honoluluadvertiser.com

Sponsored by:

Comment, blog & share photos

Log in | Become a member
The Honolulu Advertiser
Posted on: Wednesday, September 13, 2006

Lying to obtain records targeted

 •  Hewlett-Packard insiders may face criminal charges

By Paul Davidson
USA Today

Phone records aren't the only traces of your life that can be had for a buck.

Individuals' medical records, places of employment and class schedules are just some of the nuggets data brokers obtain by impersonating others, a practice known as pretexting.

Hewlett-Packard's efforts to uncover the source of a boardroom press leak have shone a spotlight on the use of pretexting to snare calling records from a phone company.

The incident has renewed congressional interest in year-old legislation that would explicitly make it illegal to lie to obtain another person's phone data, such as whom they called and when. Several states passed similar laws this year.

Yet some security experts say any legislation should encompass all types of pretexting.

"Congress got too myopic looking at calling records," says Robert Douglas, an information security consultant and former private investigator. "There's medical records, banking, utility, cable TV."

The Gramm-Leach-Bliley Act of 1999 outlawed pretexting to snag financial data. And some pretexters stopped selling phone records or adopted a lower profile after the practice drew headlines last year. But data brokers still view other personal records as fair game.

Their clients include stalkers seeking home addresses, tabloids hunting for medical information on stars and debt collectors. In 1999 in New Hampshire, Liam Youens hired an investigator who enlisted a pretexter to persuade Amy Boyer to reveal her workplace. Youens drove there and fatally shot her.

James Rapp, a former data broker who testified before Congress this year, says his clients "requested anything and everything."

For example, "if you're an employee on disability and you're not supposed to be working, I would" persuade the person to reveal their workplace. "I'd tell them there's a gas leak, and I need to reach them during the day. Whatever it takes."

On price lists obtained by the House Commerce Committee, a class schedule cost $80, an address from a utility company was $60. And job data fetched $100.