Security

Feds Crack Down on Data Brokers

Is the Information Accurate, or Not?

"Accuracy is a continuum, and the information on these sites is only as accurate as the data sets they are gathered from. We know that there are inaccuracies in the underlying data so, no, they are not totally accurate. But no large data set is," Webber adds.

"As a former programmer/analyst, I can confirm that multitudes of errors occur whenever data is compiled, and the results of any search are only as reliable as the criteria the program specifies; for example, it's interesting how some of these database search algorithms associate, then subsequently pair individuals," Stratton says.

"For example, I recently read a blog by a Red Tape Chronicles (MSNBC) journalist, Robert (Bob) Sullivan. He decided to purchase a background check on himself from Intelius. His report listed an unknown person named Shawn Sullivan (who has a possible conviction for involuntary manslaughter) as his brother. Bob Sullivan points out that the Intelius program only matches the city and numeric values of addresses; thereby, disregarding street names and even states. Bob Sullivan once lived in Columbia, Mo., at 211 N. Ann St., while Shawn Sullivan had once lived at 211 Waugh St., so, naturally, Intelius listed them as related. Bob says he and Shawn are now digital brothers," adds Stratton.

"All this information amounts to a virtual you, based on the sum of your online activities (and public records). Increasingly, decisions are made based on this virtual you, decisions such as insurance rates, credit scores and rates, and even employment opportunities," adds Downey.

Is There a Way Out?

"Informally, I think that once information has been released onto the Internet, pulling that horse back into the barn is a pretty difficult task," says Ray Valdes, research director at Gartner Research.

RELATED: How to Erase Yourself From the Web

"You can delete your online identities with Facebook, Twitter, and LinkedIn, either personally or using a technology, but this doesn't remove every trace," says Webber. "Wherever you are online, you almost always leave some sort of trace or indicator that you were there. It might be stored on a server somewhere or only on a backup disk but, given the propagation of the information on the net, it isn't likely that a person would be able to completely remove their online identities."

"Actually, permanent removal is not possible, unfortunately," Downey says. "That's why Abine developed the DeleteMe service, a subscription service that consistently monitors your information and repeatedly removes it as it repopulates. Even if you managed to remove your information from every site (which isn't possible), you're constantly generating new information that data brokers retrieve. Each new online account, home address, credit card purchase: they all lead to more data about you on the Internet."

Adler points out that Intelius offers a free opt-out. Senoner says that 123People offers a manager program, so users can "manage" their personal information on its website, because it's difficult and time consuming to remove content from these websites. "Many people are not aware that although they remove information from 123people, the information might be still publicly visible at the original source," notes Senoner.

Is There Legal Recourse?

According to Downey, currently, there isn't much legal recourse for individuals who have been adversely affected by these companies. Most of the lawsuits against these companies have failed because of an inability to prove sufficient harm. It is legal to display and sell personal data, and these brokers disclaim liability for any improper uses (such as stalking) of this information.

"Many of these websites claim that customers buying their data cannot use it for illegal purposes such as housing or employment decisions, which receive a higher level of protection. If a data broker sells information that is used for these purposes, it falls within the Fair Credit Reporting Act, which sets stricter rules on the accuracy and accessibility of data. But even though most data brokers claim that they don't fall within the FCRA, the fact remains that some of their buyers are seeking personal information for negative or unlawful purposes," Downey adds.

Summary

The bottom line is this: most of your personal information, regardless of how sensitive, is classified as "public record" under the law, which means that others can access it. Even if you want to protect your address and phone number, others have a First Amendment right to see it. Without this, single mothers could not locate ex-husbands to secure child support payments and lawsuits would be impossible without listed addresses.

If, however, you are part of a "protected class," which includes victims of domestic violence, cyber stalking, sexual assault, identity theft, or people who work in law enforcement such as judges or prosecutors, some states such as California offer victims a one-step way of removing their contact information from data brokers (called Safe at Home program). If you are a member of this protected class, check your local government's policies regarding your options.

Sartain is the author of "Data Networks 101" and a freelance journalist. She can be reached at julesds@comcast.net.

Read more about wide area network in Network World's Wide Area Network section.

Subscribe to the Security Watch Newsletter

Comments