recognizing patterns in human behavior and attempting to predict future actions.  Last year, the Technology and Privacy Advisory Committee (TAPAC) appointed by Defense Secretary Donald Rumsfeld to examine the Total Information Awareness program issued a report which concluded that this type of analysis, often called “data mining” is a “vital tool in the fight against terrorism, but when used in connection with personal data concerning U.S. persons, data mining can present significant privacy issues.”  The report found that “there is a critical need for Congress to exercise appropriate oversight” of data mining and recommended that “Congress take those steps necessary to ensure the protection of U.S. persons’ privacy and the efficient and effective oversight of government data mining activities through the judiciary and by this nation’s elected leaders through a politically credible process.”  We need to look at these developments and their implications for law enforcement, as well as our current laws.  Hearings by our Committee would be precisely in keeping with this finding.
   
• Impact of New Technologies on Surveillance Law.  Radio Frequency Identification (RFID) Technology, GPS, keystroke logging, spyware, and enhanced data storage are all developments that increase our ability to know and track individuals.  These changes have created new opportunities, as well as challenges for law enforcement.  An important question for the Committee is whether our wiretapping and other applicable laws have kept pace as technology has broadened the type and nature of information collection.
   
• Data Outsourcing.  One of the ways in which companies have reduced the cost of digitizing data has been to send printed records abroad for data entry.  Some of this information includes highly personal data, and the Fourth Amendment and other protections we enjoy on our soil do not always travel with that data.  For example, last year it was reported that a Pakistani transcriber of medical files from a San Francisco hospital threatened to post that information on the Internet unless she received back pay.  Compromised data not only violates privacy, but might also be used by terrorists for identity theft or for undermining domestic security.  The Committee should examine this trend and evaluate whether sufficient protections are afforded.

There is no doubt that the advances of the information age have improved our lives and made us safer.  But we will only be able to maximize their benefits to secure our nation and preserve its values if we take proactive steps to understand these new technologies and their implications.  I look forward to your return to the Senate and working with you on these important oversight issues.   

Sincerely, 

Patrick Leahy
Ranking Member