[Infowarrior] - Are the Police Digging into Your Phone Records?

Thu May 25 22:38:33 EDT 2006

Sunday, May. 25, 2008
Are the Police Digging into Your Phone Records?
A congressional inquiry into online data brokers has raised concerns that
federal and local law enforcement may be skirting privacy laws to obtain
calling records
By KRISTINA DELL
http://www.time.com/time/nation/printout/0,8816,1197918,00.html

The National Security Agency may not be the only one looking at your phone
records. As the agency¹s controversial program of collecting Americans¹
calling data continues to draw heat, new questions have emerged about
whether federal and local law enforcement officials are possibly skirting
privacy laws by obtaining phone records from companies that get the
information in a questionable manner and then hawk it over the Internet.

Since February, Congress has been investigating such so-called data brokers
for the ways in which they gather their information. Some of them use people
inside the phone company who are willing to divulge the data. But more
commonly, these businesses obtain phone records through an illegal practice
known as "pretexting," in which someone calls up the phone company and
impersonates a subscriber to con the service representative into releasing
copies of the records.

The possible connection with law enforcement came to light when the data
brokers were asked as part of the Congressional inquiry to submit letters
revealing their client lists. One data broker listed as clients the FBI and
unspecified "foreign governments," while another claimed to have done work
for the Department of Homeland Security. Neither company will reveal the
extent of the data they gave out. Both the FBI and the Department of
Homeland Security deny any wrongdoing.

It remains an open question whether law enforcement obtaining the private
phone records of Americans in this fashion is actually illegal. While most
data brokers claim there is no specific law against the sale of phone
records, as there is with banking records, and therefore it should not be
illegal, the Federal Trade Commission and numerous state attorneys general
disagree. Collectively, they have brought more than a dozen cases against
data brokers based on state and federal statutes governing unfair and
deceptive trade practices.

Information brokers insist they provide a valuable service to creditors,
attorneys and private investigators "to catch bad people" ‹ among them
stalkers, fugitives from the law and deadbeat dads. Although data acquired
through pretexting is not admissible in court, such information can be
useful as an investigative shortcut, without having to wait for a warrant or
subpoena. "Fifty years from now you¹re going to need a subpoena to talk to
your neighbor," says one frustrated data broker, Noah Weider, president of
IEI, which runs BestPeopleSearch.com.

Investigating Data Brokers

The House Energy and Commerce Committee's probe into data brokers has been
dogged by controversy. Robert Douglas, an information security consultant
who runs PrivacyToday.com and was hired to do research for the committee,
resigned in April because he felt allegations that the FBI and Department of
Homeland Security were purchasing phone records were not being investigated
thoroughly enough. And a bipartisan committee bill to protect phone records
by outlawing pretexting was suddenly withdrawn just before a full House vote
in early May. Some Democrats suspect there may be a connection between the
pulling of the bill and the recent revelations of the NSA's collecting of
citizens' phone records. Democratic committee members sent a letter to
Chairman Joe Barton, asking if the bill was withdrawn so that the
Intelligence Committee could add an exemption allowing phone records to be
sought for intelligence gathering purposes. In a separate letter to Barton
and Speaker Dennis Hastert, Rep. Edward Markey wondered whether there was a
plan to add an exemption "to clarify the legality of such a program because
they are currently gathering such records today without clear authority." An
Intelligence Committee spokesman told TIME that the bill was pulled because
more time was needed to determine how it might impact national security
issues.

Who Is Using the Information?

In its letter to the House committee, made public earlier this month,
Advanced Research, Inc. (ARI), the operator of ADVSearch.com, said the
company has "done work for municipalities, banks, mortgage and insurance
companies, private companies, foreign governments, law enforcement, even the
FBI." Michael Kortan, FBI spokesman, says it is possible the bureau has used
companies like Advanced Research, but notes that these companies provide
many services other than accessing phone records. "They offer a wide variety
of compressing publicly available data that saves a lot of legwork and saves
a lot of time," Kortan told TIME. While saying it did not sound plausible
that the FBI has bought phone records from Advanced Research, Kortan said he
hasn't looked into the matter closely. "We have very established ways of
collecting information. The FBI can only collect and retain data available
from commercial databases in strict compliance with applicable federal law."

Bruce Martin, vice president of Advanced Research, said he did not think the
FBI had purchased services since 1999, when he joined the company, but he
understood that information was sold to the bureau before then. ³We do not
sell telecommunications information any more,² he said. Martin's firm,
however, is being sued by the Illinois Attorney General for obtaining and
selling phone records without the consumer's consent. With regard to these
charges, Martin contends that ARI is simply a middleman: "We have
certification from all our researchers that everything they do is legal and
they don¹t tell me how they do it."

How Is the Data Used?

Most purchasers of cellphone records online tend to be those checking up on
a spouse or trying to collect debts. Other users include lawyers, private
investigators and the police. While the evidence is not admissible in court,
knowing whom a suspect is talking to can prove useful in solving crimes and
inducing confessions. "Just because evidence is not used at trial doesn¹t
mean it has no effect on the case or that there¹s no harm," says Sherwin
Siy, staff counsel at the Electronic Privacy Information Center. Texas-based
PDJ Investigations, which runs several online information gathering sites,
along with another data broker who wished to remain anonymous, told TIME
that they willingly give information to the police, often for free, if it is
requested. Many websites in fact advertise helping law enforcement.

Patrick Baird, vice president of PDJ investigations, says that in its six
years the company has supplied information for between 200 and 300 law
enforcement cases. He said the FBI and the Department of Homeland Security
were among the company's past clients. But Baird said most of the time these
agencies (and most of PDJ's other customers) ask simply for the name and
address attached to a specific phone number, not for complete call records.
Yet Douglas, the former researcher for the Congressional committee, points
out that even that information most likely is obtained through pretexting.
The anonymous data broker confirmed for TIME that pretexting is the most
common way to get name and address information for phone numbers. Jarrod
Agen, a spokesman for the Department of Homeland Security, said the agency
has "no records of contracts" with PDJ. Though the agency does work with
"some contractors that do buy information," he added, it is "not private
data. We don't go out and buy private information."

What Is Legal?

The shady business of pretexting to get personal information has been
thriving for years. But online sellers are relatively new. Typically, these
brokers claim they can obtain anyone¹s phone records for around $100. There
have been few lawsuits, mostly because the majority of victims never learn
that their phone records were accessed.

"States and governments use the information all the time, so it's possible
to do it legally," says Martin of ARI. ³Absent a law it seems unfair to go
after someone when they just decided it was illegal.² But the Federal Trade
Commission and cellphone companies claim impersonation like this is fraud,
violating federal and local statutes.

Civil liberties lawyers argue that regardless of the technical legality,
it¹s an ethically questionable practice for police to use fraudulently
obtained information in their investigations. "As a policy matter there are
set procedures [police] should use instead of side-stepping them for
convenience sake,² says Siy from the Electronic Privacy Information Center.
Under the Telecommunications Act of 1996, phone records are customers¹
private property and phone companies can disclose them only with the consent
of the subscriber or with a subpoena from law enforcement. The act applies
only to telecom companies, however, saying nothing about third parties
selling records. "I can give a pass to the average American being confused
as to the legality of [buying phone records]," says Douglas. "But Law
Enforcement 101 is the need to get a subpoena or warrant to obtain the
private records of Americans."

What You Can Do

To protect your own phone records, the most secure way is to call your
cellphone carrier and ask to have call details removed from your bill. The
drawback is that if you have a discrepancy over minutes used, it will be
more difficult to dispute, since there will be no record of your individual
calls . Another way to protect your account is with a password that only you
know and doesn¹t contain biographical information. You should also avoid
giving out your cellphone number, Social Security number and other personal
data online, when at all possible. And don't throw phone bills in the trash
without shredding them first.

With Reporting by Brian Bennett/Washington