Published Monday, March 21, 2005
Investigators Argue for Access to Private Data
By TOM ZELLER Jr.
New York Times
Diany Castillo, a 54-year-old home health care aide who lives in Brooklyn,
says she is grateful that the fragmented bits of her past - her moves from
one state to another, her marriages and her name changes - can be found in
the vast commercial databases that contain personal information on tens of
millions of Americans.
Last October, a private investigator in Los Angeles used those digital bread
crumbs to track down Ms. Castillo and send her a letter. Her estranged
daughter, Diani Ramos, adrift for nearly a decade on the streets of southern
California, was looking for her, the letter said.
The two were reunited in November.
In the heated debate over privacy rights and the sale of personal
information by the data-mining industry, the story of Ms. Castillo and Ms.
Ramos may represent a contrarian's view.
But Bernard Cane, the private detective who found Ms. Castillo, says this
kind of happy ending could become much rarer if lawmakers begin to limit
access to commercial databases, which can include, among other personal
information, Social Security numbers. In many ways, the interests of Mr.
Cane and his clients highlight the difficulties in finding a
one-size-fits-all solution that both protects consumer privacy and makes
some information available for tasks like this one.
"How does a doctor do surgery without a scalpel?" Mr. Cane asked. "You've
got to have the right tools to do a job."
Until now, the Sam Spade lobby has had surprising success in arguing that
civilian investigators, like insurance brokers, employment screeners and
other businesses, have a legitimate need for some sensitive consumer
information. But over the last month, as one company after another - first
ChoicePoint, then Bank of America and two weeks ago, LexisNexis - revealed
the loss or theft of millions of bits of sensitive consumer data, Americans
have been forced to contemplate the vulnerability of their personal
Congressional hearings into that vulnerability - and into the loosely
regulated data trade - have already begun. And as privacy advocates, federal
and state lawmakers and ordinary consumers beat the drum for new regulations
on the commercial handling of consumer data, private investigators - who are
major buyers of personal information from data brokers - have been bracing
for more scrutiny of their access.
The digital information available to Mr. Cane and others in his business was
greatly enhanced in 1993, when the Federal Trade Commission made a formal
distinction between full credit reports, which are governed by specific
rules of access, and the identifying information at the top of a credit
report. The latter, which is known as the "header," includes the person's
name, most recent address, date of birth and Social Security number.
That distinction allowed credit reporting companies to sell the header
information to the growing data-brokering industry, which was already
amassing dossiers on millions of Americans using public information sources
like court filings and criminal records.
The commercial data trove quickly got filled with millions of Social
Security numbers, and the question of just who ought to be able to gain
access to those databases has been fiercely debated and haphazardly
regulated ever since.
The Federal Trade Commission permitted a working group formed by several
database companies to come up with self-regulating guidelines in 1997. But
privacy advocates argue that individual commercial data brokers still decide
themselves who is eligible to buy personal information.
The Gramm-Leach-Bliley Act, which went into effect in July 2001, reversed
the credit header rule and prohibited credit reporting agencies from selling
that information outside the rules set out by the Fair Credit Reporting Act.
But the law did not clearly address what data brokers and their subscribers
could do with the information already in their systems.
The access now enjoyed by private investigators troubles privacy advocates.
"We're concerned generally about accountability in this profession," said
Chris Jay Hoofnagle, an associate director for the Electronic Privacy
Information Center, a digital rights group based in Washington. Mr.
Hoofnagle pointed out that investigators were not licensed in all states,
and that in some jurisdictions licensing was a mere formality.
Data brokers could conceivably limit access to investigators in states with
robust licensing rules, like California, Georgia and New York, but there is
little evidence that this is done in practice. And other critics have argued
that inaccuracies in the databases make them dubious sources for conducting
Organizations like the Privacy Rights Clearinghouse, for instance, have
gathered information on hundreds of cases in which consumers were wrongly
denied credit or, worse, wrongly associated with a crime or a debt.
And still other critics suggest that investigators could get all the
information they need the old-fashioned way - by hitting the streets,
reviewing court records and asking questions - without ever having to look
at anything like a credit header.
"Private investigators using information brokers are simply lazy," said
Robert Ellis Smith, editor and publisher of a newsletter, Privacy Journal.
"They don't want to do the legwork."
But Kirsti Ekeholm, a licensed private investigator based in Atlanta, says
her profession is too frequently dismissed in just this way. Investigators
with expertise in databases know how to handle information that can often be
incomplete or incorrect, she said.
"These records were never designed to be exploited as a commodity to be
sold," Ms. Ekeholm said. "And while it's not possible - you can't stop
private information from being available - you can limit how it's sold and
limit what industries will have access to it."
Indeed, Ms. Ekeholm is among the many private investigators who have tried
to stop big brokers like ChoicePoint from making even their less-sensitive
data widely available, particularly to the general public. Part of this, of
course, is simple turf protection for their business. But Ms. Ekeholm also
argues that her industry shares the public's concerns over privacy, and that
licensed investigators are trained to know how to protect it.
"The P.I. industry gets a black eye in all this," Ms. Ekeholm said. "But we
have just as much interest in protecting privacy as anyone else. I don't
want my information readily available to just anyone."
Several past Congressional efforts have sought to limit that availability
across the board - including to investigators. But so far none has emerged
In such cases - and in numerous negotiations with the Federal Trade
Commission, privacy advocates and state and federal legislators - the
National Council of Investigation and Security Services, a trade group
representing civilian investigators, has mounted vigorous campaigns to
stifle new regulations.
But major security gaffes at companies like ChoicePoint, which was fooled by
thieves masquerading as legitimate subscribers, might make things
considerably tougher for the industry this legislative session.
"One of our strongest arguments has been that we are vetted," said Bruce
Hulme, a private investigator in New York City and chairman of the trade
group's legislative committee. "And if ChoicePoint and others do not
properly vet their customers, then we're all in trouble."
One bill introduced in January by Senator Dianne Feinstein, Democrat of
California, would require companies to notify consumers when breaches of
security occur. It has won support from the investigators' lobby. But
another of Senator Feinstein's bills, the Privacy Act of 2005, is opposed by
investigators because it would limit access to all kinds of information that
they use every day - including the credit headers, Mr. Hulme said.
And if that happens, investigators insist, reunions like that between Ms.
Ramos and her mother would become a much rarer thing.
In an interview, Ms. Ramos explained how, at the age of 18, suffering from
an abusive past, clinical depression and a mental fog induced by an
antipsychotic drug, she left her family, which was then living in Fort
Myers, Fla., and headed to California, seeking what she called "a better
She did not find it. Instead, she says, she drifted for years between
halfway houses, shelters and the streets in Compton, Hollywood, Bell Gardens
and, finally, San Diego. During her time in California, Ms. Ramos said, she
was raped, robbed and jailed, and by last fall, she wanted desperately to go
But after nine years, all ties to her family back in Florida had evaporated.
Phone numbers were long forgotten and, in her troubled mind, even names and
places had become sketchy.
In a strange twist, Ms. Ramos reached out to the Privacy Rights
Clearinghouse in San Diego for help. She had become convinced - wrongly -
that her identity had been appropriated by thieves. The group put Ms. Ramos
in touch with Certified Investigative Professionals, a membership
organization in Santa Monica, which then put her in touch with Mr. Cane.
Ms. Ramos recalled names and middle names that her mother used - Diany,
Ziani, Janet. She had surnames, married and maiden, but the spellings
varied, and were only guessed at phonetically - Pechouka, or Pacheco, she
thought. Or Mourra. And there was the street in Fort Myers where they had
once lived - Seminole Street.
The information turned up thousands of possible leads and duplicate names,
Mr. Cane said. But as he narrowed the field, it was his ability to view
Social Security numbers that allowed him to link various records associated
with Ms. Castillo, even as her name and location changed.
The process took about two weeks, Mr. Cane said. He did not charge Ms.
"Given the holes in the information, it might have taken six months to a
year" without the header information, Mr. Cane said. "I'd have had to retain
folks, do background records searches on the ground, flown back and forth to
If new legislation were to force such globe-trotting, Mr. Cane said, he
could not afford to do it - and neither could the justice system, which, he
says, relies more heavily on private investigators using the data bazaar
than anyone wants to admit.
"I don't want to find a new vocation," Mr. Cane said. "But if they knock any
more teeth out of my tiger, I'm going to have to retire my tiger."
Ekeholm and Associates, LLC
Office: (770) 720-8343
Georgia Private Detective License: # PDC001919