Identity theft pay dirt at recycling center
Indian Consulate dumped visa applications from business, political figures at S.F. facility

February 2, 2007

By David Lazarus

http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2007/02/02/LAZ.TMP



Thousands of visa applications and other sensitive documents, including paperwork submitted by top executives and political figures, sat for more than a month in the open yard of a San Francisco recycling center after they were dumped there by the city's Indian Consulate.

The documents, which security experts say represented a potential treasure trove for identity thieves or terrorists, finally were hauled away Wednesday after The Chronicle inspected the site and questioned officials at the consulate and the recycling facility.

Among the papers were visa applications submitted by Byron Pollitt, chief financial officer of San Francisco's Gap Inc., and Anne Gust, wife of California Attorney General Jerry Brown.

"It's shocking and totally unacceptable," Brown said when asked about the incident.

Information on the documents includes applicants' names, addresses, phone numbers, birth dates, professions, employers, passport numbers and photos. Accompanying letters detail people's travel plans and reasons for visiting India.

"As we see it, the documents are not confidential," said B.S. Prakash, the consul general. "We would see something as confidential if it has a Social Security number or a credit card number, not a passport number."

But security experts say it wouldn't be hard to obtain someone's Social Security number using the information available in the consular documents. They also point out that some of the Sept. 11 hijackers used false passports, which wouldn't be hard to obtain using data and photos from the documents.

"This is absolutely sensitive information," said Charles Cresson Wood, a Sausalito information-security consultant. "It needs to be safeguarded."

Pratik Sircar, deputy consul general for the Indian Consulate, said the office on Arguello Boulevard processes visa applications and other paperwork for 14 Western states.

"We have a shortage of space," he said. "We keep this material for a year, and then we have to destroy it."

However, the consulate didn't destroy the documents. Instead, it hired a hauling company in December to cart the boxes to the Haight Ashbury Neighborhood Council recycling center near Golden Gate Park on Frederick Street.

The open-air facility is accessible to the public seven days a week. Anyone can walk through the gate and poke around.

"We thought it was their job to shred the material as soon as they got it," Sircar said.

Andy Pugni, general manager of the recycling center, responded that he doesn't know where the consulate got this idea.

"We take in paper, put it in large containers and ship it off for recycling," he said. "That's all we do. We don't shred."

Pugni added: "We assume anyone who brings stuff over here will be smart enough to destroy any sensitive materials. I wouldn't bring any of my own materials here."

Alerted by The Chronicle to the presence of confidential documents in a corner of the recycling yard -- many of the white boxes were clearly marked "visa applications" -- Pugni had a truck brought in to haul the papers to an East Bay company that will boil them down and recycle them as blank pages.

All that remained in the yard Thursday were remnants of the boxes.

But a sampling of documents obtained by The Chronicle indicate that the boxes contained confidential paperwork for virtually everyone in California and other Western states who applied for visas to travel to India between 2002 and 2005.

They also contained thousands of documents submitted by Indian citizens and people of Indian background residing in the region.

"It's hard to believe that this is how confidential information is treated," said San Francisco resident Farah Champsi, who was born in Mumbai, which is formerly known as Bombay, and requested copies of her birth certificate in 2005.

Her application ended up at the recycling center. "This is terrible," Champsi said.

Visa applications were submitted by current and former executives of many of the region's leading employers, including AT&T Wireless Inc., Oracle Corp., Intel Corp., Microsoft Corp., Qualcomm Inc. and Williams-Sonoma Inc.

The documents illustrate the extent to which major U.S. companies have established operations in India or rely on India for key services.

A letter from Gap's then-CEO Paul Pressler accompanying the visa application for Pollitt says the company's CFO was heading to India for several days in April 2004 "for the purpose of visiting Gap Inc.'s sites and vendor facilities."

After the application surfaced this week, Pollitt said he found it "both astonishing and alarming to learn that basic safeguards were apparently not in place to ensure the privacy of my personal information.

"As a past victim of identity theft, I am painfully aware of how important it is to ensure personal information is well protected," he said.

Another Bay Area exec whose privacy was jeopardized is Rob Haragan, co-founder of NetDevices Inc., a Los Altos company that specializes in network security. Much of NetDevices' research is conducted at a facility in Bangalore.

Haragan, a former executive at Cisco Systems Inc., applied for a visa to travel to India in 2004. He estimates that he's since been to the country more than a dozen times.

He said he was surprised to learn that his application spent weeks at a recycling center.

"The consulate absolutely needs to correct this," Haragan said. "It's a breach of trust."

Brian Biega oversees storage of internal paperwork at Redwood City software giant Oracle, so he knows a thing or two about the proper handling of confidential documents. He, too, applied for a visa to visit India in 2004, and his application also ended up at the recycling center.

Biega didn't hesitate when asked how Oracle's famously truculent CEO Larry Ellison would react if boxes of sensitive information were left at a recycling center. "I'm sure I'd lose my job," he replied.

At the Indian Consulate, Consul General Prakash said there may be a cultural dimension to the level of outrage related to the incident among Western visa applicants.

"In India, I would not be alarmed," he said. "We have grown up giving such information in many, many places. We would not be so worried if someone had our passport number."

Deputy Consul General Sircar said that in other countries, Indian officials are able to go to the roofs of their offices and burn documents they're no longer able to store.

"In America, you cannot do that," he said.

Sircar said the consulate would find some other way to deal with its excess paperwork in the future.

Pugni at the recycling center said that shortly after he had the documents carted away, a representative of the consulate arrived at the facility.

"He apologized for everything," Pugni said. "Then he said he was on his way to Best Buy to pick up a shredder."


main page ATTRITION feedback