Internetworkers: http://www.ibiblio.org/internetworkers/

["Christian Stalberg" <cpsr_rtp AT internet-lab.com>]

March 16, 2004

Private Eye

By Shane Harris
sharris AT govexec.com


Watching people on behalf of Uncle Sam

Arriving in Windward, a planned neighborhood tucked inside the Atlanta
suburb of Alpharetta, the first things you notice are the trees.
Strategically placed in thickets, they shield residents from unsightly views
of the Georgia 400 toll road, which pumps traffic out of the bustling city
to the south and into the affluent northern enclaves. The trees divide the
3,400-acre development into sections, comprising office parks, strip malls,
chain restaurants and subdivisions of single family homes costing from
$200,000 to $2 million.

At the center of this idyllic landscape sits the corporate headquarters for
ChoicePoint Inc. - a company that is central to the federal government's
efforts to give all of America the kind of safe and secure world that
Windward symbolizes.

ChoicePoint's business is the gathering and selling of information about
people. Huge electronic files the firm compiles contain far more data about
Americans than is available at any government office. In fact, it's illegal
for a government agency to collect most of the data ChoicePoint maintains on
private citizens. Thus an unusual alliance has grown between government,
whose appetite for information about potential security risks has risen, and
a company whose acumen in assembling personal information has made it the
supplier of choice for many federal agencies.

Demand for data on individuals is on the rise throughout American society,
and ChoicePoint serves many markets. Insurance companies use its data to
manage risk, deciding to whom they should offer policies. Many corporations
now commission background checks before hiring new employees. Children's
sports leagues require such checks of coaches.

Last October, Business 2.0 magazine listed ChoicePoint among the top 100
fastest-growing technology companies in America. The company's revenues in
2003 totaled nearly $800 million, a 9 percent increase over 2002. Revenues
in the company's Business and Government Services division totaled $340
million.

For years, the Federal Bureau of Investigation, the Internal Revenue
Service, the Defense Department, the Social Security Administration and
about three dozen other federal agencies have called on ChoicePoint to
identify tax evaders by uncovering hidden assets, root out medical benefits
fraud and help track down criminal suspects. ChoicePoint won accolades in
2003 for leading federal and local officials to the Washington snipers, by
mining name and license plate data the company owns to identify the
suspects.

But it was the Sept. 11 terrorist attacks that made the company's
capabilities most valuable to government. ChoicePoint performed more than
112,000 background checks on airline passenger screeners for the
Transportation Security Administration. The company works with the TSA on a
project to pre-screen certain airline passengers. ChoicePoint also works
with the Homeland Security Department on a program to issue identity cards
to haulers of dangerous chemicals. And, entering a previously untapped
market, ChoicePoint now works on behalf of U.S. intelligence agencies,
running data on people of interest to America's clandestine services.

ChoicePoint's intention, as its chief executive, Derek Smith, wrote in a
letter to shareholders last year, is "to create a safer, more secure
society." That's a lofty goal. But it's one that ChoicePoint, along with the
government agencies it serves, believes it can achieve.


PICTURES OF YOU

ChoicePoint is not the only company that collects personal data. But its
competitors cannot match ChoicePoint's talent for piecing together vast
swaths of data into a chronological picture of someone's life.

As you move through life, you leave traces of yourself that never disappear.
You register a car, apply for insurance, apply for a job, get a blood test,
open a bank or credit card account, buy a home, move into an apartment, get
arrested, get paroled, buy a boat, file a tax return, get married, get
divorced, have a baby, get a library card. These movements leave marks in
the form of records. A record might be a seemingly innocuous bit of
information you wrote on a form - your phone number, date of birth, where
you went to college - or a more telling nugget you surrendered to a customer
survey, like why you bought that 2004 Jeep Grand Cherokee, or why you take
trips to Ireland.

ChoicePoint and other collectors scoop up these pieces of information and
preserve them electronically. They buy the data - sometimes from each
other - or obtain it from public sources, such as court and property
records. Then, when their customers ask, ChoicePoint blends the pieces into
a picture of you. Where you've lived. The cars you drive. The people you
know - neighbors, school friends, ex-spouses. The more records, the bigger
the picture. ChoicePoint owns an astounding 19 billion records, about 65
times as many pieces of information as there are people in the United
States. As a result, ChoicePoint knows more about most people than the
federal government does.

But knowledge itself is useless. It must be applied. And ChoicePoint uses it
to separate dangerous people from trusted ones - a job that, executives say,
is at the core of homeland security. In his letter to shareholders, Smith
referred to official warnings that prompted citizens to hoard duct tape and
plastic sheeting in preparation for a chemical attack. "While there's no
harm in buying [those] supplies . . . physical barriers and color-coded
terror alerts are not the tools that are going to protect us against the
threats we face today," he wrote.

"Information used appropriately," Smith continued, "can help proactively
identify those individuals and organizations who pose a threat." The
government agrees, and has spent billions of dollars since the Sept. 11
attacks trying to better analyze the sparse data it owns. But information,
applied appropriately, does something else. Once threatening people are
identified, Smith writes, that "allow[s] us to understand and manage the
rights and privileges they are granted within our society."

The Constitution guarantees some privacy, but not anonymity, Smith has said
repeatedly. The courts concur. People have no right to lie about who they
are, or to request credentials that convey rights and privileges - such as
driver's licenses or permits - without proving their identities. The people
who wish to remain anonymous trouble Smith the most. "It is the anonymous
person," he writes, "or small group of people, who represent the greatest
risks - economic, physical or emotional - facing us today."

In an interview with business magazine Georgia Trend in 2002, Smith said
ChoicePoint conducted a survey showing that 25 percent of pizza delivery
drivers recently had spent time in jail. "What pizza do you like?" Smith
asked his interviewer. "At what price? Are you willing to take the risk
associated with dealing with a company that doesn't screen their drivers?"
Smith declined Government Executive's request for an interview.


IN THE DARK

ChoicePoint has startling anecdotes that reveal how little the government
knows about people crossing its path. Last year, a U.S. intelligence agency
gave the company a list of "people of interest," says Jim Zimbardi,
ChoicePoint's vice president of strategic sales, and its point man on
government work. The agency, which he won't reveal, wanted to know
everything Choice-Point knew about the people. ChoicePoint's report told the
agency something it didn't yet realize: Some of them had already entered the
United States.

ChoicePoint doesn't need such chilling tales to make it indispensable to the
government. An FBI official, who asked not to be identified to avoid the
appearance of publicly endorsing ChoicePoint, says, "The success of an
investigation is often directly proportional to the information [from
ChoicePoint] we can gather on suspects." The company's National Criminal
File contains more than 63 million conviction records and other data, making
it more complete than the FBI's own files.

How powerful is this data? Another FBI official, who also requested
anonymity to avoid an endorsement, paints this scenario. Say the FBI is
pursuing a suspect, and agents believe he fled the country. His ChoicePoint
record contains a travel agency form he filled out before planning a trip to
Ireland years ago. The form asked why the man wanted to make the trip. He
wrote, "Visiting relative."

"Now, if it turns out you like to travel to Ireland because you have an
uncle who lives there," the agent asks, "where do you think we're going to
look?"

But what's less obvious to the agent is when ChoicePoint records can and
cannot be searched, particularly before the commission of a crime. Can the
FBI run anyone's name through ChoicePoint, at any time? Agents aren't
supposed to run random searches, the official says, even though many have
access to ChoicePoint data on their desktop computers. But asked if any laws
expressly forbid it, the agent waffles. "Well, it might be an ethical
issue," he says.

ChoicePoint's Zimbardi says the FBI keeps a 3-inch-thick binder of
regulations covering ChoicePoint searches. But then he adds that he's never
seen the binder; he's only heard of it.

Privacy laws are quite clear on what the FBI may collect on citizens. But
ChoicePoint blurs the line. Technically, its data is only a product the FBI
has purchased. But with Zimbardi's acknowledgement that Choice-Point has
examined "persons of interest," clearly the lines between what can and
cannot be known are getting blurrier.

It's also unclear who decides what qualifies as a legitimate search.
Zimbardi considers a hypothetical scenario. Say a U.S. intelligence agency
presents a list of 5,000 names. Officials say, "We can't tell you why we
need to know about these people, but we need to know everything you have."
Would ChoicePoint comply and take the government's word that the search was
warranted? "Yes," Zimbardi says, without hesitating.

Intelligence agencies are new customers for ChoicePoint. But the practice of
intelligence isn't. The point is to spot risks early. That's ChoicePoint's
basic business. And that business isn't simply growing; it's evolving. In
its seven-year life, ChoicePoint has acquired 42 companies; an average of
one every two months. Some it buys for the data they own. Others are
purchased to absorb new customers and enter new markets. And sometimes,
ChoicePoint buys a company to get its analytic technology, magnifying its
ability to connect its 19 billion-and-counting dots of information.

As ChoicePoint collects more data, and grows more sophisticated in its
ability to make connections among pieces of the data, its pictures of people
become more compelling. Yet sometimes, the portraits are flawed.


BLURRED PICTURES

Mary Boris never pictured herself as a potential serial arsonist. But
ChoicePoint did.

In February 2000, Boris learned her insurance provider wouldn't renew
coverage of her home, her only major asset. According to a nationwide claims
report database - owned and operated by Choice-Point - Boris had filed four
fire-related claims in a short period of time. Boris panicked. She'd only
made claims for hail damage and flooding caused by a leaking washing
machine. Without insurance, she risked financial devastation if a
catastrophe occurred.

Boris asked ChoicePoint to clear her name. The database in which her
information appeared, known as the Comprehensive Loss Underwriting Exchange,
is the industry standard for underwriting-related data, and every insurance
company uses it to judge a policyholder's risk level. Boris spent months
trying to resolve the error. ChoicePoint said her insurance carrier was at
fault, since it supplied the claim data in the first place. Boris wanted
ChoicePoint to simply expunge her inaccurate CLUE record. At one point, the
fire claims disappeared, but then, mysteriously, they showed up again.

"I felt helpless," Boris says. So, rather than wait for ChoicePoint to
assist her, she sued the company. Boris accused ChoicePoint of violating the
Fair Credit Reporting Act, which gives citizens specific rights for
contesting information compiled about them. She asked a jury for punitive
damages and a compensatory award for the "mental anguish and anxiety" she
suffered trying to prove her innocence.

A jury awarded Boris $250,000 in punitive damages, as well as $197,000 for
her suffering. The judge later reduced that award to $100,000, saying Boris
had offered limited evidence of her distress, but he added that Choice-Point
behaved with a "generally uncaring attitude," and that the jury reasonably
concluded the company bore the responsibility for correcting Boris' CLUE
report. Boris' attorney says the report now is clean.

Boris is one of thousands of people ChoicePoint has labeled as something
they're not. In 1998, the state of Florida hired DBT Online Inc., a
ChoicePoint subsidiary, to identify convicted felons who, by law, officials
must purge from the rolls of eligible voters. In the heat of the 2000
presidential election vote recount, it came to light that ChoicePoint had
incorrectly fingered about 8,000 people as felons.

Press investigations found numerous flaws with the data. For example, the
online journal Salon reported that a voter named Christine got tagged as a
felon because a "Christopher" with the same last name had a conviction. In
Orange County, some of the data the company supplied was almost 20 years
old. Some county officials accepted ChoicePoint data at face value, but
others refused to use it. One election official, Linda Howell of Madison
County, threw the felon list out when she saw her name on it. Howell isn't a
convicted felon.

Many news organizations have documented voter roll errors affecting
thousands of people. Given that George Bush's official margin of victory in
Florida was 537 votes, and that most of those DBT identified as felons were
registered Democrats, a more accurate list could have affected the
election's outcome.

James Lee, ChoicePoint's marketing director, says the company refers anyone
contesting the accuracy of his or her data to the party that provided it.
But when it comes to federal counterterrorism initiatives, accuracy is
imperative. Fear of false positives (that a system would incorrectly label
someone a potential terrorist) or false negatives (that a system would
overlook a real danger) has undercut every personal profiling initiative the
government has instituted since the Sept. 11 attacks. But that's not holding
ChoicePoint back.


TWO CLASSES

In the growing library of books dissecting how and why the Sept. 11 attacks
happened, perhaps none offers a more exhaustive account of the government's
problems verifying people's identities than the 723-page After (Simon &
Schuster, 2003), penned by attorney and former journalist Steven Brill, the
founder of media commentary magazine Brill's Content.

In the epilogue to After, in which he proposes ways to prevent another Sept.
11, Brill writes that government and the private sector should implement
"some kind of credible but voluntary nationally accepted identification
card," which would give its holders access to fast lanes at airline security
checkpoints, public buildings and sporting and performance arenas. No more
waiting in line for lengthy body searches. Pre-screened card holders would
be deemed nonthreatening.

Following the release of the book, Brill founded Verified Identity Card Inc.
The first people he called, Brill says now, were Derek Smith and Jim
Zimbardi of ChoicePoint. They agreed to join forces. ChoicePoint wants to be
able to check card applicants' names against the government's terrorist
watch lists, to which ChoicePoint currently has access when working with
federal agencies. TransCore, which manufactures the E-Z Pass device that
motorists use when zipping through electronic tollbooths, also joined the
consortium, as did the Washington-based Civitas Group, a homeland security
venture capital firm whose members include Sandy Berger, President Clinton's
national security adviser.

Brill sees his card - which may not be a new card but simply a chip embedded
in the holder's credit card - as an invention of necessity. Checking
everyone who boards a plane or enters a large office building, like
Rockefeller Center in New York, where Brill keeps his offices, wastes time
and money, he says. The government shouldn't try implementing its own card
system, he argues, because most places people frequent are privately owned.
Businesses are better-suited to this task, and can do it more effectively,
he argues.

Checking everyone also creates needless redundancy. Brill recalls the day
that Berger - whom he calls "a close friend of mine" - came to Brill's
offices to discuss the card project, but got stuck in a security line in the
lobby. By the nature of his former job, Berger received the highest security
clearance, Brill says. Yet, he waited in line behind a deli employee bearing
the sandwiches Berger and Brill were about to eat.

The Brill-ChoicePoint card would ensure Berger didn't have to wait like that
again. But it apparently would also create two new classes of people:
Trusted and untrusted. Asked if that's the case, Brill says, "I wouldn't say
trusted versus untrusted. I'd say, trusted versus not-yet-trusted."

ChoicePoint will distinguish between the two. This is familiar territory. As
Smith wrote, information lets its owners grant people privileges and rights
within society. There's no precedent for companies - or government -
assuming this authority on the massive scale that a national identity card
or many of ChoicePoint's security strategies envision. Brill writes in After
that the government should "push the debate" about these programs. But the
debate isn't occurring on a large scale. There's barely a vocabulary for it.

Privacy and civil liberties advocates have battled the government for years
over alleged violations of privacy laws and the Fourth Amendment. But those
statutes never foresaw that privately run corporations would have more power
to know the details of people's lives than government. Bush administration
officials stress that privacy sits at the center of all of their homeland
security initiatives. But they repeatedly warn of the imminent threat of
terrorism, and depict likely attackers as shadowy and difficult to
understand.

ChoicePoint has found its niche discerning what is hard to grasp. And for
that reason, the company and its data will grow more and more valuable to
the government.



Brought to you by GovExec.com