ChoicePoint Conned

February 17, 2005 9:10 AM

ChoicePoint warning people that they're possible targets of fraud. ChoicePoint, Inc. the company that provided the list to help purge Florida voter records of "felons" in the 2000 election, electronically delivered thousands of sensitive financial data reports to possible identity thieves in LA. The reports contained names, addresses, SS numbers, and financial information. They're sending letters to 110,000 people across the country warning them they may be possible victims. ChoicePoint, a subsidiary of Equifax, has been discussed here before. Interestingly: "ChoicePoint, as a matter of policy, does not verify the accuracy of its data and argues that it is the user's responsibility to verify accuracy."
posted by kat (22 comments total)

I'm surprised this loophole hasn't been exploited before. It's not exactly difficult to create a company and pretend you're going to use the data for just telemarketing.
posted by smackfu at 9:26 AM on February 17, 2005

Somebody please remind me why these clowns continue getting work.
posted by RockCorpse at 9:40 AM on February 17, 2005

I would like to know how they get the information in the first place. I would think the way to stop this is to cut the flow of information to them upstream.

smackfu, I don't believe that they can legally release this information to telemarketers. The impression I received from the article was that the scammers were posing as public officials.
posted by boymilo at 9:53 AM on February 17, 2005

All your identies are belong to us.
posted by Mr_Zero at 9:57 AM on February 17, 2005

Somebody please remind me why these clowns continue getting work.

It wouldn't have anything to do with having close personal ties to The Bush Administration, would it?
posted by Fuzzy Monster at 10:06 AM on February 17, 2005

I'd like to see a demographic breakdown of said list.
posted by lobstah at 10:14 AM on February 17, 2005

The impression I received from the article was that the scammers were posing as public officials.

Nope. ChoicePoint sells data to whichever businesses have the money to pay. They're supposed to check to see that their customers are actually valid businesses, but it seems that they're not very good at that.

Ironic, as they specialize in background checks.

I also think it's interesting that the scammers managed to accumulate info on ~100,000 individuals. What companies have valid reasons to be running that number of background checks in such a short amount of time? This should have definitely raised red flags for ChoicePoint, but apparently it didn't.

So the problem isn't just that your personal data is being accumulated by a private firm that exists to sell that data to the highest bidder. It's also that, apparently, this private firm is run by a bunch of incompetent clowns.
posted by mr_roboto at 10:21 AM on February 17, 2005

This LA Times story has more details. Also, apparently the company has had a change of mind since the story broke. In the LA Times story:

"... the company could not be sure of the extent of the fraud and had no plans to contact people outside California ... California is the only state that requires companies to notify people when the security of their personal information is jeopardized."
posted by WestCoaster at 10:30 AM on February 17, 2005

This is why I'm not a Libertarian.

Because the Libertarian would argue that hey, any two entities have the right to contract to exchange money for data, and if you don't like them having your data, you can always refuse to contract with them.

Nicely omitting that it's practically impossible to get out of allowing your information into ChoicePoint's hands, without going off the grid entirely.

The Scottish philosopher David Hume made the same point to zealous "Social Contract" theorists who argued that those not willing to accept the particular Social Contract of their nation could always pick up stakes and leave -- Hume responded while theoretically true, in practice it was so difficult as to preclude it as a serious defense of Contract theory.

In cases like ChoicePoint, Libertarianism lacks the ability to recognize that the quantitative differences between really big, faceless companies and atomized individuals become qualitative differences as well: ChoicePoint can muster a platoon of lawyers and a brigade of researchers and a herd of marketing/PR people, while the individual customer/victim is face can complete virtually no financial transactions that aren't purely cash based without submitting to ChoicePoint's terms.

In the face of this, it's laughable when the Libertarian response is "well, the individual doesn't have to contract" -- he's fully free to starve! When companies get as big, and as pervasive as ChoicePoint, collective action through the establishment of laws is the only way to balance the corporations' power.
posted by orthogonality at 10:43 AM on February 17, 2005

So, they're "Absent Malice" and therefore not responsible? Sweet. Interesting comment Orthogonality, and Fuzzy Monster: give it a rest already.
posted by Pressed Rat at 10:54 AM on February 17, 2005

The front page story of the Atlanta Journal-Constitution states that the sheriff estimates the actual number to be around 400,000.
posted by mischief at 10:59 AM on February 17, 2005

See, this is why you regulate business, because if you don't, they're not going to be nice to you just out of the kindness of their heart. I mean how hard would it be to send out a letter to all of the people whose privacy has been compromised, or notify them in any way...

On preview: what orthogonality said.
posted by Freen at 11:08 AM on February 17, 2005

orthogonality: I wouldn't say that libertarianism is to be blamed for what seems to be , rather, a failure caused by limitation of responsability.

Think about the fact the before Choicepoint existed quite complicated financial transaction happened even without the use of cash.

Now notice that financial transaction were and still are, usually, surrounded by a shield of secrecy about who transfers what, when and why. Granted that such a shield isn't perfect, but usually the data concerning people involved was relatively closely guarded by banks and other financial companies.

What happens when it becomes profiteable to sell data about people to other companies or individuals ? That some companies manages to sell them the data they want.

That is surely dangerous, if the data lands in the wrong hands something bad could happen to the people involved, but this is of no consequence to the owner(s) of Choicepoint and similar companies because, afaik, the worst that could happen is that the company could file for bankrupcy.

The capital of the owners is protected from the effects of his actions or lack of due diligence, the risk is completely offloaded to people as the advantage the single individual is going to get is so little it pales in front of the damages they can suffer from having their personal data collected and misused.

Rather then a liberalistic failure, it's a quite enormous exploitation of limitation of responsability, a concept that was developed to protect investors in the event of high risk ventures like the building of a bridge : the limitation was given because the public obtained big benefits from the construction of public utilities and weren't constantly subject to an increased risk.
posted by elpapacito at 11:13 AM on February 17, 2005

orthogonality: one libertarian response could be to eliminate corporations as entities under the law, and always have a real person who is legally liable for any damages.

on preview: elpapacito said it far, far better.
posted by sonofsamiam at 11:22 AM on February 17, 2005

ortho: For the most part, you have brushed against the difference between a Libertarian and a libertarian. While you may have pegged Libertarianism, you are not alone: Most Libertarians I have met and/or heard speak don't understand libertarianism either.
posted by mischief at 11:29 AM on February 17, 2005

Pressed Rat: Fuzzy Monster: give it a rest already

So you tell me, Pressed Rat: why do these clowns continue getting work?
posted by Fuzzy Monster at 11:48 AM on February 17, 2005

The biggest problem is that they're a subsid. of equifax, one of the credit reporting agencies. If you want to get a loan or credit card, you have to have a credit report. Damned if you don't. But they're selling your data to criminals and cannot be relied upon to have accurate data anyway. Damned if you do.
posted by kat at 11:55 AM on February 17, 2005

so, on the downside, they sold half a million identities to possible thieves. On the upside the data they sold is in such bad shape accuracy-wise that it should be relatively easy to discriminate between the real J. Random Human from the bizarro-world ChoicePoint version of herself, and nail the latter to the wall.
posted by Vetinari at 12:24 PM on February 17, 2005

The FACT Act entitles consumers to obtain one free copy of his/her consumer file from certain consumer reporting agencies during each 12-month period.

ChoicePoint has three separate companies that maintain consumer files that are subject to the free disclosure requirement: C.L.U.E. Inc. maintains information on insurance claims histories, ChoicePoint WorkPlace Solutions Inc. maintains employment history information, and Resident Data Inc. maintains tenant history information.

Fun! More months of futile effort to spend on getting another three companies to correct their scrambled reports! 'Cuz don't forget, kids: "ChoicePoint, as a matter of policy, does not verify the accuracy of its data and argues that it is the user's responsibility to verify accuracy."

Is there a master list somewhere that lists each FACT Act-related agency we consumers have the burden privilege of individually contacting so we can do their data quality assurance for them?

Re: the Equifax connection, according to the L.A. Times article ChoicePoint was spun off in 1997. A search of the CP website shows that the company maintains plenty of informal ties to the mothership but is not a subsidiary.
posted by nakedcodemonkey at 1:32 PM on February 17, 2005

So you tell me, Pressed Rat: why do these clowns continue getting work?

Because they deliver a valuable product to their customers at a reasonable price? Remember, the individuals on whom they maintain data (i.e. all of us) are not their customers. They have nothing to lose by alienating those individuals. Their customers are companies that desire background data on individuals. So long as ChoicePoint delivers accurate data, they'll satisfy these customers. Regardless of the occasional leak.
posted by mr_roboto at 2:14 PM on February 17, 2005

"So long as ChoicePoint delivers accurate data, they'll satisfy these customers"

Their customer base is not necessarily interested in accurate data either; just data period. Subcontracting out research/fact-checking is about about mitigating liability. "See, it's not our fault. We HAD to (do|refuse to do) X because the report placed the person into Box (A|B|C|...Z)."
posted by nakedcodemonkey at 3:03 PM on February 17, 2005

I love that if you want to request your files from ChoicePoint by mail, you have to send a letter to each of three addresses, and then they send you three forms that you have to fill out and mail back. Would it be so hard to put those forms online, or is the point to prevent this from being an easy process for consumers?
posted by delfuego at 6:30 PM on February 17, 2005